First Citizens Bancshares Inc

BancShares assesses emerging risks on an ongoing basis, such as monitoring economic sentiment and emerging geopolitical issues, inflationary pressures due to rising energy prices among other factors, and the impact of artificial intelligence on various industries. BancShares also continues to assess operational risks such as those associated with potential cyberattacks for FCB and third parties upon whom it relies. Assessments will remain ongoing as the conditions continue to exist and develop. BancShares is also assessing the potential risk of an economic slowdown or recession that could create increased credit and market risk having downstream impacts on earnings, capital, and/or liquidity. Supported by resilient economic conditions, baseline forecasts reflect improving commercial real estate property values and a lower unemployment rate compared to the prior year, which have favorably impacted the ALLL. Key indicators will continue to be monitored, and impacts assessed as part of our ongoing Risk Management Framework.

Due to the inherent uncertainty in the macroeconomic forecasts, BancShares utilizes baseline, upside, and downside macroeconomic scenarios and probability weights the scenarios based on review of variable forecasts for each scenario and comparison to expectations. Our scenario weighting has remained consistent since the second quarter of 2025. We will continue to monitor economic sentiment and emerging geopolitical issues, rising energy prices, and the impact of artificial intelligence on various industries.

BancShares assesses emerging risks on an ongoing basis, such as monitoring economic sentiment and emerging geopolitical issues, inflationary pressures due to rising energy prices among other factors, and the impact of artificial intelligence on various industries. BancShares also continues to assess operational risks such as those associated with potential cyberattacks for FCB and third parties upon whom it relies. Assessments will remain ongoing as the conditions continue to exist and develop. BancShares is also assessing the potential risk of an economic slowdown or recession that could create increased credit and market risk having downstream impacts on earnings, capital, and/or liquidity. Supported by resilient economic conditions, baseline forecasts reflect improving commercial real estate property values and a lower unemployment rate compared to the prior year, which have favorably impacted the ALLL. Key indicators will continue to be monitored, and impacts assessed as part of our ongoing Risk Management Framework.

Due to the inherent uncertainty in the macroeconomic forecasts, BancShares utilizes baseline, upside, and downside macroeconomic scenarios and probability weights the scenarios based on review of variable forecasts for each scenario and comparison to expectations. Our scenario weighting has remained consistent since the second quarter of 2025. We will continue to monitor economic sentiment and emerging geopolitical issues, rising energy prices, and the impact of artificial intelligence on various industries.

AI Artificial Intelligence ISDA International Swaps and Derivatives Association

Artificial Intelligence

We are subject to regulation of our business and operations, including risk management, with respect to artificial intelligence (“AI”). On June 24, 2024, the CFPB along with the federal banking agencies, the National Credit Union Administration, and the Federal Housing Finance Agency, adopted a final rule on Quality Control Standards for Automated Valuation Models to address the use of algorithms and AI in estimating home values. The final rule implements quality control standards mandated by the Dodd-Frank Act for the use of automated valuation models by mortgage originators and secondary market issuers in determining the collateral worth of a mortgage secured by a consumer’s principal dwelling.

In addition, on March 27, 2024, the U.S. Treasury released a report that cautioned financial institutions like us to be aware of the special vulnerabilities of AI-based tools and the novel capacities that AI grants to threat actors seeking to carry out targeted cyberattacks against financial institutions. On September 23, 2024, the DOJ updated its guidance to federal prosecutors in conducting an investigation of a corporation related to the evaluation of corporate compliance programs, including an expectation that companies will have conducted a risk assessment regarding the use of new technologies like AI and will have taken appropriate steps to mitigate related risk.

Numerous bills have been introduced in the U.S. Congress throughout 2025 regarding the promotion and regulation of AI. In addition, certain U.S. states have recently enacted regulation related to the development and deployment of AI. Some of these laws intersect with existing privacy laws and may present challenges to the use of AI-related technologies, particularly in cases where personal information is processed requiring notice disclosure and, in certain cases, consent for use of AI. On December 11, 2025, an Executive Order titled “Ensuring a National Policy Framework for Artificial Intelligence” (“EO 14365”) was issued that takes aim at state AI regulations by, among other things, establishing a litigation task force to challenge state AI laws inconsistent with a minimally burdensome national policy framework.

We continue to monitor and evaluate statutory and regulatory proposals related to AI regulation and assess their potential impact.

