Wells Fargo & Company: 10-K Risk Factor Changes

A failure in or breach of our operational or security systems, controls or infrastructure, or those of our third-party vendors and other service providers, could disrupt our businesses, damage our reputation, increase our costs and cause losses. As a large financial institution that serves customers through numerous physical locations, ATMs, the internet, mobile banking and other distribution channels across the U.S. and internationally, we depend on our ability to process, record and monitor a large number of customer transactions on a continuous basis. As our customer base and locations have a broad geographic footprint throughout the U.S. and internationally, as we have increasingly used the internet and mobile banking to provide products and services to our customers, as customer, public, legislative and regulatory expectations regarding operational and information security have increased, and as cyber and other information security attacks have become more prevalent and complex, our operational systems, controls and infrastructure must continue to be safeguarded and monitored for potential failures, disruptions and breakdowns. Our business, financial, accounting, data processing systems, or other operating systems and facilities may stop operating properly, become insufficient based on our evolving business needs, or become disabled or damaged as a result of a number of factors including events that are wholly or partially beyond our control. For example, there have been and could in the future be sudden increases in customer transaction volume; electrical or telecommunications outages; degradation or loss of internet, website or mobile banking availability; natural disasters such as earthquakes, wildfires, tornados, and hurricanes; disease pandemics such as COVID-19; events arising from local or larger scale political or social matters, including terrorist acts; and, as described below, cyberattacks or other information security incidents. The COVID-19 pandemic or any new pandemic could result in the occurrence of new, unanticipated adverse effects on us or the recurrence of adverse effects similar to those already experienced, including creating additional operational and compliance risks, such as the need to comply with rapidly changing regulatory requirements and to quickly implement new measures to protect the functionality of our systems, networks, and operations.

Wells Fargo & Company

69

Risk Factors (continued)

Furthermore, enhancements and upgrades to our infrastructure or operating systems may be time-consuming, entail significant costs, and create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of our systems, the process of enhancing our infrastructure and operating systems, including their security measures and controls, could continue to create a risk of system disruptions and security issues. Similarly, we may not be able to timely recover critical business processes or operations that have been disrupted, which may further increase any associated costs and consequences of such disruptions. Although we have enterprise incident response processes, business continuity plans and other safeguards in place to help provide operational resiliency, our business operations may be adversely affected by significant and widespread disruption to our physical infrastructure or operating systems that support our businesses and customers. For example, we have experienced system issues caused by a variety of factors that have resulted in intermittent service interruptions, such as temporary disruptions to online and mobile banking services, delays in posting transactions, and customer difficulty signing into accounts.

As a result of financial institutions and technology systems becoming more interconnected and complex, any operational incident at a third party may increase the risk of loss or material impact to us or the financial industry as a whole. Furthermore, third parties on which we rely, including those that facilitate our business activities or to which we outsource operations, such as exchanges, clearing houses, financial intermediaries or vendors that provide services or security solutions for our operations, could continue to be sources of operational risk to us, including from information breaches or loss, breakdowns, disruptions or failures of their own systems or infrastructure, or any deficiencies in the performance of their responsibilities. These risks are increased to the extent we rely on a single or small number of third parties or on third parties in a single geographic area. We are also exposed to the risk that a disruption or other operational incident at a common service provider to our third parties could impede their ability to provide services or perform their responsibilities for us. In addition, we must meet regulatory requirements and expectations regarding our use of third-party service providers, and any failure by our third-party service providers to meet their obligations to us or to comply with applicable laws, rules, regulations, or Wells Fargo policies could result in fines, penalties, restrictions on our business, or other adverse consequences.

Disruptions or failures in the physical infrastructure, controls or operating or security systems that support our businesses and customers, failures of the third parties on which we rely to adequately or appropriately provide their services or perform their responsibilities, or our failure to effectively manage or oversee our third-party relationships, could continue to result in business disruptions, loss of revenue or customers, legal or regulatory proceedings, remediation and other costs, violations of applicable privacy and other laws, reputational damage, customer harm, or other adverse consequences, any of which could materially adversely affect our results of operations or financial condition.

