Citizens Financial Group Inc.: 10-K Risk Factor Changes

We are regulated by multiple banking, consumer protection, securities, and other regulatory authorities at the federal and state levels. This regulatory oversight is primarily established to protect depositors, the DIF, consumers of financial products, and the financial system as a whole, not for the protection of shareholders or other investors. Changes to statutes, regulations, rules, or policies, including their interpretation, implementation, or enforcement, could affect us in substantial and unpredictable ways, including by, for example, subjecting us to additional costs, limiting the types of financial services and other products we may offer, limiting our ability to pursue acquisitions, and increasing the ability of third parties, including non-banks, to offer competing financial services and products. Certain regulators and law enforcement authorities have required admissions of wrongdoing and, in some cases, criminal pleas as part of the resolutions of matters brought by them against financial institutions. Any such resolution of a matter involving us could lead to increased exposure to civil litigation, could adversely affect our reputation, could result in penalties or limitations on our ability to do business or engage in certain activities, and could have other negative effects. In addition, a single event or issue may give rise to numerous and overlapping investigations and proceedings, including by multiple federal and state regulators and other governmental authorities. We are also subject to laws and regulations relating to the privacy of the information of our customers, employees, counterparties, and others, and any failure to comply with these laws and regulations could expose us to liability and/or reputational damage. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with those laws and regulations, as well as our potential liability for non-compliance and our reporting obligations in the case of data breaches, may significantly increase. Uncertainty exists with respect to the enactment of new laws and regulations, or changes in the interpretation or enforcement of existing laws and regulations, including potential deregulation in some areas. In addition, litigation challenging actions or regulations by federal or state authorities could, depending on the outcome, significantly affect the regulatory and supervisory framework affecting our operations. For more information on regulations to which we are subject, see the “Regulation and Supervision” section in Item 1.

We are heavily regulated by multiple banking, consumer protection, securities and other regulatory authorities at the federal and state levels. This regulatory oversight is primarily established to protect depositors, the DIF, consumers of financial products, and the financial system as a whole, not for the protection of shareholders or other investors. Changes to statutes, regulations, rules or policies, including their interpretation, implementation or enforcement, could affect us in substantial and unpredictable ways, including by, for example, subjecting us to additional costs, limiting the types of financial services and other products we may offer, limiting our ability to pursue acquisitions and increasing the ability of third parties, including non-banks, to offer competing financial services and products. In recent years, we, together with the rest of the financial services industry, have faced particularly intense scrutiny, with many new regulatory initiatives and vigorous oversight and enforcement on the part of numerous regulatory and governmental authorities. Legislatures and regulators have pursued a broad array of initiatives intended to promote the safety and soundness of financial institutions, financial market stability, the transparency and liquidity of financial markets, and consumer and investor protection. Certain regulators and law enforcement authorities have also recently required admissions of wrongdoing and, in some cases, criminal pleas as part of the resolutions of matters brought by them against financial institutions. Any such resolution of a matter involving us could lead to increased exposure to civil litigation, could adversely affect our reputation, could result in penalties or limitations on our ability to do business or engage in certain activities and could have other negative effects. In addition, a single event or issue may give rise to numerous and overlapping investigations and proceedings, including by multiple federal and state regulators and other governmental authorities. We are also subject to laws and regulations relating to the privacy of the information of our customers, employees, counterparties and others, and any failure to comply with these laws and regulations could expose us to liability and/or reputational damage. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with those laws and regulations, as well as our potential liability for non-compliance and our reporting obligations in the case of data breaches, may significantly increase. While there have been significant revisions to the laws and regulations applicable to us that have been finalized in recent years, there are other rules to implement changes that have yet to be proposed or enacted by our regulators. The final timing, scope and impact of these changes to the regulatory framework applicable to financial institutions remains uncertain. Uncertainty exists with respect to new laws or regulations or changes in the interpretation or enforcement of existing laws or regulations, including potential deregulation in some areas. In addition, litigation challenging actions or regulations by federal or state authorities could, depending on the outcome, significantly affect the regulatory and supervisory framework affecting our operations. For more information on regulations to which we are subject and recent initiatives to reform financial institution regulation, see the “Regulation and Supervision” section in Item 1.

