Regions Financial (RF) Risk Analysis

The content and application of laws and regulations affecting financial services firms sometimes vary according to factors such as the size of the firm, the jurisdiction in which it is organized or operates and other criteria. Financial technology companies and other non-traditional competitors may not be subject to banking regulation, or may be supervised by a national or state regulatory agency that does not have the same regulatory priorities or supervisory requirements as our regulators. These differences in regulation can impair our ability to compete effectively with competitors that are less regulated that do not have similar compliance costs.

In the course of our business, we may foreclose on and take title to real estate. As a result, we could be subject to environmental liabilities with respect to these properties. We may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs incurred by these parties in connection with environmental contamination or may be required to investigate or clean up hazardous or toxic substances or chemical releases at a property. The costs associated with investigation or remediation activities could be substantial. In addition, if we are the owner or former owner of a contaminated site, we may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. If we become subject to significant environmental liabilities, our business, financial condition or results of operations could be adversely affected.

Failure or errors in or breach of our systems or networks, or those of our third-party service providers (or providers to such third-party service providers), including as a result of cybersecurity or other similar incidents, could disrupt our businesses or impact our customers. Examples of incidents include, among other things, denial of service attacks, ransomware, malware, worms, software bugs, hacking, social engineering, phishing attacks, credential stuffing, account takeovers, insider threats, theft, malfeasance or improper access by employees or service providers, human error, fraud or other similar disruptions. These incidents could result in the loss, unauthorized disclosure, misuse or misappropriation of confidential, personal, proprietary or other information, damage to our reputation, increases to our costs and cause customer and financial losses. As a large financial institution, we depend on our ability to process, record and monitor a large number of customer transactions on a continuous basis and otherwise collect, transmit, store and process a significant amount of personal information in connection therewith. As public, regulatory and customers' expectations have increased regarding operational resilience and cybersecurity, our systems, networks and infrastructure must continue to be safeguarded and monitored for potential failures and disruptions, as well as cybersecurity or other similar incidents. Our systems and facilities may stop operating properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control. For example, there could be electrical or telecommunications outages; pandemics; events arising from local or larger scale political or social matters, including terrorist acts and civil unrest; and, as described below, cyber-attacks or other similar incidents. Although we have business continuity plans and other safeguards in place, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or operating systems or networks, or those of our third-party service providers, that support our businesses and customers. Cybersecurity risks for large financial institutions, such as us, have increased significantly in recent years in part because of the proliferation of technology-based products and services and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, nation state-supported actors, activists and other external parties. This increase is expected to continue and further intensify. The techniques used by cyber criminals change frequently, may not be recognized until launched (or may evade detection for considerable time), can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments, and may see their frequency increased, and effectiveness enhanced, by the use of AI. These criminals may attempt to fraudulently induce employees, customers or other users of our systems and networks to disclose sensitive information (including confidential, personal, proprietary and other information) in order to gain access to data or our systems and networks. Third parties with whom we or our customers do business also present operational and cybersecurity risks to us, including cybersecurity or other similar incidents or failures or disruptions of their own systems and networks. While we have successfully defended similar attacks, we could become the subject of a successful similar style attack through a supply chain compromise. As noted above, our operations rely on the secure collection, transmission, storage and other processing of confidential, personal, proprietary and other information in our operating systems and networks. In addition, to access our products and services, our customers may use personal computers, smartphones, tablets and other mobile devices that are beyond our control environment. Additionally, cybersecurity and other similar incidents or terrorist activities could disrupt our or our customers' or other third parties' business operations. Although these past events have not resulted in a breach of our client data or account information, such attacks have adversely affected the performance of Regions Bank's website, www.regions.com, and, in some instances, prevented customers from accessing Regions Bank's secure websites for consumer and commercial applications. In all cases, the attacks primarily resulted in inconvenience; however, future cyber-attacks or other similar incidents could be more disruptive and damaging, and we may not be able to anticipate or prevent all such attacks. The U.S. government has raised concerns about increases in cyber-attacks and other similar incidents generally as a result of various political and military conflicts around the world. Although we believe that we have appropriate information security procedures and controls designed to prevent or limit the effects of a cybersecurity or other similar incident, our technologies, systems, networks and our customers' devices may be the target of cybersecurity or other similar incidents that could result in the unauthorized release, accessing, gathering, monitoring, loss, destruction, modification, acquisition, transfer, use or other processing of us or our customers' confidential, personal, proprietary and other information. We also have insurance coverage, that is reviewed annually, that may, subject to policy terms and conditions, cover certain losses associated with cybersecurity and other similar incidents, but our insurer may deny coverage as to any future claim or our insurance coverage may be insufficient to cover all losses from any such attack, breach or incident, including any related damage to our reputation. In addition, given the proliferation of cyber-events in our industry, the cost of cyber insurance is expected to continue to increase and may not be available at all or on acceptable terms. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. We may also be required to incur significant costs in connection with any regulatory investigation or civil litigation, fines, damages or injunctions resulting from a cybersecurity or other similar incident that impacts us. In addition, our third-party service providers may be unable to identify vulnerabilities in their systems and networks or, once identified, be unable to promptly provide required patches or other remedial measures. Further, even if provided, such patches or remedial measures may not fully address any vulnerability or may be difficult for us to implement. While we perform cybersecurity diligence on our key service providers, because we do not control our service providers and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share them. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cybersecurity or other similar incidents attributed to our service providers as they relate to the information we share with them. Disruptions or failures in the physical infrastructure or operating systems or networks that support our businesses and customers, or cybersecurity or other similar incidents of the networks, systems or devices that our customers use to access our products and services, could result in customer attrition, violation of applicable privacy and cybersecurity laws and regulations, notifications obligations, regulatory fines, civil litigation, damages, injunctions, penalties or intervention, reputational damage, reimbursement or other compensation costs, remediation costs, additional cybersecurity protection costs, increased insurance premiums and/or additional compliance costs, any of which could materially adversely affect our business, results of operations or financial condition. We could also be adversely affected if we lose access to information or services from a third-party service provider as a result of a cybersecurity or similar incident or system, network or operational failure or disruption affecting the third-party service provider. For a more detailed discussion of these risks and specific occurrences, see the "Information Security Risk" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K.

