UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

Form 10-K

☒ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2023

OR

☐ TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from                      to                     

Commission File No. 001-07511

STATE STREET CORPORATION

(Exact name of registrant as specified in its charter)

Massachusetts					04-2456637
(State or other jurisdiction of incorporation)					(I.R.S. Employer Identification No.)
One Congress Street
Boston,	MA				02114
(Address of principal executive offices)					(Zip Code)
		(617)	786-3000
		(Registrant's telephone number, including area code)
Securities registered pursuant to Section 12(b) of the Act:
Title of Each Class				Trading Symbol(s)	Name of each exchange on which registered
Common Stock, $1 par value per share				STT	New York Stock Exchange
Depositary Shares, each representing a 1/4,000th ownership interest in a share of				STT.PRD	New York Stock Exchange
Fixed-to-Floating Rate Non-Cumulative Perpetual Preferred Stock, Series D, without par value per share
Depositary Shares, each representing a 1/4,000th ownership interest in a share of				STT.PRG	New York Stock Exchange
Fixed-to-Floating Rate Non-Cumulative Perpetual Preferred Stock, Series G, without par value per share

Securities registered pursuant to Section 12(g) of the Act:

None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.  Yes  ☒   No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act.  Yes  ☐  No  ☒ 

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports) and (2) has been subject to such filing requirements for the past 90 days.  Yes  ☒   No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).  Yes  ☒   No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer”, “accelerated filer”, “smaller reporting company”, and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer	☒	Accelerated filer	☐	Non-accelerated filer	☐	Smaller reporting company	☐
						Emerging growth company	☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ¨

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant's executive officers during the relevant recovery period pursuant to § 240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). ☐ Yes ☒ No

The aggregate market value of the voting and non-voting common equity held by non-affiliates computed by reference to the per share price ($73.18) at which the common equity was last sold as of the last business day of the registrant’s most recently completed second fiscal quarter (June 30, 2023) was approximately $23.52 billion.

The number of shares of the registrant’s common stock outstanding as of January 31, 2024 was 301,943,571.

Portions of the following documents are incorporated by reference into Parts of this Report on Form 10-K, to the extent noted in such Parts, as indicated below:

(1) The registrant’s definitive Proxy Statement for the 2024 Annual Meeting of Shareholders to be filed pursuant to Regulation 14A on or before April 29, 2024 (Part III).

STATE STREET CORPORATION

ANNUAL REPORT ON FORM 10-K FOR THE YEAR ENDED

December 31, 2023

TABLE OF CONTENTS

		Page
	Forward-Looking Statements	4
	Risk Factors Summary	4
PART I
Item 1	Business	6
Item 1A	Risk Factors	24
Item 1B	Unresolved Staff Comments	54
Item 1C	Cybersecurity	54
Item 2	Properties	54
Item 3	Legal Proceedings	54
Item 4	Mine Safety Disclosures	54
Supplemental Item	Information about our Executive Officers	55
PART II
Item 5	Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	58
Item 6	[Reserved]	61
Item 7	Management's Discussion and Analysis of Financial Condition and Results of Operations	61
	General	61
	Overview of Financial Results	62
	Consolidated Results of Operations	65
	Total Revenue	65
	Net Interest Income	73
	Provision for Credit Losses	76
	Expenses	76
	Acquisition and Restructuring Costs	77
	Repositioning Charges	77
	Income Tax Expense	77
	Line of Business Information	77
	Investment Servicing	77
	Investment Management	78
	Financial Condition	79
	Investment Securities	79
	Loans	83
	Risk Management	84
	Credit Risk Management	90
	Liquidity Risk Management	94
	Operational Risk Management	100
	Information Technology Risk Management	101
	Market Risk Management	103
	Model Risk Management	110
	Strategic Risk Management	111
	Capital	112
	Off-Balance Sheet Arrangements	121
	Significant Accounting Estimates	121
	Recent Accounting Developments	124
	Other Matters	124
Item 7A	Quantitative and Qualitative Disclosures About Market Risk	124
Item 8	Financial Statements and Supplementary Data	124
	Report of Independent Registered Public Accounting Firm (PCAOB ID: 42)	125
	Consolidated Statement of Income	127

State Street Corporation | 2

	Consolidated Statement of Comprehensive Income	128
	Consolidated Statement of Condition	129
	Consolidated Statement of Changes in Shareholders' Equity	130
	Consolidated Statement of Cash Flows	131
	Note 1. Summary of Significant Accounting Policies	132
	Note 2. Fair Value	134
	Note 3. Investment Securities	140
	Note 4. Loans and Allowance for Credit Losses	146
	Note 5. Goodwill and Other Intangible Assets	151
	Note 6. Other Assets	152
	Note 7. Deposits	153
	Note 8. Short-Term Borrowings	153
	Note 9. Long-Term Debt	154
	Note 10. Derivative Financial Instruments	155
	Note 11. Offsetting Arrangements	159
	Note 12. Commitments and Guarantees	162
	Note 13. Contingencies	163
	Note 14. Variable Interest Entities	165
	Note 15. Shareholders' Equity	167
	Note 16. Regulatory Capital	169
	Note 17. Net Interest Income	171
	Note 18. Equity-Based Compensation	171
	Note 19. Employee Benefits	173
	Note 20. Occupancy Expense and Information Systems and Communications Expense	173
	Note 21. Expenses	175
	Note 22. Income Taxes	175
	Note 23. Earnings Per Common Share	177
	Note 24. Line of Business Information	177
	Note 25. Revenue from Contracts with Customers	179
	Note 26. Non-U.S. Activities	182
	Note 27. Parent Company Financial Statements	183
	Note 28. Subsequent Events	184
	Supplemental Financial Data	185
Item 9	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	189
Item 9A	Controls and Procedures	189
Item 9B	Other Information	192
Item 9C	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	192
PART III
Item 10	Directors, Executive Officers and Corporate Governance	192
Item 11	Executive Compensation	192
Item 12	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	192
Item 13	Certain Relationships and Related Transactions, and Director Independence	193
Item 14	Principal Accounting Fees and Services	193
PART IV
Item 15	Exhibits, Financial Statement Schedules	194
Item 16	Form 10-K Summary	194
	EXHIBIT INDEX	195
	SIGNATURES	198

State Street Corporation | 3

Forward-Looking Statements

This Form 10-K, as well as other reports and proxy materials submitted by us under the Securities Exchange Act of 1934, registration statements filed by us under the Securities Act of 1933, our annual report to shareholders and other public statements we may make, may contain statements (including statements in our Management's Discussion and Analysis included in such reports, as applicable) that are considered “forward-looking statements” within the meaning of U.S. securities laws, including statements about our goals and expectations regarding our business, financial and capital condition, results of operations, strategies, cost savings and transformation initiatives, investment portfolio performance, climate, dividend and stock purchase programs, acquisitions, outcomes of legal proceedings, market growth, joint ventures and divestitures, client growth, new technologies, services and opportunities, sustainability and impact, human capital, as well as industry, governmental, regulatory, economic and market trends, initiatives and developments, the business environment and other matters that do not relate strictly to historical facts.

Terminology such as “expect,” “outlook,” “will,” “goal,” “target,” “strategy” “may,” “estimate,” “plan,” “intend,” “objective,” “forecast,” “believe,” “priority,” “anticipate,” “seek,” and “trend,” or similar statements or variations of such terms, are intended to identify forward-looking statements, although not all forward-looking statements contain such terms.

Forward-looking statements are subject to various risks and uncertainties, which change over time, are based on management's expectations and assumptions at the time the statements are made and are not guarantees of future results. Management's expectations and assumptions, and the continued validity of the forward-looking statements, are subject to change due to a broad range of factors affecting the U.S. and global economies, regulatory environment and the equity, debt, currency and other financial markets, as well as factors specific to State Street and its subsidiaries, including State Street Bank. Factors that could cause changes in the expectations or assumptions on which forward-looking statements are based cannot be foreseen with certainty and include the factors described under the headings “Risk Factors Summary” and “Risk Factors” and elsewhere in this Form 10-K, including under “Management's Discussion and Analysis.”

Actual outcomes and results may differ materially from what is expressed in our forward-looking statements and from our historical financial results due to the factors discussed in this section and elsewhere in this Form 10-K or disclosed in our other SEC filings. Forward-looking statements in this Form 10-K should not be relied on as representing our expectations or assumptions as of any time

subsequent to the time this Form 10-K is filed with the SEC. We undertake no obligation to revise our forward-looking statements after the time they are made. The factors discussed herein are not intended to be a complete statement of all risks and uncertainties that may affect our businesses. We cannot anticipate all developments that may adversely affect our business or operations or our consolidated results of operations, financial condition or cash flows.

Forward-looking statements should not be viewed as predictions and should not be the primary basis on which investors evaluate State Street. Any investor in State Street should consider all risks and uncertainties disclosed in our SEC filings, including our filings under the Securities Exchange Act of 1934, in particular our annual reports on Form 10-K, our quarterly reports on Form 10-Q and our current reports on Form 8-K, or registration statements filed under the Securities Act of 1933, all of which are accessible on the SEC's website at www.sec.gov or on the “Filings & reports” tab of our website at investors.statestreet.com.

Risk Factors Summary

The following is a summary of material risks we are exposed to in the course of our business activities and which could have an adverse effect on our business or consolidated results of operations or financial condition. It does not contain all of the information that may be important to you and should be read together with the more detailed discussion of risks under the heading “Risk Factors,” as well as elsewhere in this Form 10-K under the heading “Management's Discussion and Analysis.”

Strategic Risks

•We are subject to intense competition, which could negatively affect our profitability;

•We are subject to significant pricing pressure and variability in our financial results and our AUC/A and AUM;

•Our development and completion of new products and services, including State Street Alpha® and those related to digital assets and artificial intelligence, may impose costs on us, involve dependencies on third parties and may expose us to increased operational, model and other risks;

•Acquisitions, strategic alliances, joint ventures and divestitures, and the integration, retention and development of the benefits of these transactions, including the consolidation of our operations joint ventures in India, pose risks for our business; and

State Street Corporation | 4

•Competition for qualified members of our workforce is intense, and we may not be able to attract and retain the highly skilled people we need to support our business.

Financial Market Risks

•We could be adversely affected by political, geopolitical, economic and market conditions including, for example, as a result of liquidity or capital deficiencies (actual or perceived) by other financial institutions and related market and government actions, the Israel-Hamas war, ongoing war in Ukraine, major political elections globally, actions taken by central banks to address inflationary and growth pressures, monetary policy tightening, periods of significant volatility in valuations and liquidity or other disruptions in the markets for equity, fixed income and other assets classes globally or within specific markets;

•We have significant global operations and clients that can be adversely impacted by disruptions in key global economies, including local, regional and geopolitical developments affecting those economies;

•Our investment securities portfolio, consolidated financial condition and consolidated results of operations could be adversely affected by changes in the financial markets, governmental action or monetary policy. For example, among other risks, increases in prevailing interest rates or market conditions have led, and were they to occur in the future could further lead, to reduced levels of client deposits and resulting decreases in our NII or to portfolio management decisions resulting in reductions in our capital or liquidity ratios;

•Our business activities expose us to interest rate risk;

•We assume significant credit risk of counterparties, who may also have substantial financial dependencies on other financial institutions, and these credit exposures and concentrations could expose us to financial loss;

•Our fee revenue represents a significant portion of our revenue and is subject to decline based on, among other factors, market and currency declines, investment activities and preferences of our clients and their business mix;

•If we are unable to effectively manage our capital and liquidity, our financial condition, capital ratios, results of operations and

business prospects could be adversely affected;

•Our calculations of risk exposures, total RWA and capital ratios depend on data inputs, formulae, models, correlations and assumptions that are subject to change, which could materially impact our risk exposures, our total RWA and our capital ratios from period to period;

•We may need to raise additional capital or debt in the future, which may not be available to us or may only be available on unfavorable terms; and

•If we experience a downgrade in our credit ratings, or an actual or perceived reduction in our financial strength, our borrowing and capital costs, liquidity and reputation could be adversely affected.

Compliance and Regulatory Risks

•Our business and capital-related activities, including common share repurchases, may be adversely affected by regulatory requirements and considerations, including capital, credit and liquidity ;

•We face extensive and changing government regulation and supervision in the jurisdictions in which we operate, which may increase our costs and compliance risks and may affect our business activities and strategies;

•Our businesses may be adversely affected by government enforcement and litigation;

•Our businesses may be adversely affected by increased and conflicting political and regulatory scrutiny of asset management stewardship and corporate sustainability or ESG practices;

•Any misappropriation of the confidential information we possess could have an adverse impact on our business and could subject us to regulatory actions, litigation and other adverse effects;

•Changes in accounting standards may adversely affect our consolidated results of operations and financial condition;

•Changes in tax laws, rules or regulations, challenges to our tax positions and changes in the composition of our pre-tax earnings may increase our effective tax rate;

•We could face liabilities for withholding and other non-income taxes, including in connection with our services to clients, as a result of tax authority examinations; and

•Our businesses may be negatively affected by adverse publicity or other reputational harm.

State Street Corporation | 5

Operational and Technology Risks

Our internal control environment may be inadequate, fail or be circumvented, and actual results may differ from those expressed as a result of a number of factors, including the manifestation of operational risk as follows:

•Our business may be negatively affected by our failure to update and maintain our technology infrastructure, or otherwise meet the increasing resiliency expectations of our clients and regulators, or as a result of a cyber-attack or similar vulnerability in our or business partners' infrastructure;

•Our risk management framework, models and processes may not be effective in identifying or mitigating risk and reducing the potential for related losses, and a failure or circumvention of our controls and procedures, or errors or delays in our operational and transaction processing, or those of third parties, could have an adverse effect on our business, financial condition, operating results and reputation;

•Shifting and maintaining operational activities to non-U.S. jurisdictions, changing our operating model and outsourcing to, or insourcing from, third parties may expose us to increased operational risk, geopolitical risk and reputational harm and may not result in expected cost savings or operational improvements;

•Attacks or unauthorized access to our or our business partners' or clients’ information technology systems or facilities, such as cyber-attacks or other disruptions to our or their operations, could result in significant costs, reputational damage and impacts on our business activities;

•Long-term contracts and customizing service delivery for clients expose us to increased operational risk, pricing and performance risk;

•We may not be able to protect our intellectual property or may infringe upon the rights of third parties;

•The quantitative models we use to manage our business may contain errors that could adversely impact our business, financial condition, operating results and regulatory compliance;

•Our reputation and business prospects may be damaged if investors in the collective investment pools we sponsor or manage incur substantial losses in these investment pools or are restricted in redeeming their interests in these investment pools;

•Our efforts to improve our billing processes and practices are ongoing and may result in the identification of additional errors or areas for remediation;

•The impacts of climate change, and regulatory responses, and disclosure requirements related to such risks, could adversely affect us; and

•We may incur losses or face negative impacts on our business as a result of unforeseen events including terrorist attacks, natural disasters, climate change, pandemics, global conflicts, an abrupt banking crisis and other geopolitical events which may have a negative impact on our business and operations.

PART I

ITEM 1. BUSINESS

OVERVIEW

State Street Corporation is one of the world’s largest providers of financial services to institutional investors. We believe we are an essential partner to institutional investors and operate with the purpose of helping to create better outcomes for the world’s investors and the people they serve. Our clients - asset managers and owners, insurance companies, official institutions, and central banks - rely on us to deliver solutions that support their goals across the investment life cycle.

Through our subsidiaries, including our principal banking subsidiary, State Street Bank and Trust Company, referred to as State Street Bank, we operate in more than 100 geographic markets worldwide, including the United States, Canada, Latin America, Europe, the Middle East and Asia. We provide a broad range of financial products and services to institutional investors worldwide, with $41.81 trillion of AUC/A and $4.13 trillion of AUM as of December 31, 2023.

We had consolidated total assets of $297.26 billion, consolidated total deposits of $220.97 billion, consolidated total shareholders' equity of $23.80 billion and approximately 46,000 employees as of December 31, 2023.

State Street Corporation, referred to as the Parent Company, was organized in 1969 under the laws of the Commonwealth of Massachusetts, and is a financial holding company. We conduct our business primarily through State Street Bank, which traces its beginnings to the founding of the Union Bank in 1792. State Street Bank's current charter was authorized by a special Act of the Massachusetts Legislature in 1891, and its present name was adopted in 1960. State Street Bank operates as a specialized bank, referred to as a trust or custody

State Street Corporation | 6

bank, that services and manages assets on behalf of its institutional clients.

Our executive offices are located at One Congress Street, Boston, Massachusetts 02114 (telephone (617) 786-3000). For purposes of this Form 10-K, unless the context requires otherwise, references to “State Street,” “we,” “us,” “our” or similar terms mean State Street Corporation and its subsidiaries on a consolidated basis. The Parent Company is a source of financial and managerial strength to our subsidiaries.

ADDITIONAL INFORMATION

On the “Filings & reports” tab of our website at investors.statestreet.com, we make available, free of charge, all reports we electronically file with, or furnish to, the SEC including our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, as well as any amendments to those reports, as soon as reasonably practicable after those documents have been filed with, or furnished to, the SEC. These documents are also accessible on the SEC’s website at www.sec.gov. We have included the website addresses of State Street and the SEC in this report as inactive textual references only. Information on those websites (or any other) is not incorporated by reference in this Form 10-K.

We have Corporate Governance Guidelines, as well as written charters for the Examining and Audit Committee, the Executive Committee, the Human Resources Committee, the Nominating and Corporate Governance Committee, the Risk Committee and the Technology and Operations Committee of our Board of Directors, or Board, and a Code of Ethics for Senior Financial Officers, a Standard of Conduct for Directors and a Standard of Conduct for our employees. Each of these documents is accessible on the “Corporate governance” tab of our website at investors.statestreet.com.

We provide additional disclosures required by applicable bank regulatory standards, including supplemental qualitative and quantitative information with respect to regulatory capital (including market risk associated with our trading activities), the LCR and the NSFR, summary results of annual State Street-run stress tests that we conduct under the Dodd-Frank Act, and resolution plan disclosures required under the Dodd-Frank Act. These additional disclosures are accessible on the “Filings & reports” tab of our website at investors.statestreet.com.

We use acronyms and other defined terms for certain business terms and abbreviations, as defined on the acronyms list and glossary under Item 8 in this Form 10-K.

LINES OF BUSINESS

Our operations are organized into two lines of business: Investment Servicing and Investment

Management, which are defined based on products and services provided.

Investment Servicing

Our Investment Servicing line of business provides a range of services to our clients. Through State Street Investment Services, State Street Global Markets®, State Street Alpha®, and State Street Digital®, we provide investment services for institutional clients, including mutual funds, collective investment funds and other investment pools, corporate and public retirement plans, insurance companies, investment managers, foundations and endowments worldwide. Our financial services and products allow our large institutional investor clients to execute financial transactions on a daily basis in markets across the globe. As most institutional investors cannot economically or efficiently build their own technology and operational processes necessary to facilitate all of their global securities settlement needs, our primary role as a global trust and custody bank is to aid our clients to efficiently perform services associated with the clearing, settlement and execution of securities transactions and related payments.

Products under the Investment Servicing line of business include: back office products such as custody, accounting, regulatory reporting, investor services, performance and analytics; middle office products such as investment book of record, transaction management, loans, cash, derivatives and collateral services, record keeping, client reporting and investment analytics; investment manager and alternative investment manager operations outsourcing; performance, risk and compliance analytics; financial data management to support institutional investors; foreign exchange, brokerage and other trading services; securities finance, including prime services products; and deposit and short-term investment facilities.

We provide some or all of the Investment Servicing integrated products and services to clients in the United States and in many other markets, including, among others, Australia, Brazil, Canada, Cayman Islands, Germany, Hong Kong, Ireland, Italy, Japan, Luxembourg, South Korea and the United Kingdom. As of December 31, 2023, we serviced AUC/A of approximately $29.95 trillion in the Americas, approximately $8.91 trillion in Europe and the Middle East and approximately $2.95 trillion in the Asia-Pacific region.

Included within our Investment Servicing line of business is the Charles River Investment Management Solution, a technology offering which is designed to automate and simplify the institutional investment process across asset classes, from portfolio management and risk analytics through trading and post-trade settlement, with integrated compliance and managed data throughout. With the

State Street Corporation | 7

acquisition of CRD in 2018, we took the first step in building our front-to-back platform, State Street Alpha. In 2021, we further expanded State Street Alpha's technology offering with the acquisition of Mercatus, Inc., enabling the launch of Alpha for Private Markets. In 2023, we enhanced State Street Alpha with the release of two notable upgrades to its fixed income management module. Today our State Street Alpha platform combines portfolio management, trading and execution, analytics and compliance tools, and advanced data aggregation and integration with other industry platforms and providers.

In 2021, we established State Street Digital to focus on the development of services related to digital assets and related technologies, such as blockchain, tokenization, cryptocurrency, and central bank digital currency, including the evolution of a new integrated business and digital operating model designed to support primarily our institutional clients' digital investment cycle.

Investment Management

Our Investment Management line of business provides a broad range of investment management strategies and products for our clients through State Street Global Advisors. Our investment management strategies and products for equity, fixed income and cash assets, including core and enhanced indexing, multi-asset strategies, active quantitative and fundamental active capabilities and alternative investment strategies, span the risk/reward spectrum of these investment products. Our AUM is currently primarily weighted to indexed strategies. In addition, we provide a breadth of services and solutions, including ESG investing, defined benefit and defined contribution products, and Global Fiduciary Solutions. State Street Global Advisors is also a provider of ETFs, including the SPDR® ETF brand. As of December 31, 2023, State Street Global Advisors had AUM of approximately $4.13 trillion.

Additional information about our lines of business is provided under “Line of Business Information” included in our Management's Discussion and Analysis, and in Note 24 to the consolidated financial statements in this Form 10-K. Additional information about our non-U.S. activities is included in Note 26 to the consolidated financial statements in this Form 10-K.

COMPETITION

We operate in a highly competitive environment in all areas of our business globally. Our competitors include a broad range of financial institutions and servicing companies, including other custodial banks, deposit-taking institutions, investment management firms, insurance companies, mutual funds, broker/dealers, investment banks, benefits consultants, investment analytics businesses, business service and software companies, technology companies, data providers and information services firms. As our businesses grow and markets evolve, we may encounter increasing and new forms of competition around the world.

We believe that many key factors drive competition in the markets for our business. Technological expertise, economies of scale, required levels of capital, pricing, quality and scope of services, and sales and marketing are critical to our Investment Servicing line of business. For our Investment Management line of business, key competitive factors include expertise, experience, availability of related service offerings, quality of service, price, efficiency of our products and services, and performance.

Our success and competitive position may depend on our ability to develop and market new and innovative services, to adopt or develop new technologies, to implement efficiencies into our operational processes, to bring new services to market in a timely fashion at competitive prices, to integrate existing and future products and services effectively into State Street Alpha and State Street Digital, to continue to expand our relationships with existing clients, and to attract new clients.

We are a G-SIB and are subject to extensive regulation and supervision with respect to our operations and activities. Not all of our competitors have similarly been designated as systemically important nor are all of them subject to the same degree of regulation as a bank or financial holding company, and therefore some of our competitors may not be subject to the same limitations, requirements and standards with respect to their operations and activities. Most other financial institutions designated as systemically important have substantially greater financial resources and a broader base of operations than we do and are, consequently, in a better competitive position to manage and bear the costs of this enhanced regulatory requirement. See “Supervision and Regulation” in this Item for more information.

