Byline Bancorp, Inc.

From time to time, we may implement new lines of business or offer new products and product enhancements as well as new services within our existing lines of business. We may also implement new technologies, such as those related to artificial intelligence ("AI"), automation and algorithms, in order to create efficiencies, access and use data and enhance our customers’ engagement with us. There are substantial risks and uncertainties associated with these efforts, particularly in instances in which the markets are not fully developed. Also, the implementation of certain new technologies may have unintended consequences due to their limitations, potential manipulation, or our failure to use them effectively. In implementing, developing, or marketing new lines of business, products, product enhancements or services and/or technologies, we may invest significant time and resources and not realize their expected results or returns. Further, initial timetables for the introduction and development of new initiatives may not be achieved, and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, shifting market preferences and general economic conditions, may also affect the ultimate implementation of a new line of business or offerings of new products, product enhancements or services and/or technologies. Furthermore, any such initiative could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of

As a financial institution, we are susceptible to fraudulent activity, information security breaches, and cybersecurity-related incidents that may be committed against us, our customers, or third-party service providers that we utilize, which may result in financial losses or increased costs to us or our customers, disclosure or misuse of our information or our customer information, misappropriation of assets, privacy breaches against our customers, litigation, or damage to our reputation. Information security breaches and cybersecurity-related incidents may include fraudulent or unauthorized access to systems used by us or our customers, denial or degradation of service attacks, and malware or other cyberattacks. There continues to be a rise in electronic fraudulent activity, security breaches, and cyberattacks directed at the financial services industry. Consistent with industry trends, we have also experienced an increase in attempted electronic fraudulent activity, security breaches, and cybersecurity-related incidents. The continued evolution and increased usage of AI technologies may further increase these risks. Information pertaining to us and our customers is maintained, and transactions are executed, on networks and systems maintained by us and certain third-party partners, such as our online banking or reporting systems. The secure maintenance and transmission of confidential information, as well as execution of transactions over these systems, are essential to protect us and our customers against fraud and security breaches and to maintain our customers’ confidence and privacy. Although we have developed, and continue to invest in, systems and processes that are designed to detect and prevent security breaches and cyberattacks and periodically test our security, our or our third-party partners’ inability to anticipate, or failure to adequately mitigate, breaches of security could result in: losses to us or our customers; our loss of business and/or customers; damage to our reputation; the incurrence of additional expenses; disruption to our business; our inability to grow our online services or other businesses; additional regulatory scrutiny or penalties; or our exposure to civil litigation and possible financial liability, any of which could have a material adverse effect on our business, financial condition, or results of operations.

AI and our ability to implement and leverage AI to deliver new products and services to our customers present competitive risks.

The financial services industry is experiencing and will continue to experience rapid technological change due to the emergence of AI, including generative AI and agentic AI. The effective use of AI enables financial institutions to better serve their customers and reduce expenses. Our success and competitiveness may depend in part on our ability to adopt such technology and deliver our products and services in a manner consistent with evolving customer preferences and industry standards. At the same time, the use of AI presents unique risks. AI models, which are primarily developed and managed by third parties, introduce risks related to model development, implementation and training. AI may also produce incorrect outputs or biased results, disclose personal or confidential information, or otherwise cause issues for us or our customers. In addition, the legal and regulatory landscape for AI is uncertain and continuously evolving, which may increase our compliance costs and risk of non-compliance. Failure to adopt AI tools that match our customer expectations and needs or failure to properly manage risks associated with AI could have a material adverse effect on our business, financial condition or results of operation.

We have developed an Information Security Program (the “Program”) as part of our overall Enterprise Risk Management ("ERM") framework to address material risks from potential cybersecurity threats, including threats utilizing generative AI, and to facilitate the governance and oversight of cybersecurity risks. The Program is administered by our Chief Risk Officer, Ms. Michelle Johnson, and includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed, and the Company’s response readiness about potential and actual cyber threats and incidents.