We manage our business through two primary business segments: Consumer Banking and Commercial Banking. Our activities outside these segments are classified as Other and primarily includes treasury and community development operations, along with other unallocated assets, liabilities, capital, revenues, provision (benefit) for credit losses, and expenses, including income tax expense (benefit). For additional information regarding our business segments see the “Business Segments” section of Item 7 and Note 24 in Item 8. Consumer Banking Segment Consumer Banking serves consumer customers and small businesses, with products and services that include deposits, mortgage and home equity lending, credit cards, small business loans, and wealth management solutions largely across our 14-state traditional banking footprint. We also offer education and point-of-sale finance loans in addition to select digital deposit products nationwide. Citizens Private Bank and Private Wealth integrate banking services and wealth management solutions to serve high- and ultra-high-net-worth individuals and families, as well as investors, entrepreneurs, and businesses. Consumer Banking operates a multi-channel distribution network with a workforce of approximately 5,100 branch colleagues, 1,000 branches, including 117 in-store locations, and 3,100 ATMs. Our network includes approximately 1,500 specialists covering lending, savings, and wealth management needs as well as a broad range of small business products and services. We serve customers on a national basis through telephone service centers and our online and mobile platforms where we offer customers the convenience of depositing funds, paying bills, and transferring money between accounts and from person to person, as well as a host of other everyday transactions. Commercial Banking Segment Commercial Banking primarily serves companies and institutions and strives to be a trusted advisor to our clients and preferred provider for their banking needs. We offer a broad complement of financial products and solutions, including lending and leasing, deposit and treasury management services, foreign exchange, interest rate and commodity risk management solutions, as well as loan syndication, corporate finance, merger and acquisition, and debt and equity capital markets capabilities. Commercial Banking is organized around client segments and their banking needs. Middle Market & Midcorporate - Commercial & Industrial, Commercial Real Estate, Capital Markets and Advisory, and Treasury & Wholesale Payments work together to understand client needs and provide comprehensive solutions to meet those needs. We acquire new clients through a coordinated approach to the market, leveraging deep industry knowledge in specialized banking groups and a geographic coverage model. Middle Market & Midcorporate - Commercial & Industrial serves commercial and industrial clients based in the United States. To better meet the unique needs of these client segments we offer a more dedicated and tailored approach and cover a group of targeted industry sectors. Commercial Real Estate provides customized debt capital solutions for middle-market operators, institutional developers, investors, and real estate investment trusts. Commercial Real Estate provides financing for projects primarily in the multifamily, office, industrial, retail, healthcare, and hospitality sectors. Capital Markets and Advisory serves clients through key product groups including Corporate Finance, Capital Markets, and Global Markets. Corporate Finance primarily provides advisory services to middle-market and mid-corporate clients, including mergers and acquisitions and capital structure advice. The team works closely with industry-sector specialists within capital markets to advise our clients. Corporate Finance also provides acquisition and follow-on financing for new and recapitalized portfolio companies of key sponsors, with services meeting the unique and time-sensitive needs of private equity firms, management companies, and funds, and underwriting and portfolio management expertise for leveraged transactions and relationships. Capital Markets originates, structures, and underwrites credit and equity facilities targeting middle-market, mid-corporate, and private equity sponsors. They focus on offering value-added ideas to optimize their capital structures, including advising on and facilitating mergers and acquisitions, valuations, tender offers, financial restructurings, bond and equity underwriting, asset sales, divestitures, and other corporate reorganizations and business combinations. Capital Markets also provides sales and trading across loan, fixed income, and equity products, as well as other brokerage services including equity research. Global Markets provides foreign exchange, interest rate, and commodities risk management services. Treasury & Wholesale Payments supports Commercial Banking and certain small business clients with treasury management and payment solutions, including domestic and international products and services related to receivables, payables, information reporting, and liquidity management, as well as commercial credit cards and trade finance.

Commercial Banking primarily serves companies and institutions and strives to be a trusted advisor to our clients and preferred provider for their banking needs. We offer a broad complement of financial products and solutions, including lending and leasing, deposit and treasury management services, foreign exchange, interest rate and commodity risk management solutions, as well as syndicated loans, corporate finance, mergers and acquisitions, and debt and equity capital markets capabilities. Commercial Banking is organized around client segments and their banking needs. Corporate Banking, Commercial Real Estate, Capital Markets and Advisory, and Treasury Solutions work together to understand client needs and provide comprehensive solutions to meet those needs. We acquire new clients through a coordinated approach to the market, leveraging deep industry knowledge in specialized banking groups and a geographic coverage model. Corporate Banking serves commercial and industrial clients and corporate clients in the United States. In several areas, such as Aerospace, Defense and Government Services, Communications, Transportation and Logistics, Food and Restaurants, Human Capital Management, and Gaming we offer a more dedicated and tailored approach to better meet the unique needs of these client segments. Commercial Real Estate provides customized debt capital solutions for middle-market operators, institutional developers, investors, and REITs. Commercial Real Estate provides financing for projects primarily in the multi-family, office, industrial, retail, healthcare and hospitality sectors. Capital Markets and Advisory serves clients through key product groups including Corporate Finance, Capital Markets, and Global Markets. Corporate Finance provides advisory services to middle-market and mid-corporate clients, including mergers and acquisitions and capital structure advice. The team works closely with industry-sector specialists within capital markets to advise our clients. Corporate Finance also provides acquisition and follow-on financing for new and recapitalized portfolio companies of key sponsors, with services meeting the unique and time-sensitive needs of private equity firms, management companies and funds, and underwriting and portfolio management expertise for leveraged transactions and relationships. Capital Markets originates, structures and underwrites credit and equity facilities targeting middle-market, mid-corporate and private equity sponsors. They focus on offering value-added ideas to optimize their capital structures, including advising on and facilitating mergers and acquisitions, valuations, tender offers, financial restructurings, bond and equity underwriting, asset sales, divestitures and other corporate reorganizations and business combinations. Capital Markets also provides sales and trading across loan, fixed income and equity products, as well as other brokerage services including equity research. Global Markets provides foreign exchange, interest rate and commodities risk management services. The Treasury Solutions product group supports Commercial Banking and certain small business clients with treasury management solutions, including domestic and international products and services related to receivables, payables, information reporting and liquidity management, as well as commercial credit cards and trade finance.

Our business is affected by national economic and political conditions, as well as perceptions of those conditions and future economic prospects, with changes in such conditions neither predictable or controllable. Adverse economic and political conditions, such as global trade policies, inflationary pressures, and government shutdowns could have a material adverse effect on our business, financial condition, and results of operations. U.S. global trade policies, including the imposition of tariffs and uncertainty surrounding the resolution of trade disputes, or renewal of trade agreements, with various countries, may cause inflation to rise and ultimately affect interest rates. In addition, the risk of government shutdowns could cause volatility in the financial markets by adversely impacting consumer and investor confidence. Unfavorable changes related to these national economic and political conditions may also result in increased delinquencies and defaults among borrowers in light of economic uncertainty, which could require us to charge off a higher percentage of loans and increase the provision for credit losses, ultimately reducing our net income.

Our business is affected by national economic conditions, as well as perceptions of those conditions and future economic prospects. Changes in such economic conditions are not predictable and cannot be controlled. Adverse economic conditions, such as recent inflationary pressures, could require us to charge off a higher percentage of loans and increase the provision for credit losses, which would reduce our net income and otherwise have a material adverse effect on our business, financial condition and results of operations.