State Street Corporation | 8

HUMAN CAPITAL

Our human capital strategy is a meaningful driver of our overall enterprise strategy and our long-term performance. Our employees drive the company’s value proposition, innovate better ways to serve our clients and act as custodians of our reputation. We seek to empower our employees by providing development and learning opportunities to help each person reach their full potential, by promoting an inclusive, diverse and equitable workplace and by improving organizational effectiveness.

In 2023, we continued to execute on our human capital strategy, as described in the sections below. Our employee population at December 31, 2023 increased approximately 10% compared to December 31, 2022 to approximately 46,000 employees. This increase was almost entirely driven by the consolidation of one of our operations joint ventures in India in the fourth quarter of 2023, as described below in this “Human Capital” section. Approximately 74% of our employees are located outside the United States.

The Board of Directors’ Human Resources Committee oversees our human capital management strategy, and receives regular updates on matters such as recruitment, retention, development, culture and inclusion, diversity and equity initiatives. Our Enterprise Talent Management Committee, which consists of senior executives, provides leadership, input and advice on our global talent-related initiatives to support our strategic priority to continually seek to become a higher-performing organization.

Organizational Effectiveness

Driving improvements in both individual and organizational productivity is a key enabler of our overall human capital management strategy, and we are focused on strategic workforce planning, building upon current headcount budgeting and forecasting activities. Our productivity efforts aim to promote the optimal cost and efficiency of our human capital through clear alignment between our business strategy and our organizational structure, headcount, personnel expense, geographic footprint, performance management, people development and reward systems. We focus on cultivating a high performing workforce that is adept at achieving profitable growth, responsive to changing business needs, and structured and resourced to deliver desired outcomes. Professional development and employee learning are necessary to achieve our human capital goals, and we seek to align our learning and development offerings with our corporate strategy as described in more detail below under “Attracting and Retaining Top Talent.” We believe that improving the productivity of our workforce and strengthening our operational and execution focus will yield more engaged and higher

performing employees and optimize our ability to serve our clients, grow revenues and improve operating margin.

In 2023, we continued to streamline and increase the efficiency of our operations to drive sustained productivity improvements, which we expect to enable us to further enhance our client service model. As noted above, in the fourth quarter of 2023, as part of ongoing transformation and productivity initiatives, we completed the consolidation of one of our operations joint ventures in India. Subsequently in 2023, we announced plans to assume full ownership of a second operations joint venture in India, which is expected to be completed in 2024 and further streamline our operating model in India.

Workforce Engagement and Culture

Our culture and values help to define us as a company and provide employees with a clear and compelling value proposition. Our culture traits provide a blueprint for employees in carrying out their work:

•Choose to Own It;

•Break Through Silos;

•Deliver Results with Integrity and Speed;

•Do Better Every Day; and

•Care for Our Colleagues, Clients and Community.

We aim to promote strong levels of employee commitment and connection to the company by highlighting our shared culture traits and the behaviors that drive our business strategy. Our leadership training programs are designed to embed these culture traits into our development processes. We also provide multiple avenues for recognition of employees who role-model our culture traits, such as through our Risk Excellence Awards, which recognize and reward employees who demonstrate exemplary risk management behaviors. Through our Bravo program, employees recognized their colleagues over 118,000 times for outstanding work in 2023. We believe that a culture where employees feel valued, engaged and empowered makes State Street a more desirable place to work, helps us attract key talent and retain employees as they grow in their careers, fostering an environment that enhances each individual’s productivity and professional satisfaction.

We use our compensation program to incentivize our executives to role-model these shared culture traits. In determining executive compensation, we first measure enterprise-level performance. We then evaluate executives’ performance against individual objectives derived from our corporate goals, including their performance advancing and role-modeling the critical leadership behaviors and culture traits that drive our business strategy.

State Street Corporation | 9

The integrity and ethical decision-making of our employees is also paramount for our culture and we want our employees to know their opinions are valued, to feel comfortable asking questions and raising concerns, and to have no fear of retaliation. We encourage employees to speak up if they see behavior that is inconsistent with our Standard of Conduct, policies, culture or values, and we regularly communicate the multiple channels provided for them to do so, including our Speak Up Line (which can be used to report anonymous concerns), Global Human Resources team and other avenues. Reports are provided to State Street’s Lead Director, General Counsel and General Auditor, depending on the nature of the reported concern. Encouraging professional challenge and debate is also a key leadership behavior that we use in evaluating candidates for executive promotions. Our approach is to promote ethical conduct by treating minor policy breaches as learning opportunities, and treating major policy breaches and misconduct promptly, professionally and seriously.

Attracting and Retaining Top Talent

Our talent management efforts are focused on developing and retaining top talent and industry leaders in markets that align with current and future demands and the evolution of our business. Retention and ongoing development of our talent requires competitive compensation and benefits, a wide range of learning and development offerings, strong support by engaged and well-trained leaders and managers and a culture where employees feel valued, engaged and empowered. As such, we carefully monitor our hiring, promotion and turnover rates and implement programs to help retain and develop our employees.

In 2023, we continued to focus on our strategic workforce planning efforts to improve internal mobility, upskilling employees capable of expanding or changing their contributions, and limiting our external hiring to priority areas. Through our various internal mobility efforts, more than one-third of open roles in 2023 were filled with internal candidates. Hiring managers have visibility into internal talent pools, allowing us to continue to leverage our global employee population as our talent source.

As a critical component of our ability to attract and retain employees, we regularly monitor our compensation program to maintain competitiveness. Our overall aim with respect to compensation is to reward high performance, motivate employees and provide competitive incentive opportunities. Compensation typically comprises fixed compensation, which reflects individual skills and abilities relative to role requirements, and variable compensation, which is designed to link total compensation to organizational, business line, risk management and individual performance. Our compensation program is intended to drive our business strategy by differentiating pay based on

performance, including, as described above, the performance of our executives in advancing and role-modeling the leadership behaviors and culture traits that drive that strategy.

Professional development and employee learning are also key elements of our talent retention strategy. We seek to align our learning and development offerings with our corporate strategy by offering skill enhancement opportunities addressing the rapidly changing, technology-centric demands of the financial services industry. This includes structured, pre-defined ‘learning-pathways’ like the Global Delivery Academy, which provides standardized technical training support for new employees, as well as individual access to a wide range of learning offerings that allow manager and employee to define a personalized development journey. We also provide professional development opportunities and access to enhanced or new roles to help deepen our employees’ skillsets and provide them with a broader perspective on the company.

Inclusion, Diversity and Equity

Inclusion, diversity and equity have long been a focus for our company, and we aim to deliver programs, resources and support that foster an environment in which every employee feels valued, inspired and empowered to leverage their diverse experiences and identities to provide innovative and authentic service to our clients, community and each other.

We believe that our strength comes from our diversity, including with respect to disability, gender, LGBTQ+ identity, race and veteran status, and our objective is to attract, hire and promote the best person for each job, positioning us to be an essential partner to our clients. We established enterprise-wide multi-year diversity goals for gender (globally) and employees who are black, indigenous and people of color (BIPOC) (United States only) in 2017. In 2023, we made progress compared to 2022 in six of the eight goal categories. Although we fell short of achieving all of our diversity goals, we achieved five of our eight goals, including all of our goals for BIPOC employees in the United States in 2023. We are proud of our progress and continue to integrate key learnings as we prepare to establish our next set of multi-year goals.

We are also focused on transparency and accountability and publish information about our inclusion, diversity and equity-related goals and activities on our website because we believe that maintaining transparency about where we are and where we have more work to do is an important part of holding ourselves accountable. We also publish our EEO-1 demographic data and pay equity information on our website.

We continue to accelerate progress via our “10 Actions Against Racism and Inequality,” which we established in July 2020. These concrete actions

State Street Corporation | 10

include goals to increase our Black and Latinx representation among our senior leaders, while addressing racial and social injustice and inequity by enhancing inclusion and diversity within our own company and advocating for the same in our industry and communities. In 2023, we announced our achievement of Management Leadership for Tomorrow’s (MLT) Black Equity at Work Bronze Certification. State Street became the first global SIFI to earn this designation, which focuses on rigorous action with accountability, development and implementation of a comprehensive Black equity plan.

At the end of 2023, our global workforce was approximately 56% men and 44% women, and women represented approximately 39% of our leadership (defined as senior vice president level and above). In the United States, approximately 37% of our workforce self-identified as members of the BIPOC community.

Community Engagement

Through our community engagement programs, we aim to benefit the communities where our employees work and live, develop employees’ professional and leadership skills, and increase employee engagement and retention through meaningful volunteer opportunities that affirm a sense of purpose and demonstrate alignment with our values.

We are proud of our impact on communities around the world through employee volunteering and the financial support of State Street Foundation to non-profit organizations. We provide training and support for State Street employees to serve as members of boards of directors of charitable organizations, expanding their leadership skills through community service. Our skills-based volunteer program gives employees the opportunity to strengthen their communities while also improving their professional skills in alignment with our overall human capital management strategy. Additionally, our matching gifts program recognizes the employees' contributions in the community by monetizing volunteer time, matching personal donations and supporting employee fundraising efforts. We believe that being a good corporate citizen drives employee engagement, enhances our reputation with clients and potential employees, improves brand recognition and builds public trust.

SUPERVISION AND REGULATION

We are registered with the Federal Reserve as a bank holding company pursuant to the Bank Holding Company Act of 1956. The Bank Holding Company Act generally limits the activities in which bank holding companies and their non-banking subsidiaries may engage to managing or controlling banks and to a range of activities that are considered to be closely related to banking. Bank holding companies that have elected to be treated as financial holding companies, such as the Parent Company, may engage in a broader range of activities considered to be “financial in nature.” The regulatory limits on our activities also apply to non-banking entities that we are deemed to “control” for purposes of the Bank Holding Company Act, which may include companies of which we own or control 5% or more of a class of voting shares. The Federal Reserve may order a bank holding company to terminate any activity, or its ownership or control of a non-banking subsidiary, if the Federal Reserve finds that the activity, ownership or control constitutes a serious risk to the financial safety, soundness or stability of a banking subsidiary or is inconsistent with sound banking principles or statutory purposes. The Bank Holding Company Act also requires a bank holding company to obtain prior approval of the Federal Reserve before it acquires substantially all the assets of any bank, or ownership or control of more than 5% of the voting shares of any bank.

The Parent Company has elected to be treated as a financial holding company and, as such, may engage in a broader range of non-banking activities than permitted for bank holding companies and their subsidiaries that have not elected to become financial holding companies. Financial holding companies may engage directly or indirectly, either de novo or by acquisition, in activities that are defined by the Federal Reserve to be financial in nature, provided that the financial holding company gives the Federal Reserve after-the-fact notice of the new activities. Activities defined to be financial in nature include, but are not limited to: providing financial or investment advice; underwriting; dealing in or making markets in securities; making merchant banking investments, subject to significant limitations; and any activities previously found by the Federal Reserve to be closely related to banking. In order to maintain our status as a financial holding company, we and each of our U.S. depository institution subsidiaries are expected to be well capitalized and well managed, as defined in applicable regulations and determined in part by the results of regulatory examinations, and must comply with Community Reinvestment Act obligations. Failure to maintain these standards may result in restrictions on our activities and may ultimately permit the Federal Reserve to take enforcement actions against us and restrict our ability to engage in activities defined to be financial in nature.

State Street Corporation | 11

In response to the 2008 financial crisis, as well as other factors, such as technological and market changes, both the scope of the laws and regulations and the intensity of the supervision to which our business is subject has increased. Regulatory enforcement and fines have also increased across the banking and financial services sector. Many of these changes have occurred as a result of the Dodd-Frank Act and its implementing regulations, most of which are now in place. Subsequently, in 2018, the EGRRCPA was enacted. The EGRRCPA’s revisions to the U.S. financial regulatory framework have altered certain laws and regulations applicable to us and other major financial services firms. Changes in key personnel at the federal banking agencies that regulate such banking organizations, including the Federal Reserve, the FDIC and the OCC (U.S. Agencies), may result in increased prudential and conduct oversight, more extensive regulatory requirements, changing interpretations of existing rules and guidelines, and potentially more stringent enforcement and more severe penalties. Irrespective of any regulatory change, we expect that our business will remain subject to extensive regulation and supervision.

In addition, increased regulatory requirements and initiatives have been and are being implemented globally with respect to financial institutions, including the implementation of the Basel III rule (refer to “Regulatory Capital Adequacy and Liquidity Standards” in this “Supervision and Regulation” section and under “Capital” in “Financial Condition” in our Management's Discussion and Analysis in this Form 10-K for a discussion of Basel III, as well as the U.S. Agencies’ proposed rule regarding the Basel III endgame), the Capital Requirements Directive and Capital Requirements Regulation and the E.U. Digital Operational Resilience Act (DORA), as well as proposals for amending the Alternative Investment Fund Managers Directive and under the Capital Markets Union Action Plan.

Many aspects of our business are subject to regulation by other U.S. federal and state governmental and regulatory agencies and self-regulatory organizations (including securities exchanges), and by non-U.S. governmental and regulatory agencies and self-regulatory organizations. Some aspects of our public disclosure, corporate governance principles and internal control systems are subject to the Sarbanes-Oxley Act of 2002 (SOX), the Dodd-Frank Act and regulations and rules of the SEC and the New York Stock Exchange.

Regulatory Capital Adequacy and Liquidity Standards

Basel III Rule

We are subject to the Basel III framework (Basel III rule) in the United States. The provisions of the

Basel III rule related to minimum capital requirements, capital buffers and deductions and adjustments to regulatory capital were fully implemented as of January 2019. We are also subject to the market risk capital rule as implemented by U.S. banking regulators.

As required by the Dodd-Frank Act, we are subject to a “capital floor,” also referred to as the Collins Amendment, in the assessment of our regulatory capital adequacy. Thus, our risk-based capital ratios for regulatory assessment purposes are the lower of each ratio calculated under the standardized approach and the advanced approaches. We are also subject to the capital conservation buffer and the countercyclical capital buffer described below in this “Supervision and Regulation” section.

On July 27, 2023, the U.S. Agencies issued a proposed rule to implement the Basel III endgame (Basel III Endgame Proposal) for large banks, and separately proposed revisions to the U.S. G-SIB capital surcharge framework (G-SIB Surcharge Proposal). The Basel III Endgame Proposal would, among other things, eliminate the advanced approaches for monitoring capital adequacy in favor of a new standardized expanded risk-based approach that would include, unlike the current standardized approach, operational risk and CVA risk RWA components, and would also replace the existing market risk rule with the new fundamental review of the trading book (FRTB) framework. The G-SIB Surcharge Proposal would, among other things, measure the G-SIB surcharge in more granular 0.1% increments as opposed to the 0.5% increments that currently apply.

The Basel III Endgame Proposal would maintain the current Basel III rule’s dual-requirement structure, whereby we and State Street Bank would be required to calculate our risk-based capital ratios under both the expanded risk-based approach and the standardized approach. In addition, the proposal would modify the existing standardized approach by requiring that the proposed new market risk standards, FRTB, also be applied in the standardized approach.

State Street Corporation | 12

The Basel III Endgame Proposal would apply the SCB and G-SIB surcharge to the risk-based capital requirements calculated under both the expanded risk-based approach and the existing standardized approach. The Basel III Endgame Proposal includes an effective date of July 1, 2025, with three-year transition arrangements until the requirements are fully phased in on July 1, 2028. The G-SIB Surcharge Proposal is set to be implemented two calendar quarters after the date of the adoption of the final rule, which is currently to be determined.

Based on our current understanding of the Basel III Endgame Proposal, we estimate that, if the expanded risk-based approach had been applied on a fully phased-in basis as of December 31, 2023, and in the absence of taking any actions to mitigate its impact, our expanded risk-based approach RWA as of that date would have been approximately 15% higher than our actual standardized approach RWA as of that date.

Any estimate of how the expanded risk-based approach may impact us is subject to uncertainty, as actual results may differ from the anticipated results and may be materially affected by and dependent on a range of factors, including business performance, future capital actions, the results of future supervisory stress tests, and interpretations (including changes in interpretations) of, and potential modifications by the U.S. Agencies to, the proposal.

Risk Weighted Assets

The existing Basel III rule provides two frameworks for the calculation of RWA for purposes of bank regulatory compliance: the “standardized” approach and the “advanced” approaches, which are applicable to advanced approaches banking organizations, like us.

The standardized approach prescribes standardized risk weights for certain on- and off-balance sheet exposures in the calculation of RWA. The advanced approaches consist of the Advanced Internal Ratings-Based Approach (AIRB) used for the calculation of RWA related to credit risk and the Advanced Measurement Approach (AMA) used for the calculation of RWA related to operational risk.

In November 2019, the U.S. Agencies issued a final rule that, among other things, implements the standardized approach for counterparty credit risk (SA-CCR), a methodology for calculating the exposure amount for derivative contracts. Under the final rule, beginning on January 1, 2022, we had the option to use the SA-CCR or the Internal Model Methodology (IMM) to measure the exposure amount of our cleared and uncleared derivative transactions under our advanced approaches calculation. We have elected to use the SA-CCR for purposes of our advanced approaches capital calculations. Since January 1, 2022, we are required to determine the

amount of these exposures under our standardized approach capital calculation using the SA-CCR.

Minimum Risk-Based Capital Requirements

Among other things, the Basel III rule (as amended) requires:

•a minimum CET1 risk-based capital ratio of 4.5% and a minimum SLR of 3% for advanced approaches banking organizations;

•a minimum Tier 1 risk-based capital ratio of 6%;

•a minimum total capital ratio of 8%; and

•the stress capital and countercyclical capital buffers, referenced below, as well as a G-SIB surcharge and the enhanced SLR (which acts as an SLR buffer) described in “Capital” in “Financial Condition” in our Management's Discussion and Analysis in this Form 10-K.

Under the Basel III rule, our total regulatory capital is composed of three tiers: CET1 capital, Tier 1 capital (which includes CET1 capital), and Tier 2 capital. The total of Tier 1 and Tier 2 capital, adjusted as applicable, is referred to as total regulatory capital.

CET1 capital is composed of core capital elements, such as qualifying common shareholders' equity and related surplus plus retained earnings and the cumulative effect of foreign currency translation plus net unrealized gains (losses) on debt and equity securities classified as AFS, less treasury stock and less goodwill and other intangible assets, net of related deferred tax liabilities. Tier 1 capital is composed of CET1 capital plus additional Tier 1 capital instruments which, for us, includes four series of preferred equity outstanding as of December 31, 2023. Tier 2 capital includes certain eligible subordinated long-term debt instruments. Total regulatory capital consists of Tier 1 capital and Tier 2 capital.

Certain other items, if applicable, must be deducted from Tier 1 and Tier 2 capital, including certain investments in the capital of unconsolidated banking, financial and insurance entities and the amount of expected credit losses that exceeds recorded allowances for loan and other credit losses. Expected credit losses are calculated for wholesale credit exposures by formula in conformity with the Basel III rule.

State Street Corporation | 13

G-SIB Surcharge

The eight U.S. bank holding companies deemed to be G-SIBs, including us, are required to calculate the G-SIB surcharge annually according to two methods, and be bound by the higher of the two:

•Method 1: Assesses systemic importance based upon five equally-weighted components: size, interconnectedness, complexity, cross-jurisdictional activity and substitutability; or

•Method 2: Alters the calculation from Method 1 by factoring in a short-term wholesale funding score in place of substitutability and applying a fixed coefficient to each of the five components.

Method 2 is the binding methodology for us as of December 31, 2023. Our current G-SIB surcharge, through December 31, 2024, is 1.0%. Based upon preliminary calculations using data as of December 31, 2023, we currently anticipate that our surcharge will remain at 1% through December 31, 2025; however, that calculation has not yet been finalized and is subject to many financial, balance sheet, market and other factors, and consequently there is a risk that a higher G-SIB surcharge of 1.5% will result from the final calculation. As noted above, our G-SIB surcharge must be calculated annually, and year-over-year changes in our Method 1 or Method 2 G-SIB scores may therefore result in changes to our G-SIB surcharge. If our Method 1 or Method 2 score changes year-over-year such that we would become subject to a higher surcharge, the higher surcharge would not become effective for two years from the “as of” date (e.g., a higher surcharge calculated as of December 31, 2023 would not become effective until January 1, 2026). If, however, our Method 1 or Method 2 score changes year-over-year such that we would become subject to a lower surcharge, we would be subject to the lower surcharge beginning one full year from the “as of” date (e.g., a lower surcharge calculated as of December 31, 2023 would become effective January 1, 2025).

Stress Capital Buffer

On March 4, 2020, the U.S. Agencies issued the SCB final rule that replaced, under the standardized approach, the fixed capital conservation buffer (2.5%) with an SCB calculated as the difference between the institution’s starting and lowest projected CET1 ratio under the severely adverse scenario of the Federal Reserve’s supervisory stress test plus planned common stock dividend payments (as a percentage of RWA) from the fourth through seventh quarter of the supervisory stress testing planning horizon. Based on our results from the 2023 supervisory stress test, our SCB for the period of October 1, 2023 through September 30, 2024 is set at the prescribed minimum of 2.5% of

RWA. For additional information about the SCB final rule, refer to “Capital Planning, Stress Tests and Dividends” in this “Supervision and Regulation” section.

Under the SCB final rule, a banking organization would be able to make capital distributions and discretionary bonus payments without specified quantitative limitations (although subject to other potential regulatory constraints, such as supervisory limitations), as long as it maintains its required SCB plus the applicable G-SIB surcharge (plus any potentially applicable countercyclical capital buffer) over the minimum required risk-based capital ratios and as long as it satisfies all leverage based capital requirements and buffers. From time to time, under certain economic conditions, banking regulators may establish a minimum countercyclical capital buffer up to a maximum of 2.5% of total RWA. The countercyclical capital buffer was initially set by banking regulators at zero, and has not been increased since its inception.

Assuming a countercyclical buffer of 0%, the minimum capital ratios as of January 1, 2024, including a capital conservation buffer and an SCB of 2.5% for advanced and standardized approaches, respectively, and a G-SIB surcharge of 1.0%, are 8.0% for CET1 capital, 9.5% for Tier 1 risk-based capital and 11.5% for total risk-based capital, in order for us to make capital distributions and discretionary bonus payments without limitation.

Leverage Ratios

We are subject to a minimum Tier 1 leverage ratio and SLR. The Tier 1 leverage ratio is based on Tier 1 capital and adjusted quarterly average on-balance sheet assets. The Tier 1 leverage ratio differs from the SLR primarily in that the denominator of the Tier 1 leverage ratio is a quarterly average of on-balance sheet assets, while the SLR additionally includes off-balance sheet exposures. We must maintain a minimum Tier 1 leverage ratio of 4%.

We are also subject to a minimum SLR of 3%, and as a U.S. G-SIB, we must maintain a 2% SLR buffer in order to avoid any limitations on distributions to shareholders and discretionary bonus payments to certain executives. If we do not maintain this buffer, limitations on these distributions and discretionary bonus payments would be increasingly stringent based upon the extent of the shortfall.

