Regions Financial (RF) Risk Factors

We must comply with enhanced regulatory and other standards associated with doing business with vendors and other service providers, including standards relating to the outsourcing of functions as well as the performance of significant banking and other functions by subsidiaries. We incur significant costs and expenses in connection with our initiatives to address the risks associated with oversight of our external service providers. Our failure to appropriately assess and manage these relationships, especially those involving significant banking functions, shared services or other critical activities, could materially adversely affect us. Specifically, any such failure could result in: potential harm to clients and customers, and any liability associated with that harm; regulatory fines, penalties or other sanctions; lower revenues, and the opportunity cost from lost revenues; increased operational costs, or harm to our reputation.

We are subject to a variety of risks, including reputational risk, associated with environmental, social and governance, or ESG, issues. As a large financial institution with a diverse base of customers, vendors and suppliers, we may face negative publicity based on the identity, practices and perceptions of certain entities with whom we choose to do business. The public holds diverse and potentially conflicting views of those entities, and their activities, including the perceived environmental, social or economic impacts of those entities or of financial institutions' relationships with those entities. Because we have multiple stakeholders, among them shareholders, customers, employees, federal and state regulatory authorities and political entities, often those stakeholders have differing, and sometimes conflicting, priorities and expectations regarding ESG issues. For example, certain federal and state laws and regulations related to ESG issues may include provisions that conflict with other laws and regulations, which may increase our costs or limit our ability to conduct business in certain jurisdictions. Simultaneous, disparate and divergent sentiments on ESG-related matters from multiple stakeholder groups must be considered. For example, there is an increasing number of state-level anti-ESG initiatives in the U.S. that may conflict with other regulatory requirements or our various stakeholders' expectations. Such divergent, sometimes conflicting views on ESG-related matters increase the risk that any action or lack thereof by us on such matters will be perceived negatively by some stakeholders. Failing to comply with expectations and standards from investors, customers, regulators, policymakers and other stakeholders regarding ESG-related issues, or taking action in conflict with one or another of those stakeholders' expectations, could also lead to loss of business, adverse publicity, an adverse impact on our reputation, customer complaints or public protests. Negative publicity may be driven by adverse news coverage in traditional media and may also be spread more broadly through the use of social media platforms. If our relationships with our customers, vendors and suppliers were to become the subject of such negative publicity, our ability to attract and retain customers and employees, compete effectively and grow our business may be negatively impacted. Additionally, a growing number of investors (in particular institutional investors who hold and manage substantial equity positions, in some cases in nearly all major U.S. listed companies) are integrating ESG factors into their analysis of the expected risk and return of potential investments. The specific ESG factors considered, as well as the approach to incorporating the factors into a broader investment process, vary by investor and can shift over time. Our failure to align with, or remain aligned with, investors' ESG-related priorities may negatively impact the trading price of our common stock.

Our success depends, in part, on our executive officers and other key personnel. The market for qualified individuals is highly competitive, and we may not be able to attract and retain qualified personnel or candidates to replace or succeed members of our senior management team or other key personnel. As a large financial and banking institution, we may be subject to limitations on compensation practices, which may or may not affect our competitors, by the Federal Reserve, the FDIC or other regulators. These limitations could further affect our ability to attract and retain our executive officers and other key personnel, in particular as we are more often competing for personnel with fintechs, technology companies and other less regulated entities who may not have the same limitations on compensation as we do. The increase in remote work arrangements and opportunities in regional, national and global labor markets has also increased competition to attract and retain skilled personnel. Our current or future approach to in-office and remote-work arrangements may not meet the needs or expectations of our current or prospective employees or may not be perceived as favorable as the arrangements offered by other employers, which could adversely affect our ability to attract and retain employees.

We are exposed to many types of operational risks, including business resilience, process, third party, information technology, human resource, model and fraud risks, each of which may be amplified by continued remote work. Our fraud risks include fraud committed by external parties against the Company or its customers and fraud committed internally by our associates. Certain fraud risks, including identity theft and account takeover, may increase as a result of customers' account or personally identifiable information being obtained through breaches of retailers' or other third parties' networks. Examples of external fraud we face include fraudulent checks, stolen checks and other check-related fraud. We have established processes and procedures intended to identify, measure, monitor, mitigate, report and analyze these risks; however, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated, monitored or identified. If our risk management framework proves ineffective, we could suffer unexpected losses, we may have to expend resources detecting and correcting the failure in our systems and we may be subject to potential claims from third parties and government agencies. We may also suffer severe reputational damage. Any of these consequences could adversely affect our business, financial condition or results of operations. In particular, the unauthorized disclosure, misappropriation, mishandling or misuse of personal, non-public, confidential or proprietary information of customers could result in significant regulatory consequences, reputational damage and financial loss.

