Pinnacle Financial Partners (PNFP) Risk Analysis

We are from time to time subject to certain litigation in the ordinary course of our business. BHG, like us, is also subject to certain litigation in the ordinary course of its business. As we have aggressively hired new revenue producing team members we, and the team members we have hired, have also periodically been the subject of litigation and threatened litigation with these team members' former employers. We may also be subject to claims related to our loan servicing programs, particularly those involving servicing of commercial real estate loans. These and other claims and legal actions, as well as supervisory and enforcement actions by our and BHG's regulators, including those with oversight of our loan servicing programs, could involve large monetary claims against us or BHG, as well as capital directives, agreements with federal regulators, cease and desist penalties and orders and significant defense costs. The outcome of any such cases or actions is uncertain. Substantial legal liability or significant regulatory action against us or BHG could have material adverse financial effects on our financial condition or results of operations or cause significant reputational harm to us or BHG, which in turn could seriously harm our or BHG's business prospects. We manage risks associated with litigation and other potential legal or regulatory exposure through internal controls, employee training, insurance, litigation management, our compliance and ethics processes, and other means. However, the commencement, outcome, and magnitude of litigation cannot be predicted or controlled with any certainty. In accordance with GAAP, for matters where a loss is not probable or the amount of the loss cannot be estimated, no accrual is established. For matters where it is probable we will incur a loss and the amount can be reasonably estimated, we establish an accrual for the loss. The actual cost of resolving a legal claim may be substantially higher than any amounts reserved for that matter. As of December 31, 2025, our management estimated the aggregate range of reasonably possible losses resulting from our outstanding legal matters, including, without limitation, the matters described in this Annual Report on Form 10-K, is from zero to $10 million in excess of the amounts accrued, if any, related to those matters. This estimated aggregate range was based upon information then available to us, and the actual losses could prove to be higher. We may still incur legal costs or losses for a matter even if we have not established an accrual. As there are further developments in legal matters, we will reassess these matters, and the estimated range of reasonably possible losses may change as a result of this assessment. In addition, in the future, we may need to record additional litigation accruals with respect to these matters. Further, regardless of how these matters proceed, it could significantly harm our reputation and divert our management's attention and other resources away from our business. Once established, the accrual is adjusted periodically to reflect any relevant developments. Moreover, where we have accrued an amount with respect thereto, the actual cost of any outstanding legal proceedings or threatened claims, however, may turn out to be substantially higher than the amount accrued, if any. Further, our or BHG's insurance, as applicable, may not cover all litigation, other proceedings or claims, or the costs of defense. Future developments could result in an unfavorable outcome for any existing or new lawsuits or investigations in which we or BHG are, or may become, involved, which may have a material adverse effect on our or BHG's business, financial condition or results of operations.

From time to time as part of our normal course of business, customers may make claims and take legal action against us based on actions or inactions related to the fiduciary responsibilities of Pinnacle Bank's trust and wealth management team members. If such claims and legal actions are not resolved in a manner favorable to us, they may result in financial liability and/or adversely affect our market reputation or our products and services. Any financial liability or reputation damage could have a material adverse effect on our business, which, in turn, could have a material adverse effect on our financial condition and results of operations.

Our financial performance is highly dependent on the business environment in the markets where we operate and in the U.S. as a whole. Unfavorable or uncertain economic and market conditions can be caused by, among other causes, declines in economic growth, business activity, investor or business confidence, consumer sentiment, limitations on the availability or increases in the cost of credit and capital, increases in inflation or interest rates, natural disasters, international trade disputes and retaliatory tariffs, monetary policy, supply chain disruptions, labor shortages, terrorist attacks, global pandemics, acts of war, or a combination of these or other factors. Inflation rose sharply at the end of 2021 and continued at heightened levels throughout 2023 and into 2024. Heightened levels of inflation remained constant through 2025 and prices are currently expected to remain elevated for many goods and services in the near term. We, along with our customers, experienced an uncertain and volatile economic environment during 2025 due to issues of national security, inflation, international trade disputes and retaliatory tariffs, increasing unemployment and the resulting pressure of these factors on monetary policy. A worsening of business and economic conditions, including as a result of escalating geopolitical tensions around the world (including the ongoing conflicts in Ukraine and the Middle East, the recent actions by the United States government in Venezuela or increased terrorist activity in the United States), persistent inflationary pressures combined with increasing unemployment, and actions taken by the Federal Reserve in response thereto, intensifying trade disputes or retaliatory tariffs, or supply chain disruptions, generally or specifically in the principal markets in which we conduct business, could have adverse effects, including the following: –a decrease in deposit balances or the demand for loans and other products and services we offer;–an increase in the number of borrowers who become delinquent, file for protection under bankruptcy laws or default on their loans or other obligations to us, which could lead to higher levels of nonperforming assets, net charge-offs and provisions for credit losses;–a decrease in the value of loans and other assets secured by real estate;–a decrease in net interest income from our lending and deposit gathering activities; and –an increase in competition resulting from financial services companies. There can be no assurance that economic conditions will improve in the near term or that conditions will not worsen. Such conditions could adversely affect our business, financial condition, and results of operations. In addition, over the last several years, the federal government has shut down periodically, in some cases for prolonged periods, including during the fall of 2025, and it is possible that the federal government may shut down again in the future. If another prolonged government shutdown occurs, it could significantly impact business and economic conditions generally or specifically in our principal markets, which could have a material adverse effect on our results of operations and financial condition.