A cyberattack or other information security incident could have a material adverse effect on our results of operations, financial condition, or reputation. Information security risks for large financial institutions such as Wells Fargo have generally increased in recent years in part because of the proliferation of new technologies, the use of the internet, mobile devices, and

cloud technologies to conduct financial transactions, the increased reliance on third parties, the increase in remote work arrangements, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, including foreign state-sponsored parties. Those parties also may continue to attempt to misrepresent personal or financial information to commit fraud, obtain loans or other financial products from us, or attempt to fraudulently induce employees, customers, or other users of our systems to disclose confidential, proprietary, or other information to gain access to our networks, data or information belonging to our customers. Geopolitical matters may also continue to elevate the risk of an information security threat, particularly by foreign state-sponsored parties or their supporters. In addition, we continue to experience information security threats arising from the increased availability and use of artificial intelligence to conduct attacks that can be difficult to detect. As noted above, our operations rely on the secure processing, transmission and storage of confidential, proprietary, and other information in our computer systems and networks. Our banking, brokerage, investment advisory, and capital markets businesses rely on our digital technologies, computer and email systems, software, hardware, and networks to conduct their operations. In addition, to access our products and services, our customers may use computers, personal smartphones, tablets, and other mobile devices that are beyond our control systems. Our technologies, systems, software, networks, and our customers’ devices continue to be the target of cyberattacks or other information security threats, which could materially adversely affect us, including as a result of fraudulent activity, the unauthorized release, gathering, monitoring, misuse, loss or destruction of Wells Fargo’s or our customers’ confidential, proprietary and other information, or the disruption of Wells Fargo’s or our customers’ or other third parties’ business operations. For example, various retailers have reported they were victims of cyberattacks in which large amounts of their customers’ data, including debit and credit card information, was obtained. In these situations, we generally incur costs to replace compromised cards and address fraudulent transaction activity affecting our customers. We also continue to be exposed to the risk that an employee or other person acting on behalf of the Company fails to comply with applicable policies and procedures and inappropriately circumvents information security controls for personal gain or other improper purposes.

Due to the increasing interconnectedness and complexity of financial institutions and technology systems, an information security incident at a third party or a third party’s downstream service providers may increase the risk of loss or material impact to us or the financial industry as a whole. In addition, third parties (including their downstream service providers) on which we rely, including those that facilitate our business activities or to which we outsource operations, such as internet, mobile technology, hardware, software, and cloud service providers, continue to be sources of information security risk to us. We could suffer material harm, including business disruptions, losses or remediation costs, reputational damage, legal or regulatory proceedings, or other adverse consequences as a result of the failure of those third parties to adequately or appropriately safeguard their technologies, systems, networks, hardware, or software, or as a result of our or our customers’ data being compromised due to information security incidents affecting those third parties. Furthermore, any indemnification from a third party or its downstream service providers may not be sufficient to address the impact on us of an information security incident at those third parties.

70

Wells Fargo & Company

Our risk and exposure to information security threats remains heightened because of, among other things, the persistent and evolving nature of these threats, the prominent size and scale of Wells Fargo and its role in the financial services industry, our plans to continue to implement our digital and mobile banking channel strategies and develop additional remote connectivity solutions to serve our customers when and how they want to be served, our geographic footprint and international presence, our use of third parties, the outsourcing of some of our business operations, and the current global economic and political environment. For example, Wells Fargo and other financial institutions, as well as our third-party service providers, continue to be the target of various evolving and adaptive information security threats, including cyberattacks, malware, ransomware, other malicious software intended to exploit hardware or software vulnerabilities, phishing, credential validation, and distributed denial-of-service, in an effort to disrupt the operations of financial institutions, test their cybersecurity capabilities, commit fraud, or obtain confidential, proprietary or other information. Cyberattacks have also focused on targeting online applications and services, such as online banking, as well as cloud-based and other products and services provided by third parties, and have targeted the infrastructure of the internet, causing the widespread unavailability of websites and degrading website performance. As a result, information security and the continued development and enhancement of our controls, processes and systems designed to protect our networks, computers, software and data from attack, damage or unauthorized access remain a priority for Wells Fargo. We are also involved in industry cybersecurity efforts and working with other parties, including our third-party service providers and governmental agencies, to continue to enhance defenses and improve resiliency to information security threats.