Our operations are subject to regulation, supervision, and examination under federal and state laws and regulations. These laws and regulations cover all aspects of our business, including lending practices, deposit insurance, customer privacy and cybersecurity, capital adequacy and planning, liquidity, safety and soundness, consumer protection and disclosure, permissible activities and investments, and certain transactions with affiliates. These laws and regulations are intended primarily for the protection of customers, depositors, the DIF, and the banking system as a whole and not for the protection of shareholders or other investors. The discussion below outlines the material elements of selected laws and regulations applicable to us and our subsidiaries, but does not summarize all possible or proposed changes in laws or regulations. Changes in applicable law or regulation, and in their interpretation and application by regulatory agencies and other governmental authorities, cannot be predicted, but may have a material effect on our business, financial condition, or results of operations. We are subject to examinations by federal banking regulators, as well as the SEC, FINRA, CFTC, and various state insurance and securities regulators. In some cases, regulatory agencies may take supervisory actions that may not be publicly disclosed, and such actions may restrict or limit our activities or activities of our subsidiaries. As part of our regular examination process, regulators may advise us to operate under various restrictions as a prudential matter. We periodically receive requests for information from regulatory authorities at the federal and state level, including from banking, securities, and insurance regulators, state attorneys general, federal agencies or law enforcement authorities, and other regulatory authorities concerning our business practices. Such requests are considered incidental to the normal conduct of business. For a further discussion of how regulatory actions may impact our business, see Item 1A “Risk Factors.” For additional information regarding regulatory matters, see Note 23 in Item 8. Overview We are a BHC under the Bank Holding Company Act and have elected to be treated as a FHC under amendments to this Act as effected by GLBA. As such, we are subject to the supervision, examination, and reporting requirements of the Bank Holding Company Act and the regulations of the FRB, including through the Federal Reserve Bank of Boston. Under the system of “functional regulation” established under the Bank Holding Company Act, the FRB serves as the primary regulator of our consolidated organization. The OCC serves as the primary regulator for CBNA, and the SEC and FINRA serve as the primary regulators of our broker-dealer subsidiaries. The federal banking regulators have authority to approve or disapprove mergers, acquisitions, consolidations, the establishment of branches, and similar corporate actions. These banking regulators also have the power to prevent the continuance or development of unsafe or unsound banking practices or other violations of law. Federal law governs the activities in which CBNA engages, including the investments it makes and the aggregate amount of available credit that it may grant to one borrower. Various consumer and compliance laws and regulations also affect its operations. The actions the FRB takes to implement monetary policy also affect us. In addition, CBNA is subject to regulation, supervision, and examination by the CFPB with respect to consumer protection laws and regulations. The CFPB regulates the offering and provision of consumer financial products by depository institutions, such as CBNA, with more than $10 billion in total assets. The CFPB may promulgate rules under a variety of consumer financial protection statutes, including the Truth in Lending Act, the Equal Credit Opportunity Act, the Electronic Funds Transfer Act, and the Real Estate Settlement Procedures Act. Enhanced Prudential Standards and Regulatory Tailoring Rules As a BHC with over $100 billion in total consolidated assets, we are currently subject to enhanced prudential standards and associated capital and liquidity rules (“Tailoring Rules”). The Tailoring Rules assign each BHC, including its bank subsidiaries, to one of four categories based on its size and certain risk-based indicators. CFG and CBNA are each subject to Category IV standards, the least restrictive of the requirements under the Tailoring Rules. Bank and Financial Holding Company Regulation As a FHC, we may engage in a broader range of activities than a BHC that is not also a FHC. These activities include securities underwriting and dealing, insurance underwriting and brokerage, merchant banking, and other activities that are determined by the FRB, in coordination with the U.S. Department of the Treasury, to be “financial in nature or incidental thereto” or that the FRB determines unilaterally to be “complementary” to financial activities. In addition, a FHC may commence new permissible financial activities or acquire non-bank financial companies engaged in such activities, in either case, with after-the-fact notice to the FRB. To maintain FHC status, a BHC and all of its depository institution subsidiaries must remain “well capitalized” and “well managed,” as described below under “Federal Deposit Insurance Act.” If a BHC fails to meet these regulatory standards, the FRB could place limitations on its ability to conduct the broader financial activities permissible for FHCs or impose limitations or conditions on the conduct or activities of the BHC or its affiliates. If the deficiencies persisted, the FRB could order the BHC to divest any subsidiary bank or to cease engaging in any activities permissible for FHCs that are not permissible for BHCs, or the BHC could elect to conform its non-banking activities to those permissible for a BHC that is not also a FHC. In addition, the CRA requires U.S. banks to help serve the needs of their communities. If a depository institution subsidiary of a BHC were to receive a CRA rating of less than “satisfactory”, the BHC would be prohibited from engaging in certain activities or acquisitions (see “Community Reinvestment Act” below). Federal and state laws impose notice and approval requirements for mergers and acquisitions of other depository institutions or BHCs. As noted above, FRB approval is generally not required for BHCs to acquire a company engaged in activities that are financial in nature or incidental to activities that are financial in nature, as determined by the FRB. Prior regulatory approval is required, however, before a BHC may acquire or control more than 5% of any class of voting shares or substantially all of the assets of a BHC, including a FHC, or a bank. In considering applications for approval of acquisitions, the banking regulators may take several factors into account, including the competitive effects of the transaction in the relevant geographic markets; the financial and managerial resources and future prospects of companies involved in the transaction; the effect of the transaction on the financial stability of the U.S. banking or financial system; the companies’ compliance with anti-money laundering laws and regulations; the convenience and needs of the communities to be served; and the performance record of the IDIs involved in the transaction under the CRA. Capital and Stress Testing Requirements We are required to comply with the U.S. Basel III rules, which establish risk-based and leverage capital requirements. The risk-based requirements are based on a banking organization’s RWA, which is inclusive of the organization’s on- and off-balance sheet exposures. We calculate RWA