In November 2019, pursuant to the EGRRCPA, the U.S. Agencies adopted a final rule that excludes central bank deposits from a custodial banking organization’s total leverage exposure for purpose of calculating the SLR. This exclusion is not applicable to total leverage exposure under the calculation of Tier 1 leverage. This exclusion is equal to the lesser of (i) the total amount of funds the custodial banking organization and its consolidated subsidiaries have

State Street Corporation | 14

on deposit at qualifying central banks and (ii) the total amount of client funds on deposit at the custodial banking organization that are linked to fiduciary or custodial and safekeeping accounts. The rule became effective on April 1, 2020. For the quarter ended December 31, 2023, we excluded $69.6 billion of average balances held on deposit at central banks from the denominator used in the calculation of our SLR based on this custodial banking exclusion. The TLAC and LTD that State Street is required to hold under SLR-based requirements reflect the exclusion of certain central bank balances as a consequence of the rule.

The SA-CCR final rule that went into effect for us on January 1, 2022, also requires us to incorporate the SA-CCR into the calculation of our total leverage exposure for the purpose of calculating SLR.

Total Loss-Absorbing Capacity

The Federal Reserve has implemented rules on TLAC, LTD and clean holding company requirements for U.S. domiciled G-SIBs, such as us. The requirements are intended to improve the resiliency and resolvability of certain U.S. banking organizations through enhanced prudential standards. The TLAC rule imposes: (1) external TLAC requirements (i.e., combined eligible Tier 1 regulatory capital and LTD); (2) separate external LTD requirements; and (3) clean holding company requirements that impose restrictions on certain types of liabilities and limit non-TLAC related third party liabilities to 5% of external TLAC.

Among other things, the TLAC rule requires us to comply with minimum requirements for external TLAC and external LTD. Specifically, since January 2023, we must hold:

(1) combined eligible Tier 1 regulatory capital and LTD in the amount equal to the greater of 21.5% of total RWA (18.0% minimum plus a 2.5% capital conservation buffer plus a G-SIB surcharge calculated for these purposes under Method 1 of 1.0% plus any applicable counter-cyclical buffer, which is currently 0%) and 9.5% of total leverage exposure (7.5% minimum plus the enhanced SLR buffer of 2.0%), as defined by the SLR rule; and

(2) qualifying external LTD equal to the greater of 7.0% of RWA (6.0% minimum plus a G-SIB surcharge calculated for these purposes under Method 2 of 1.0%) and 4.5% of total leverage exposure, as defined by the SLR rule.

Additionally, certain large banking organizations, such as us and State Street Bank, are required to make deductions from regulatory capital for investments in certain unsecured debt instruments issued by bank holding companies and U.S. intermediate holding companies of foreign banks that

are subject to the Federal Reserve’s TLAC and LTD requirements, as well as foreign G-SIBs.

Liquidity Coverage Ratio and Net Stable Funding Ratio

In addition to capital standards, the Basel III framework introduced two quantitative liquidity standards: the LCR and the NSFR.

We are subject to the rule issued by the U.S. Agencies implementing the BCBS's LCR in the United States. The LCR is intended to promote the short-term resilience of internationally active banking organizations, like us, to improve the banking industry's ability to absorb shocks arising from market stress over a 30 calendar day period and improve the measurement and management of liquidity risk.

The LCR measures an institution’s HQLA against its net cash outflows under a prescribed stress environment. We report LCR to the Federal Reserve daily and are required to calculate and maintain an LCR that is equal to or greater than 100%. In addition, we publicly disclose certain qualitative and quantitative information about our LCR consistent with the quarterly disclosure requirements of the Federal Reserve's final rule.

Compliance with the LCR has required that we maintain an investment portfolio that contains an adequate amount of HQLA. In general, HQLA investments generate a lower investment return than other types of investments, resulting in a negative impact on our NII and our NIM. In addition, the level of HQLA we are required to maintain under the LCR is dependent upon our client relationships and the nature of services we provide, which may change over time. Deposits resulting from certain services provided (“operational deposits”) are treated as more resilient during periods of stress than other deposits. As a result, if balances of operational deposits increased relative to our total client deposit base, we would expect to require less HQLA in order to maintain our LCR. Conversely, if balances of operational deposits decreased relative to our total client deposit base, we would expect to require more HQLA. On May 5, 2020, the U.S. Agencies issued a rule that modified the LCR rule to neutralize the impact on LCR of the advances made by the MMLF (and Paycheck Protection Liquidity Facility program) and the exposures securing such advances.

In October 2020, the U.S. Agencies issued a final rule implementing the BCBS’s NSFR in the U.S. The final rule requires large banking organizations to maintain an amount of available stable funding, which is a weighted measure of a company’s funding sources over a one-year time horizon, calculated by applying standardized weightings to the company’s equity and liabilities based on their expected stability, that is no less than the amount of required stable funding, which is calculated by applying standardized

State Street Corporation | 15

weightings to assets, derivatives exposures and certain other items based on their liquidity characteristics. As a U.S. G-SIB, we are required to maintain an NSFR that is equal to or greater than 100%. In addition, in 2023, we began publicly disclosing certain qualitative and quantitative information about our NSFR consistent with the semi-annual disclosure requirements of the Federal Reserve’s final rule. Additional information about our NSFR is provided in “Asset Liquidity” in “Liquidity Risk Management” in our Management's Discussion and Analysis in this Form 10-K.

Capital Planning, Stress Tests and Dividends

Pursuant to the Dodd-Frank Act, in March 2020, the Federal Reserve adopted capital planning and stress test requirements for large bank holding companies, including us, which form part of the Federal Reserve’s annual stress testing and capital planning framework. The Federal Reserve conducts its own stress tests of our business operations using supervisory models, referred to as supervisory stress tests, the results of which it uses to calibrate our annual SCB, subject to a minimum of 2.5%. In addition, under the Federal Reserve’s capital plan rule, we must conduct periodic stress testing of our business operations and submit an annual capital plan to the Federal Reserve, taking into account the results of separate stress tests designed by us and by the Federal Reserve. The Federal Reserve conducts a qualitative assessment of our capital plan as part of the annual supervisory process known as CCAR, to evaluate the strength of our capital planning practices, including our ability to identify, measure, and determine the appropriate amount of capital for our risks, and controls and governance supporting capital planning.

The Federal Reserve's final SCB rule to integrate its annual capital planning and stress testing requirements with certain ongoing regulatory capital requirements applies to certain bank holding companies, including us. The final rule introduced an SCB and related changes to the capital planning and stress testing processes. The standardized approach SCB equals the greater of (i) 2.5%; and (ii) the maximum decline in our CET1 capital ratio under the severely adverse scenario over the supervisory stress test measurement period, plus the ratio of (a) the sum of the dollar amount of our planned common stock dividends for the fourth through seventh quarters of the supervisory stress test projection period to (b) our projected RWA for the quarter in which our projected CET1 capital ratio reaches its minimum in the supervisory stress test. Risked-based regulatory capital requirements under the standardized approach include the SCB, as summarized above, as well as our G-SIB capital surcharge and any applicable countercyclical capital buffer.

The final rule made related changes to capital planning and stress testing processes for bank holding companies subject to the SCB requirement. In particular, the final rule assumes that bank holding companies maintain a constant level of assets and RWA throughout the supervisory stress test projection period. In addition, under the final rule the supervisory stress test no longer assumes that bank holding companies make all nine quarters of planned capital distributions under stress, although the SCB incorporates the dollar amount of four quarters of planned common stock dividends, as described above.

The final rule did not change regulatory capital requirements under the advanced approaches, the Tier 1 leverage ratio or the SLR.

Our SCB requirement was 2.5% for the period from October 1, 2022 through September 30, 2023. On June 28, 2023, we were notified by the Federal Reserve of the results from the 2023 supervisory stress test. Our SCB calculated under the 2023 supervisory stress test was well below the 2.5% minimum, resulting in an SCB at that floor, which went into effect starting October 1, 2023 and will remain effective through September 30, 2024.

Although the final SCB rule changed the effects of the CCAR and supervisory stress test processes so that the SCB, rather than CCAR, is the source of our stress-based capital requirements, we continue to be subject to CCAR's capital plan requirements and the supervisory assessment of our capital planning activities. Under the capital planning requirements, our annual capital plan must include a description of all of our planned capital actions over a nine-quarter planning horizon, including any capital qualifying instruments, any capital distributions, such as payments of dividends on, or repurchases of, our stock, and any similar action that the Federal Reserve determines could affect our consolidated capital. The capital plan must include a discussion of how we will maintain capital above the minimum regulatory capital ratios, including the minimum ratios under the Basel III rule, and serve as a source of strength to State Street Bank under supervisory stress scenarios. Changes in our strategy, merger or acquisition activity or unanticipated uses of capital could result in a change in our capital plan and its associated capital actions, including capital raises or modifications to planned capital actions, such as repurchases of our stock, and may require resubmission of the capital plan to the Federal Reserve if, among other reasons, we would not meet our regulatory capital requirements after making the proposed capital distribution.

In addition to its stress testing and capital planning requirements, the Federal Reserve has the authority to prohibit or to limit the payment of dividends, the repurchase of common stock, or other capital actions that reduce capital by the banking

State Street Corporation | 16

organizations it supervises, including the Parent Company and State Street Bank, if, in the Federal Reserve’s opinion, the capital action would constitute an unsafe or unsound practice in light of-the financial condition of the banking organization. All of these policies and other requirements could affect our ability to pay dividends and repurchase our stock or require us to provide capital assistance to State Street Bank and any other banking subsidiary. Our common stock and other stock dividends, including the declaration, timing and amount thereof, remain subject to consideration and approval by our Board of Directors at the relevant times.

The Federal Reserve, under the Dodd-Frank Act, previously required us to conduct semi-annual State Street-run stress tests and to publicly disclose the summary results of our State Street-run stress tests under the severely adverse economic scenario. We are also required to undergo an annual supervisory stress test conducted by the Federal Reserve. The EGRRCPA modifies certain aspects of these stress-testing requirements, reducing the number of scenarios in the Federal Reserve’s supervisory stress test from three to two and modifying our obligation to perform company-run stress-tests from semi-annually to annually. The Federal Reserve adopted a final rule in October 2019 that, among other things, implemented this modification.

Enhanced Prudential Standards

The Dodd-Frank Act, as amended by the EGRRCPA, establishes a systemic risk regime to which large bank holding companies with $100 billion or more in consolidated assets, such as us, are subject. The Federal Reserve is required to tailor the application of the enhanced prudential standards to bank holding companies based on their size, complexity, risk profile and other factors. U.S. G-SIBs, such as us, are subject to the most stringent requirements, including heightened capital, leverage, liquidity and risk management requirements and single-counterparty credit limits (SCCL).

The FSOC can recommend prudential standards, reporting and disclosure requirements for SIFIs to the Federal Reserve, and must approve any finding by the Federal Reserve that a financial institution poses a grave threat to financial stability and must undertake mitigating actions. The FSOC is also empowered to designate systemically important payment, clearing and settlement activities of financial institutions, subjecting them to prudential supervision and regulation, and, assisted by the Office of Financial Research within the U.S. Department of the Treasury, can gather data and reports from financial institutions, including us.

Under the Federal Reserve's enhanced prudential standards regulation under the Dodd-Frank

Act, as amended by the EGRRCPA, we are required to comply with various liquidity-related risk management standards and maintain a liquidity buffer of unencumbered highly liquid assets based on the results of internal liquidity stress testing. This liquidity buffer is in addition to other liquidity requirements, such as the LCR and the NSFR. The regulations also establish requirements and responsibilities for our risk committee and mandate risk management standards.

In 2018, the Federal Reserve finalized rules that established SCCL for large banking organizations. U.S. G-SIBs, including us, are subject to a limit of 15% of Tier 1 capital for aggregate net credit exposures to any “major counterparty” (defined to include other U.S. G-SIBs, foreign G-SIBs and non-bank SIFIs supervised by the Federal Reserve). In addition, we are subject to a limit of 25% of Tier 1 capital for aggregate net credit exposures to any other unaffiliated counterparty. The final SCCL rules became effective for us on January 1, 2020.

The Federal Reserve has established a rule that imposes contractual requirements on certain “qualified financial contracts” to which U.S. G-SIBs, including us, and their subsidiaries are parties. Under the rule, certain qualified financial contracts generally must expressly provide that transfer restrictions and default rights against a U.S. G-SIB, or subsidiary of a U.S. G-SIB, are limited to the same extent as they would be under the Federal Deposit Insurance Act and Title II of the Dodd-Frank Act and their implementing regulations. In addition, certain qualified financial contracts may not, among other things, permit the exercise of any cross-default right against a U.S. G-SIB or subsidiary of a U.S. G-SIB based on an affiliate’s entry into insolvency, resolution or similar proceedings, subject to certain creditor protections.

The systemic-risk regime also provides that for U.S. G-SIBs deemed to pose a grave threat to U.S. financial stability, the Federal Reserve, upon an FSOC vote, must limit that institution’s ability to merge, restrict its ability to offer financial products, require it to terminate activities, impose conditions on activities or, as a last resort, require it to dispose of assets. Upon a grave threat determination by the FSOC, the Federal Reserve must issue rules that require financial institutions subject to the systemic-risk regime to maintain a debt-to-equity ratio of no more than 15 to 1 if the FSOC considers it necessary to mitigate the risk of the grave threat. The Federal Reserve also has the ability to establish further standards, including those regarding contingent capital, enhanced public disclosures and limits on short-term debt, including off-balance sheet exposures.

As a G-SIB, we are subject to enhanced supervision and prudential standards. Our status as a G-SIB has also resulted in heightened expectations of our U.S. and international regulators with respect to

State Street Corporation | 17

our capital and liquidity management and our compliance and risk oversight programs. These heightened expectations have increased our regulatory compliance costs, including personnel, technology and systems, as well as significant additional implementation and related costs to enhance our regulatory compliance programs. Regulatory compliance requirements are anticipated to remain at least at the elevated levels we have experienced over the past several years.

Failure to meet current and future regulatory capital requirements could subject us to a variety of enforcement actions, including the termination of State Street Bank's deposit insurance by the FDIC, and to certain restrictions on our business, including those that are described above in this “Supervision and Regulation” section.

Not all of our competitors have similarly been designated as systemically important nor are all of them subject to the same degree of regulation as a bank or financial holding company, and therefore some of our competitors may not be subject to the same additional capital requirements.

For additional information about our regulatory capital position and our regulatory capital adequacy, as well as current and future regulatory capital requirements, refer to “Capital” in “Financial Condition” in our Management's Discussion and Analysis, and Note 16 to the consolidated financial statements in this Form 10-K.

The Volcker Rule

We are subject to the Volcker Rule and implementing regulations. The Volcker Rule prohibits banking entities, including us and our affiliates, from engaging in certain prohibited proprietary trading activities, as defined in the Volcker Rule regulations, subject to exemptions for market-making related activities, risk-mitigating hedging, underwriting and certain other activities. The Volcker Rule also requires banking entities to either restructure or divest certain ownership interests in, and relationships with, covered funds (as such terms are defined in the Volcker Rule regulations).

The Volcker Rule regulations require banking entities to establish extensive programs designed to promote compliance with the restrictions of the Volcker Rule. We have established a compliance program that we believe complies with the Volcker Rule regulations as currently in effect. Our compliance program restricts our ability in the future to service certain types of funds, in particular covered funds for which State Street Global Advisors acts as an advisor and certain types of trustee relationships. Consequently, Volcker Rule compliance entails both the cost of a compliance program and loss of certain revenue and future opportunities.

Recovery and Resolution Planning

Under Section 165(d) of the Dodd-Frank Act, we are required to submit a resolution plan on a biennial basis jointly to the Federal Reserve and the FDIC (as used in this “Recovery and Resolution Planning” section, the Agencies). The purpose of our resolution plan is to describe our preferred resolution strategy and to demonstrate that we have the resources and capabilities to execute on that strategy in the event of major financial distress. Through resolution planning, we seek to maintain our role as a key infrastructure provider within the financial system, while minimizing risk to the financial system.

The final rule published on November 1, 2019 requires U.S. G-SIBs to file a full resolution plan and a targeted resolution plan on an alternating basis in the relevant submission years. We submitted our updated 2023 165(d) resolution plan by July 1, 2023. Under the 165(d) rule, results are due from the Agencies by July 1, 2024, unless the deadline is extended due to extenuating circumstances. Our next 165(d) resolution plan submission to the Agencies is due by July 1, 2025.

In the event of material financial distress, our preferred resolution strategy is the Single Point of Entry (SPOE) Strategy. The SPOE Strategy provides that prior to the bankruptcy of the Parent Company and pursuant to a support agreement among the Parent Company, SSIF (a direct subsidiary of the Parent Company), our Beneficiary Entities (as defined below) and certain of our other entities, SSIF is obligated, up to its available resources, to recapitalize and/or provide liquidity to State Street Bank and the other entities benefiting from such capital and/or liquidity support (collectively with State Street Bank, “Beneficiary Entities”), in amounts designed to prevent the Beneficiary Entities from themselves entering into resolution proceedings. Following the recapitalization of, or provision of liquidity to the Beneficiary Entities, the Parent Company would enter into a bankruptcy proceeding under the U.S. Bankruptcy Code. The Beneficiary Entities and our other subsidiaries would be transferred to a newly organized holding company held by a reorganization trust for the benefit of the Parent Company’s claimants.

Under the support agreement, the Parent Company pre-funded SSIF by contributing certain of its assets (primarily its liquid assets, cash deposits, investments in intercompany debt, investments in marketable securities and other cash and non-cash equivalent investments) to SSIF at the time it entered into the support agreement and will continue to contribute such assets, to the extent available, on an ongoing basis. In consideration for these contributions, SSIF has agreed in the support agreement to provide capital and liquidity support to the Parent Company and all of the Beneficiary

State Street Corporation | 18

Entities in accordance with the Parent Company’s capital and liquidity policies. Under the support agreement, the Parent Company is only permitted to retain cash needed to meet its upcoming obligations and to fund expected expenses during a potential bankruptcy proceeding. SSIF has provided the Parent Company with a committed credit line and issued (and may issue) one or more promissory notes to the Parent Company (the “Parent Company Funding Notes”) that together are intended to allow the Parent Company to continue to meet its obligations throughout the period prior to the occurrence of a “Recapitalization Event”, which is defined as the earlier occurrence of: (1) one or more capital and liquidity thresholds being breached or (2) the authorization by the Parent Company's Board of Directors for the Parent Company to commence bankruptcy proceedings. The support agreement does not obligate SSIF to maintain any specific level of resources and SSIF may not have sufficient resources to implement the SPOE Strategy.

In the event a Recapitalization Event occurs, the obligations outstanding under the Parent Company Funding Notes would automatically convert into or be exchanged for capital contributed to SSIF. The obligations of the Parent Company and SSIF under the support agreement are secured through a security agreement that grants a lien on the assets that the Parent Company and SSIF would use to fulfill their obligations under the support agreement to the Beneficiary Entities. SSIF is a distinct legal entity separate from the Parent Company and the Parent Company’s other affiliates.

In accordance with our policies, we are required to monitor, on an ongoing basis, the capital and liquidity needs of State Street Bank and our other Beneficiary Entities. To support this process, we have established a trigger framework that identifies key actions that would need to be taken or decisions that would need to be made if certain events tied to our financial condition occur. The trigger thresholds are set at levels intended to provide for the availability of sufficient capital and liquidity to enable an orderly resolution without extraordinary government support that results in us emerging from resolution as a stabilized institution with market confidence restored.

Upon the occurrence of a Recapitalization Event: (1) SSIF would not be authorized to provide any further liquidity to the Parent Company; (2) the Parent Company would be required to contribute to SSIF any remaining assets it is required to contribute to SSIF under the support agreement (which specifically exclude amounts designated to fund expected expenses during a potential bankruptcy proceeding); (3) SSIF would be required to provide capital and liquidity support to the Beneficiary Entities to support such entities’ continued operation to the extent of its available resources and consistent with

the support agreement; and (4) the Parent Company would be expected to commence Chapter 11 proceedings under the U.S. Bankruptcy Code. No person or entity, other than a party to the support agreement, should rely on any of our affiliates being or remaining a Beneficiary Entity or receiving capital or liquidity support pursuant to the support agreement, including in evaluating any of our entities from a creditor's perspective or determining whether to enter into a contractual relationship with any of our entities.

State Street Bank is also required to submit periodically to the FDIC a plan for resolution in the event of its failure, referred to as an IDI plan. We submitted our last IDI plan by December 1, 2023 in alignment with changes to the IDI plan requirements as set out in the June 25, 2021 policy statement issued by the FDIC. The FDIC issued a notice of proposed rulemaking for the IDI Rule in August 2023 that, among other changes, would require IDI Plans to be submitted on a biennial basis by Group A filers (IDIs with $100 billion or more in total assets), which is the category applicable to State Street.

Additionally, we are required to submit a recovery plan periodically to the Federal Reserve. The plan includes strategies designed to respond to stress factors at an early stage and stabilize and maintain operational continuity and market confidence. Our recovery strategies are intended to be implemented before our resolution plan is triggered. We are also engaged in recovery planning requirements in certain international jurisdictions where we operate.

Orderly Liquidation Authority

Under the Dodd-Frank Act, certain financial companies, including bank holding companies such as the Parent Company, and certain covered subsidiaries, can be subjected to the orderly liquidation authority. For the FDIC to be appointed as our receiver, two-thirds of the FDIC Board and two-thirds of the Federal Reserve Board must recommend appointment, and the U.S. Treasury Secretary, in consultation with the U.S. President, must then make certain extraordinary financial distress and systemic risk determinations. Absent such actions, we, as a bank holding company, would remain subject to the U.S. Bankruptcy Code.

The orderly liquidation authority went into effect in 2010, and rulemaking is proceeding incrementally, with some regulations now finalized and others planned but not yet proposed. If the FDIC were appointed as the receiver of the Parent Company pursuant to the orderly liquidation authority, the FDIC would have considerable powers to resolve the Parent Company, including: (1) the power to remove officers and directors responsible for the Parent Company's failure and to appoint new directors and

State Street Corporation | 19

officers; (2) the power to assign assets and liabilities to a third party or bridge financial company without the need for creditor consent or prior court review; (3) the ability to differentiate among similarly situated creditors, subject to a minimum recovery right to receive at least what they would have received in bankruptcy liquidation; and (4) broad powers to administer the claims process to determine distributions from the assets of the receivership to creditors not transferred to a third party or bridge financial institution.

In 2013, the FDIC released its proposed SPOE strategy for resolution of a SIFI under the orderly liquidation authority. The FDIC’s release outlines how it would likely use its powers under the orderly liquidation authority to resolve a SIFI by placing its top-tier U.S. holding company in receivership and keeping its operating subsidiaries open and out of insolvency proceedings by transferring the operating subsidiaries to a new bridge holding company, recapitalizing the operating subsidiaries and imposing losses on the shareholders and creditors of the holding company in receivership according to their statutory order of priority.

Derivatives

Title VII of the Dodd-Frank Act imposed a comprehensive regulatory structure on the OTC derivatives market, including requirements for clearing, exchange trading, capital, margin, reporting and record-keeping. Title VII also requires certain persons to register as a major swap participant, a swap dealer or a securities-based swap dealer. The CFTC, the SEC, and other U.S. regulators have largely implemented key provisions of Title VII, although certain final regulations have only been in place for limited periods of time and others have not been finalized. Through this rulemaking process, these regulators collectively have adopted or proposed, among other things, regulations relating to reporting and record-keeping obligations, margin and capital requirements, the scope of registration and the central clearing and exchange trading requirements for certain OTC derivatives. The CFTC has also issued rules to enhance the oversight of clearing and trading entities. The CFTC, along with other regulators, including the Federal Reserve, have also issued rules with respect to margin requirements for uncleared derivatives transactions.