As these threats continue to evolve, we expect to continue to be required to expend significant resources to develop and enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Because the investigation of any information security breach is inherently unpredictable and would require time to complete, we may not be able to immediately identify, assess, or remediate the harm caused by the breach, which may further increase any associated costs and consequences. In addition, any actions we take to respond to an information security breach may themselves create a risk of system disruptions or security issues. Moreover, to the extent our insurance covers aspects of information security risk, such insurance may not be sufficient to cover all liabilities or losses associated with an information security breach.

Cyberattacks or other information security incidents affecting us or third parties (including their downstream service providers) on which we rely, including those that facilitate our business activities or to which we outsource operations, or affecting the networks, systems or devices that our customers use to access our products and services, could result in business disruptions, loss of revenue or customers, legal or regulatory proceedings, compliance, remediation and other costs, violations of applicable privacy and other laws, reputational damage, or other adverse consequences, any of which could materially adversely affect our results of operations or financial condition.

Our framework for managing risks may not be fully effective in mitigating risk and loss to us. Our risk management framework seeks to mitigate risk and loss to us. We have established processes and procedures intended to identify, measure, monitor, report and analyze the types of risk to which we are

subject, including liquidity risk, credit risk, market risk, interest rate risk, operational risk, legal and compliance risk, and reputational risk, among others. However, as with any risk management framework, there are inherent limitations to our risk management strategies as there may exist, or develop in the future, risks that we have not appropriately anticipated, identified or managed. Our risk management framework is also dependent on ensuring that effective operational controls and an appropriate risk mindset exist throughout the Company. The inability to develop effective operational controls or to foster the appropriate culture throughout the Company, including the inability to align performance management and compensation to achieve the desired culture, could adversely impact the effectiveness of our risk management framework. Similarly, if we are unable to effectively manage our business or operations, we may be exposed to increased risks or unexpected losses. We process a large number of transactions each day and could continue to experience increased costs, regulatory investigations, or other adverse consequences if we do not accurately or completely execute a process or transaction, whether due to human error or otherwise; if we are unable to detect and prevent fraudulent activity; or if an employee or third-party service provider fails to comply with applicable policies and procedures, inappropriately circumvents controls, or engages in other misconduct.

In certain instances, we rely on models to measure, monitor and predict risks, such as market, interest rate, liquidity and credit risks, as well as to help inform business decisions; however, there is no assurance that these models will appropriately or sufficiently capture all relevant risks or accurately predict future events or exposures. Furthermore, certain of our models are subject to regulatory review and approval, and any failure to meet regulatory standards or expectations could result in fines, penalties, restrictions on certain business activities, or other adverse consequences, and any required modifications or changes to these models can impact our capital ratios and requirements and result in increased operational and compliance costs. In addition, we rely on data to aggregate and assess our various risk exposures and business activities, and any issues with the quality or effectiveness of our data, including our aggregation, management, and validation procedures, could result in ineffective risk management practices, business decisions or customer service, inefficient use of resources, or inaccurate regulatory or other risk reporting.

We also use artificial intelligence to help further inform or automate certain business decisions, operations, and risk management practices, as well as to improve our customer service, but there is no assurance that artificial intelligence will appropriately or sufficiently replicate certain outcomes or human assessment or accurately predict future events or exposures. For example, the algorithms or datasets underlying our artificial intelligence may be inaccurate or include other weaknesses that could result in deficient or biased data outputs or other unintended consequences. Accordingly, even though we may have controls, our use of artificial intelligence could result in ineffective business decisions, operations, risk management practices, or customer service, legal or regulatory proceedings, reputational harm, or other adverse effects on our business or financial results.