Many of our borrowers operate in industries that are directly or indirectly impacted by changes in commodity prices. This includes agriculture, livestock, metals, timber, textiles and energy businesses (including oil, gas and petrochemical), as well as businesses indirectly impacted by commodities prices such as businesses that transport commodities or manufacture equipment used in production of commodities. Changes in commodity prices depend on local, regional and global events or conditions that affect supply and demand for the relevant commodity. These industries have been, and may in the future be, subject to significant volatility. For example, oil prices have been volatile, both rising and falling, in recent years. Such volatility is expected to continue in the foreseeable future due to an unpredictable geopolitical and economic environment. As a consequence of oil and gas price volatility, our energy-related portfolio may be subject to additional pressure on credit quality metrics including past due, criticized, and non-performing loans, as well as net charge-offs. In addition, legislative changes such as the elimination of certain tax incentives and the transition to a less carbon dependent economy in response to climate change and other factors could have significant impacts on this portfolio.

We provide traditional commercial, retail and mortgage banking services, as well as other financial services including asset management, wealth management, securities brokerage, merger-and-acquisition advisory services and other specialty financing. All of our businesses are materially affected by conditions in the financial markets and economic conditions generally or specifically in the South, Midwest and Texas, the principal markets in which we conduct business. A worsening of business and economic conditions generally or specifically in the principal markets in which we conduct business could have adverse effects on our business, including the following: - A decrease in the demand for, or the availability of, loans and other products and services offered by us, including as a result of changing interest rate conditions;- A decrease in the value of our loans held for sale or other assets secured by consumer or commercial real estate;- An impairment of certain intangible assets, such as goodwill;- A decrease in interest income from variable rate loans, due to declines in interest rates;- An increase in the number of clients and counterparties who become delinquent, file for protection under bankruptcy laws or default on their loans or other obligations to us, which could result in a higher level of nonperforming assets, net charge-offs, provisions for credit losses and valuation adjustments on loans held for sale;- A decrease in the supply of deposits or the need to price interest-bearing deposits higher due to competitive forces, which could result in substantial increase in cost to retain and service deposits; and - A change in the pricing or spread environment could adversely impact the yields received on newly originated loans or securities. In the event of severely adverse business and economic conditions generally or specifically in the principal markets in which we conduct business, there can be no assurance that the federal government and the Federal Reserve would intervene or make adjustments to fiscal or monetary policy that would cause business and economic conditions to improve. If business and economic conditions worsen or volatility increases, our business, financial condition and results of operations could be materially adversely affected. Volatility and uncertainty related to inflation and the effects of inflation, which has led to increased costs for businesses and consumers and potentially contribute to poor business and economic conditions generally and may enhance or contribute to some of the risks of our business. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for our products, adversely affect the creditworthiness of the Company's borrowers or result in lower values for our investment securities and other fixed-rate assets. In response to sustained inflationary pressures, the Federal Reserve has tightened monetary policy, as described below. To the extent these policies do not mitigate the volatility and uncertainty related to inflation and the effects of inflation, or to the extent conditions otherwise worsen, we could experience adverse effects on our business, financial condition and results of operations.