using the standardized approach and have made the AOCI opt-out election, permitting us to exclude components of AOCI from regulatory capital. The leverage requirements are based on a banking organization’s average consolidated on-balance sheet assets. Under the U.S. Basel III rules, the minimum capital ratios are: •CET1 capital ratio of 4.5%; •Tier 1 capital ratio of 6.0%; •Total capital ratio of 8.0%; and •Tier 1 leverage ratio of 4.0%. For BHCs with $100 billion or more in assets, such as us, the FRB’s capital rules impose an institution-specific SCB on top of each of the three minimum risk-based capital ratios listed above. Banking institutions that fail to meet the effective minimum ratios including the SCB will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the institution’s “eligible retained income”, defined as the greater of four quarter trailing net income net of distributions and tax effects not reflected in net income, or the average four quarter trailing net income. As a Category IV firm under the Tailoring Rules, we are subject to biennial supervisory stress testing and are exempt from company-run stress testing and related disclosure requirements. The FRB supervises Category IV firms on an ongoing basis, including evaluating the capital adequacy and capital planning processes of firms during off-cycle years. We are required to develop, maintain, and submit an annual capital plan for review and approval by our Board of Directors, or one of its committees, as well as FR Y-14 reporting requirements. In July 2023, the federal banking regulators issued a proposal to implement the final components of the Basel III capital framework. The proposal, commonly referred to as Basel III “Endgame,” would significantly revise the capital requirements applicable to large banking organizations with total assets of $100 billion or more, including the Company and CBNA as Category IV firms. Under the proposal, the Company and CBNA would (i) be subject to the same capital treatment regarding the inclusion of AOCI, deductions, and rules for minority interest as Category I and II firms, (ii) be required to utilize two new standardized approaches for credit, operational, market, and credit valuation adjustment risk, (iii) be required to calculate counterparty credit exposure related to derivative transactions using the standardized approach for counterparty credit risk, and (iv) become subject to the supplementary leverage ratio and the countercyclical capital buffer. The federal banking regulators have not finalized this proposal and indicated that their aim is to unveil a re-proposal of the rule in early 2026. However, the timing and scope of any final rule are uncertain at this point in time. We will continue to monitor developments related to this proposal. In April 2025, the FRB issued a proposal designed to reduce the volatility of year-over-year changes in regulatory capital requirements stemming from its annual stress test results, including averaging the results of the prior two annual supervisory stress tests to inform a firm’s SCB requirement. Category IV firms, like us, that choose, or are otherwise required, to participate in consecutive supervisory stress tests would also be subject to results averaging. The proposal would also extend the annual effective date of the SCB requirement from October 1 to January 1 of the following year, providing firms with additional time to comply with their updated SCB requirement. The FRB’s proposed changes are not designed to materially affect overall bank capital requirements, but rather to decrease regulatory reporting burden. In October 2025, the FRB issued a proposal to enhance the transparency and public accountability of its supervisory stress testing framework. The FRB is seeking comment on (i) the supervisory stress test models and related revisions intended to enhance the transparency of its stress test framework, and (ii) an enhanced disclosure process that would include public comment on material model changes and the annual stress test scenarios. We are also subject to the FRB's risk-based capital requirements for market risk. See the “Market Risk” section of Item 7 for additional details. For more details regarding our regulatory capital and SCB, and the AOCI impact of the Basel III Endgame proposal on our regulatory capital, see the “Capital” section of Item 7. Liquidity Requirements The liquidity coverage ratio (“LCR”) is designed to ensure that a covered bank or BHC maintains an adequate level of unencumbered high-quality liquid assets to cover expected net cash outflows over a 30-day time horizon under an acute liquidity stress scenario. The net stable funding ratio (“NSFR”) is designed to promote more medium- and long-term funding of the assets and activities of banking organizations over a one-year time horizon. Under the Tailoring Rules, Category IV firms with less than $50 billion in weighted short-term wholesale funding, such as us, are not subject to any LCR or NSFR requirement. We are subject to certain liquidity requirements under the Tailoring Rules including liquidity buffer, stress testing, risk management, and reporting requirements. In addition, as a Category IV firm, we are required to calculate collateral positions monthly, establish a set of liquidity risk limits, and monitor certain elements of intraday liquidity risk exposures. Resolution Planning The FDIC requires IDIs with $100 billion or more in average total assets that are not affiliates of U.S. global systemically important banking organizations, including CBNA, to submit full resolution plans triennially, with interim supplemental submissions due annually in the intervening years. The FDIC adopted its IDI resolution planning rule in July 2024 to focus on the operational information most relevant for the FDIC to conduct an effective resolution. This rule prioritized executing a large bank resolution through a weekend sale or, if necessary, operating the bank for a short period of time while rapidly marketing the institution or its assets. Institutions must provide credible and detailed information that supports the FDIC’s ability to conduct a low‑cost resolution, ensures timely access to insured deposits, maximizes value from the sale or disposition of assets, and mitigates risks to U.S. financial stability. CBNA submitted its most recent resolution plan to the FDIC on June 25, 2025, and is expected to file an interim submission on or before July 1, 2026. Long-Term Debt Requirements In August 2023, the federal banking regulators issued a proposal that would require large bank holding companies and IDIs with total assets of $100 billion or more, such as CFG and CBNA, to maintain a minimum amount of long-term debt. The joint agency proposal aims to increase the resolvability and resiliency of large banking organizations by mandating a long-term debt requirement to provide the regulatory agencies additional resources to resolve failed banking organizations, foster depositor confidence, and decrease costs to the DIF in the event of a large banking organization failure. Under the proposal, large bank holding companies and IDIs would be (i) required to maintain a minimum amount of eligible long-term debt, (ii) prohibited from engaging in certain activities that could complicate their resolution, and (iii) discouraged from holding long-term debt issued by other banks to reduce interconnectedness. The proposal provides for a phase-in of the long-term debt requirement over a three-year transition period. The federal banking regulators have not finalized this proposal and the timing and scope of any final rule are uncertain at this point in time. We will continue to monitor developments related to this proposal. Standards for Safety and Soundness The FDIA requires the federal banking regulators to prescribe operational and managerial standards for all IDIs, including CBNA. Regulations and interagency guidelines adopted by these agencies set forth the safety and soundness standards used to identify and address problems at IDIs before capital becomes impaired. If an agency determines that a bank fails to satisfy any standard, it may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans. If, after being notified to submit a compliance plan, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other types of actions that an undercapitalized institution is subject to under the FDIA as discussed in “Federal Deposit Insurance Act” below. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties. Federal Deposit Insurance Act The FDIA requires, among other things, that federal banking regulators take “prompt corrective action” with respect to IDIs that do not meet minimum capital requirements, as described above in “Capital and Stress Testing Requirements.” The FDIA sets forth the following five capital categories: “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.” An IDI’s capital category is determined based on how its capital levels compare with various relevant capital measures and certain other factors that are established by regulation. The federal banking regulators must take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions that are undercapitalized, significantly undercapitalized, or critically undercapitalized, with the actions becoming more restrictive and punitive the lower the institution’s capital category. Under existing rules, an IDI that is not an advanced approaches institution, such as CBNA, is deemed to be “well capitalized” if it has a CET1 ratio of at least 6.5%, a Tier 1 capital ratio of at least 8%, a Total capital ratio of at least 10%, and a Tier 1 leverage ratio of at least 5%. The FRB’s regulations which are applicable to BHCs, such as the Parent Company, separately define “well capitalized” as having a Tier 1 capital ratio of at least 6% and a Total capital ratio of at least 10%. As described above under “Bank and Financial Holding Company Regulation”, a FHC that is not well capitalized and well managed, or whose bank subsidiaries are not well capitalized and well managed, under applicable prompt corrective action standards may be restricted in certain of its activities and ultimately may lose FHC status. As of December 31, 2025, both the Parent Company and CBNA were well-capitalized. The FDIA prohibits insured banks from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally, depending upon where the deposits are solicited, unless it is “well-capitalized,” or it is “adequately capitalized” and receives a waiver from the FDIC. A bank that is “adequately capitalized” and accepts brokered deposits under a waiver from the FDIC may not pay an interest rate on any deposit in excess of 75 basis points over certain prevailing market rates. The FDIA imposes no such restrictions on a bank that is “well-capitalized.” Deposit Insurance The DIF provides insurance coverage for certain deposits, up to a standard maximum deposit insurance amount of $250,000 per depositor based on ownership right and capacity category codes and is funded through assessments on IDIs based on the risk each institution poses to the DIF. CBNA accepts customer deposits insured by the DIF and must pay insurance premiums as a result, which the FDIC may increase based on various factors, including its assessment of CBNA’s risk profile. The FDIC also requires large depository institutions, including CBNA, to maintain enhanced deposit account recordkeeping and related information technology system capabilities to facilitate prompt calculation of insured deposits if such an institution was taken into FDIC receivership. The FDIC, as required under the FDIA, established a restoration plan in September 2020 to restore the DIF reserve ratio, 1.36% as of June 30, 2025, to meet or exceed the statutory minimum of 1.35% within eight years. This initial plan did not include an increase in the deposit insurance assessment rate, but the FDIC subsequently determined that the DIF reserve ratio was at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028, absent an increase in assessment rates. Therefore, in October 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023. As of June 30, 2025, the DIF reserve ratio exceeded the statutory minimum, therefore the FDIC will no longer operate under a restoration plan. In November 2023, the FDIC adopted a final rule to impose a special assessment on IDIs to recover the loss to the DIF arising from the protection of uninsured depositors in connection with the systemic risk determination announced in March 2023, following the closures of Silicon Valley Bank and Signature Bank, as required by the FDIA. The special assessment was based on an IDI’s estimated uninsured deposits, adjusted to exclude the first $5 billion, as reported for the quarter ended December 31, 2022, and was assessed at an annual rate of approximately 13.4 basis points over eight quarterly periods beginning with the first quarter of 2024. The FDIC’s current estimate of the loss attributable to this systemic risk determination is $16.7 billion. As of September 30, 2025, the FDIC projects that the special assessment collected through the initial eight-quarter collection period will recover the entire loss estimate amount and no extension of the collection period will be necessary. The FDIC reserves the right to impose a one-time final shortfall special assessment after it terminates all receiverships. CBNA’s special assessment was approximately $230 million, which remains subject to change if the eventual loss to the DIF differs from the FDIC’s current estimate. Dividends Various federal statutory provisions and regulations, as well as regulatory expectations, limit the amount of dividends that we and our subsidiaries may pay. Our payment of dividends to stockholders is subject to oversight by the FRB. In particular, the FRB reviews the dividend policies and share repurchases of a large BHC based on capital plans submitted as part of the CCAR process and the results of stress tests, as discussed under “Capital and Stress Testing Requirements” above. In addition to other limitations, our ability to make any capital distributions, including dividends and share repurchases, is subject to the prior approval of the FRB if we are required to resubmit our capital plan. Dividends payable by CBNA, as a national bank subsidiary, are limited to the lesser of the amount calculated under a “recent earnings” test and an “undivided profits” test. Under the recent earnings test, a dividend may not be paid if the total of all dividends declared during any calendar year exceeds the sum of current year net income and retained net income of the two preceding years, less any required transfers to surplus, unless the national bank obtains the approval of the OCC. Under the undivided profits test, a dividend may not be paid in excess of the entity’s “undivided profits” (generally accumulated net profits that have not been paid out as dividends or transferred to surplus). Federal banking regulatory agencies have issued policy statements that provide that FDIC-insured depository institutions and their holding companies should generally pay dividends only out of current operating earnings. Support of Subsidiary Bank The Parent Company is required to serve as a source of financial and managerial strength to CBNA and, under appropriate conditions, to commit resources to support CBNA. This support may be required by the FRB at times when the Parent Company may not have the financial resources