We are dependent upon information technologies, computer systems and networks, including those we maintain and those maintained and provided to us by third parties, to conduct operations and are reliant on technology to help increase efficiency in our business. These systems could become unavailable or impaired due to a variety of causes, including storms and other natural disasters, terrorist attacks, fires, phishing schemes, social engineering, utility outages, internal or external theft or fraud, design defects, human error, misconduct or complications or failures encountered as existing systems are maintained, replaced or upgraded. For example, our financial, accounting, data processing, or other operating or security systems or infrastructure or those of third parties upon which we rely may fail to operate properly or become compromised, disabled or damaged, which could adversely affect our ability to process transactions or provide services. In the event that backup systems are utilized, they may not process data as quickly as our primary systems and we may experience data losses in the course of such recovery. We periodically update the systems on which we rely to support our operations and growth and to remain compliant with all applicable laws, rules and regulations. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions that may occur in the course of such implementation challenges. We maintain a system of internal controls and security to mitigate the risks of many of these occurrences and maintain insurance coverage for certain risks; however, should an event, including a cyberattack (including a ransomware attack), occur that is not prevented or detected by our internal controls, causes an interruption, degradation or outage in service, causes us to pay a ransom fee, or is uninsured against or in excess of applicable insurance limits, such occurrence could have an adverse effect on our business and our reputation, which, in turn, could expose us to costs, sanctions, fines or penalties (which may not be covered by our insurance policies), negative publicity and reputational harm, release of sensitive and/or confidential information, diversion of the attention of management away from the operation of our business, increases in operating expenses and lost revenues, any of which could have a material adverse effect on our financial condition, results of operations and liquidity. Our operations rely on the secure processing, storage and transmission of confidential, proprietary, personal and other information in our computer systems and networks. Although we take protective measures and endeavor to modify these systems as circumstances warrant, the security of our computer systems, software and networks may be vulnerable to breaches, unauthorized access, misuse, computer viruses or other malicious code and other events that could have a security impact. We provide our customers the ability to bank remotely, including over the Internet or through their mobile device. The secure transmission of confidential information is a critical element of remote and mobile banking. Our network, and the systems of parties with whom we contract or on which we rely, as well as those of our customers and regulators, could be vulnerable to unauthorized access, computer viruses, phishing schemes, social engineering, spam attacks, ransomware attacks, human error, natural disasters, power loss and other security breaches. Sources of attacks vary and may include hackers, disgruntled employees or vendors, criminal organizations, terrorists, hostile foreign governments, corporate espionage and activists. In recent periods, there continues to be a rise in electronic fraudulent activity (including wire fraud), security breaches and cyberattacks within the financial services industry, especially in the commercial banking sector due to cyber criminals targeting commercial bank accounts or seeking to infiltrate legitimate transactions, including through the compromise of our clients' email systems. We believe these types of efforts will continue to increase in frequency and in their level of sophistication. We have established policies, processes, and procedures to identify, measure, monitor, mitigate, report, and analyze risks associated with fraud, including check fraud, and continue to invest in systems, resources, and controls to detect and prevent it. There are inherent limitations, however, to our risk management strategies, systems, and controls as they may exist, or develop in the future. We may not appropriately anticipate, monitor, or identify these risks. If our risk management framework proves ineffective in connection with any fraudulent activity, we could suffer unexpected losses, we may have to expend resources detecting and correcting the failure in our systems, and we may be subject to potential claims from third parties and government agencies. We may also suffer reputational damage. Any of these consequences could adversely affect our business, financial condition, or results of operations. Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal use of web-based and cloud-based products and applications. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks are becoming more prevalent and sophisticated and are extremely difficult to prevent. The rapid evolution and increased adoption of generative artificial intelligence is further increasing risks in this area, including by making fraud detection more difficult, particularly with detection devices that use voice recognition or authentication. The techniques used by bad actors change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. Additionally, the existence of cyberattacks or security breaches at third parties with access to our data, such as vendors, may not be disclosed to us in a timely manner. Consistent with industry trends, we remain at risk for attempted electronic fraudulent activity, as well as attempts at security breaches and cybersecurity-related incidents. Cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Service disruptions in cloud technologies or intrusion into those of our systems hosted on cloud-based technologies may