State Street Bank has registered with the CFTC as a swap dealer. As a registered swap dealer, State Street Bank is subject to significant regulatory obligations regarding its swap activity and the supervision, examination and enforcement powers of the CFTC and other regulators. The CFTC has granted State Street Bank a limited-purpose swap dealer designation. Under this limited-purpose designation, interest rate swap activity conducted by

State Street Bank’s Global Treasury group is not subject to certain of the swap regulatory requirements otherwise applicable to swaps entered into by a registered swap dealer, subject to a number of conditions. For all other swap transactions, our swap activities remain subject to all applicable swap dealer regulations.

Subsidiaries

The Federal Reserve is the primary federal banking agency responsible for regulating us and our subsidiaries, including State Street Bank, with respect to both our U.S. and non-U.S. operations. Our banking subsidiaries are subject to supervision and examination by various regulatory authorities and have regulatory requirements that may differ from the Parent Company.

State Street Bank

State Street Bank is a member of the Federal Reserve System, its deposits are insured by the FDIC and it is subject to applicable federal and state banking laws and to supervision and examination by the Federal Reserve, the Massachusetts Commissioner of Banks, as well as the FDIC and the regulatory authorities of those states and countries in which State Street Bank operates a branch.

As with the Parent Company, State Street Bank is considered an advanced approaches banking organization subject to the Basel III framework in the United States and is also subject to the market risk capital rule jointly issued by U.S. Agencies to implement the changes to the market risk capital framework in the United States. As required by the Dodd-Frank Act, State Street Bank, as an advanced approaches banking organization, is subject to a “capital floor,” also referred to as the Collins Amendment, in the assessment of its regulatory capital adequacy, including the capital conservation buffer and countercyclical capital buffer described above in this “Supervision and Regulation” section.

Under the Basel III rule, State Street Bank's regulatory capital calculations, including any additions or deductions from capital for regulatory purposes, are consistent with the calculations of the Parent Company. For additional information about the Basel III endgame proposal, including the proposed replacements of the advanced approaches and existing market risk capital framework, refer to “Basel III Rule” above in this “Supervision and Regulation” section.

Similar to our Parent Company, State Street Bank is subject to the Tier 1 leverage ratio and the supplementary leverage ratio. However, as State Street Bank is an IDI subsidiary of a U.S. G-SIB, it is required to maintain a minimum Tier 1 leverage ratio of 5% and a minimum SLR of 6% to be considered well capitalized.

State Street Corporation | 20

Furthermore, for the purposes of calculating the SLR, State Street Bank is similarly subject to a final rule adopted by the U.S. Agencies that excludes central bank deposits from a custodial banking organization’s total leverage exposure. For the quarter ended December 31, 2023, State Street Bank excluded $69.6 billion of average balances held on deposit at central banks from the denominator used in the calculation of our SLR based on this custodial banking exclusion.

Pursuant to the U.S. Agencies’ LCR and NSFR final rules, as a subsidiary of a U.S. G-SIB, State Street Bank is similarly required to maintain an LCR and NSFR, respectively, equal to or greater than 100%.

We and our subsidiaries that are not subsidiaries of State Street Bank are affiliates of State Street Bank under federal banking laws, which impose restrictions on various types of transactions, including loans, extensions of credit, investments or asset purchases by or from State Street Bank, on the one hand, to us and those of our subsidiaries, on the other. Transactions of this kind between State Street Bank and its affiliates generally are limited with respect to each affiliate to 10% of State Street Bank’s capital and surplus, as defined by the aforementioned banking laws, are limited in the aggregate for all affiliates to 20% of State Street Bank's capital and surplus, and in some cases are also subject to strict collateral requirements. Derivatives, securities borrowing and securities lending transactions between State Street Bank and its affiliates became subject to these restrictions pursuant to the Dodd-Frank Act. The Dodd-Frank Act also expanded the scope of transactions required to be collateralized. In addition, the Volcker Rule generally prohibits similar transactions between the Parent Company or any of its affiliates and covered funds for which we or any of our affiliates serve as the investment manager, investment adviser, commodity trading advisor or sponsor and other covered funds organized and offered pursuant to specific exemptions in the Volcker Rule regulations.

Federal law also requires that certain transactions by a bank with affiliates be on terms and under circumstances, including credit standards, that are substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions involving other non-affiliated companies. Alternatively, in the absence of comparable transactions, the transactions must be on terms and under circumstances, including credit standards, that in good faith would be offered to, or would apply to, non-affiliated companies.

State Street Bank is also prohibited from engaging in certain tie-in arrangements in connection with any extension of credit or lease or sale of property or furnishing of services. Federal law provides for a depositor preference on amounts

realized from the liquidation or other resolution of any depository institution insured by the FDIC.

Other Subsidiaries

Our other subsidiary trust companies are subject to supervision and examination by the OCC, the Federal Reserve or by the appropriate state banking regulatory authorities of the states in which they are organized and operate. Our continental European banking subsidiary, State Street Bank International GmbH is a significant entity in accordance with European banking regulations and accordingly is supervised directly by the European Central Bank. State Street Bank International GmbH operates in several countries including Germany, Luxembourg, Italy, France and Switzerland. In the United Kingdom, the London branch of State Street Bank is dually regulated by the Prudential Regulatory Authority and the Financial Conduct Authority, in Ireland our depositary and fund administration companies are regulated by the Central Bank of Ireland and in Canada our trust company is regulated by the Office of the Superintendent of Financial Institutions. Our other subsidiaries internationally engaged in our investment servicing activities are regulated by applicable authorities in the jurisdictions of their activities. Our subsidiaries involved in our investment management and securities and markets businesses are regulated by governments, securities exchanges, self-regulatory organizations, central banks and regulatory bodies in U.S. federal and state and non-U.S. jurisdictions, especially in those jurisdictions in which we maintain an office.

Many aspects of our investment management activities are subject to U.S. federal and state, as well as non-U.S., laws and regulations primarily intended to benefit the investment holder, rather than our shareholders. These laws and regulations generally grant supervisory agencies and bodies broad administrative powers, including the power to limit or restrict us from conducting our investment management activities in the event that we fail to comply with such laws and regulations, and examination authority. Our business related to investment management and trusteeship of collective trust funds and separate accounts offered to employee benefit plans is subject to the Employee Retirement Income Security Act (ERISA), and is regulated by the U.S. DOL.

The majority of our non-U.S. asset servicing operations are conducted pursuant to the Federal Reserve's Regulation K through State Street Bank’s Edge Act subsidiary or through international branches of State Street Bank. An Edge Act corporation is a corporation organized under federal law that conducts foreign business activities. In general, banks may not make investments in their Edge Act corporations (and similar state law corporations) that exceed 20% of their capital and surplus, as defined in the relevant

State Street Corporation | 21

banking regulations, and the investment of any amount in excess of 10% of capital and surplus requires the prior approval of the Federal Reserve.

In addition to our non-U.S. operations conducted pursuant to Regulation K, we also make new investments abroad directly (through us or through our non-banking subsidiaries) pursuant to the Federal Reserve's Regulation Y, or through international bank branch expansion, neither of which is subject to the investment limitations applicable to Edge Act subsidiaries.

Additionally, Massachusetts has its own bank holding company statute, under which we, among other things, may be required to obtain prior approval by the Massachusetts Board of Bank Incorporation for an acquisition of more than 5% of any additional bank's voting shares, or for other forms of bank acquisitions.

Anti-Money Laundering and Financial Transparency

Certain of our subsidiaries are subject to the Bank Secrecy Act of 1970, as amended by the USA PATRIOT Act of 2001, and related regulations, which contain AML and financial transparency provisions and which require implementation of an AML compliance program, including processes for verifying client identification and monitoring client transactions and detecting and reporting suspicious activities. AML laws outside the United States contain similar requirements. State Street Corporation and its subsidiaries are also required to comply with sanctions laws and regulations administered and imposed by the United States government, including the U.S. Treasury Department’s OFAC and the Department of State, as well as comparable sanctions programs imposed by foreign governments and multilateral bodies. We have implemented an enterprise-wide AML and sanctions compliance program, including policies, procedures and internal controls that are designed to promote compliance with applicable AML laws and regulations and sanctions. AML laws and regulations applicable to our operations may be more stringent than similar requirements applicable to our non-regulated competitors or financial institutions principally operating in other jurisdictions. Compliance with applicable AML and related requirements is a common area of review for financial regulators, and any failure by us to comply with these requirements could result in fines, penalties, lawsuits, regulatory sanctions, difficulties in obtaining governmental approvals, restrictions on our business activities or harm to our reputation.

Deposit Insurance

The Dodd-Frank Act made permanent the general $250,000 deposit insurance limit for insured deposits. The FDIC’s Deposit Insurance Fund (DIF) is funded by assessments on FDIC IDIs. The FDIC assesses DIF premiums based on an IDI's average

consolidated total assets, less the average tangible equity of the IDI during the assessment period. For larger institutions, such as State Street Bank, assessments are determined based on regulatory ratings and forward-looking financial measures to calculate the assessment rate, which is subject to adjustments by the FDIC, and the assessment base.

In July 2022, the FDIC adopted a final rule, applicable to all IDIs, to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, effective as of the first quarterly assessment period of 2023. The FDIC also concurrently maintained the Designated Reserve Ratio (DRR) target for the DIF at 2% for 2023. The increase in assessment rate schedules is intended to increase the likelihood that the reserve ratio of the DIF reaches the statutory minimum of 1.35% by the statutory deadline of September 30, 2028.

Following the failures of certain banks and the resulting losses to the DIF in the first half of 2023, the FDIC adopted a final rule on November 16, 2023 to implement a special assessment to recover the cost associated with protecting uninsured depositors. Under the final rule, the assessment base for the special assessment is equal to an IDI’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion of uninsured deposits. The $5 billion exclusion is applied once to the aggregate uninsured deposits of a consolidated banking organization. The final rule provides that the FDIC will collect the special assessment at a quarterly rate of 3.36 basis points over eight quarterly assessment periods, subject to change depending on any adjustments to the loss estimate, mergers, failures, or amendments to reported estimates of uninsured deposits. We recognized the entire estimated amount of our portion of the special assessment, approximately $387 million, as an accrued liability and related expense in the fourth quarter of 2023. The final rule becomes effective on April 1, 2024 and the first collection will be reflected on the invoice for the first quarterly assessment period of 2024, with the first payment due on June 28, 2024. For additional information about the FDIC special assessment, refer to “Closures of Silicon Valley Bank and Signature Bank and Related FDIC Matters” under “Other Matters” included in our Management's Discussion and Analysis in this Form 10-K.

The FDIC is required to determine whether and to what extent adjustments to the assessment base are appropriate for “custody banks” that satisfy specified institutional eligibility criteria. The FDIC has concluded that certain liquid assets could be excluded from the deposit insurance assessment base of custody banks. This, subject to change by the FDIC, has the effect of reducing the amount of DIF insurance premiums due from custody banks. State Street Bank qualifies as a custody bank for this purpose. The custody bank assessment adjustment may not exceed total transaction account deposits

State Street Corporation | 22

identified by the institution as being directly linked to a fiduciary or custody and safekeeping asset.

Prompt Corrective Action

The FDIC Improvement Act of 1991 requires the appropriate federal banking regulator to take “prompt corrective action” with respect to a depository institution if that institution does not meet certain capital adequacy standards, including minimum capital ratios. While these regulations apply only to banks, such as State Street Bank, the Federal Reserve is authorized to take appropriate action against a parent bank holding company, such as our Parent Company, based on the under-capitalized status of any banking subsidiary. In certain instances, we would be required to guarantee the performance of a capital restoration plan if one of our banking subsidiaries were undercapitalized.

Support of Subsidiary Banks

Under Federal Reserve regulations, a bank holding company such as our Parent Company is required to act as a source of financial and managerial strength to its banking subsidiaries. This requirement was added to the Federal Deposit Insurance Act by the Dodd-Frank Act. This means that we have a statutory obligation to commit resources to State Street Bank and any other banking subsidiary in circumstances in which we otherwise might not do so absent such a requirement. In the event of bankruptcy, any commitment by us to a federal bank regulatory agency to maintain the capital of a banking subsidiary will be assumed by the bankruptcy trustee and will be entitled to a priority payment.

Insolvency of an Insured U.S. Subsidiary Depository Institution

If the FDIC is appointed the conservator or receiver of an FDIC-insured U.S. subsidiary depository institution, such as State Street Bank, upon its insolvency or certain other events, the FDIC has the ability to transfer any of the depository institution’s assets and liabilities to a new obligor without the approval of the depository institution’s creditors, enforce the terms of the depository institution’s contracts pursuant to their terms or repudiate or disaffirm contracts or leases to which the depository institution is a party. Additionally, the claims of holders of deposit liabilities and certain claims for administrative expenses against an IDI would be afforded priority over other general unsecured claims against such an institution, including claims of debt holders of the institution and, under current interpretation, depositors in non-U.S. branches and offices, in the liquidation or other resolution of such an institution by any receiver. As a result, such persons would be treated differently from and could receive, if anything, substantially less than

the depositors in U.S. offices of the depository institution.

Cybersecurity and Data Privacy

The financial services industry faces increased global regulatory focus regarding cybersecurity and data privacy. Many aspects of our businesses are subject to cybersecurity and data privacy legal and regulatory requirements enacted by U.S. federal and state governments and other non-U.S. jurisdictions. These requirements impose, among other things, mandatory cybersecurity and data privacy obligations, including providing for individual rights, enhanced governance and accountability requirements, and significant fines and litigation risk for noncompliance. In addition, several jurisdictions have enacted or proposed localization requirements and restrictions on cross-border transfers of personal information that may restrict our ability to conduct business in those jurisdictions or create additional financial, legal and regulatory burdens to do so. For example, in the E.U., we are subject to the GDPR, which requires, among other things, a comprehensive privacy, data protection and cybersecurity program to protect the personal and sensitive data of residents of the European Economic Area. Following the withdrawal of the U.K. from the EU, we are also subject to the U.K. General Data Protection Regulation (a version of the GDPR as implemented into U.K. law).

The U.S. Agencies finalized a rule in November 2021 requiring banking organizations to notify their primary federal regulators as soon as possible and no later than 36 hours after identifying a “computer-security incident” that has materially affected, or is reasonably likely to materially affect, the viability of their operations, their ability to deliver banking products and services or the stability of the financial sector. The final rule became effective April 1, 2022.

In March 2022, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was signed into law and requires, among other things, the Cybersecurity and Infrastructure Security Agency (CISA) to develop and implement regulations for covered entities to report certain covered cyber incidents within 72 hours from the time the company reasonably believes the incident occurred. In addition, the SEC adopted new rules on July 26, 2023 that require registrants to publicly disclose on a Form 8-K material cybersecurity incidents within four business days of determining that such an incident is material.

Most recently, the EU adopted DORA in November 2022, which requires, among other things, financial institutions to follow certain rules regarding protection, detection, containment, recovery and repair capabilities with respect to information and communication technology-related incidents. Financial institutions will have until January 17, 2025 to comply with DORA before enforcement begins. In addition, numerous jurisdictions have passed laws,

State Street Corporation | 23

rules and regulations regarding cybersecurity and data privacy risk management, and many are considering new or updated requirements that could impact our businesses, particularly as the application, interpretation and enforcement of these laws, rules and regulations are often uncertain and evolving.

Further discussion of cybersecurity and data privacy risk management is provided in “Information Technology Risk Management” included in our Management's Discussion and Analysis in this Form 10-K.

ECONOMIC CONDITIONS AND GOVERNMENT POLICIES

Economic policies of the U.S. government and its agencies influence our operating environment. Monetary policy conducted by the Federal Reserve directly affects the level of interest rates, which may affect overall credit conditions of the economy. Monetary policy is applied by the Federal Reserve through open market operations in U.S. government securities, changes in reserve requirements for depository institutions, and changes in the discount rate and availability of borrowing from the Federal Reserve. Government regulation of banks and bank holding companies is intended primarily for the protection of depositors of the banks, rather than for the shareholders of the institutions and therefore may, in some cases, be adverse to the interests of those shareholders. We are similarly affected by the economic policies of non-U.S. government agencies, such as the ECB.

ITEM 1A. RISK FACTORS 

Risk Factors

In the normal course of our business activities, we are exposed to a variety of risks. The following is a discussion of material risk factors applicable to us. Additional information about our risk management framework is included under “Risk Management” in Management’s Discussion and Analysis in this Form 10-K. Additional risks beyond those described in our Management's Discussion and Analysis or in the following discussion may apply to our activities or operations as currently conducted, or as we may conduct them in the future, or in the markets in which we operate or may in the future operate.

Strategic Risks

We are subject to intense competition in all aspects of our business, which could negatively affect our ability to maintain or increase our profitability.

The markets in which we operate across all facets of our business are both highly competitive and global. These markets are changing as a result of financial and technological innovation and new and evolving laws and regulations applicable to financial services institutions. Market changes,

macroeconomic developments and other factors cannot always be anticipated, and may adversely affect the demand for, and profitability of, the products and services that we offer. In addition, new market entrants and competitors may address or influence changes in the markets more rapidly than we do, may have materially greater resources to invest in infrastructure and product development than we do, or may provide clients with a more attractive or cost-efficient offering of products and services, adversely affecting our business. Our efforts to develop and market new products, particularly in the “Fintech” sector including through State Street Alpha and State Street Digital, may position us in new markets with pre-existing competitors with strong market position. We have also experienced, and anticipate that we will continue to experience, significant pricing pressure in many of our core businesses, particularly our custodial and investment management services. This pricing pressure has and may continue to impact our revenue growth and operational margins and may limit the positive impact of new client demand and growth in AUC/A. Many of our businesses compete with other domestic and international banks and financial services companies, such as custody banks, investment advisors, broker/dealers, outsourcing companies, information providers, data analytics and processing companies. Further consolidation within the financial services industry could also pose challenges to us in the markets we serve, including potentially increased downward pricing pressure across our businesses.

Some of our competitors, including our competitors in core services, have substantially greater capital resources than we do, are not subject to as stringent capital or other regulatory requirements as we are, or may not be as constrained as we are by these requirements due to the relative size of our balance sheet. In some of our businesses, we are service providers to significant competitors. These competitors are in some instances significant clients, and the retention of these clients involves additional risks, such as the avoidance of actual or perceived conflicts of interest and the maintenance of high levels of service quality and intra-company confidentiality. Our relationships with other businesses, including competitors, necessarily involve the sharing of confidential information, and we cannot be certain, notwithstanding the existence of confidentiality obligations on the part of those other businesses, that our information will not be used to the competitive advantage of others. The ability of a competitor to offer comparable or improved products or services at a lower price would likely negatively affect our ability to maintain or increase our profitability. Many of our core services are subject to contracts that have relatively short terms or may be terminated by our

State Street Corporation | 24

client after a short notice period. In addition, pricing pressures as a result of the activities of competitors, client pricing reviews, and rebids, as well as the introduction of new products, may result in a reduction in the prices we can charge for our products and services.

We are subject to variability in our assets under custody and/or administration and assets under management, and in our financial results, due to the significant size of our relationship with many of our institutional clients, and are also subject to significant pricing pressure due to trends in the market for custodial services and the considerable market influence exerted by those clients.

Our clients include institutional investors, such as mutual funds, collective investment funds, UCITS, hedge funds and other investment pools, corporate and public retirement plans, insurance companies, official institutions, foundations, endowments and investment managers. In both our asset servicing and asset management businesses, we endeavor to attract institutional investors controlling large and diverse pools of assets, as those clients typically have the opportunity to benefit from the full range of our expertise and service offerings. Due to the large pools of assets controlled by these clients, the loss or gain of one client, or even a portion of the assets controlled by one client, or a client’s decision to in-source certain services that we provide, could have a significant effect on our AUC/A or our AUM, as applicable, in the relevant period. Loss of all or a portion of the servicing of a client's assets can occur for a variety of reasons. For example, as previously disclosed in early 2021, due to a decision to diversify providers, one of our large asset servicing clients is moving a significant portion of its ETF assets currently with State Street to one or more other providers. The transition began in 2022. Prior to the commencement of the transition of assets, we estimated that the financial impact of this transition represented approximately 1.9% of our 2021 total fee revenue. Our AUM or AUC/A are also affected by decisions by institutional owners to favor or disfavor certain investment instruments or categories. Similarly, if one or more clients change the asset class in which a significant portion of assets are invested (e.g., by shifting investments from emerging markets to the U.S.), those changes could have a significant effect on our results of operations in the relevant period, as our fee rates often change based on the type of asset classes we are servicing or managing. As our fee revenue is significantly impacted by our levels of AUC/A and AUM, changes in levels of different asset classes could have a corresponding significant effect on our results of operations in the relevant period. Large institutional clients also, by their nature, are often able to exert considerable market influence, and this, combined with strong competitive forces in the markets for our

services, has resulted in, and may continue to result in, significant pressure to reduce the fees we charge for our services in both our asset servicing and asset management lines of business. Our strategy of focusing our efforts on the segments of the market for investor services represented by very large asset managers and asset owners causes us to be particularly impacted by this industry trend. Many of these large clients are also under competitive and regulatory pressures that are driving them to manage the expenses that they and their investment products incur more aggressively, which in turn exacerbates their pressures on our fees. As a result, the servicing fees we generate from any particular client, or any specific client mandate over time, may be less than the servicing fees we expect as a result of that client or mandate at the time we win that business.

Development and completion of new products and services, including State Street Alpha and those related to digital assets and artificial intelligence, may impose costs on us, involve dependencies on third parties and may expose us to increased operational, model and other risks.

Our financial performance depends, in part, on our ability to develop and market new and innovative services and to adopt or develop new technologies that differentiate our products or provide cost efficiencies, while avoiding increased related expenses. This dependency is exacerbated in the current “Fintech” environment, where financial institutions are investing significantly in evaluating new technologies, such as distributed ledger technology (e.g., blockchain and artificial intelligence), and developing potentially industry-changing products, services and standards. The introduction of new products and services can require significant time and resources, including regulatory approvals and the development and implementation of technical data management, control and model validation requirements and effective security and resiliency elements. New products and services, such as State Street Alpha and those related to digital assets and artificial intelligence, often also involve dependencies on third parties to, among other things, access innovative technologies, develop new distribution channels or form collaborative product and service offerings, and can require complex strategic alliances and joint venture relationships. Substantial risks and uncertainties are associated with the introduction of new products and services, strategic alliances and joint ventures, including rapid technological change in the industry, our ability to access and use technical, data and other information from our clients, significant and ongoing investments required to bring new products and services to market in a timely manner at competitive prices, sharing of benefits in those relationships, conflicts with existing business partners and clients, understanding third party rights, delineating ownership rights, protection

State Street Corporation | 25

of intellectual property and other confidential information, the competition for employees with the necessary expertise and experience, and sales and other materials that fully and accurately describe the product or service and its underlying risks and are compliant with applicable regulations. New products or services may fail to operate or perform as expected and may not be suitable for the intended client or may not produce anticipated efficiencies, savings or benefits for either the client or us. Our failure to manage these risks and uncertainties also exposes us to enhanced risk of operational lapses and third party claims, which may result in the recognition of financial statement liabilities. Regulatory and internal control requirements, capital requirements, competitive alternatives, vendor relationships and shifting market preferences may also determine if such initiatives can be brought to market in a manner that is timely and attractive to our clients. Failure to successfully manage all of the above risks in the development and implementation of new products or services, including continued development of State Street Alpha and those related to digital assets and artificial intelligence, could have a material adverse effect on our business and reputation, consolidated results of operations or financial condition.