to do so, or when doing so may not serve our interests or those of our shareholders or creditors. In addition, any capital loans by a BHC to a subsidiary bank are subordinate in right of payment to deposits and certain other indebtedness of such subsidiary bank. In the event of a BHC’s bankruptcy, any commitment by the BHC to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to a priority of payment. Transactions with Affiliates and Insiders Federal banking laws and regulations impose certain quantitative limits and qualitative standards upon certain transactions between a member bank, including CBNA, and its affiliates, including a parent BHC. Covered transactions with any single affiliate are limited to 10% of the member bank’s capital stock and surplus and covered transactions with all affiliates are limited to 20% of the member bank’s capital stock and surplus. Covered transactions include, among other things, extensions of credit to an affiliate, investments in the securities of an affiliate, purchases of assets from an affiliate, and certain other transactions that expose the member bank to the credit risks of its affiliates. Transactions between a member bank and its affiliates, including all covered transactions, are also required to be on terms substantially the same, or at least as favorable to the member bank, as those prevailing at the time for comparable transactions with nonaffiliates. We are also subject to quantitative restrictions on extensions of credit to executive officers, directors, principal stockholders, and their related interests. These extensions of credit may not exceed certain quantitative limits, must be made on substantially the same terms as those currently prevailing in the market for comparable transactions with third parties, and must not involve more than the normal risk of repayment or present other unfavorable features. Certain extensions of credit also require the approval of our Board. Volcker Rule Under the Volcker Rule, banks and their affiliates are prohibited from engaging in proprietary trading and investing in, sponsoring, and having certain relationships with private funds such as certain hedge funds or private equity funds. Under this rule, we are viewed as having “moderate” trading assets and liabilities, which subjects us to a simplified compliance program requirement that is appropriate for our activities, size, scope, and complexity. This rule does not have a material impact on Citizens. Regulation of Derivatives The regulatory framework with respect to OTC derivatives requires the registration of certain market participants as swap dealers and security-based swap dealers, as well as central clearing and trade execution of certain swaps and security-based swaps on regulated exchanges or execution facilities. CBNA is a CFTC-registered swap dealer and is subject to the CFTC’s regulatory regime, including business conduct standards, recordkeeping, and transaction and financial reporting requirements. CBNA is also subject to regulation by the National Futures Association, a self-regulatory organization. In addition, CBNA is subject to the OCC’s rules that mandate the exchange of initial margin and variation margin for swaps and security-based swaps between CBNA and specified counterparties that are not centrally cleared through a regulated clearing house. The amount of margin required varies based on the relative risk of the associated swap. Consumer Financial Protection Regulations The retail activities of banks are subject to a variety of statutes and regulations designed to protect consumers and promote lending to various sectors of the economy and population. These laws include, but are not limited to, the Equal Credit Opportunity Act, the Fair Debt Collection Practices Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Service Members Civil Relief Act, the Expedited Funds Availability Act, the Right to Financial Privacy Act, the Truth in Savings Act, the Electronic Funds Transfer Act, and their respective federal regulations and state law counterparts. In addition to these federal laws and regulations, the guidance and interpretations of the various federal agencies charged with the responsibility of implementing such regulations also influence loan and deposit operations. The CFPB has rulemaking, supervisory, examination, and enforcement authority over various consumer financial protection laws, including those referenced above, fair lending laws, and certain other statutes. The CFPB also has examination and primary enforcement authority with respect to depository institutions with $10 billion or more in assets, such as CBNA, including the authority to prevent unfair, deceptive, or abusive acts or practices in connection with the offering of consumer financial products. The Federal Reserve has adopted rules applicable to banks with $10 billion or more in assets, such as CBNA, that establish standards for debit card interchange fees and prohibit network exclusivity and routing restrictions. These rules establish a maximum permissible interchange fee that banks may charge for many types of debit card transactions. In October 2023, the Federal Reserve proposed amendments to these rules that would reduce this maximum permissible interchange fee and establish automatic updates to the fee every other year based on a survey of debit card issuers. We will continue to monitor the proposed changes to these rules. States are permitted to adopt stricter consumer protection laws and standards than those adopted at the federal level, and in certain circumstances allows state attorneys general to enforce compliance with both the state and federal laws and regulations on banks like us. Protection of Customer Personal Information and Cybersecurity The privacy provisions of GLBA generally prohibit financial institutions, including us, from disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes unless customers have the opportunity to opt out of the disclosure. The Fair Credit Reporting Act restricts information sharing among affiliates for marketing purposes. Both the Fair Credit Reporting Act and Regulation V, which are issued by the FRB, govern the use and provision of information to consumer reporting agencies. In October 2024, the CFPB adopted a rule regarding personal financial data rights (“PFDR rule”) that applies to financial institutions that offer consumer deposit accounts, such as CBNA. Covered financial institutions are required to provide consumers electronic access to 24 months of transaction data and certain account information and are prohibited from imposing any fees or charges for maintaining or providing access to such data. The PFDR rule also imposes data accuracy, retention, and other obligations. For banks with total assets between $10 billion and $250 billion, compliance with the rule is required by April 1, 2027. In August 2025, in response to legal challenges, the CFPB issued an Advance Notice of Proposed Rulemaking seeking comments and data to inform its consideration of certain issues related to the implementation of the PFDR rule. We will continue to monitor the outcome of the CFPB’s PFDR rule. The federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. Financial institutions are expected to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers when accessing internet-based services of the financial institution. Further, a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyberattack involving destructive malware or other compromise of customer data and/or systems. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyberattack or compromise. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. For further discussion of risks related to cybersecurity, see Item 1A “Risk Factors.” A financial institution is also required to notify its primary banking regulator within 36 hours of computer-security incidents that have materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade its: •ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base; •business lines, including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or •operations, including associated services, functions, and support, the failure or discontinuance of which would pose a threat to the financial stability of the United States. In addition, the SEC requires registrants to disclose material cybersecurity incidents on Form 8-K, which must describe the material aspects of the nature, scope, and timing of the incident, as well as the impact of the incident on the registrant. In Form 10-K filings, registrants are required to describe their processes for assessing, identifying, and managing material risks from cybersecurity threats and whether such risks have materially affected the registrant. Registrants must also describe Board oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from such threats. See Item 1C “Cybersecurity” for more information. State regulators have also been active in implementing privacy and cybersecurity standards and regulations. Several states have adopted laws and regulations requiring certain financial institutions to implement cybersecurity programs and provide details with respect to these programs. In addition, many states have implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity to continue and are continually monitoring developments in the states in which we operate. Climate-Related Laws and Regulations In March 2024, the SEC adopted a final rule to require registrants to disclose certain climate-related matters in their registration statements and annual reports including risks, activities to mitigate or adapt to such risks, governance, financial effects of severe weather events, and audited measurements of certain greenhouse gas emissions. The SEC subsequently issued an order staying its rule in April 2024 while federal courts considered various legal challenges brought by states, businesses, and business groups, which were consolidated in the U.S. Court of Appeals for the Eighth Circuit. In March 2025, the SEC voted to end its defense of the rule and withdrew from the lawsuit. Litigation is expected to continue with the court ultimately deciding whether the rule will remain in effect as adopted. The rule remains stayed until the litigation is resolved. Several states in which we operate have also enacted or proposed statutes or regulations addressing climate-related issues. For example, California has enacted laws that impose climate-related disclosure requirements on certain companies doing business in California, while some states have enacted, or proposed to enact, divergent or sometimes conflicting statutes, including those that prohibit financial institutions from denying or canceling products or services on the basis of social credit scores and certain other factors. We will continue to monitor developments on these laws and regulations. Community Reinvestment Act The CRA requires CBNA’s primary federal bank regulatory agency, the OCC, to evaluate the bank’s record in meeting the credit needs of the communities it serves, including low- and moderate-income neighborhoods and individuals. Institutions are assigned one of four ratings: “Outstanding,” “Satisfactory,” “Needs to Improve,” or “Substantial Noncompliance.” A bank’s CRA record is considered by regulatory agencies in evaluating mergers, acquisitions, and applications to open a branch or facility. In addition, the CRA record of a subsidiary bank of a FHC is considered if a FHC wishes to commence certain new financial activities or to acquire a company engaged in such activities, which requires a rating of at least “satisfactory.” CBNA received an “Outstanding” rating on its most recent CRA evaluation. In October 2023, the federal banking regulators issued a joint final rule to modernize their regulations implementing the CRA. The final rule took effect on April 1, 2024, with most of its requirements effective January 1, 2026, and certain reporting requirements effective January 1, 2027. However, a court issued a preliminary injunction enjoining the federal banking regulators from enforcing the revised regulations pending resolution of a lawsuit challenging the regulations. In July 2025, the federal banking regulators issued a joint Notice of Proposed Rulemaking (“NPR”) to rescind the CRA joint final rule and replace it with the prior CRA regulations adopted by the agencies in 1995, with certain technical amendments. The NPR is intended to restore certainty in the CRA regulatory framework for stakeholders and limit regulatory burden on financial institutions. Compensation Our compensation practices are subject to oversight by the federal banking regulators, with their jointly issued guidance designed to ensure that incentive compensation arrangements take into account risk and are consistent with safe and sound practices. The guidance sets forth the following three key principles with respect to incentive compensation arrangements: •The arrangements should provide employees with incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk; •The arrangements should be compatible with effective controls and risk management; and •The arrangements should be supported by strong corporate governance. We will continue to monitor regulations related to incentive compensation arrangements that have not been finalized. Anti-Money Laundering The Bank Secrecy Act (“BSA”) and the Patriot Act contain anti-money laundering (“AML”) and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The BSA, as amended by the Patriot Act, requires depository institutions and their holding companies to maintain an AML program, verify the identity of customers and certain beneficial owners for legal entity customers, monitor for and report suspicious transactions, report on cash transactions exceeding specified thresholds, and respond to requests for information by regulatory authorities and law enforcement agencies. We are also required to provide our employees with AML training, designate an AML compliance officer, and undergo an annual, independent audit to assess the effectiveness of our AML program. We have implemented policies, procedures, and internal controls that are designed to comply with these AML requirements. Financial services regulators are focusing their examinations on AML compliance, and we continue to monitor and augment, where necessary, our AML compliance programs. The federal banking agencies are required, when reviewing bank and BHC acquisition or merger applications, to take into account the effectiveness of the AML activities of the applicants. The Anti-Money Laundering Act of 2020 (“AMLA”), enacted in 2021 as part of the National Defense Authorization Act, requires the U.S. Department of the Treasury to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities and conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping, and reporting requirements that the BSA and the Patriot Act impose on financial institutions. The AMLA also increases penalties for violations of the BSA and significantly expands a whistleblower award program both of which could increase the prospect of regulatory enforcement. In 2021, the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury, issued the priorities for AML and countering the financing of terrorism policy, as required under the AMLA. These priorities include corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking, and proliferation financing. Office of Foreign Assets Control Regulation The U.S. has