Our ability to operate our businesses efficiently and profitably, to offer products and services that meet the expectations of our clients and customers, and to maintain an effective risk management framework is highly dependent on our ability to staff our operations appropriately and on the competence, integrity, health and safety of our employees. We are similarly dependent on the workforces of other parties on which our operations rely, including vendors and other service providers. Our businesses could be materially and adversely affected by the ineffective implementation of business decisions; any failure to institute controls that appropriately address risks associated with business activities; or appropriately train employees with respect to those risks and controls; staffing shortages, particularly in tight labor markets. In addition, our business could be adversely impacted by a significant operational breakdown or failure, theft, fraud or other unlawful conduct or other negative outcomes caused by human error or misconduct by an employee of us or of another party on which our operations depend. Our operations could also be impaired if the measures taken by us or by governmental authorities to help ensure the health and safety of our employees are ineffective, or if any external party on which we rely fails to take appropriate and effective actions to protect the health and safety of its employees.

We are exposed to many types of operational risks, including business resilience, process, third party, information technology, human resource, model and fraud risks, each of which may be amplified by continued remote work. Our fraud risks include fraud committed by external parties against the Company or its customers and fraud committed internally by our associates. Certain fraud risks, including identity theft and account takeover, may increase as a result of customers' account or personal information being obtained through breaches of retailers' or other third parties' networks. Examples of external fraud we face include fraudulent checks, stolen checks and other check-related fraud. We have established processes and procedures intended to identify, measure, monitor, mitigate, report and analyze these risks; however, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated, monitored or identified. If our risk management framework proves ineffective, we could suffer unexpected losses, we may have to expend resources detecting and correcting the failure in our systems and we may be subject to potential claims from third parties and government agencies. We may also suffer severe reputational damage. Any of these consequences could adversely affect our business, financial condition or results of operations. In particular, the unauthorized disclosure, misappropriation, mishandling or misuse of personal, non-public, confidential or proprietary information of customers could result in significant regulatory consequences, reputational damage and financial loss.