Acquisitions, strategic alliances, joint ventures and divestitures pose risks for our business.

We acquire complementary businesses and technologies, enter into strategic alliances and joint ventures and divest portions of our business. We undertake transactions of varying sizes to, among other reasons, gain advantages of scale, expand our geographic footprint, access new clients, distribution channels, technologies or services, enhance our operating model, expand or enhance our product offerings, develop closer or more collaborative relationships with our business partners, efficiently deploy capital or leverage cost savings or other business or financial opportunities. We may not achieve the expected benefits of these transactions, which could result in increased costs, lowered revenues, ineffective deployment of capital, regulatory concerns, exit costs or diminished competitive position or reputation.

Transactions of this nature also involve a number of risks and financial, accounting, tax, regulatory, strategic, managerial, operational, cultural and employment challenges, which could adversely affect our consolidated results of operations and financial condition. For example, the businesses that we acquire or our strategic alliances or joint ventures may under-perform relative to the price paid or the resources committed by us; we may not achieve anticipated revenue growth, cost savings or operational improvements or efficiencies; or we may otherwise be adversely affected by acquisition-related

charges. The intellectual property of an acquired business may be an important component of the value that we agree to pay for it. However, such acquisitions are subject to the risks that the acquired business may not own the intellectual property that we believe we are acquiring, that the intellectual property is dependent on licenses from third parties, that the acquired business infringes on the intellectual property rights of others, that the technology does not have the acceptance in the marketplace that we anticipated or that the technology requires significant investment to remain competitive. Similarly, such transactions present risks to our ability to retain the acquired talent, which may be essential to achieve our objectives in the acquisition. The integration of an acquired business' information technology infrastructure into ours has in the past and may in the future also expose us to additional security and resiliency risks. Further, past acquisitions have resulted in the recognition of goodwill and other significant intangible assets in our consolidated statement of condition. For example, we recorded goodwill and intangible assets of approximately $2.46 billion associated with our acquisition of CRD in 2018. These assets are not eligible for inclusion in regulatory capital under applicable requirements. In addition, we may be required to record impairment in our consolidated statement of income in future periods if we determine that the value of these assets has declined.

Through our acquisitions or joint ventures, we may also assume unknown or undisclosed business, operational, tax, regulatory and other liabilities, fail to properly assess known contingent liabilities or assume businesses with internal control deficiencies. While in most of our transactions we seek to mitigate these risks through, among other things, due diligence, indemnification provisions or insurance, these or other risk-mitigating provisions we put in place may not be sufficient to address these liabilities and contingencies and involve credit and execution risks associated with successfully seeking recourse from a third party, such as the seller or an insurance provider. Other major financial services firms have paid significant penalties to resolve government investigations into matters conducted in significant part by acquired entities.

Various regulatory approvals or consents, formal or informal, are generally required prior to closing of these transactions, which may include approvals, non-objections or regulatory exceptions from the Federal Reserve and other domestic and non-U.S. regulatory authorities. These regulatory authorities may impose conditions on the completion of the acquisition or require changes to its terms that materially affect the terms of the transaction or our ability to capture some of the opportunities presented by the transaction, or may not approve, or may take

State Street Corporation | 26

substantial time to review, the transaction. Any such conditions, or any associated regulatory delays, could limit the benefits of the transaction. U.S. anti-trust and banking agencies continue to express concerns about the growth of large banking institutions, and competition authorities in many jurisdictions have increased the scrutiny and standards they apply in their review of transactions. Acquisitions or joint ventures we announce may not be completed if we do not receive the required regulatory approvals, if regulatory approvals are significantly delayed or if other closing conditions are not satisfied.

As an example, after consideration of both regulatory feedback and potential transaction modifications to address that feedback, we determined in November 2022 to no longer pursue our acquisition of the Brown Brothers Harriman's Investor Services business announced in September 2021. Any failure to complete a transaction, including that of Brown Brothers Harriman’s Investor Services business acquisition, presents reputational, counterparty and competitive risks that could affect our business, results of operations and financial condition, potentially materially, and may also challenge our ability to enter into future transactions on terms acceptable to us.

The integration and the retention and development of the benefits of our acquisitions result in risks to our business and other uncertainties.

In recent years, we have undertaken acquisitions, including our 2021 acquisition of Mercatus and our 2018 acquisition of CRD. The integration of acquisitions presents risks that differ from the risks associated with our ongoing operations. Integration activities are complicated and time consuming and can involve significant unforeseen costs. We may not be able to effectively assimilate services, technologies, key personnel or businesses of acquired companies into our business or service offerings as anticipated, and we may not achieve related revenue growth or cost savings. We also face the risk of being unable to retain, or cross-sell our products or services to, the clients of acquired companies or joint ventures and the risk of being unable to cross-sell acquired products or services to our existing clients. In particular, some clients, including significant clients, of an acquired business may have the right to transition their business to other providers on short notice for convenience, fiduciary or other reasons and may take the opportunity of the acquisition or market, commercial, relationship, service satisfaction or other developments following the acquisition to terminate, reduce or renegotiate the fees or other terms of our relationship. Any such client losses, reductions or renegotiations likely will reduce the expected benefits of the acquisition, including revenues, cross-selling opportunities and market

share, cause impairment to goodwill and other intangibles or result in reputational harm, which effects could be material, and we may not have recourse against the seller of the business or the client. The risk of client loss is even greater where the client is a competitor of ours or has key strategic commercial relationships with our competitors. Acquisitions of Investment Servicing businesses entail information technology systems conversions, which involve operational risks, as well as fiduciary and other risks associated with client retention. Acquisitions of Asset Management businesses similarly involve fiduciary and similar risks associated with client retention, distribution channels and additional servicing opportunities, as well as potential cultural conflicts. Acquisitions of technology firms can involve extensive information technology integration, with associated risk of defects, security breaches and resiliency lapses and product enhancement and development activities, the costs of which can be difficult to estimate, as well as heightened cultural and compliance concerns in integrating an unregulated firm into a bank regulatory environment. Joint ventures involve all of these risks, as well as risks associated with shared control and decision-making (even in majority-owned situations), minority rights and exit rights, which can delay, challenge or foreclose execution on material opportunities or initiatives, create regulatory risks and limit divestment opportunities.

With any acquisition, the integration of the operations and resources of the businesses could result in the loss of key employees, the disruption of our and the acquired company's ongoing businesses or inconsistencies in standards, controls, procedures or policies that could adversely affect our ability to maintain relationships with clients, business partners or employees, maintain regulatory compliance or achieve the anticipated benefits of the acquisition. Integration efforts may also divert management attention and resources.

Competition for qualified members of our workforce is intense, and we may not be able to attract and retain the personnel we need to support our business.

Our success depends, in large part, on our ability to attract and retain qualified personnel. Competition for labor in most activities in which we engage can be intense, including for both individuals identified as key talent and for other personnel. We may not be able to hire people or retain them, particularly in light of challenges associated with compensation restrictions applicable, or which may become applicable, to banks and some asset managers and that are not applicable to other financial services firms in all jurisdictions or to technology or other firms with which we compete for personnel, generally. This can be particularly constraining when competing for skill sets which are

State Street Corporation | 27

in high demand, such as technology and information security. The unexpected loss of services of personnel in business units, control functions, information technology, operations or other areas could have a material adverse impact on our business and operations because of the loss of skills, knowledge of our markets, operations and clients, years of industry experience and, in some cases, the difficulty of promptly finding qualified replacement personnel. These adverse impacts may be exacerbated by increased costs and expenses driven by the competitive labor market in several jurisdictions in which we operate, particularly with regard to the ability to meet compensation and hybrid working expectations. In addition, the loss of personnel, either individually or as a group, could adversely affect our clients' perception of our ability to continue to manage certain types of investment management or servicing mandates to provide other services to them or to maintain a culture of innovation and proficiency.

Financial Market Risks

Political, geopolitical and economic conditions and developments could adversely affect us, particularly if we face increased uncertainty and unpredictability in managing our businesses.

Global financial markets can suffer from substantial volatility, illiquidity, or disruption, particularly as a result of political or geopolitical events, high inflation, slowing economic growth, concerns related to the U.S. federal debt ceiling and monetary policy uncertainty across key central banks. If such volatility, illiquidity or disruption were to result in an adverse economic environment in the United States or in international markets or result in a lack of confidence in the financial stability of major developed or emerging markets, such developments could have an adverse effect on our business, as well as the businesses of our clients and our significant counterparties, and could also increase the difficulty and unpredictability of aligning our business strategies, our infrastructure and our operating costs in light of uncertain market and economic conditions.

Market disruptions can adversely affect our consolidated results of operations if the value of our AUC/A or AUM decline, while the costs of providing the related services remain constant or increase. They may also result in investor preference trends towards asset classes and markets deemed more secure, such as cash or non-emerging markets, with respect to which our fee rates are often lower. These factors could reduce the profitability of our asset-based fee revenue and could also adversely affect our transaction-based revenue, such as revenues from securities finance and foreign exchange activities, and the volume of transactions that we execute for or with our clients. Further, the degree of volatility in foreign exchange rates can affect our foreign exchange trading revenue. In general,

increased currency volatility tends to increase our market risk but also increases our opportunity to generate foreign exchange revenue. Conversely, periods of lower currency volatility tend to decrease our market risk but also decrease our foreign exchange revenue.

In addition, as our business grows globally and a significant percentage of our revenue is earned (and of our expenses paid) in currencies other than U.S. dollars, our exposure to foreign currency volatility could affect our levels of consolidated revenue, our consolidated expenses and our consolidated results of operations, as well as the value of our investment in our non-U.S. operations and our non-U.S. investment portfolio holdings. The extent to which changes in the strength of the U.S. dollar relative to other currencies affect our consolidated results of operations, including the degree of any offset between increases or decreases to both revenue and expenses, will depend upon the nature and scope of our operations and activities in the relevant jurisdictions during the relevant periods, which may vary from period to period.

As our product offerings expand, in part as we seek to take advantage of perceived opportunities arising under various regulatory reforms and resulting market changes, the degree of our exposure to various market and credit risks will evolve, potentially resulting in greater revenue volatility.

We have significant global operations, and clients that can be adversely impacted by disruptions in key global economies, including local, regional and geopolitical developments affecting those economies.

Economic conditions across the world face continued uncertainty due to, among other things, elevated geopolitical risks in multiple regions, including Ukraine, Israel and the Middle East, among others, an uncertain monetary policy environment, and slowing growth and heightened volatility in key emerging markets. New or continued economic deterioration may increase concerns about sovereign debt sustainability, interdependencies among financial institutions and sovereigns, and political and other risks. Continued uncertainty in the external environment has led to increased concern around the near- to medium-term outlook for economic progress in the regions in which we operate, including Europe, the Middle East and Asia.

Given the scope of our global operations, economic or market uncertainty, volatility, illiquidity or disruption resulting from these and related factors could have a material adverse impact on our consolidated results of operations or financial condition, with a greater relative impact as compared to our peers.

State Street Corporation | 28

Our investment securities portfolio, consolidated financial condition and consolidated results of operations could be adversely affected by changes in the financial markets, governmental action or monetary policy. For example, among other risks, increases in prevailing interest rates or other market conditions have led, and were they to occur in the future could further lead, to reduced levels of client deposits and resulting decreases in our NII or to portfolio management decisions resulting in reductions in our capital or liquidity ratios.

Our investment securities portfolio represented approximately 34% of our total assets as of December 31, 2023. The gross interest income associated with our investment portfolio represented approximately 16% of our total gross revenue for the year ended December 31, 2023 and has represented as much as 31% of our total gross revenue in the fiscal years since 2007. As such, our consolidated financial condition and results of operations are materially exposed to the risks associated with our investment portfolio, including changes in interest rates, credit spreads, credit performance (including risk of default), credit ratings, our access to liquidity, foreign exchange markets and mark- to-market valuations, and our ability to profitably manage changes in repayment rates of principal with respect to our portfolio securities. While recent increases in interest rates are beneficial to NII, uncertain economic and monetary policy environments continue to drive risks for ongoing volatility. Managing reinvestment for both higher and lower rate outcomes will continue to be a challenge. The extent to which the Federal Reserve engages in quantitative tightening activities, the market effects and the associated challenges in managing our investment portfolio, consolidated financial condition and consolidated results of operations, including our capital ratios and share repurchase program, may differ from or be exacerbated by the effects of changes in interest rates and also may be volatile and difficult to predict, presenting even further challenges. In addition, certain regulatory liquidity standards, such as the LCR, require that we maintain minimum levels of HQLA in our investment portfolio, which generally generate lower rates of return than other investment assets. This has resulted in increased levels of HQLA as a percentage of our investment portfolio and an associated negative impact on our NII and our NIM. As a result, we may not be able to attain our prior historical levels of NII and NIM. For additional information regarding these liquidity requirements, refer to the “Liquidity Coverage Ratio and Net Stable Funding Ratio” section of “Supervision and Regulation” in Business in this Form 10-K. We may enter into derivative transactions to hedge or manage our exposure to interest rate risk, as well as other risks, such as foreign exchange risk and credit risk. Derivative instruments that we hold for these or other purposes may not achieve their intended results and

could result in unexpected losses or stresses on our liquidity or capital resources.

Our investment securities portfolio represents a greater proportion of our consolidated statement of condition and our loan portfolio represents a smaller proportion (approximately 12% of our total assets as of December 31, 2023), in comparison to many other major financial institutions. In some respects, the accounting and regulatory treatment of our investment securities portfolio may be less favorable to us than a more traditional held-for-investment lending portfolio. For example, under the Basel III rule, after-tax changes in the fair value of AFS investment securities are recognized in AOCI and included in Tier 1 capital. Since loans held for investment are not subject to a fair value accounting framework, changes in the fair value of loans (other than expected credit losses) are not similarly included in the determination of Tier 1 capital under the Basel III rule. Due to this differing treatment, we may experience increased variability in our Tier 1 capital relative to other major financial institutions for which loan-and-lease portfolios represent a larger proportion of their consolidated total assets than ours. Additionally, accounting rules may constrain our ability to sell HTM securities, for example to generate liquidity in times of stress or if we are unable to monetize through repurchase agreements or use of the Federal Reserve’s discount window or other federal facilities at which we can pledge securities classified as HTM. Any decision to sell investment securities classified as HTM would likely require us to recognize all HTM securities at fair value, with any difference between amortized cost and fair value recognized in either AOCI (if transferred to AFS classification) or through earnings. Securities classified as AFS that have experienced a reduction in fair value below their amortized cost, reflect our determination, as of the relevant period end, that we did not have the intent to sell, nor was it more likely than not that we will be required to sell, any of those securities. If that determination changes in the future, we could be required to recognize a loss in earnings for the entire difference between fair value and amortized cost of those securities. Potential regulatory changes could also result in a decrease in our ability to include HQLA classified as HTM in our calculation of LCR, which could materially impact the calculation of that ratio.

Additional risks associated with our investment portfolio include:

•Asset class concentration. Our investment portfolio continues to have significant concentrations in several classes of securities, including agency residential MBS, commercial MBS and other ABS, and securities with concentrated exposure to consumers. These classes and types of

State Street Corporation | 29

securities experienced significant liquidity, valuation and credit quality deterioration during the financial crisis that began in mid-2007. We also hold non-U.S. government securities, non-U.S. MBS and ABS with exposures to European countries, whose sovereign-debt markets have experienced increased stress at times since 2011 and may continue to experience stress in the future. For further information, refer to the risk factor titled “We have significant global operations and clients that can be adversely impacted by disruptions in key global economies, including local, regional and geopolitical developments affecting those economies”. Further, we hold a portfolio of U.S. state and municipal bonds, the value of which may be affected by the budget deficits that a number of states and municipalities currently face, resulting in risks associated with this portfolio.

•Effects of market conditions. If market conditions deteriorate, our investment portfolio could experience a decline in market value, whether due to a decline in liquidity or an increase in the yield required by investors to hold such securities, regardless of our credit view of our portfolio holdings. In addition, in general, deterioration in credit quality, or changes in management's expectations regarding repayment timing or in management's investment intent to hold securities to maturity, in each case with respect to our portfolio holdings, could result in recognition of an allowance for expected credit losses or an impairment. Similarly, if a material portion of our investment portfolio were to experience credit deterioration, our capital ratios as calculated pursuant to the Basel III rule could be adversely affected. This risk is greater with portfolios of investment securities that contain credit risk than with holdings of U.S. Treasury securities. Both AFS and HTM securities in our investment portfolio carry liquidity risk if there is lower demand for either the sale or sale under repurchase agreement of these securities.

•Effects of interest rates. Our investment portfolio is further subject to changes in both U.S. and non-U.S. (primarily in Europe) interest rates, and could be negatively affected by changes in those rates, whether or not expected. This is particularly true in the case of a quicker-than-anticipated increase in interest rates, which would decrease market values in the near-term, or monetary policy that results in persistently low or negative

rates of interest on certain investments. The latter has been the case, for example, with respect to past ECB monetary policy, including negative interest rates in some jurisdictions, with associated negative effects on our investment portfolio reinvestment, NII and NIM. The effect on our NII has been exacerbated by the effects in recent fiscal years of the strong U.S. dollar relative to other currencies, particularly the Euro. If European interest rates remain low or decrease and the U.S. dollar strengthens relative to the Euro, the negative effects on our NII likely will continue or increase. The overall level of NII can also be impacted by the size of our deposit base, as further increases in interest rates could lead to reduced deposit levels and also lower overall NII. Further, a reduction in deposit levels could increase the requirements under the regulatory liquidity standards requiring us to invest a greater proportion of our investment portfolio holdings in HQLA that have lower yields than other investable assets. See also, “Our business activities expose us to interest rate risk” in this section.

Our business activities expose us to interest rate risk.

In our business activities, we assume interest rate risk by investing short-term deposits received from our clients in our investment portfolio of longer- and intermediate-term assets. Our NII and NIM, and ability to attract deposits from our clients, are affected by among other things, the levels of interest rates in global markets, changes in the relationship between short- and long-term interest rates, the direction and speed of interest rate changes and the asset and liability spreads relative to the currency and geographic mix of our interest-earning assets and interest-bearing liabilities. These factors are influenced, among other things, by a variety of economic and market forces and expectations, including monetary policy and other activities of central banks, such as the Federal Reserve and ECB, that we do not control. Our ability to anticipate changes in these factors or to hedge the related on- and off-balance sheet exposures, and the cost of any such hedging activity, can significantly influence the success of our asset-and-liability management activities and the resulting level of our NII and NIM. The impact of changes in interest rates and related factors will depend on the relative duration and fixed- or floating-rate nature of our assets and liabilities. Sustained lower interest rates, a flat or inverted yield curve and narrow credit spreads generally have a constraining effect on our NII. In addition, our ability to reduce deposit rates in response to declines in prevailing interest rates and other market and related

State Street Corporation | 30

factors is limited by client relationship considerations. The impact of interest rates on our investment portfolio and consolidated financial results, including AOCI, can also affect our ability to maintain our capital ratios within our target ranges as well as the amount and timing of our future share repurchases. For example, in the first half of 2022 unrealized losses on AFS securities within AOCI, driven by the significant increase in interest rates across the yield curve, contributed to a decrease in CET1 capital. For additional information about the effects on interest rates on our business, refer to the Market Risk Management section, “Asset-and-Liability Management Activities” in our Management's Discussion and Analysis in this Form 10-K.

We assume significant credit risk to counterparties, many of which are major financial institutions. These financial institutions and other counterparties may also have substantial financial dependencies with other financial institutions and sovereign entities. These credit exposures and concentrations could expose us to financial loss.

The financial markets are characterized by extensive interdependencies among numerous parties, including banks, central banks, broker/dealers, insurance companies and other financial institutions. These financial institutions also include collective investment funds, such as mutual funds, UCITS and hedge funds that share these interdependencies. Many financial institutions, including collective investment funds, also hold, or are exposed to, loans, sovereign debt, fixed-income securities, derivatives, counterparty and other forms of credit risk in amounts that are material to their financial condition. As a result of our own business practices and these interdependencies, we and many of our clients have concentrated counterparty exposure to other financial institutions and collective investment funds, particularly large and complex institutions, sovereign issuers, mutual funds, UCITS and hedge funds. Although we have procedures for monitoring both individual and aggregate counterparty risk, significant individual and aggregate counterparty exposure is inherent in our business, as our focus is on servicing large institutional investors.

In the normal course of our business, we assume concentrated credit risk at the individual obligor, counterparty or group level. Such concentrations may be material. Our material counterparty exposures change daily, and the counterparties or groups of related counterparties to which our risk exposure is concentrated are also variable during any reported period; our largest exposures tend to be to other financial institutions.

Concentration of counterparty exposure presents significant risks to us and to our clients

because the failure or perceived weakness of our counterparties (or in some cases of our clients' counterparties) has the potential to expose us to risk of financial loss. Changes in market perception of the financial strength of particular financial institutions or sovereign issuers can occur rapidly, are often based on a variety of factors and are difficult to predict.

This was observed during the financial crisis that began in 2007-2008, when economic, market, political and other factors contributed to the perception of many financial institutions and sovereign issuers as being less credit worthy. This led to credit downgrades of numerous large U.S. and non-U.S. financial institutions and several sovereign issuers (which exposure stressed the perceived creditworthiness of financial institutions, many of which invest in, accept collateral in the form of, or value other transactions based on the debt or other securities issued by sovereigns) and substantially reduced value and liquidity in the market for their credit instruments. These or other factors could again contribute to similar consequences or other market risks associated with reduced levels of liquidity. Though more contained than the 2007-2008 financial crisis, Silicon Valley Bank and Signature Bank failed in early 2023. As a result, we may be exposed to increased counterparty risks, either resulting from our role as principal or because of commitments we make in our capacity as agent for some of our clients.

Additional areas where we experience exposure to credit risk include:

•Short-term credit: The degree of client demand for short-term credit tends to increase during periods of market turbulence, which may expose us to further counterparty-related risks. For example, investors in collective investment vehicles for which we act as a custodian may experience significant redemption activity due to adverse market or economic news. Our relationship with our clients and the nature of the settlement process for some types of payments may result in the extension of short-term credit in such circumstances. We also provide committed lines of credit to support such activity. For some types of clients, we provide credit to allow them to leverage their portfolios, which may expose us to potential loss if the client experiences investment losses or other credit difficulties.

•Industry and country risks: In addition to our exposure to financial institutions, we are from time to time exposed to concentrated credit risk at an industry or country level. This concentration risk also applies to groups of unrelated counterparties that may have similar investment strategies involving one or more particular industries, regions, or other

State Street Corporation | 31

characteristics. These unrelated counterparties may concurrently experience adverse effects to their performance, liquidity or reputation due to events or other factors affecting such investment strategies. Though potentially not material individually (relative to any one such counterparty), our credit exposures to such a group of counterparties could expose us to a single market or political event or a correlated set of events that, in the aggregate, could have a material adverse impact on our business.