imposed economic sanctions that affect transactions with designated foreign countries, nationals, and others, that are administered by OFAC. OFAC-administered sanctions targeting countries take many different forms and generally contain one or more of the following elements: •Restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned country; and •Blocking assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off, or transferred in any manner without a license from OFAC. Lists including the names of individuals and organizations suspected of aiding, harboring, or engaging in terrorist acts, including the Specially Designated Nationals and Blocked Persons list, is published and routinely updated by OFAC. We are responsible for, among other things, blocking accounts of, and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them, and reporting blocked transactions after they occur. If we identify a name on any transaction, account, or wire transfer that is on an OFAC list we must freeze the associated account, file a suspicious activity report, and notify the appropriate authorities. Failure to comply with these sanctions could have serious legal and reputational consequences. Regulation of Broker-Dealers Our subsidiaries, Citizens Securities, Inc. and Citizens JMP Securities, LLC, are registered broker-dealers with the SEC and subject to regulation and examination by the SEC and FINRA. These regulations cover a broad range of matters, including capital requirements; sales and trading practices; use of client funds and securities; the conduct of directors, officers, and employees; recordkeeping and recording; supervisory procedures to prevent improper trading on material nonpublic information; qualification and licensing of sales personnel; and limitations on the extension of credit in securities transactions. In addition to federal registration, state securities commissions require the registration of certain broker-dealers. Heightened Risk Governance Standards CBNA is subject to OCC guidelines that impose heightened risk governance standards on large national banks with average total consolidated assets of $50 billion or more. The guidelines set forth minimum standards for the design and implementation of a bank’s risk governance framework and its associated oversight by a bank’s board of directors. The guidelines are intended to protect the safety and soundness of covered banks and improve the ability of bank examiners to assess compliance with the OCC’s expectations. Under the guidelines, a bank may use the risk governance framework of its parent company if it meets the minimum standards and the risk profiles of the parent company and the covered bank are substantially the same, along with certain other conditions. CBNA has elected to use the Parent Company’s risk governance framework. A bank’s board of directors is required to have two members who are independent of bank and parent company management, ensure that the risk governance framework meets the appropriate standards, provide active oversight and a credible challenge to management’s recommendations and decisions, and ensure that decisions made by the parent company do not jeopardize the safety and soundness of the bank. In December 2025, the OCC issued a Notice of Proposed Rulemaking that, if enacted, would increase the average total consolidated assets threshold for applying the guidelines from $50 billion to $700 billion.

Our operations are subject to extensive regulation, supervision and examination under federal and state laws and regulations. These laws and regulations cover all aspects of our business, including lending practices, deposit insurance, customer privacy and cybersecurity, capital adequacy and planning, liquidity, safety and soundness, consumer protection and disclosure, permissible activities and investments, and certain transactions with affiliates. These laws and regulations are intended primarily for the protection of customers, depositors, the DIF and the banking system as a whole and not for the protection of shareholders or other investors. The discussion below outlines the material elements of selected laws and regulations applicable to us and our subsidiaries, but do not summarize all possible or proposed changes in laws or regulations. Changes in applicable law or regulation, and in their interpretation and application by regulatory agencies and other governmental authorities, cannot be predicted, but may have a material effect on our business, financial condition or results of operations. We are subject to examinations by federal banking regulators, as well as the SEC, FINRA, CFTC and various state insurance and securities regulators. In some cases, regulatory agencies may take supervisory actions that may not be publicly disclosed, and such actions may restrict or limit our activities or activities of our subsidiaries. As part of our regular examination process, regulators may advise us to operate under various restrictions as a prudential matter. We have periodically received requests for information from regulatory authorities at the federal and state level, including from banking, securities and insurance regulators, state attorneys general, federal agencies or law enforcement authorities, and other regulatory authorities, concerning our business practices. Such requests are considered incidental to the normal conduct of business. For a further discussion of how regulatory actions may impact our business, see Item 1A “Risk Factors.” For additional information regarding regulatory matters, see Note 25 in Item 8. Overview We are a BHC under the Bank Holding Company Act and have elected to be treated as a FHC under amendments to this Act as effected by GLBA. As such, we are subject to the supervision, examination and reporting requirements of the Bank Holding Company Act and the regulations of the FRB, including through the Federal Reserve Bank of Boston. Under the system of “functional regulation” established under the Bank Holding Company Act, the FRB serves as the primary regulator of our consolidated organization. The OCC serves as the primary regulator for CBNA, and the SEC and FINRA serve as the primary regulators of our broker-dealer subsidiaries. The federal banking regulators have authority to approve or disapprove mergers, acquisitions, consolidations, the establishment of branches and similar corporate actions. These banking regulators also have the power to prevent the continuance or development of unsafe or unsound banking practices or other violations of law. Federal law governs the activities in which CBNA engages, including the investments it makes and the aggregate amount of available credit that it may grant to one borrower. Various consumer and compliance laws and regulations also affect its operations. The actions the FRB takes to implement monetary policy also affect us. In addition, CBNA is subject to regulation, supervision and examination by the CFPB with respect to consumer protection laws and regulations. The CFPB has broad authority to regulate the offering and provision of consumer financial products by depository institutions, such as CBNA, with more than $10 billion in total assets. The CFPB may promulgate rules under a variety of consumer financial protection statutes, including the Truth in Lending Act, the Equal Credit Opportunity Act, the Electronic Funds Transfer Act and the Real Estate Settlement Procedures Act. In 2024, CBNA registered as a swap dealer with the CFTC and became a member of the National Futures Association, the self-regulatory organization for participants in the U.S. derivatives industry, to accommodate growth in its hedging business. For more information see “Regulation of Derivatives” below.