Previous financial and credit crises and resulting regulatory reforms highlighted both the importance and some of the limitations of managing unanticipated risks, and our regulators remain focused on ensuring that financial institutions, and Wells Fargo in particular, maintain risk management policies and practices. If our risk management framework proves ineffective,

Wells Fargo & Company

71

Risk Factors (continued)

we could suffer unexpected losses which could materially adversely affect our results of operations or financial condition.

We may be exposed to additional legal or regulatory proceedings, costs, and other adverse consequences related to instances where customers may have experienced financial harm. We have identified and may in the future identify areas or instances where customers may have experienced financial harm, including as a result of our continuing efforts to strengthen our risk and control infrastructure. For example, we identified certain issues related to past practices involving certain automobile collateral protection insurance policies and certain issues related to the unused portion of guaranteed automobile protection waiver or insurance agreements. We also previously entered into settlements to resolve inquiries or investigations by various government entities and lawsuits by non-governmental parties arising out of certain retail sales practices of the Company. Negative publicity or public opinion resulting from instances where customers may have experienced financial harm may continue to increase the risk of reputational harm to our business. Similarly, the identification of areas or instances where customers may have experienced financial harm could lead to, and in some cases has already resulted in, significant remediation costs, loss of revenue or customers, legal or regulatory proceedings, compliance and other costs, or other adverse consequences.

For additional information, see the “Overview – Customer Remediation Activities” section in this Report.

We may incur fines, penalties, business restrictions, and other adverse consequences from regulatory violations or from any failure to meet regulatory standards or expectations. We maintain systems and procedures designed to ensure that we comply with applicable laws and regulations. However, we are subject to heightened compliance and regulatory oversight and expectations, particularly due to the evolving and increasingly complex regulatory landscape we operate in. We are also subject to consent orders and other regulatory actions that subject us to various conditions and restrictions. In addition, a single event or issue may give rise to numerous and overlapping investigations and proceedings, either by multiple federal and state agencies in the U.S. or by multiple regulators and other governmental entities in different jurisdictions. Also, the laws and regulations in jurisdictions in which we operate may be different or even conflict with each other, such as differences between U.S. federal and state law or differences between U.S. and non-U.S. laws as to the products and services we may offer or other business activities we may engage in, which can lead to compliance difficulties or issues. Additionally, regulatory or compliance issues at other financial institutions could result in regulatory scrutiny for us. We could also be subject to regulatory actions, including fines, penalties, business restrictions, or other adverse consequences, if we fail to obtain applicable licensing or registration in any jurisdiction in which we offer our products and services. Furthermore, many legal and regulatory regimes require us to report transactions and other information to regulators and other governmental authorities, self-regulatory organizations, exchanges, clearing houses and customers. We may be subject to fines, penalties, business restrictions, or other adverse consequences if we do not timely, completely, or accurately provide regulatory reports, customer notices, or disclosures.

Moreover, some legal/regulatory frameworks provide for the imposition of fines, penalties, business restrictions, or other adverse consequences for noncompliance even though the noncompliance was inadvertent or unintentional and even

though there were systems and procedures in place at the time designed to ensure compliance. For example, we are subject to regulations issued by the Office of Foreign Assets Control (OFAC) that prohibit financial institutions from participating in the transfer of property belonging to the governments of certain non-U.S. countries and designated nationals of those countries. OFAC may impose fines, penalties, or restrictions on certain business activities for inadvertent or unintentional violations even if reasonable processes are in place to prevent the violations. Any violation of these or other applicable laws or regulatory requirements, even if inadvertent or unintentional, or any failure to meet regulatory standards or expectations, including any failure to satisfy the conditions of any consent orders or other regulatory actions, could result in significant fines, penalties, restrictions on certain business activities, negative impacts to our capital and liquidity, requirements to undergo significant changes to our business, operations, products and services, and risk management practices, reputational harm, loss of customers, or other adverse consequences. Furthermore, these consequences may escalate to the extent issues are not timely resolved or are repeated.