•Subcustodian risks: With the exception of the United States, Canada, Germany and the United Kingdom, we maintain subcustodian relationships in all jurisdictions in which our clients invest, including emerging and other underdeveloped markets, and markets subject to sanctions. Our use of unaffiliated subcustodians exposes us to operational, reputational and regulatory risk, as we are dependent upon the subcustodians in performing several of our services to clients in those markets. Operational risk includes risks of the legal and regulatory systems and market practices of the jurisdictions in which the subcustodians operate. Our operating model exposes us to risk of unaffiliated subcustodians to a degree greater than some of our competitors who have banking operations in more jurisdictions than we do. The risks of maintaining custody services in such markets are amplified due to evolving regulatory and sanctions requirements with respect to our financial exposures in the event those subcustodians, or we, are unable to return, transfer or reinvest clients’ assets. In some regulatory regimes, such as the E.U.'s UCITS V directive, we are subject to requirements that we be responsible for resulting losses suffered by our clients, and we may agree to similar or more stringent standards with clients that are not subject to such regulations. In addition, to the extent we maintain currencies on our consolidated balance sheet (where the client deposit liability is with State Street and State Street, as principal, maintains cash on deposit with a subcustodian or clearing agency) or are subject to regulatory requirements to return assets placed in custody, we are also subject to the risk of credit exposure to such subcustodians and clearing agencies. Depending upon the currency and jurisdiction of the client, a significant portion of our deposit exposure in non-U.S. currencies is recognized on our consolidated balance sheet. In some jurisdictions, such as Russia,

sanctions programs or government intervention inhibit our clients' and our ability to access or transfer cash or securities held for clients through subcustodians and clearing agencies. If such client deposit liabilities are on our consolidated balance sheet, we maintain a corresponding amount of cash on deposit with the subcustodian or clearing agency, which increases our credit exposure to that entity and can accumulate over time based upon distributions on, or other activities related to, our clients' assets. If the subcustodian or clearing agency were to become insolvent in circumstances not involving expropriation of assets or other circumstances that excuse performance under force majeure or other provisions, the risk of loss on such cash on deposit would be ours rather than the clients. As of December 31, 2023, we held cash on deposit with our subcustodian and clearing agencies in Russia, which amount is expected to increase substantially over time as long as the sanctions and other restrictions remain in effect, and which currently is subject to restrictions on our ability to access such deposits. Our subcustodians are also directly affiliated with or are subsidiaries of large, global financial institutions with whom we have other credit exposures. This credit exposure to these financial institutions or subcustodians can limit the financial relationship we may have with these counterparties and has in the past made, and may in the future make, compliance with specific U.S. regulatory single counterparty credit limits (SCCL) more challenging. For additional information, see Note 1 to the consolidated financial statements in this Form 10-K.

•Settlement risks: We are exposed to settlement risks, particularly in our payments and foreign exchange activities. Those activities may lead to extension of credit and consequent losses in the event of a counterparty breach or an operational error, including the failure to provide credit. Due to our membership in several industry clearing or settlement exchanges, we may be required to guarantee obligations and liabilities, or provide financial support, in the event that other members do not honor their obligations or default. Moreover, not all of our counterparty exposure is secured, and even when our exposure is secured, the realizable value of the collateral may have declined by the time we exercise our rights against that collateral. This risk may be particularly acute

State Street Corporation | 32

if we are required to sell the collateral into an illiquid or temporarily-impaired market or with respect to clients protected by sovereign immunity. We are exposed to risk of short-term credit or overdraft of our clients in connection with the process to facilitate settlement of trades and related foreign exchange activities, particularly when contractual settlement has been agreed with our clients. The occurrence of overdrafts at peak volatility could create significant credit exposure to our clients depending upon the value of such clients' collateral at the time. Our settlement-related activities and obligations are also subject to regulatory risk, including the risk of regulators globally accelerating the timeline to settlement, such as the SEC’s recent rule to shorten the standard settlement cycle for securities transactions in the United States from trade date plus two business days (T+2) to trade date plus one business day (T+1) in May 2024. This rule presents the risk of non-compliance, as well as careful coordination with and dependencies on other industry participants and additional risks associated with technology development and implementation, change management and operational errors, any of which could be material in light of the magnitude and volume of our settlement-related activities and obligations. Although we have budgeted for anticipated expenses associated with implementing the rule, due to the nature of these and other risks and considerations, there can be no assurance actual costs will not exceed our expectations.

•Securities lending and repurchase agreement indemnification: On behalf of clients enrolled in our securities lending program, we lend securities to banks, broker/dealers and other institutions. In the event of a failure of the borrower to return such securities, we typically agree to indemnify our clients for the amount by which the fair market value of those securities exceeds the proceeds of the disposition of the collateral posted by the borrower in connection with such transaction. We also lend and borrow securities as principal, and in connection with those transactions receive a security interest in securities held by the borrowers in their securities portfolios and advance cash or securities as collateral to securities lenders. Borrowers are generally required to provide collateral equal to a contractually agreed percentage equal to or in excess of the fair market value of the loaned securities. As the

fair market value of the loaned securities or collateral changes, additional collateral is provided by the borrower or a portion of collateral is returned to the borrower. In addition, our agency securities lending clients often purchase securities or other financial instruments from financial counterparties, including broker/dealers, under repurchase arrangements, frequently as a method of reinvesting the cash collateral they receive from lending their securities. Under these arrangements, the counterparty is obligated to repurchase these securities or financial instruments from the client at the same price (plus an agreed rate of return) at some point in the future. The value of the collateral is intended to exceed the counterparty's payment obligation, and collateral is adjusted daily to account for shortfall under, or excess over, the agreed-upon collateralization level. As with the securities lending program, we agree to indemnify our clients from any loss that would arise on a default by the counterparty under these repurchase arrangements if the proceeds from the disposition of the securities or other financial assets held as collateral are less than the amount of the repayment obligation by the client's counterparty. In such instances of counterparty default, for both securities lending and repurchase agreements, we, rather than our client, are exposed to the risks associated with collateral value.

•Repurchase and resale transactions: We enter into repurchase and resale transactions in eligible securities with sponsored clients and with other FICC members and, pursuant to FICC Government Securities Division rules, submit, novate and net the transactions when specific netting criteria are met. We may sponsor clients to clear their eligible repurchase or resale transactions with FICC, backed by our guarantee to FICC of the prompt and full payment and performance of our sponsored member clients’ respective obligations. Although we obtain a security interest from our sponsored clients in the collateral that they receive, we are exposed to the associated risks, including insufficiency of the value of collateral.

•Stable value arrangements: We enter into stable value wrap derivative contracts with unaffiliated stable value funds that allow a stable value fund to provide book value coverage to its participants. During the 2008 financial crisis, the book value of obligations under many of these contracts exceeded the market value of the underlying portfolio

State Street Corporation | 33

holdings. Concerns regarding the portfolio of investments protected by such contracts, or regarding the investment manager overseeing such an investment option, may result in redemption demands from stable value products covered by benefit-responsive contracts at a time when the portfolio's market value is less than its book value, potentially exposing us to risk of loss.

•Private equity subscription finance credit facilities: We provide credit facilities to private equity funds. The portfolio consists of capital call lines of credit, the repayment of which is dependent on the receipt of capital calls from the underlying limited partner investors in the funds managed by these firms.

•U.S. municipal obligations remarketing credit facilities: We provide credit facilities in connection with the remarketing of U.S. municipal obligations, potentially exposing us to credit exposure to the municipalities issuing such bonds and contingent liquidity risk.

•Leveraged loans: We invest in leveraged loans, both in the United States and in Europe. We invest in these loans to non-investment grade borrowers through participation in loan syndications in the non-investment grade lending market. We rate these loans as “speculative” under our internal risk-rating framework, and these loans have significant exposure to credit losses relative to higher-rated loans. We are therefore at a higher risk of default with respect to these investments relative to other of our investments activities. In addition, unlike other financial institutions that may have an active role in managing individual loan compliance, our investment in these loans is generally as a passive investor with limited control. Over time, our allowance for credit losses related to these loans has increased, and may in the future further increase, through additional provisions for credit losses.

•Commercial real estate: We finance commercial and multi-family properties, which serve as collateral for our loans. Although collateralized, these loans may become under-secured if the value of the collateral was over-estimated or declines. Loan payments are dependent on the successful operation and management of the underlying collateral property to generate sufficient cash flow to repay the loan in a timely fashion. A material decline in real estate markets or economic conditions could negatively impact value or property performance, which could

adversely impact timely loan repayment, which may result in increased provision for credit losses on loans, and actual losses, either of which would have an adverse impact on our net income. We observed these effects in some commercial real estate markets during 2023, resulting in a commercial real estate-related provision for credit losses on loans of $41 million for that period. Were conditions, or our evaluation of conditions, in those or other markets to worsen in 2024 or subsequent years, we could experience similar or more significant effects during those periods.

•Unavailability of netting: We are generally not able to net exposures across counterparties that are affiliated entities and may not be able in all circumstances to net exposures to the same legal entity across multiple products. As a consequence, we may incur a loss in relation to one entity or product even though our exposure to an entity's affiliates or across product types is over-collateralized. In some cases, for example in our securities finance and foreign exchange activities, we are able to enter into netting agreements that allow us to net offsetting exposures and payment obligations against one another. In the event we become unable, due to operational constraints, actions by regulators, changes in accounting principles, law or regulation (or related interpretations) or other factors, to net some or all of our offsetting exposures and payment obligations under those agreements, we would be required to gross up our assets and liabilities on our statement of condition and our calculation of RWA, accordingly. This would result in a potentially adverse impact on our regulatory ratios, including LCR, and present increased credit, liquidity, asset-and-liability management and operational risks, some of which could be material.

Under currently prevailing regulatory restrictions on credit exposure, we are required to limit our exposures to specific issuers or counterparties or groups of counterparties, including financial institutions and sovereign issuers. These credit exposure restrictions have and may further adversely affect certain of our businesses, may require that we expand our credit exposure to a broader range of issuers and counterparties, including issuers and counterparties that represent increased credit risk, may reduce or foreclose our ability to enter into advantageous transactions or ventures with particular counterparties and may require that we modify our operating models or the policies and practices we use to manage our consolidated statement of condition. The effects of these considerations may increase

State Street Corporation | 34

when evaluated under a stressed environment in stress testing, including CCAR. In addition, we are an adherent to the International Swaps and Derivatives Association 2015 Universal Resolution Stay Protocol and as such are subject to restrictions against the exercise of rights and remedies against fellow adherents, including other major financial institutions, in the event they or an affiliate of theirs enters into resolution. Although our overall business is subject to these factors, several of our activities are particularly sensitive to them including our currency trading business and our securities finance business. For a discussion of regulatory requirements applicable to our counterparty exposures, see - “Enhanced Prudential Standards” under “Supervision and Regulation” in Business in this Form 10-K.

Given the limited number of strong counterparties in the current market, we are not able to mitigate all of our and our clients' counterparty credit risk.

Fee revenue represents a significant majority of our consolidated revenue and is subject to decline, among other things, in the event of a reduction in, or changes to, the level or type of investment activity by our clients.

We rely primarily on fee-based services to derive our revenue. This contrasts with commercial banks that may rely more heavily on interest-based sources of revenue, such as loans. During 2023, total fee revenue represented approximately 79% of our total revenue. Fee revenue generated by our Investment Servicing and Investment Management businesses is augmented by foreign exchange trading services, securities finance, software and processing fees and other fee revenue. The level of these fees is influenced by several factors, including the mix and volume of our AUC/A and our AUM, the value and type of securities positions held (with respect to AUC/A) and the volume of our clients' portfolio transactions, and the types of products and services used by our clients. Our fee revenue would be negatively affected, potentially materially, by a decline in the market value of client portfolios resulting from a broad market correction, especially in equity markets.

In addition, our clients include institutional investors, such as mutual funds, collective investment funds, UCITS, hedge funds and other investment pools, corporate and public retirement plans, insurance companies, foundations, endowments and investment managers. Economic, market or other factors that reduce the level or rates of savings in or with those institutions, either through reductions in financial asset valuations or through changes in investor preferences, could materially reduce our fee revenue and have a material adverse effect on our consolidated results of operations.

If we are unable to effectively manage our capital and liquidity, including by continuously attracting deposits and other short-term funding, our consolidated financial condition, including our regulatory capital ratios, our consolidated results of operations and our business prospects, could be adversely affected.

Liquidity management, including on an intra-day basis, is critical to the management of our consolidated statement of condition and to our ability to service our client base. We generally use our liquidity to:

•meet clients' demands for return of their deposits;

•extend credit to our clients in connection with our investor services businesses; and

•fund the pool of long- and intermediate-term assets that are included in the investment securities and loan portfolio carried in our consolidated statement of condition.

Because the demand for credit by our clients, particularly settlement related extensions of credit, is difficult to predict and control, and may be at its peak at times of disruption in the securities markets, and because the average maturity of our investment securities and loan portfolios is longer than the contractual maturity of our client deposit base, we need to continuously attract, and are dependent on access to, various sources of short-term funding. Since the 2008 financial crisis, the level of client deposits held by us has tended to increase during times of market disruption; however, since such deposits are considered to be transitory, we have historically deposited so-called excess deposits with U.S. and non-U.S. central banks and in other highly liquid instruments. These levels of excess client deposits, when they manifest, have increased our NII but have adversely affected our NIM. There can be no assurance that client behavior in a market disruption will be similar in the future or that our level of deposit funding will not decrease.

In managing our liquidity, our primary source of short-term funding is client deposits, which are predominantly transaction-based deposits by institutional investors. Our ability to continue to attract these deposits, and other short-term funding sources such as certificates of deposit, is subject to variability based on a number of factors, including volume and volatility in global financial markets, the volume of client settlement related activities, the interest rates that we are prepared to pay for these deposits, the loss or gain of one or more clients, client interest in reducing non-interest-bearing deposits, the perception of safety of these deposits or short-term obligations relative to alternative short-term investments available to our clients, including the capital markets, and the classification of certain

State Street Corporation | 35

deposits for regulatory purposes and related discussions we may have from time to time with clients regarding better balancing our clients' cash management needs with our economic and regulatory objectives.

The Parent Company is a non-operating holding company and generally maintains only limited cash and other liquid resources at any time primarily to meet anticipated near-term obligations. To effectively manage our liquidity, we routinely transfer assets among affiliated entities, subsidiaries and branches. Internal or external factors, such as regulatory requirements and standards, including resolution planning and restrictions on dividend distributions, influence our liquidity management and may limit our ability to effectively transfer liquidity internally which could, among other things, restrict our ability to fund operations, dividends or stock repurchases or pay interest on debt securities or require us to seek external and potentially more costly capital and impact our liquidity position.

In addition, while not obligations of ours, the investment products that we manage for third parties may be exposed to liquidity risks. These products may be funded on a short-term basis or the clients participating in these products may have a right to the return of cash or assets on limited notice. These business activities include, among others, securities finance collateral pools, money market and other short-term investment funds and liquidity facilities utilized in connection with municipal bond programs. If clients demand a return of their cash or assets, particularly on limited notice, and these investment pools do not have the liquidity to support those demands, we could be forced to sell investment securities held by these asset pools at unfavorable prices, damaging our reputation as a service provider and potentially exposing us to claims related to our management of the pools.

The availability and cost of credit in short-term markets are highly dependent on the markets' perception of our liquidity and creditworthiness. Our efforts to monitor and manage our liquidity risk, including on an intra-day basis, may not be successful or sufficient to deal with dramatic or unanticipated changes in the global securities markets or other event-driven reductions in liquidity. As a result of such events, among other things, our cost of funds may increase, thereby reducing our NII, or we may need to dispose of a portion of our investment securities portfolio, which, depending on market conditions, could result in a loss from such sales of investment securities being recorded in our consolidated statement of income.

Our calculations of credit, market and operational risk exposures, total RWA and capital ratios for regulatory purposes depend on data inputs, formulae, models, correlations and assumptions that are subject to change over time, which changes, in addition to our consolidated financial results, could materially impact our risk exposures, our total RWA and our capital ratios from period to period.

To calculate our credit, market and operational risk exposures, our total RWA and our capital ratios for regulatory purposes, the current Basel III rule involves the use of current and historical data, including our own loss data and similar information from other industry participants, market volatility measures, interest rates and spreads, asset valuations, credit exposures and the creditworthiness of our counterparties. These calculations also involve the use of quantitative formulae, statistical models, historical correlations and significant assumptions. We refer to the data, formulae, models, correlations and assumptions, as well as our related internal processes, as our “advanced systems.” While our advanced systems are generally quantitative in nature, significant components involve the exercise of judgment based on, among other factors, our and the financial services industry's evolving experience. Any of these judgments or other elements of our advanced systems may not, individually or collectively, precisely represent or calculate the scenarios, circumstances, outputs or other results for which they are designed or intended. Collectively, they represent only our estimate of associated risk.

In addition, our advanced systems are subject to update and periodic revalidation in response to changes in our business activities and our historical experiences, forces and events experienced by the market broadly or by individual financial institutions, changes in regulations and regulatory interpretations and other factors, and are also subject to continuing regulatory review and approval. For example, a significant operational loss experienced by another financial institution, even if we do not experience a related loss, could result in a material change in the output of our advanced systems and a corresponding material change in our risk exposures, our total RWA and our capital ratios compared to prior periods. An operational loss that we experience could also result in a material change in our capital requirements for operational risk under the advanced approaches, depending on the severity of the loss event, its characterization among the seven Basel-defined UOM, and the stability of the distributional approach for a particular UOM. This change in our capital requirements could be without direct correlation to the effects of the loss event or the timing of such effects on our results of operations. Due to the influence of changes in our advanced systems, whether resulting

State Street Corporation | 36

from changes in data inputs, regulation or regulatory supervision or interpretation, specific to us or more general market, or individual financial institution-specific, activities or experiences, or other updates or factors, we expect that our advanced systems and our credit, market and operational risk exposures, our total RWA and our capital ratios calculated under the Basel III rule will change, and may be volatile, over time, and that those latter changes or volatility could be material as calculated and measured from period to period.

We may need to raise additional capital or debt in the future, which may not be available to us or may only be available on unfavorable terms.

We may need to raise additional capital or debt in order to maintain our credit ratings, in response to regulatory changes, including capital rules, or for other purposes, including financing acquisitions and joint ventures and optimizing capital management.

However, our ability to access the capital markets, if needed, on a timely basis or at all will depend on a number of factors, such as the state of the financial markets and securities law requirements and standards. In the event of rising interest rates, disruptions in financial markets, negative perceptions of our business or our financial strength, or other factors that would increase our cost of borrowing, we cannot be sure of our ability to raise additional capital or debt, if needed, on terms acceptable to us. Any diminished ability to raise additional capital or debt, if needed, could adversely affect our business and our ability to implement our business plan, capital plan and strategic goals, including the financing of acquisitions and joint ventures, our efforts to maintain regulatory compliance and optimize our capital management activities.

Any downgrades in our credit ratings, or an actual or perceived reduction in our financial strength, could adversely affect our borrowing costs, capital costs and liquidity position and cause reputational harm.

Major independent rating agencies publish credit ratings for our debt obligations based on their evaluation of a number of factors, some of which relate to our performance and other corporate developments, including financings, acquisitions and joint ventures, and some of which relate to general industry conditions. For example, in November 2023, Moody's Investors Service issued a notice advising that its outlooks for State Street Bank's long-term issuer and deposit ratings, and senior unsecured ratings, is negative. We anticipate that the rating agencies will continue to review our ratings regularly based on our consolidated results of operations and developments in our businesses, including regulatory considerations such as resolution planning. One or more of the major independent credit rating agencies

have in the past downgraded, and may in the future downgrade, our credit ratings, or have negatively revised their outlook for our credit ratings. The current market and regulatory environment and our exposure to financial institutions and other counterparties, including sovereign entities, increase the risk that we may not maintain our current ratings, and we cannot provide assurance that we will continue to maintain our current credit ratings. Downgrades in our credit ratings may adversely affect our borrowing costs, our capital costs and our ability to raise capital and, in turn, our liquidity. A failure to maintain an acceptable credit rating may also preclude us from being competitive in various products.

Additionally, our counterparties, as well as our clients, rely on our financial strength and stability and evaluate the risks of doing business with us. If we experience diminished financial strength or stability, actual or perceived, due to the effects of market or regulatory developments, announced or rumored business developments, consolidated results of operations, a decline in our stock price or a downgrade to our credit rating, our counterparties may be less willing to enter into transactions, secured or unsecured, with us, our clients may reduce or place limits on the level of service we provide to them or seek to transfer the business, in whole or in part, to other service providers or our prospective clients may select other service providers. Any, or all of these may have adverse effects on our business and reputation.

The risk that we may be perceived as less creditworthy than other market participants is higher as a result of recent market developments, which include an environment in which the consolidation, and in some instances failure, of financial institutions, including major global financial institutions, has resulted in a smaller number of much larger counterparties and competitors. If our counterparties perceive us to be a less viable counterparty, our ability to enter into financial transactions on terms acceptable to us or our clients, on our or our clients' behalf, will be materially compromised. If our clients reduce their deposits with us or select other service providers for all or a portion of the services we provide to them, our revenues will decrease accordingly.

State Street Corporation | 37

Compliance and Regulatory Risks

Our business and capital-related activities, including our ability to return capital to shareholders and repurchase our capital stock, may be adversely affected by our implementation of regulatory capital and liquidity standards that we must meet or as a result of regulatory capital stress testing.

Basel III and Dodd-Frank Act

We are required to calculate our risk-based capital ratios under both the Basel III advanced approaches and the Basel III standardized approach, and we are subject to the more stringent of the risk-based capital ratios calculated under the advanced approaches and those calculated under the standardized approach in the assessment of our capital adequacy.

In implementing various aspects of these capital regulations, we are making interpretations of the regulatory intent. The Federal Reserve may determine that we are not in compliance with the capital rules and may require us to take actions to come into compliance that could adversely affect our business operations, our regulatory capital structure, our capital ratios or our financial performance, or otherwise restrict our growth plans or strategies. In addition, banking regulators could change the Basel III rule or their interpretations as they apply to us, including changes to these standards or interpretations made in regulations implementing provisions of the Dodd-Frank Act, which could adversely affect us and our ability to comply with the Basel III rule.

For example, on July 27, 2023, the U.S. Agencies issued a proposed rule to implement the Basel III endgame agreement for large banks. The proposed rule would introduce the expanded risk-based approach, reflecting new RWA methodologies that generally align with changes to the global Basel Accord adopted by the BCBS. The proposal would eliminate the current Basel III rule’s advanced approaches and effectively replace it with the expanded risk-based approach, which more heavily relies on standardized methodologies. As compared with the standardized approach, the proposed expanded approach includes more granular risk weights for credit risk and introduces a new market risk framework. In addition, unlike the existing standardized approach, the proposed expanded risk-based approach includes operational risk and credit valuation adjustment RWA components. Based on our current understanding of the Basel III endgame proposed rule, we estimate that, if the expanded risk-based approach had been applied on a fully phased-in basis as of December 31, 2023, and in the absence of taking any actions to mitigate its impact, our expanded risk-based approach RWA as of that

date would have been approximately 15% higher than our actual standardized approach RWA as of that date.