Weather-related events, health crises, the occurrence or worsening of disease outbreaks or pandemics such as COVID-19, or other catastrophic events, other natural or man-made disasters, climate change and the transition to a lower-carbon economy, as well as government actions or other restrictions in connection with such events, pose shorter- and longer-term risks to our business and/or that of our customers, vendors and suppliers and are expected to increase over time. A significant portion of our operations is located in the areas bordering the Gulf of Mexico and the Atlantic Ocean, regions that are susceptible to hurricanes, or in areas of the Southeastern U.S. that are susceptible to tornadoes and other severe weather events. In particular, in recent years, a number of severe hurricanes impacted areas in our footprint. Many areas in the Southeastern U.S. have also experienced severe droughts and floods in recent years. Any of these, or any other severe weather event, could cause disruption to our operations and could have a material adverse effect on our overall business, results of operations or financial condition. In some cases, we have taken preemptive measures in an effort to mitigate certain of these adverse effects, such as maintaining insurance that includes coverage for resultant losses and expenses where possible, though these measures cannot fully mitigate all future risks. We cannot be sure that such insurance will continue to be available to us on commercially reasonable terms, or at all, or that our insurers will not deny coverage as to any future claim. In addition, such measures cannot predict the nature, timing or level of severe weather events or prevent the disruption that a catastrophic earthquake, fire, hurricane, tornado or other severe weather event could cause to the markets that we serve and any resulting adverse impact on our customers, such as hindering our borrowers' ability to timely repay their loans and diminishing the value of any collateral held by us. Man-made disasters and other events connected with the Gulf of Mexico or Atlantic Ocean, such as oil spills, could have similar effects. Climate change could intensify the severity of and increase the frequency of adverse effects of weather-related events impacting us and our customers. Namely, climate change may intensify the severity of and increase the frequency of earthquakes, fires, hurricanes, tornadoes, droughts, floods and other weather-related events, which could cause even greater disruption to our business and operations. Longer-term changes, such as increasing average temperatures and rising sea levels, may damage, destroy or otherwise impact the value or productivity of our properties and other assets, reduce the availability of or increase the cost of insurance, and/or lead to prolonged disruptions in our operations. Responding to concerns around climate change provides us with potential new avenues through which we can support our stakeholders but also exposes us to risks associated with the transition to a lower-carbon economy. Such risks may result from changes in policies, laws and regulations, technologies, or market preferences relating to climate change. These changes could materially and negatively impact our business, results of operations, financial condition and our reputation, in addition to having a similar impact on our customers, vendors and suppliers. Federal and state regulatory authorities, investors and other third parties have increasingly scrutinized the business activities of financial institutions and the relationship of those activities to climate change (including such institutions' involvement or their customers' involvement in certain industries or projects associated with climate change, as well as any decisions to conduct or change activities in response to considerations relating to climate change), which may result in financial institutions facing increased pressure regarding the disclosure and management of climate risks and related lending and investment activities. As a result, we may face increased scrutiny related to our ability to demonstrate resilience to potential climate-related risks, including systemic risks posed by operational disruptions and external demands. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices, including inconsistent (and sometimes conflicting) perspectives or requirements, may result in higher regulatory, compliance, credit and reputational risks and costs. In addition, the transition to a lower-carbon economy could indirectly subject us to specific risks through our borrowers' exposure to changes in commodity prices. For more information see the "We are subject to environmental, social and governance risks that could adversely affect our business, reputation and the trading price of our common stock" and "Weakness in commodity businesses could adversely affect our performance" risk factors above.