Reputational harm, including as a result of our actual or alleged conduct or public opinion of the financial services industry generally, could adversely affect our business, results of operations, and financial condition. Reputation risk, or the risk to our business, earnings and capital from negative public opinion, is inherent in our business and has increased substantially because of our size and profile in the financial services industry and due to instances where customers may have experienced financial harm. Negative public opinion about the financial services industry generally or Wells Fargo specifically could adversely affect our reputation and our ability to keep and attract customers. Negative public opinion could result from our actual or alleged conduct in any number of activities, including sales practices; mortgage, auto or other consumer lending practices; loan origination or servicing activities; mortgage foreclosure actions; management of client accounts or investments; lending, investing or other business relationships; identification and management of potential conflicts of interest from transactions, obligations and interests with and among our customers; environmental, social and governance practices; regulatory compliance; risk management; incentive compensation practices; human capital management; and disclosure, sharing or inadequate protection or improper use of customer information, and from actions taken by government regulators and community or other organizations in response to that conduct. Although we have policies and procedures in place intended to detect and prevent conduct by employees and third-party service providers that could potentially harm customers or our reputation, there is no assurance that such policies and procedures will be fully effective in preventing such conduct. Furthermore, our actual or perceived failure to address or prevent any such conduct or otherwise to effectively manage our business or operations could result in significant reputational harm. In addition, because we conduct most of our businesses under the “Wells Fargo” brand, negative public opinion about one business also could affect our other businesses. Moreover, actions by the financial services industry generally or by certain members or individuals in the industry also can adversely affect our reputation. The proliferation of social media websites utilized by Wells Fargo and other third parties, as well as the personal use of social media by our employees and others, including personal blogs and social network profiles, also may increase the risk that, or broaden the extent to which, negative, inappropriate or

72

Wells Fargo & Company

unauthorized information may be posted or released publicly that could harm our reputation or have other negative consequences.

Wells Fargo and other financial institutions have been targeted from time to time by protests and demonstrations, which have included disrupting the operation of our retail banking locations, and have been subject to negative public commentary, including with respect to certain business practices and the fees charged for various products and services. Wells Fargo and other financial institutions have also been subject to negative publicity as a result of providing or reducing financial services to or making investments in industries or organizations subject to stakeholder concerns. In addition, Wells Fargo and other financial institutions have faced criticism stemming from diverging views among stakeholders, including whether companies should focus more or less on a variety of activities or strategies such as those related to environmental, social and governance practices and sustainability. There can be no assurance that continued protests or negative public opinion or criticism of the Company specifically or large financial institutions generally will not harm our reputation and adversely affect our business, results of operations, and financial condition.

If we are unable to develop and execute effective business plans or strategies or manage change effectively, our competitive standing and results of operations could suffer. In order to advance our business goals, we may undertake business plans or strategies related to, among other things, our organizational structure, our compliance and risk management framework, our expenses and efficiency, the types of products and services we offer, the types of businesses we engage in, the geographies in which we operate, the manner in which we serve our clients and customers, the third parties with which we do business, and the methods and distribution channels by which we offer our products and services. Accomplishing these business plans or strategies may be complex, time intensive, require significant financial, technological, management and other resources, may divert management attention and resources away from other areas of the Company, and may impact our expenses and ability to generate revenue. There is no guarantee that any business plans or strategies, including our current efficiency initiatives, will ultimately be successful. To the extent we are unable to develop or execute effective business plans or strategies or manage change effectively, our competitive position, reputation, prospects for growth, and results of operations may be adversely affected.

In addition, from time to time, we may decide to divest certain businesses or assets. Difficulties in executing a divestiture may cause us not to realize any expected cost savings or other benefits from the divestiture, or may result in higher than expected losses of employees or harm our ability to retain customers. The divestiture or winding down of certain businesses or assets may also result in the impairment of goodwill or other long-lived assets related to those businesses or assets, which could adversely affect our financial results.

Similarly, we may explore opportunities to expand our products, services, and assets through strategic acquisitions of companies or businesses in the financial services industry. We generally must receive federal regulatory approvals before we can acquire a bank, bank holding company, or certain other financial services businesses. We cannot be certain when or if, or on what terms and conditions, any required regulatory approvals will be granted. We might be required to sell banks, branches and/or business units or assets or issue additional equity as a condition to receiving regulatory approval for an acquisition.