Any estimate of how the expanded risk-based approach may impact us is subject to uncertainty, as actual results may differ from the anticipated results and may be materially affected by and dependent on a range of factors, including business performance, future capital actions, the results of future supervisory stress tests, and interpretations (including changes in interpretations) of, and potential modifications by the U.S. Agencies to, the proposal.

For additional information on these requirements, refer to the “Regulatory Capital Adequacy and Liquidity Standards” section under “Supervision and Regulation” in Business in this Form 10-K.

Along with the Basel III rule, banking regulators also introduced additional requirements, such as the SLR, LCR and NSFR, each of which presents compliance risks.

For example, these regulatory requirements could have a material effect on our business activities, including the management and composition of our investment securities portfolio and our ability to extend credit through committed facilities, loans to our clients or our principal securities lending activities as the structure of our balance sheet changes. In addition, further capital and liquidity requirements are being implemented or are under consideration by U.S. and international banking regulators. Any of these rules, or any additional regulatory initiatives introduced under the current administration, could have a material effect on our capital and liquidity planning and related activities, including the management and composition of our investment securities portfolio and our ability to extend committed contingent credit facilities to our clients. The full effects of these rules, and of other regulatory initiatives related to capital or liquidity, on us and State Street Bank are subject to further regulatory guidance, action or rule-making.

Systemic Importance

As a G-SIB, we are generally subject to the most stringent provisions under the Basel III rule. For example, we are subject to the Federal Reserve's rules on the implementation of capital surcharges for U.S. G-SIBs, and on TLAC, LTD and clean holding company requirements for U.S. G-SIBs which we refer to as the “TLAC rule”. For additional information on these requirements, including proposed amendments thereof, refer to the “Regulatory Capital Adequacy and Liquidity Standards” section under “Supervision and Regulation” in Business in this Form 10-K.

Not all of our competitors have similarly been designated as systemically important nor are all of them subject to the same degree of regulation as a bank or financial holding company, and therefore

State Street Corporation | 38

some of our competitors are not subject to the same additional capital requirements.

Supervisory Stress Testing and Capital Planning

We are required by the Federal Reserve to conduct periodic stress testing of our business operations and to develop an annual capital plan and are subject to supervisory stress testing, all as part of the Federal Reserve's stress testing and capital planning processes. The stress testing and capital planning processes, the severity and other characteristics of which may evolve from year-to-year, are used by the Federal Reserve to evaluate our management of capital and the adequacy of our regulatory capital and to determine the SCB that we must maintain above our minimum regulatory capital requirements in order for us to make capital distributions and discretionary bonuses without limitation. The results of the supervisory stress testing process are difficult to predict due, among other things, to the Federal Reserve's use of proprietary stress models that differ from our internal models. The results of the Federal Reserve’s supervisory stress tests may result in an increase in our SCB requirement. The amounts of the planned capital actions in our capital plan in any year, including stock repurchases and dividends, may be substantially reduced from the amounts included in prior capital plans. These reductions may reflect changes in one or more different factors, including our business prospects and related capital needs, our capital position, proposed acquisitions or other uses of capital, the models used in our capital planning process, the supervisory models used by the Federal Reserve to stress our balance sheet, the Federal Reserve’s hypothetical economic scenarios for the supervisory stress testing process, the Federal Reserve’s stress testing instructions and the Federal Reserve’s supervisory expectations for the capital planning process. Any of these potential events could require us, as applicable, to revise our stress-testing or capital-management approaches, resubmit our capital plan or postpone, cancel or alter our planned capital actions. In addition, changes in our business strategy, merger or acquisition activity or uses of capital could result in a change in our capital plan and its associated capital actions, and may require us to resubmit our capital plan to the Federal Reserve, which could prompt the Federal Reserve to recalculate our SCB requirement. We are also subject to asset quality reviews and stress testing by the ECB and in the future we may be subject to similar reviews and testing by other regulators.

Our implementation of capital and liquidity requirements may not be approved or may be objected to by the Federal Reserve, and the Federal Reserve may impose capital requirements in excess of our expectations or require us to maintain levels of liquidity that are higher than we may expect and

which may adversely affect our consolidated revenues. In the event that our implementation of capital and liquidity requirements under regulatory initiatives or our current capital structure are determined not to conform with current and future capital requirements, our ability to deploy capital in the operation of our business or our ability to distribute capital to shareholders or to repurchase our capital stock may be constrained, and our business may be adversely affected. In addition, we may choose to forgo business opportunities, due to their impact on our capital plan or stress tests, including our SCB requirement. Likewise, in the event that regulators in other jurisdictions in which we have banking subsidiaries determine that our capital or liquidity levels do not conform with current and future regulatory requirements, our ability to deploy capital, our levels of liquidity or our business operations in those jurisdictions may be adversely affected.

For additional information about the above matters, refer to “Regulatory Capital Adequacy and Liquidity Standards” section under “Supervision and Regulation” in Business and “Capital” section under “Financial Condition” in our Management's Discussion and Analysis in this Form 10-K.

We face extensive and changing government regulation and supervision globally in jurisdictions in which we operate, which may increase our costs and expose us to risks related to compliance.

Most of our businesses are subject to extensive regulation and supervision by multiple regulatory and supervisory bodies, and many of the clients to which we provide services are themselves subject to a broad range of regulatory requirements. These regulations may affect the scope of, and the manner and terms of delivery of, our services. For example, potential changes in the regulation of money market funds have the potential to alter the marketplace for and increase the complexity and costs of providing services to, those funds. As a financial institution with substantial international operations, we are subject to extensive regulation and supervisory oversight, both inside and outside of the United States. This regulation and supervisory oversight affects, among other things, the scope of our activities and client services, our capital and organizational structure, our ability to fund the operations of our subsidiaries, our lending practices, our dividend policy, our common share repurchase actions, the manner in which we market our services, our acquisition activities and our interactions with foreign regulatory agencies and officials.

In particular, we are registered with the Federal Reserve as a bank holding company pursuant to the Bank Holding Company Act of 1956. The Bank Holding Company Act generally limits the activities in

State Street Corporation | 39

which we and our non-banking subsidiaries may engage to managing or controlling banks and to activities considered to be closely related to banking. As a bank holding company that has elected to be treated as a financial holding company under the Bank Holding Company Act, we and some of our non-banking subsidiaries may also engage in a broader range of activities considered to be “financial in nature.” Financial holding company status may be denied if we and our banking subsidiaries do not remain well capitalized and well managed or fail to comply with Community Reinvestment Act obligations.

We are unable to predict what, if any, changes to the regulatory environment may be enacted by Congress, or the current and next presidential administration and what the impact of any such changes will be on our results of operations or financial condition, including increased expenses or changes in the demand for our services or our ability to engage in transactions to expand our business, or on the U.S.-domestic or global economies or financial markets.

Moreover, the current presidential administration has made certain changes in the leadership and senior staffs of the federal banking agencies and may make additional changes in the future. Such changes are likely to impact the rulemaking, supervision, examination and enforcement priorities and policies of the agencies. In addition, changes in key personnel at the agencies that regulate such banking organizations, including the federal banking agencies, may result in differing interpretations of existing rules and guidelines and potentially more stringent enforcement and more severe penalties than previously. The potential impact of any changes in agency personnel, policies, priorities and interpretations on the financial services sector, including us, cannot be predicted at this time. Furthermore, fiduciary, anti-competitive, voting power, governance, and other concerns with ESG investment strategies continue to be the subject of legislative and regulatory debate globally, particularly at the federal and state level in the United States, the outcomes of which could impact both our asset management business and the clients that we service, as well as, potentially, our investment servicing activities more broadly.

We expect that our business will remain subject to extensive regulation and supervision. Several other aspects of the regulatory environment in which we operate, and related risks, are discussed below. Additional information is provided under “Supervision and Regulation” in Business in this Form 10-K.

Resolution Planning

We are required to periodically submit a plan for rapid and orderly resolution in the event of material

financial distress or failure commonly referred to as a resolution plan or a living will to the Federal Reserve and the FDIC under Section 165(d) of the Dodd-Frank Act. Through resolution planning, we seek, in the event of insolvency, to maintain State Street Bank’s role as a key infrastructure provider within the financial system, while minimizing risk to the financial system and maximizing value for the benefit of our stakeholders. Significant management attention and resources are devoted in an effort to meet regulatory expectations with respect to resolution planning.

In the event of material financial distress or failure, our preferred resolution strategy is the SPOE Strategy. Our resolution plan, including our implementation of the SPOE Strategy with a secured support agreement, may result in significant risks, including that: (1) the SPOE Strategy and the obligations under the related secured support agreement may result in the recapitalization of and/or provision of liquidity to State Street Bank and our other material entities and the commencement of bankruptcy proceedings by the Parent Company at an earlier stage of financial stress than might otherwise occur without such mechanisms in place; (2) as an expected effect of the SPOE Strategy, together with applicable TLAC regulatory requirements, our losses will be imposed on Parent Company shareholders and the holders of long-term debt and other forms of TLAC securities currently outstanding or issued in the future by the Parent Company, as well as on any other Parent Company creditors, before any of our losses are imposed on the holders of the debt securities of State Street Bank or certain of the Parent Company’s other operating subsidiaries or any of their depositors or creditors and before U.S. taxpayers are put at risk; (3) there can be no assurance that there would be sufficient recapitalization resources available to ensure that State Street Bank and our other material entities are adequately capitalized following the triggering of the requirements to provide capital and/or liquidity under the secured support agreement; and (4) there can be no assurance that credit rating agencies, in response to our resolution plan or the secured support agreement, will not downgrade, place on negative watch or change their outlook on our debt credit ratings, generally or on specific debt securities. Additional information about the SPOE Strategy, including related risks, is provided under “Recovery and Resolution Planning” in Business in this Form 10-K.

Systemic Importance

Our qualification in the United States as a SIFI, and our designation by the Financial Stability Board as a G-SIB, to which certain regulatory capital surcharges may apply, subjects us to incrementally higher capital and prudential requirements, increased scrutiny of our activities and potential additional

State Street Corporation | 40

regulatory requirements or heightened regulatory expectations as compared to those applicable to some of the financial institutions with which we compete as a custodian or asset manager. This qualification and designation also has significantly increased, and may continue to increase, our expenses associated with regulatory compliance, including personnel and systems, as well as implementation and related costs to enhance our programs.

Global and Non-U.S. Regulatory Requirements

The breadth of our business activities, together with the scope of our global operations and varying business practices in relevant jurisdictions, increase the complexity and costs of meeting our regulatory compliance obligations, including in areas that are receiving significant regulatory scrutiny. We are, therefore, subject to related risks of non-compliance, including fines, penalties, lawsuits, regulatory sanctions, difficulties in obtaining governmental approvals, limitations on our business activities or reputational harm, any of which may be significant. For example, the global nature of our client base requires us to comply with complex laws and regulations of multiple jurisdictions relating to economic sanctions and money laundering. In addition, we are required to comply not only with the U.S. Foreign Corrupt Practices Act, but also with the applicable anti-corruption laws of other jurisdictions in which we operate. Beyond the risks of non-compliance, these requirements potentially expose us to increased counterparty credit risk and exposures to our clients created due to complications associated with compliance, including country risk, market risk, restrictions on asset transfers and inability to access assets. Further, our global operating model requires that we comply with information security, resiliency and outsourcing oversight requirements, including with respect to affiliated entities, of multiple jurisdictions and enable our clients to comply with information security, resiliency and outsourcing oversight requirements imposed upon them. Regulatory scrutiny of compliance with these and other laws and regulations is increasing and may, in some respects, impede the implementation of our global operating model that is central to both delivery of client service requirements and cost efficiency. We sometimes face inconsistent laws and regulations across the various jurisdictions in which we operate. The evolving regulatory landscape may interfere with our ability to conduct our operations, hamper our pursuit of a common global operating model or impede our ability to compete effectively with other financial institutions operating in those jurisdictions which may be subject to different regulatory requirements than apply to us. In particular, non-U.S. regulations and initiatives that may be inconsistent or conflict with current or proposed regulations in the

U.S. could create increased compliance and other costs that would adversely affect our business, operations or profitability. Geopolitical events also have the potential to increase the complexity and cost of regulatory compliance.

In addition to U.S. regulatory initiatives, we are further affected by non-U.S. regulatory initiatives, including the implementation of the Basel prudential framework, the E.U. Digital Operational Resilience Act, Corporate Sustainability Reporting Directive and Sustainable Finance Disclosures Regulation, as well as proposals for amending the AIFM Directive and under the Capital Markets Union Action Plan. Recent, proposed or potential regulations in the U.S. and E.U. with respect to the supervision of digital assets and of climate and environmental risks, short-term wholesale funding, such as repurchase agreements or securities lending, or other non-bank finance activities, could also adversely affect not only our own operations but also the operations of the clients to which we provide services. Concerns regarding the liquidity and valuation of prime money market funds and similar products, as well as potential related regulation, may adversely impact the cash management products we offer. In addition, anti-competitive, voting power, governance and other concerns with passive investment strategies continue to be the subject of legislative and regulatory debate which could significantly impact both our asset management business and the clients that we service.

Consequences of Regulatory Environment and Compliance Risks

Domestic and international regulatory reform could limit our ability to pursue certain business opportunities, increase our regulatory capital requirements, alter the risk profile of certain of our core activities and impose additional costs on us, otherwise adversely affect our business, our consolidated results of operations or financial condition and have other negative consequences, including, a reduction of our credit ratings. Different countries may respond to the market and economic environment in different and potentially conflicting manners, which could increase the cost of compliance for us.

The evolving regulatory environment, including changes to existing regulations and the introduction of new regulations, may also contribute to decisions we may make to suspend, reduce or withdraw from existing businesses, activities, markets or initiatives. In addition to potential lost revenue associated with any such suspensions, reductions or withdrawals, any such suspensions, reductions or withdrawals may result in significant restructuring or related costs or exposures or may result in inefficiencies or increased costs due to associated changes in our operating model.

State Street Corporation | 41

If we do not comply with governmental regulations, we may be subject to fines, penalties, lawsuits, delays, or difficulties in obtaining regulatory approvals or restrictions on our business activities or harm to our reputation, which may significantly and adversely affect our business operations and, in turn, our consolidated results of operations. The willingness of regulatory authorities to impose meaningful sanctions, and the level of fines and penalties imposed in connection with regulatory violations, has increased substantially since the 2008 financial crisis. Regulatory agencies may, at times, limit our ability to disclose their findings, related actions or remedial measures. Similarly, many of our clients are subject to significant regulatory requirements and retain our services in order for us to assist them in complying with those legal requirements. Changes in these regulations can significantly affect the services that we are asked to provide, as well as our costs.

Adverse publicity and damage to our reputation arising from the failure or perceived failure to comply with legal, regulatory or contractual requirements could affect our ability to attract and retain clients. If we cause clients to fail to comply with any regulatory requirements, we may be liable to them for losses and expenses that they incur. In recent years, regulatory oversight and enforcement have increased substantially, imposing additional costs and increasing the potential risks associated with our operations. If this regulatory trend continues, it could continue to adversely affect our operations and, in turn, our consolidated results of operations and financial condition.

For additional information, see the risk factor “Our businesses may be adversely affected by government enforcement and litigation.”

Our businesses may be adversely affected by government enforcement and litigation.

The businesses in which we operate are highly-regulated and subject to extensive external scrutiny that may be directed generally to participants in the businesses or markets in which we are involved or may be specifically directed at us, including as a result of whistleblower and qui tam claims. In the course of our business, we are frequently subject to various regulatory, governmental and law enforcement inquiries, investigative demands and subpoenas, and from time to time, our clients, or the government on its own behalf or on behalf of our clients or others, make claims and take legal action relating to, among other things, our performance of our fiduciary, contractual or regulatory responsibilities. Often, the announcement of any such matters, or of any settlement of a claim or action, whether it involves us or others in our industry, may spur the initiation of similar claims by other clients or

governmental parties. Regulatory authorities have, and are likely to continue to, initiate cross industry reviews when a material issue is identified at a financial institution. Such inquiries involve costs and management time and may lead to proceedings relating to our own activities.

Regardless of the outcome of any governmental enforcement or litigation matter, responding to such matters is time-consuming and expensive and can divert the attention of senior management. Governmental enforcement and litigation matters can involve claims for disgorgement, demands for substantial monetary damages, the imposition of civil or criminal penalties, and the imposition of remedial sanctions or other required changes in our business practices, any of which could result in increased expenses, loss of client demand for our products or services, or harm to our reputation. The exposure associated with any proceedings that may be threatened, commenced or filed against us could have a material adverse effect on our consolidated results of operations for the period in which we establish a reserve with respect to such potential liability or upon our reputation. In government settlements since the 2008 financial crisis, the fines imposed by authorities have increased substantially and may exceed in some cases the profit earned or harm caused by the regulatory or other breach. For example, in 2021, we paid a $115 million penalty to the office of the United Sates Attorney for the District of Massachusetts to resolve potential criminal claims arising from the invoicing matter. In addition, in connection with the resolution of a transition management matter, we agreed to pay a fine of £22.9 million (approximately $37.8 million) to the U.K. FCA in 2014 and fines of $32.3 million to each of the DOJ and the SEC in 2017. As a further example, we paid an aggregate of $575 million in 2016 to resolve a series of investigations and governmental and private claims alleging that our indirect foreign exchange rates prior to 2008 were not adequately disclosed or were otherwise improper. These matters have also resulted in regulatory focus on the manner in which we charge clients and related disclosures. This focus may lead to increased and prolonged governmental inquiries and client, qui tam and whistleblower claims associated with the amount and disclosure of compensation we receive for our products and services.

Moreover, U.S. and certain international governmental authorities have increasingly brought criminal actions against financial institutions, and criminal prosecutors have increasingly sought and obtained criminal guilty pleas, deferred prosecution agreements or other criminal sanctions from financial institutions. For example, in 2017 we entered into a deferred prosecution agreement with the U.S. Department of Justice in connection with the

State Street Corporation | 42

resolution of a transition management matter and in May 2021, we entered into a deferred prosecution agreement with the office of the United States Attorney for the District of Massachusetts in connection with the invoicing matter and such agreement could increase the likelihood that governmental authorities will seek criminal sanctions against us in pending proceedings or future litigation legal proceedings. Government authorities may also pursue criminal claims against current or former employees, and these matters can, among other things, involve continuing reputational harm to us. For example, four of our former employees were indicted by U.S. prosecutors on charges of criminal conspiracy in connection with their involvement in the transition management matter. Two of these individuals pled guilty, and a third was convicted in 2018.

In many cases, we are required or may choose to report inappropriate or non-compliant conduct to the authorities, and our failure or delay to do so may represent an independent regulatory violation or be treated as an indication of non-cooperation with governmental authorities. Even when we promptly report a matter, we may nonetheless experience regulatory fines, liabilities to clients, harm to our reputation or other adverse effects. Moreover, our settlement or other resolution of any matter with any one or more regulators or other applicable party may not forestall other regulators or parties in the same or other jurisdictions from pursuing a claim or other action against us with respect to the same or a similar matter.

For more information about current contingencies relating to legal proceedings, see Note 13 to the consolidated financial statements in this Form 10-K. The resolution of certain pending or potential legal or regulatory matters could have a material adverse effect on our consolidated results of operations for the period in which the relevant matter is resolved or an accrual is determined to be required, on our consolidated financial condition or on our reputation.

In view of the inherent difficulty of predicting the outcome of legal and regulatory matters, we cannot provide assurance as to the outcome of any pending or potential matter or, if determined adversely against us, the costs associated with any such matter, particularly where the claimant seeks very large or indeterminate damages or where the matter presents novel legal theories, involves a large number of parties, involves the discretion of governmental authorities in seeking sanctions or negotiated resolution or is at a preliminary stage. We may be unable to accurately estimate our exposure to the risks of legal and regulatory contingencies when we record reserves for probable and estimable loss contingencies. As a result, any reserves we establish

may not be sufficient to cover our actual financial exposure. Similarly, our estimates of the aggregate range of reasonably possible loss for legal and regulatory contingencies are based upon then-available information and are subject to significant judgment and a variety of assumptions and known and unknown uncertainties. The matters underlying the estimated range will change from time to time, and actual results may vary significantly from the estimate at any time.

Our businesses may be adversely affected by increased and conflicting political and regulatory scrutiny of asset management stewardship and corporate sustainability or ESG practices.

Our Investment Management line of business provides investment management strategies and products that may incorporate the consideration of sustainability or ESG factors into the investment process. For clients and fund investors who want an investment solution that purposefully takes into consideration sustainability or ESG factors, we offer investment funds and strategies that consider sustainability or ESG factors as a material component of the investment strategy or index methodology. Where clients have delegated to us authority to vote securities on their behalf at shareholder meetings of the public companies held in their investment portfolios, we may also take into consideration sustainability or ESG issues that we believe are relevant to the long-term performance of the companies in which our clients invest. As part of our asset stewardship program, we regularly engage with representatives of companies held in client portfolios, and these engagements may involve discussion of risks and opportunities relating to sustainability or ESG issues affecting these companies. We have also become members of various organizations focused on climate change and other sustainability or ESG issues.

Our sustainability- or ESG-related investment management practices have recently become the subject of significant scrutiny by regulatory agencies and government officials. Certain U.S. officials have suggested that sustainability- or ESG-related investing practices may result in violations of law – including antitrust laws – and breaches of fiduciary duty. Views on sustainability or ESG practices, particularly those related to climate issues, have also become political issues, which can amplify the reputational risks associated with such allegations. Overall expectations of our stakeholders, including regulators and clients, outside the United States, particularly in Europe, concerning sustainability or ESG issues can be markedly different from expectations in the United States. Given we conduct our asset stewardship activities on a global basis, conflicting U.S. and non-U.S. global expectations complicate our ability to mitigate the risks. We have

State Street Corporation | 43

received information requests from various government entities in connection with their investigations of sustainability or ESG investing practices. We are, therefore, subject to related risks of non-compliance with relevant legal requirements, including fines, penalties, lawsuits, regulatory sanctions, difficulties in obtaining governmental approvals, limitations on our business activities or reputational harm, any of which may be significant. We also face potential risks presented by recently adopted SEC rules, which would impose new disclosure requirements and naming conventions for sustainability- or ESG-related funds and other sustainability- or ESG-related disclosure obligations on public companies more generally. Regulations in other jurisdictions could have similar effects or present conflicting or inconsistent regulatory obligations across jurisdictions. We also face potential risks associated with the enactment of various state laws aimed at sustainability- or ESG-related investing practices and proxy voting. Governmental enforcement action could also spark civil litigation claims by clients and fund shareholders asserting violations of law, fiduciary duties and contractual obligations. Regardless of the outcome of any governmental enforcement or litigation matter, responding to such matters is time-consuming and expensive and can divert the attention of senior management. In Europe, we are subject to potential fines and other regulatory consequences if regulators conclude we are not managing or reducing climate risk consistent with their expectations, not only in our own operations, but also through the vendors we use and, potentially, the clients we service.

State law and/or political pressure may also prevent governmental clients from using service providers, such as us, either as asset manager or investment servicer, if the legislators or governmental officials in such jurisdictions believe our sustainability- or ESG-related practices are not consistent with requirements under state law or the views of such legislators or officials.

