Crossfirst Bankshares, Inc.

Advances and changes in technology could significantly affect our business, financial condition, results of operations and future prospects. The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services, including those incorporating data analytics, artificial intelligence (“AI”), generative AI, and machine learning. Failure to successfully keep pace with technological change affecting our industry could harm our ability to compete effectively. Many of our competitors have substantially greater resources to invest in technological improvements. We face many challenges, including the increased demand to provide clients electronic access to their accounts and the cost and implementation of systems to perform electronic banking transactions. Our ability to compete depends on our ability to continue to adapt technology on a timely and cost-effective basis to meet these demands. We may not be able to effectively or timely implement new technology-driven products and services or be successful in marketing these products and services to our clients. In addition, the implementation of technological changes and upgrades to maintain current systems and integrate new ones may cause service interruptions, transaction processing errors, system conversion delays and other adverse effects. As these technologies are improved in the future, we may be required to make significant capital expenditures in order to remain competitive, which may increase our overall expenses and have a material adverse effect on our business, financial condition, results of operations and cash flows.

Cybersecurity threats and potential security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer. We conduct a portion of our business over the Internet. We rely heavily upon data processing, software, communications and information systems from a number of third parties to conduct our business. Our business involves the storage and transmission of clients’ proprietary information and security breaches could expose us to the risk of loss or misuse of such information, litigation and potential liability. The secure processing, maintenance and transmission of this information is critical to our operations and business strategy. We, our clients and other financial institutions with which we interact, are subject to increasingly frequent, continuous attempts, including ransomware and malware attacks, to penetrate key systems by individual hackers, organized criminals, and in some cases, state-sponsored organizations. Our operations are also vulnerable to disruptions from human error, natural disasters, power loss, computer viruses, unauthorized access and other unforeseen events. Undiscovered data corruption could render our client information inaccurate. Third-party or internal systems and networks may fail to operate properly or become disabled due to deliberate attacks or unintentional events. These risks are further heightened by factors such as developments in generative AI, increased remote working and geopolitical turmoil. Cyberattacks and security breaches may also cause significant increases in operating costs, including the costs of compensating clients for any resulting losses they may incur, and the costs and capital expenditures required to correct the deficiencies in and strengthen the security of data processing and storage systems, and these costs may exceed coverage limits under our cyber insurance policies.

Employee error or employee and client misconduct could subject us to financial losses or regulatory sanctions and seriously harm our reputation. Misconduct by our employees could include hiding unauthorized activities from us, unauthorized use of generative AI tools, improper or unauthorized activities on behalf of our clients or improper use of confidential information. It is not always possible to prevent employee error or misconduct and the precautions we take to prevent and detect this activity may not be effective in all cases. Because the nature of the financial services business

involves a high volume of transactions, certain errors, which may be automated or manual or involve the use of generative AI, may be repeated or compounded before they are discovered and successfully rectified. Our necessary dependence upon processing systems to record and process transactions and our large transaction volume may further increase the risk that employee errors, tampering or manipulation of those systems will result in losses that are difficult to detect. Employee error or misconduct could also subject us to financial claims. If our internal control systems fail to prevent or detect an occurrence, it could have a material adverse effect on our business, financial condition and results of operations.

As a financial institution, we are inherently exposed to operational risk in the form of theft and other fraudulent activity by employees, clients and other third parties targeting us and our clients' accounts or data. Such activity may take many forms, including check fraud, electronic fraud, wire fraud, phishing, social engineering and other dishonest acts. Although the Company devotes substantial resources to maintaining effective policies and internal controls to identify and prevent such incidents, given the increasing sophistication of possible perpetrators and developments in technologies such as generative AI, the Company may experience financial losses or reputational harm as a result of fraud. In addition, we may be required to make significant capital expenditures in order to modify and enhance our protective measures or to investigate and remediate fraudulent activity. Although we have not experienced any material business or reputational harm as a result of fraudulent activities in the past, the occurrence of fraudulent activity could damage our reputation, disrupt our business, increase our costs and cause losses in the future.

We may also be required to spend significant resources to monitor and police our intellectual property rights. Our competitors may independently develop similar technology, duplicate our products or services, design around our intellectual property or infringe on our intellectual property rights through the use of generative AI tools, and in such cases, we may not be able to assert our intellectual property rights against such parties. Further, our contractual arrangements may not