Many of our borrowers operate in industries that are directly or indirectly impacted by changes in commodity prices. This includes agriculture, livestock, metals, timber, textiles and energy businesses (including oil, gas and petrochemical), as well as businesses indirectly impacted by commodities prices such as businesses that transport commodities or manufacture equipment used in production of commodities. Changes in commodity prices depend on local, regional and global events or conditions that affect supply and demand for the relevant commodity. These industries have been, and may in the future be, subject to significant volatility. For example, oil prices have been volatile, both rising and falling, in recent years. Such volatility is expected to continue in the foreseeable future due to an unpredictable geopolitical and economic environment. As a consequence of oil and gas price volatility, our energy-related portfolio may be subject to additional pressure on credit quality metrics including past due, criticized, and non-performing loans, as well as net charge-offs. In addition, legislative changes such as the elimination of certain tax incentives and the transition to a less carbon dependent economy in response to climate change and other factors could have significant impacts on this portfolio.

Our operations are concentrated primarily in the South, Midwest and Texas. As a result, local economic conditions in these areas significantly affect the demand for the loans and other products we offer to our customers (including real estate, commercial and construction loans), the ability of borrowers to repay these loans and the value of the collateral securing these loans. Any declines in real estate values in these areas may adversely affect borrowers and the value of the collateral securing many of our loans, which could adversely affect our currently performing loans, leading to future delinquencies or defaults and increases in our provision for credit losses. Adverse changes in the economic conditions in these regions could materially adversely affect our business, results of operations or financial condition.

Aggressive actions by hostile governments or groups, including armed conflict or intensified cyber-attacks, could expand in unpredictable ways by drawing in other countries or escalating into full-scale war with potentially catastrophic consequences, particularly if one or more of the combatants possess nuclear weapons. Depending on the scope of the conflict, the hostilities could result in worldwide economic disruption, heightened volatility in financial markets, severe declines in asset values, disruption of global trade and supply chains and diminished consumer, business and investor confidence. Instability in geopolitical matters could have a material adverse effect on our results of operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. For example, trade negotiations between the United States and other nations remain uncertain and could adversely impact economic and market conditions for our and our clients and counterparties. Global political and military conflicts, including the ongoing conflicts in the Ukraine and the Middle East, present destabilizing forces, including higher and more volatile commodity and food prices, which may cause international and domestic economic deterioration. Financial markets may be adversely affected by the current or anticipated impact of military conflicts, including the conflicts in the Ukraine and the Middle East, terrorism or other geopolitical events (including China-Taiwan and U.S.-China relations), which could cause higher inflation. Any of the above consequences could have significant negative effects on the U.S. economy, and, as a result, our operations and earnings. We could also experience more numerous and aggressive cyber-attacks launched by or under the sponsorship of one or more of the adversaries in such a conflict.

As of December 31, 2024, consumer residential real estate loans represented approximately 26.5 percent of our total loan portfolio. A general decline in home values would adversely affect the value of collateral securing the residential real estate that we hold, as well as the volume of loan originations and the amount we realize on the sale of real estate loans. Additionally, if insurance obtained by our borrowers is insufficient to cover any losses sustained to the collateral, the decreases in the value of collateral securing our loans as a result of natural disasters or other related events could adversely impact our financial condition and results of operations. If insurance coverage is unavailable to our borrowers due to the reluctance of insurance companies to renew policies covering the collateral or due to other factors, the resulting increase in cost of home ownership could affect the ability of borrowers to repay loans. These factors could result in higher delinquencies and greater charge-offs in future periods, which could materially adversely affect our business, financial condition or results of operations.