Adverse publicity and damage to our reputation arising from the failure or perceived failure to comply with legal, regulatory or contractual requirements could affect our ability to attract and retain clients. Moreover, aside from any governmental enforcement or litigation activity, public criticism levelled at sustainability or ESG investing practices could result in reduced investor demand for sustainability- or ESG-related products, which could in turn negatively effect our assets under management and resulting fee revenues.

As a general matter, large index fund providers, such as State Street Global Advisors, have been and are expected to continue to be subject to legislative and regulatory proposals or investigations from both sides of the political spectrum due to a perception

that they exert inappropriate influence over publicly traded companies.

For additional information, see the risk factor “Our businesses may be adversely affected by government enforcement and litigation.”

Any theft, loss, damage to or other misappropriation or inadvertent disclosure of, or inappropriate access to, the confidential information we possess could have an adverse impact on our business and could subject us to regulatory actions, litigation and other adverse effects.

Our businesses and relationships with clients are dependent on our ability to maintain the confidentiality of our and our clients' trade secrets and other confidential information (including client transactional and holdings data and personal data about our clients, our clients' clients and our employees). Unauthorized access, or failure of our controls with respect to granting access to our systems, or failure of our other data loss prevention controls, may in the future occur, resulting in theft, loss, damage to or other misappropriation of such information. Our personnel or our vendors have in the past and may in the future, inadvertently or deliberately, disclose client or other confidential information. In addition, our systems or systems of our vendors have in the past or may in the future be inadvertently or deliberately exploited resulting in disclosure of client or other confidential information. Any theft, loss, damage to other misappropriation or inadvertent disclosure of confidential information could have a material adverse impact on our competitive position, our relationships with our clients and our reputation and could subject us to regulatory inquiries, enforcement and fines, civil litigation and possible financial liability or costs. To the extent any of these events involve personal information, the risks of enhanced regulatory scrutiny and the potential financial liabilities are exacerbated, particularly under data protection regulations such as the GDPR.

Changes in accounting standards may adversely affect our consolidated financial statements.

New accounting standards, or changes to existing accounting standards, resulting both from initiatives of the FASB as well as changes in the interpretation of existing accounting standards potentially could affect our consolidated results of operations, cash flows and financial condition. These changes can materially affect how we record and report our consolidated results of operations, cash flows, financial condition and other financial information. In some cases, we could elect, or be required, to apply a new or revised standard retroactively, resulting in the revised treatment of certain transactions or activities, and, in some cases, the revision of our consolidated financial statements

State Street Corporation | 44

for prior periods. For additional information regarding changes in accounting standards, refer to the “Recent Accounting Developments” section of Note 1 to the consolidated financial statements in this Form 10-K.

Changes in tax laws, rules or regulations, challenges to our tax positions with respect to historical transactions, and changes in the composition of our pre-tax earnings may increase our effective tax rate and thus adversely affect our consolidated financial statements.

Our businesses can be directly or indirectly affected by new tax legislation, the expiration of existing tax laws or the interpretation of existing tax laws worldwide. The U.S. federal and state governments, including Massachusetts, and jurisdictions around the world continue to review and enact proposals to amend tax laws, rules and regulations, including those related to corporate and global minimum taxes, applicable to our businesses that could have a negative impact on our capital or after-tax earnings. In the normal course of our business, we are subject to review by U.S. and non-U.S. tax authorities. A review by any such authority could result in an increase in our recorded tax liability. In addition to the aforementioned risks, our effective tax rate is dependent on the nature and geographic composition of our pre-tax earnings and could be negatively affected by changes in these factors.

We could face liabilities for withholding and other non-income taxes as a result of tax authority examinations.

In addition to income tax, we are at present, and in the future will be, under audit or other examination, and litigation or other dispute resolution proceedings, with U.S. and non-U.S. tax authorities regarding non-income-based tax matters. Our interpretations or application of tax laws and regulations, including with respect to withholding, transfer, wage, sales, use, stamp, value added, service and other non-income taxes, could differ from that of the relevant governmental taxing authority, or we may experience timing or other compliance deficiencies in connection with our efforts to comply with applicable tax laws and regulations, which could result in the requirement to pay additional taxes, penalties and/or interest, which could be material. Our tax exposure may also be impacted by tax positions taken by our clients and counterparties.

Our businesses may be negatively affected by adverse publicity or other reputational harm.

Our relationship with many of our clients is predicated on our reputation as a fiduciary and a service provider that adheres to the highest standards of ethics, service quality and regulatory compliance, as well as a leading provider of the products and services we offer. Adverse publicity, regulatory actions or fines, litigation, operational failures, loss of client

opportunities or market share or the failure to meet client expectations or fiduciary or other obligations could materially and adversely affect our reputation, our ability to attract and retain clients or key employees or our sources of funding for the same or other businesses. For example, over the past decade we have experienced adverse publicity with respect to our indirect foreign exchange trading, and this adverse publicity has contributed to a shift of client volume to other foreign exchange execution methods. Similarly, governmental actions and reputational issues in our transition management business in the U.K. have adversely affected our transition management revenue and, with criminal convictions or guilty pleas of three of our former employees in 2018 and the deferred prosecution agreement we entered into in early 2017 and the related SEC settlement, these effects have the potential to continue. The client invoicing matter we announced in late 2015, and the related deferred prosecution agreement entered into in May 2021, have had similar effects. For additional information about these matters, see the risk factor “Our businesses may be adversely affected by government enforcement and litigation.”

Preserving and enhancing our reputation also depends on maintaining systems, procedures and controls that address known risks, regulatory standards and client expectations, as well as our ability to timely identify, understand and mitigate additional risks that arise due to changes in our businesses and the marketplaces in which we operate, the regulatory environment and client business practices.

Operational and Technology Risks

Our business may be negatively affected by our failure to update and maintain our technology infrastructure.

In order to maintain and grow our business, we must make strategic decisions about our current and future business plans and effectively execute upon those plans. Strategic initiatives that we are currently developing or executing against include cost initiatives, enhancements and efficiencies to our operational processes, improvements to existing and new service offerings and enhancements to existing and development of new information technology and other systems. Implementing strategic programs and creating cost efficiencies involves certain strategic, technological, operational and regulatory risks. Many features of our present initiatives include investment in systems integration and new technologies and also the development of new, and the evolution of existing, methods and tools to accelerate the pace of innovation, the introduction of new services and enhancements to the resiliency of our systems and operations. These initiatives also may fail to meet

State Street Corporation | 45

increasing regulatory and client expectations, may take longer than anticipated to implement and may result in increases in operating losses, inadvertent data disclosures or other operating errors. Further, savings achieved as a result of operational, systems or other business process or organizational initiatives may not persist for the anticipated periods. We may not have sufficient resources to complete all of the systems development or projects that might enhance our product capabilities, resiliency of our operations or cost initiatives and, consequently, management makes judgments as to the priority to give to competing initiatives. In implementing these programs, we have material dependencies on third parties with contractual limits on their responsibilities to us. The transition to new operating processes and technology infrastructure may also cause disruptions in our relationships with clients and employees or loss of institutional understanding and may present other unanticipated technical or operational hurdles. In addition, the relocation to or expansion of servicing activities and other operations in different geographic regions or vendors may entail client, regulatory and other third party data use, storage and security challenges, as well as other regulatory compliance, business continuity and other considerations. As a result, we may not achieve some or all of the anticipated cost savings, process improvement, compliance or other benefits and may experience unanticipated challenges from clients, regulators or other parties or reputational harm. Further, some new products and services may quickly be superseded in the marketplace, after significant investment by us, by more effective innovative technologies or solutions to which we may not have access. In addition, some systems development initiatives may not have access to significant resources or management attention and, consequently, may be delayed or unsuccessful. Many of our systems require enhancements to meet the requirements of evolving regulation and marketplace demands, to enhance security and resiliency and decommission obsolete technologies, to permit us to optimize our use of capital or to reduce the risk of operating error. In addition, the implementation of State Street Alpha, State Street Digital and products and services involving artificial intelligence requires substantial systems development and expense. We may not have the resources to pursue all of these objectives simultaneously.

Our risk management framework, models and processes may not be effective in identifying or mitigating risk and reducing the potential for related losses, and a failure or circumvention of our controls and procedures, or errors or delays in our operational and transaction processing, or those of third parties, could have an adverse effect on our business, financial condition, operating results and reputation.

We have in the past failed and may in the future fail to identify and manage risks related to a variety of aspects of our business, including cybersecurity, information technology risk, operational risk and resiliency, interest rate risk, foreign exchange risk, fiduciary risk, legal and compliance risk, liquidity risk and credit risk. We have adopted various risk frameworks, controls, procedures, policies and systems to monitor and manage risk. We cannot provide assurance that those frameworks, controls, procedures, policies and systems are or will be adequate to identify and mitigate internal and external risks, including risks related to third-party service providers, in our various businesses and corporate functions. The risk of individuals, either employees or contractors, engaging in conduct harmful or misleading to clients or to us, such as consciously circumventing established control mechanisms, for example to exceed trading or investment management limitations, commit fraud or improperly sell products or services to clients, is particularly challenging to manage through a risk framework, controls or other measures. In addition, we are subject to increasing resiliency risk and client and regulatory expectations, requiring continuous reinvestment, enhancement and improvement in and of our information technology and operational infrastructure, controls and personnel which may not be effectively or timely deployed or integrated. Moreover, the financial and reputational impact of control or conduct failures can be significant. Persistent or repeated issues with respect to controls, information technology and operational resiliency or individual conduct have raised and may in the future raise concerns among regulators regarding our culture, governance and control environment. There can be no assurance that our efforts to address such risks will be effective. While we seek to effectively manage operational risk and adverse impacts to our business, financial condition, operating results and reputation, the degree of protection that we are able to achieve varies, and our potential exposure may be greater than the revenue we anticipate that we will earn from servicing our clients.

In addition, our businesses and the markets in which we operate are continuously evolving. We will need to make additional investments to develop an appropriate operational infrastructure and to enhance our compliance and risk management frameworks and capabilities to support our businesses through their evolution, which may increase the operating expenses of such businesses. Moreover, we may fail to identify or fully understand the implications of changes in our businesses or the financial markets and fail to adequately or timely enhance our risk framework to address those changes. To the extent that our risk framework is ineffective, either because it fails to keep pace with changes in the financial

State Street Corporation | 46

markets, regulatory or industry requirements, technology and cybersecurity developments, our businesses, our counterparties, clients or service providers or for other reasons, we could incur losses, suffer reputational damage or find ourselves out of compliance with applicable regulatory or contractual mandates or expectations, and subject to regulatory inquiry or action against us.

Operational risk is inherent in all of our business activities. As a leading provider of services to institutional investors, we provide a broad array of services that expose us to operational risk and potential loss resulting from inadequate or failed internal processes, employee supervision or monitoring mechanisms, service-provider processes or other systems or controls, which could materially affect our future consolidated results of operations. In addition, these services generate a broad array of complex and specialized servicing, confidentiality and fiduciary requirements, many of which involve the opportunity for human, systems or process errors. We face the risk that the policies, procedures and controls we have established to, among other things, manage operational, technology and information security risks, will fail or be inadequate, in whole or in part, to mitigate risk and may become outdated. Additionally, several of our processes for specific clients, often large clients with a high volume and large magnitude of transactions and activities, are bespoke and require additional attention, oversight and controls which involve an enhanced risk of episodic or continued failure as well as additional costs. Given the volume and magnitude of transactions we process on a daily basis, operational losses represent a potentially significant financial risk for our business. Operational errors that result in us remitting funds to a failing or bankrupt entity may be irreversible, and may subject us to losses. In addition to the financial losses associated with operational errors, these errors present the risk of client dissatisfaction and loss and reputational risk.

We may also be subject to disruptions from external events that are wholly or partially beyond our control, which could cause delays or disruptions to operational functions, including information processing and financial market settlement functions. In addition, our clients, vendors and counterparties could suffer from such events. Should these events affect us, or the clients, vendors or counterparties with which we conduct business, our consolidated results of operations could be negatively affected.

When we record balance sheet accruals for probable and estimable loss contingencies related to operational losses, we may be unable to accurately estimate our potential exposure, and any accruals we establish to cover operational losses may not be sufficient to cover our actual financial exposure,

which could have a material adverse effect on our consolidated results of operations.

Outsourcing of work to global hub locations may expose us to increased operational risk and reputational harm and may not result in expected cost savings.

We manage our operations and expenses across a global model, which may include migrating certain business processes and business support functions to emerging market-based geographic hub locations, such as India, Poland and China, and by outsourcing to vendors and joint ventures in various jurisdictions. This effort exposes us to the risk that we may not effectively transition the relevant processes and activities, and that we may not maintain service quality, control and effective management or business resiliency within these operations during and after transitions. These migrations also involve risks that our outsourcing vendors or joint ventures may not comply with their servicing and other contractual obligations to us, including with respect to indemnification and information security, and to the risk that we may not satisfy applicable regulatory responsibilities regarding the management and oversight of outsourcing providers, joint ventures and other third parties. Our geographic footprint also exposes us to the relevant macroeconomic, political, legal and similar risks generally involved in doing business in the jurisdictions in which we establish lower-cost locations or joint ventures or in which our outsourcing vendors locate their operations, particularly in locations where we have a concentration of our operational activities, such as India, Poland and China. The increased elements of risk that arise from certain operating processes being conducted in some jurisdictions could lead to an increase in reputational risk. Given changes in client perception of geopolitical risk, clients may question or object to some or many of our services for them being conducted in particular jurisdictions. During periods of transition of operations, either directly or via changes in ownership, greater operational risk and client concerns exist with respect to maintaining a high level of service delivery and business continuity. The extent and pace at which we are able to move functions to lower-cost locations, joint ventures and outsourcing providers may also be affected by political, regulatory and client acceptance issues, including with respect to data use, storage and security. Such relocation or outsourcing of functions also entails costs, such as technology, real estate and restructuring expenses, which may offset or exceed the expected financial benefits of the relocation or outsourcing. In addition, the financial benefits of lower-cost locations and of outsourcing may diminish over time or could be offset in the event that the United States or other jurisdictions impose tax, trade barrier or other

State Street Corporation | 47

measures which seek to discourage the use of lower cost jurisdictions.

Any failures of or damage to, attack on or unauthorized access to our information technology systems or facilities or disruptions to our continuous operations, including the systems, facilities or operations of third parties with which we do business, such as resulting from cyber-attacks, could result in significant costs and reputational damage and impact our ability to conduct our business activities.

Our businesses depend on information technology infrastructure, both internal and external, to, among other things, record and process a large volume of increasingly complex transactions and other data, in many currencies, on a daily basis, across numerous and diverse markets and jurisdictions and to maintain that data securely. In recent years, several financial services firms have suffered successful cyber-attacks launched both domestically and from abroad, resulting in the disruption of services to clients, loss or misappropriation of sensitive or private data and reputational harm. We also have been the target of certain cyber-attacks, and although we have not to our knowledge suffered a material breach or suspension of our systems, it is possible that we could suffer such a breach or suspension in the future or that we may be unaware of a prior attack. Cyber-threats are sophisticated and continually evolving. We may not implement effective systems and other measures to effectively identify, detect, prevent, mitigate, recover from or remediate all potential cyber-threats or improve and adapt such systems and measures as such threats evolve and advance.

A failure to protect the technology infrastructure, systems and information of us, our clients and others against cybersecurity threats, could result in the theft, loss, unauthorized access to, disclosure, misuse or alteration of information, system failures or outages or loss of access to information. The expectations of our clients and regulators with respect to the resiliency of our systems and the adequacy of our control environment with respect to such systems has and is expected to increase as the risk of cyber-attacks, which is presently elevated due to the current geopolitical environment and global human capital footprint at State Street, and the consequences of those attacks become more pronounced. We may not be successful in meeting those expectations or in our efforts to identify, detect, prevent, mitigate and respond to such cyber-attacks or for our systems to recover in a manner that does not disrupt our ability to provide services to our clients. The failure to maintain an adequate technology infrastructure and applications with effective cybersecurity controls could impact operations, adversely affect our financial results, result in loss of business, damage our

reputation or impact our ability to comply with regulatory obligations, leading to regulatory fines and sanctions. We may be required to expend significant additional resources to investigate or remediate vulnerabilities or other exposures arising from cybersecurity threats.

Our networks, technology systems, facilities and information have suffered and in the future may suffer disruptions or otherwise fail to operate properly or become disabled, overloaded or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which can adversely affect our ability to process transactions, provide services, maintain systems availability, maintain information security, comply with internal controls or regulations or otherwise appropriately conduct our business activities. For example, in addition to cyber-attacks, there could be sudden increases in transaction or data volumes, electrical or telecommunications outages, natural disasters, or employee or contractor error or malfeasance. Third parties may also attempt to place individuals within State Street or fraudulently induce employees, vendors, clients or other users of our systems to disclose sensitive information in order to gain access to our systems or data or that of our clients or other parties. Any such disruptions or failures may require us, among other things, to reconstruct lost data (which may not be possible), reimburse our clients' costs associated with such disruption or failure, result in loss of client business or damage our information technology infrastructure or those of our clients or other parties. While we have not in the past suffered material harm or adverse effects from such disruptions or failures, we may not successfully prevent, respond to or recover from such disruptions or failures in the future, and any such disruption or failure could adversely impact our ability to conduct our businesses, damage our reputation and cause losses, potentially materially.

The third parties with which we do business, which facilitate our business activities, to whom we outsource operations or other activities, from whom we receive products or services or with whom we otherwise engage or interact, including financial intermediaries and technology infrastructure and service providers, are also susceptible to the foregoing risks (including the third parties with which they are similarly interconnected or on which they otherwise rely), and our or their business operations and activities have been and may in the future be adversely affected, perhaps materially, by failures, terminations, errors or malfeasance by, or attacks or constraints on, one or more financial, technology, infrastructure or government institutions or intermediaries with whom we or they are interconnected or conduct business.

State Street Corporation | 48

In particular, we, like other financial services firms, will continue to face increasing cyber-threats, including computer viruses, malicious code, distributed denial of service attacks, phishing attacks, ransomware, hacker attacks, limited availability of services, unauthorized access, information security breaches or employee or contractor error or malfeasance that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our, our clients' or other parties' confidential, personal, proprietary or other information or otherwise disrupt, compromise or damage our or our clients' or other parties' business assets, operations and activities. These and similar types of threats are occurring globally with greater frequency and intensity, and we may not anticipate or implement effective preventative measures against, or identify and detect one or more, such threats, particularly because the techniques used change frequently or may not be recognized until after they are launched. Our status as a G-SIB likely increases the risk that we are the target of such cyber-attacks. In addition, some of our service offerings, such as data warehousing, may also increase the risk that we are, and the consequences of being, targeted. We may be required to expend significant additional resources to investigate or remediate vulnerabilities or other exposures arising from cybersecurity threats. We therefore could experience significant related costs and legal and financial exposures, including lost or constrained ability to provide our services or maintain systems availability for clients, regulatory inquiries, enforcements, actions and fines, litigation, damage to our reputation or property and enhanced competition.

Due to our dependence on technology and the important role it plays in our business operations, we are attempting to improve and update our information technology infrastructure, among other things: (1) as some of our systems are approaching the end of their useful life, are redundant or do not share data without reconciliation; (2) to be more efficient, meet increasing client and regulatory security, resiliency and other expectations and support opportunities of growth; and (3) to enhance resiliency and maintain business continuity. Updating these systems involves material costs and often involves implementation, integration and security risks, including risks that we may not adequately anticipate the market or technological trends, regulatory expectations or client needs or experience unexpected challenges that could cause financial, reputational and operational harm. Failing to properly respond to and invest in changes and advancements in technology can limit our ability to attract and retain clients, prevent us from offering similar products and services as those offered by our competitors, impair our ability to maintain continuous operations, inhibit our ability to meet regulatory requirements and subject us to

regulatory inquiries, the result of which could be significant costs or limitations on our business activities.

Long-term contracts expose us to increased operational risk, pricing and performance risk.

We frequently enter into long-term client servicing contracts in our Investment Servicing business, including with respect to our State Street Alpha services. These include outsourcing and other core services contracts and can involve information technology development. These arrangements generally set forth our fee schedule for the term of the contract and, absent a change in service requirements, do not permit us to re-price the contract for changes in our costs or for market pricing. The long-term contracts for these relationships require, in some cases, considerable up-front investment by us, including technology and conversion costs, and carry the risk that pricing for the products and services we provide might not prove adequate to generate expected operating margins over the term of the contracts.

The profitability of these contracts is largely a function of our ability to accurately calculate pricing for our services, efficiently assume our contractual responsibilities in a timely manner, control our costs and maintain the relationship with the client for an adequate period of time to recover our up-front investment. Our estimate of the profitability of these arrangements can be adversely affected by declines in or inaccurate projections of the assets under the clients' management, whether due to general declines in the securities markets or client-specific issues. In addition, the profitability of these arrangements may be based on our ability to cross-sell additional services to these clients, and we may be unable to do so. In addition, such contracts may permit early termination or reduction in services in the event that certain service levels are not met, which termination or service reduction may result in loss of upfront investment in onboarding the client.

Performance risk exists in each contract, given our dependence on successful conversion and implementation onto our own operating platforms of the service activities provided. Our failure to meet specified service levels or implementation timelines may also adversely affect our revenue from such arrangements, or permit early termination of the contracts by the client. If the demand for these types of services were to decline, we could see our revenue decline.

We may not be able to protect our intellectual property, and we are subject to claims of third-party intellectual property rights.

Our potential inability to protect our intellectual property and proprietary technology effectively may allow competitors to duplicate our technology and

State Street Corporation | 49

products and may adversely affect our ability to compete with them. To the extent that we do not protect our intellectual property effectively through patents, maintaining trade secrets or other means in all of the jurisdictions in which we operate or market our products and services, other parties, including former employees, with knowledge of our intellectual property may seek to exploit our intellectual property for their own or others' advantage. In addition, we may infringe on claims of third-party patents, and we may face intellectual property challenges from other parties, including clients or service providers with whom we may engage in the development or implementation of other products, services or solutions or to whose information we may have access for limited permitted purposes but with whom we also compete. The risk of such infringement is enhanced in the current competitive “Fintech” environment, particularly with respect to our development of new products and services containing significant technology elements and dependencies, any of which could become the subject of an infringement claim. We may not be successful in defending against any such challenges or in obtaining licenses to avoid or resolve any intellectual property disputes. Third-party intellectual rights, valid or not, may also impede our deployment of the full scope of our products and service capabilities in all jurisdictions in which we operate or market our products and services.

The quantitative models we use to manage our business may contain errors that result in inadequate risk assessments, inaccurate valuations or poor business and risk management decisions, and lapses in disclosure controls and procedures or internal control over financial reporting could occur, any of which could result in material harm.

We use quantitative models to help manage many different aspects of our businesses. As inputs to our overall assessment of capital adequacy, outputs of models are used to measure the amount of credit risk, market risk and operational risk we face. We also use models for interest rate risk management and liquidity planning. During the preparation of our consolidated financial statements, we sometimes use models to measure the value of asset and liability positions for which reliable market prices are not available. We also use models to support many different types of business decisions including trading activities, investment, credit underwriting, hedging, asset-and-liability management and whether to change business strategy. We also use artificial intelligence and machine learning models to automate or enhance certain business processes. Weaknesses in the underlying model including input data, assumptions, parameters, or implementation, as well as

inappr