Failure or errors in or breach of our systems or networks, or those of our third-party service providers (or providers to such third-party service providers), including as a result of cybersecurity or other similar incidents, could disrupt our businesses or impact our customers. Examples of incidents include, among other things, denial of service attacks, ransomware, malware, worms, software bugs, hacking, social engineering, phishing attacks, credential stuffing, account takeovers, insider threats, theft, malfeasance or improper access by employees or service providers, human error, fraud or other similar disruptions. These incidents could result in the loss, unauthorized disclosure, misuse or misappropriation of confidential, personal, proprietary or other information, damage to our reputation, increases to our costs and cause customer and financial losses. As a large financial institution, we depend on our ability to process, record and monitor a large number of customer transactions on a continuous basis and otherwise collect, transmit, store and process a significant amount of personal information in connection therewith. As public, regulatory and customers' expectations have increased regarding operational resilience and cybersecurity, our systems, networks and infrastructure must continue to be safeguarded and monitored for potential failures and disruptions, as well as cybersecurity or other similar incidents. Our systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be electrical or telecommunications outages; pandemics; events arising from local or larger scale political or social matters, including terrorist acts and civil unrest; and, as described below, cyber-attacks or other similar incidents. Although we have business continuity plans and other safeguards in place, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or operating systems or networks, or those of our third-party service providers, that support our businesses and customers. Cybersecurity risks for large financial institutions, such as us, have increased significantly in recent years in part because of the proliferation of technology-based products and services and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, nation state-supported actors, activists and other external parties. This increase is expected to continue and further intensify. The techniques used by cyber criminals change frequently, may not be recognized until launched (or may evade detection for considerable time), can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments, and may see their frequency increased, and effectiveness enhanced, by the use of artificial intelligence. These criminals may attempt to fraudulently induce employees, customers or other users of our systems and networks to disclose sensitive information (including confidential, personal, proprietary and other information) in order to gain access to data or our systems and networks. Third parties with whom we or our customers do business also present operational and cybersecurity risks to us, including cybersecurity or other similar incidents or failures or disruptions of their own systems and networks. While we have successfully defended similar attacks, we could become the subject of a successful similar style attack through a supply chain compromise. As noted above, our operations rely on the secure collection, transmission, storage and other processing of confidential, personal, proprietary and other information in our operating systems and networks. In addition, to access our products and services, our customers may use personal computers, smartphones, tablets and other mobile devices that are beyond our control environment. Additionally, cybersecurity and other similar incidents or terrorist activities could disrupt our or our customers' or other third parties' business operations. Although these past events have not resulted in a breach of our client data or account information, such attacks have adversely affected the performance of Regions Bank's website, www.regions.com, and, in some instances, prevented customers from accessing Regions Bank's secure websites for consumer and commercial applications. In all cases, the attacks primarily resulted in inconvenience; however, future cyber-attacks or other similar incidents could be more disruptive and damaging, and we may not be able to anticipate or prevent all such attacks. The United States government has raised concerns about a potential increase in cyber-attacks and other similar incidents generally as a result of the military conflict between Russia and Ukraine and the related sanctions imposed by the United States and other countries or the ongoing Israel-Hamas conflict. Although we believe that we have appropriate information security procedures and controls designed to prevent or limit the effects of a cybersecurity or other similar incident, our technologies, systems, networks and our customers' devices may be the target of cybersecurity or other similar incidents that could result in the unauthorized release, accessing, gathering, monitoring, loss, destruction, modification, acquisition, transfer, use or other processing of us or our customers' confidential, personal, proprietary and other information. We also have insurance coverage, that is reviewed annually, that may, subject to policy terms and conditions, cover certain losses associated with cybersecurity and other similar incidents, but our insurer may deny coverage as to any future claim or our insurance coverage may be insufficient to cover all losses from any such attack, breach or incident, including any related damage to our reputation. In addition, given the proliferation of cyber-events in our industry, the cost of cyber insurance is expected to continue to increase and may not be available at all or on acceptable terms. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. We may also be required to incur significant costs in connection with any regulatory investigation or civil litigation, fines, damages or injunctions resulting from a cybersecurity or other similar incident that impacts us. In addition, our third-party service providers may be unable to identify vulnerabilities in their systems and networks or, once identified, be unable to promptly provide required patches or other remedial measures. Further, even if provided, such patches or remedial measures may not fully address any vulnerability or may be difficult for us to implement. While we perform cybersecurity diligence on our key service providers, because we do not control our service providers and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share them. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cybersecurity or other similar incidents attributed to our service providers as they relate to the information we share with them. Disruptions or failures in the physical infrastructure or operating systems or networks that support our businesses and customers, or cybersecurity or other similar incidents of the networks, systems or devices that our customers use to access our products and services, could result in customer attrition, violation of applicable privacy and cybersecurity laws and regulations, notifications obligations, regulatory fines, civil litigation, damages, injunctions, penalties or intervention, reputational damage, reimbursement or other compensation costs, remediation costs, additional cybersecurity protection costs, increased insurance premiums and/or additional compliance costs, any of which could materially adversely affect our business, results of operations or financial condition. We could also be adversely affected if we lose access to information or services from a third-party service provider as a result of a cybersecurity or similar incident or system, network or operational failure or disruption affecting the third-party service provider. For a more detailed discussion of these risks and specific occurrences, see the "Information Security Risk" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K.

As of December 31, 2023, consumer residential real estate loans represented approximately 26.3% of our total loan portfolio. A general decline in home values would adversely affect the value of collateral securing the residential real estate that we hold, as well as the volume of loan originations and the amount we realize on the sale of real estate loans. These factors could result in higher delinquencies and greater charge-offs in future periods, which could materially adversely affect our business, financial condition or results of operations.