When we do announce an acquisition, our stock price may fall depending on the size of the acquisition, the type of business to be acquired, the purchase price, and the potential dilution to existing stockholders or our earnings per share if we issue common stock in connection with the acquisition. Furthermore, difficulty in integrating an acquired company or business may cause us not to realize expected revenue increases, cost savings, increases in geographic or product presence, and other projected benefits from the acquisition. The integration could result in higher than expected deposit attrition, loss of key employees, an increase in our compliance costs or risk profile, disruption of our business or the acquired business, or otherwise harm our ability to retain customers and employees or achieve the anticipated benefits of the acquisition. Time and resources spent on integration may also impair our ability to grow our existing businesses. Many of the foregoing risks may be increased if the acquired company or business operates internationally or in a geographic location where we do not already have significant business operations and/or employees.

Our operations and business could be adversely affected by the impacts of climate change. The physical effects of climate change, including an increased prevalence and severity of extreme weather events and natural disasters, could damage or interfere with our operations or those of our third-party service providers, which could disrupt our business, increase our costs, or cause losses. Climate change related impacts could also negatively affect the financial condition of our customers, increase the credit risk associated with those customers, or result in the deterioration of the value of the collateral we hold. In addition, changes in consumer behavior or other market conditions on account of climate considerations or due to a transition to a low-carbon economy may adversely affect customers in certain industries, sectors or geographies, which may increase our credit risk and reduce the demand by these customers for our products and services. Furthermore, a transition to a low-carbon economy could result in additional costs or other adverse consequences to our business operations. Legislation and/or regulation in connection with climate change, as well as stakeholder perceptions and expectations related to climate change and its impacts, could require us to change certain of our business and/or risk management practices, impose additional costs on us, reduce our revenue or business opportunities, subject us to legal or regulatory proceedings, or otherwise adversely affect our operations and business. Additionally, climate-related data, methodologies, and models may be subject to measurement uncertainties or other limitations, or may be available only from third parties, which can make them difficult to obtain, validate, or analyze, impact the effectiveness of our related models, projections, strategies, and decisions, or result in legal actions or other adverse consequences. Moreover, our reputation may be damaged and we may lose business opportunities as a result of our approach to climate change, including if we are unable or perceived to be unable to achieve our objectives or realize any anticipated benefits, or if our approach is disliked or perceived to be ineffective or insufficient. Similarly, any perceived overstatement or mislabeling of the environmental benefits of our products, services or activities may subject us to legal actions, reputational harm, or other adverse consequences. For additional information on regulatory developments related to climate change and sustainability, see the “Regulation and Supervision” section in our 2024 Form 10-K.

Wells Fargo & Company

73

Risk Factors (continued)

We are exposed to potential financial loss or other adverse consequences from legal actions. Wells Fargo and some of its subsidiaries are involved in judicial, regulatory, governmental, arbitration, and other proceedings or investigations concerning matters arising from the conduct of our business activities, and many of those proceedings and investigations expose Wells Fargo to potential financial loss or other adverse consequences. There can be no assurance as to the ultimate outcome of any of these legal actions. We establish accruals for legal actions when potential losses associated with the actions become probable and the costs can be reasonably estimated. We may still incur costs for a legal action even if we have not established an accrual. In addition, the actual cost of resolving a legal action may be substantially higher than any amounts accrued for that action. The ultimate resolution of a pending legal action, depending on the remedy sought and granted, could materially adversely affect our results of operations and financial condition.

As noted above, we are subject to heightened regulatory oversight and scrutiny, which may lead to regulatory investigations, proceedings or enforcement actions. In addition to imposing potentially significant fines, penalties, business restrictions, and other adverse consequences, regulatory authorities may require criminal pleas or other admissions of wrongdoing and compliance with other conditions in connection with settling such matters, which can lead to reputational harm, loss of customers, restrictions on the ability to access capital markets, limitations on capital distributions, the inability to engage in certain business activities or offer certain products or services, and/or other direct and indirect adverse effects.

For additional information, see Note 13 (Legal Actions) to Financial Statements in this Report.