Zions Bancorporation National Association (ZION) Risk Factors

We, and the entire financial services industry, have incurred, and will continue to incur, substantial costs related to personnel, systems, consulting, and other activities in order to comply with banking regulations. See "Supervision and Regulation" on page 7 for further information about the regulations applicable to us and the financial services industry generally. Regulators, the U.S. Congress, state legislatures, and other governing or consultative bodies continue to enact rules, laws, and policies to regulate the financial services industry and public companies, including laws that are designed to promote, protect, or penalize certain activities or industries and their access to financial services. We are, and may in the future become, subject to these laws by offering our products and services to certain industries or in certain locations. The nature of these laws and regulations and their effect on our future business and performance cannot be predicted. There can be no assurance that any or all of these regulatory changes or actions will ultimately be enacted. However, if enacted, some of these proposals could adversely affect us by, among other things: impacting after-tax returns earned by financial services firms in general; limiting our ability to grow; increasing FDIC insurance assessments, taxes or fees on our funding or activities; limiting the range of products and services that we could offer; and requiring us to raise capital at inopportune times. Political developments may also result in substantial changes in tax, international trade, immigration, and other policies. The extent and timing of any such changes are uncertain, as are the potential direct and indirect impacts, whether beneficial or adverse. Regulations and laws may be modified or repealed, and new legislation may be enacted that will affect us and our subsidiaries. The ultimate impact of these proposals cannot be predicted as it is unclear which, if any, may be enacted.

At December 31, 2023, we had a net deferred tax asset of $1.0 billion. The accounting treatment for realization of deferred tax assets is complex and requires judgment. Our ability to fully realize our deferred tax asset could be reduced in the future if our estimates of future taxable income from our operations, future reversals of existing deferred tax liabilities ("DTLs"), or tax planning strategies do not support the realization of our deferred tax asset. Changes in applicable tax laws, regulations, macroeconomic conditions, or market conditions may adversely affect our financial results, and there can be no assurance that we will be able to fully realize our deferred tax assets. For information about how we manage capital, see "Capital Management" in MD&A on page 72.

Adverse economic conditions pose significant risks to our business, including our loan and investment portfolios, capital levels, results of operations, and financial condition. A slowing economy and uncertainty related to inflationary pressures, including related changes in monetary and fiscal policies and actions, rising interest rates, and decreased values of our fixed-rate assets, can increase these risks and lead to lower demand for loans, higher credit losses, and lower fee income, among other negative effects.

We may encounter significant operational disruptions arising from our numerous projects and initiatives. These may include significant time delays, cost overruns, loss of key people, technological problems, and processing failures. We may also experience operational disruptions due to capacity constraints, service level failures and inadequate performance, and certain replacement costs. Any or all of these issues could result in disruptions to our systems, processes, control environment, procedures, employees, and customers. The ultimate effect of any significant disruption to our business could subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability, any of which could materially affect us, including our control environment, operating efficiency, and results of operations.

We rely heavily on communications and information systems to conduct our business. We process and maintain on our systems certain information that is confidential, proprietary, personal, or otherwise sensitive, including financial and other confidential business information. We, our customers, and other financial institutions with which we interact, are subject to ongoing, continuous attempts by threat actors, such as organized cybercrime, hackers, and state-sponsored organizations to penetrate key systems. Information security risks for us and other large financial institutions have increased significantly in recent years, in part because of the proliferation of new technologies, the ubiquity of internet connections, and the increased sophistication and activities of threat actors. The types of attacks these threat actors may use include, but are not limited to: exploiting customer or system vulnerabilities or misconfigurations, deceiving employees through email phishing or social engineering, and compromising any of our suppliers. Third parties, including our suppliers and their subcontractors, also present operational and information security risks to us, including security incidents or failures of their own systems and downstream systems. In incidents involving third parties, we may not be informed promptly of any effect on our services or our data, or be able to participate in any related investigation, notification, or remediation that occurs. The possibility of third-party or employee error, failure to follow security procedures, or malfeasance also presents these risks. As cybersecurity threats continue to evolve, we will be required to expend additional resources to continue to modify or enhance our defenses or to investigate or remediate any information security vulnerabilities. We, and our third-party suppliers, have experienced cybersecurity incidents in the past that have not had material impact to our data, customers, or operations, but there can be no assurance that any such failure, interruption, or significant security breach will not occur in the future, or, if any future occurrences will be adequately addressed. It is impossible to determine the severity or potential effects of these incidents with any certainty. System enhancements and updates may also create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our defenses itself can create a risk of systems disruptions and security issues. We may face additional risks to the extent our hardware and software providers are unable to deliver patches and updates to mitigate vulnerabilities or we are unable to implement patches in a timely manner, particularly when a vulnerability is being actively exploited by threat actors. We have devoted and will continue to devote significant resources to the security of our computer systems, but they may still be vulnerable to these threats and our efforts may subsequently be deemed to have been inadequate by regulators or courts. The occurrence of any failure, interruption or security incident to our information systems or those of our third-party suppliers could interfere with or disrupt our operations and services, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, expose us to civil litigation and financial liability, or otherwise result in material adverse consequences on us. For information about how we manage cybersecurity risk, see Part I, Item 1C. Cybersecurity on page 24.