lead to unauthorized access of, delays in accessing, or the loss of, data that is important to our businesses and may hinder our clients' access to our products and services, which would negatively impact our operations which in turn could have a material adverse effect on our financial condition, results of operations and liquidity. We spend significant capital and other resources to protect against the threat of security breaches and computer viruses, and may be required to spend significant capital and other resources to alleviate problems caused by security breaches or viruses. To the extent that our activities or the activities of our vendors, regulators or customers involve the storage and transmission of confidential information, security breaches (including breaches of security of customer, vendor or regulatory systems and networks) and viruses could expose us to claims, litigation and other possible liabilities. Any inability to prevent or promptly detect security breaches or computer viruses could also cause existing customers to lose confidence in our systems and could adversely affect our reputation, results of operations and ability to attract and retain customers and businesses. In addition, a security breach could also subject us to additional regulatory scrutiny, expose us to civil litigation and possible financial liability and cause reputational damage. We outsource many of our major systems, such as data processing, loan servicing and deposit processing systems. The failure of these systems, or the termination of a third-party software license or service agreement on which any of these systems is based, could interrupt our operations. Because our information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such services exceeds capacity or such third-party systems fail or experience interruptions, including as a result of viruses or other attacks. If sustained or repeated, a system failure or service denial could result in a deterioration of our ability to process new and renewal loans, gather deposits and provide customer service, compromise our ability to operate effectively, damage our reputation, result in a loss of customer business and/or subject us to additional regulatory scrutiny and possible financial liability, any of which could have a material adverse effect on our financial condition, results of operations and liquidity. We also face the risk of operational disruption, failure, termination, or capacity constraints of any of the third parties that facilitate our business activities, including vendors, exchanges, and other financial intermediaries. Such parties could also be the source or cause of an attack on, or breach of, our operational systems, data or infrastructure, and could disclose such attack or breach to us in a delayed manner or not at all. In addition, we may be at risk of an operational failure with respect to our customers' systems. Our risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats and the continued uncertain global economic environment. As cybersecurity threats continue to evolve, we will likely expend significant additional resources to continue to modify or enhance our protective measures, investigate and remediate any information security vulnerabilities, or respond to any changes to state or federal regulations, policy statements or laws concerning information systems or security. Any failure to maintain adequate security over our information systems, our technology-driven products and services or our customers' personal and transactional information could negatively affect our business and our reputation and result in fines, penalties, or other costs, including litigation expense and/or additional compliance costs, all of which could have a material adverse effect on our financial condition, results of operations and liquidity. Furthermore, the public perception that a cyberattack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. A successful penetration or circumvention of system security could result in negative consequences for us, including loss of customers and business opportunities, disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, or damage to our customers' and/or third parties' computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our financial condition, results of operations and liquidity.

The market value of real estate can fluctuate significantly in a short period of time, including as a result of market conditions in the geographic area in which the real estate is located. If the value of the real estate serving as collateral for our loan portfolio were to decline materially, a significant part of our loan portfolio could become under-collateralized. If the loans that are collateralized by real estate become troubled during a time when market conditions are declining or have declined, we may not be able to realize the value of the security anticipated when we originated the loan, which in turn could have an adverse effect on our allowance and provision for credit losses and our financial condition, results of operations and liquidity. Most of our foreclosed assets are comprised of real estate properties. We carry these properties at their estimated fair values less estimated selling costs. While we believe the carrying values for such assets are reasonable and appropriately reflect current market conditions, there can be no assurance that the values of such assets will not further decline prior to sale or that the amount of proceeds realized upon disposition of foreclosed assets will approximate the carrying value of such assets. If the proceeds from any such dispositions are less than the carrying value of foreclosed assets, we will record a loss on the disposition of such assets, which in turn could have an adverse effect on our results of operations. Compared to national financial institutions, we are less able to spread the risks of unfavorable local economic conditions across a large number of diversified economies. Moreover, we cannot give any assurance that we will benefit from any market growth or return of more favorable economic conditions in our primary market areas if they do occur.