The financial services industry is continually undergoing rapid technological change with frequent introduction of new technology-related products and services, including recent and rapid developments in AI and crypto-assets and related technologies. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. The rapid growth of new technologies related to the digitization of banking services and capabilities, including through internet services and mobile devices, requires us to continuously evaluate our product and service offerings to ensure they remain competitive. Our success depends in part on our ability to adapt and deliver our products and services in a manner responsive to evolving industry standards and consumer preferences. The cost of investing in, implementing and maintaining such technology is high, and there can be no assurance, given the fast pace of change and innovation, that our technology, either purchased or developed internally, will meet our needs or allow us to remain competitive, in a timely, cost-effective manner or at all.

The use of AI presents its own unique risks. Third-party development of AI models introduces risks related to how those models are developed, trained, and deployed, including unauthorized material in training data and limited visibility into risk mitigation steps. The legal and regulatory environment for AI is uncertain and rapidly evolving, both in the United States and internationally, potentially increasing compliance costs and risk of non-compliance. We are also exposed to the risk that generative AI models may produce incorrect outputs, release confidential information, reflect biases, infringe intellectual property, or otherwise cause harm. Their complexity makes it challenging to understand outputs and comply with documentation or explanation requirements. Crypto-asset related activities also present unique risks, including market and liquidity risk, operational and cybersecurity risks, consumer protection requirements and AML requirements. Refer to Item 1. Business—Regulatory Considerations—Artificial Intelligence and —Crypto-Asset Related Activities for additional information. Failure to adopt new technologies that match consumer preferences or a failure to keep pace with or effectively implement technological changes could adversely affect our results of operations and financial condition.

Cybersecurity risks for large banking institutions, such as FCB, have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and mobile banking to conduct financial transactions, and the increased sophistication of criminal activities. Refer to Item 1. Business—Regulatory Considerations—Artificial Intelligence and —Crypto-Asset Related Activities for additional information. These risks are expected to continue and further intensify in the future. Even the most advanced control environment may be vulnerable to compromise given the possibility of employee error, failures to follow security procedures or malfeasance. Additionally, the increase of supply chain attacks, including potential attacks on third parties with access to our data or those providing critical services to us, remain an operational risk. As cyber threats continue to evolve, we will be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. Furthermore, past and future business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

As technology continues to evolve, criminals are using increasingly more sophisticated techniques to commit fraud, hide fraudulent activity, and proliferate effective techniques through social media. Fraudulent activity that we have been and are likely to continue to be exposed to can come in many forms, including debit card/credit card fraud, check fraud, wire fraud, electronic scanning devices attached to automated teller machines, use of AI to facilitate the perpetration of social engineering and impersonation schemes and identity theft, peer-to-peer payment fraud, social engineering, digital fraud, malware, and phishing, smishing, or vishing attacks to obtain personal information and fraudulent impersonation of our customers through the use of falsified documents, fake identification, or stolen credentials. We expect that combating fraudulent activities as they evolve will require continued ongoing investments and attention as significant fraud could cause us direct losses for which insurance coverage may not be available, or where available, that exceed insurance limits, result in potential legal actions as a result of operational deficiency or noncompliance with regulatory standards, or impair our customer relationships, among other potential consequences, adversely impacting our reputation or results of operations.

30 Glossary of Abbreviations and Acronyms The following is a list of certain abbreviations and acronyms used throughout this document. AFS – Available for Sale ALLL – Allowance for Loan and Lease Losses AOCI – Accumulated Other Comprehensive Income bps – Basis point(s); 1 bp = 0.01% C&I – Commercial and Industrial CET1 – Common Equity Tier 1 CRE – Commercial Real Estate EOP – End of Period EPS – Earnings Per Share FDIC – Federal Deposit Insurance Corporation FFS – Fed Funds Sold FHLB – Federal Home Loan Bank FRB – Federal Reserve Bank FY – Full Year GAAP – United States Generally Accepted Accounting Principles HQLS – High-Quality Liquid Securities HTM – Held to Maturity IBD – Interest-Bearing Deposits ID – Investor Dependent MSA – Metropolitan Statistical Area NCO – Net Charge-Off NII – Net Interest Income NIM – Net Interest Margin NM – Not Meaningful NPL – Nonperforming Loans PAA – Purchase Accounting Accretion or Amortization PPNR – Pre-Provision Net Revenue QTD – Quarter-to-date ROA – Return on Average Assets ROE – Return on Average Common Stockholders’ Equity ROTCE – Return on Average Tangible Common Stockholders’ Equity SLA – Shared Loss Agreement with the FDIC VC – Venture Capital YTD – Year-to-date 3Q25 Additions 3Q25 Removals Archive ACL – Allowance for Credit Losses CAB - Community Association Banking NIB - Noninterest-bearing RBC - Risk-Based Capital TA - Tangible Assets TCE - Tangible Common Equity AUM – Assets Under Management AWA – Affluent Wealth Advisors LIBOR – London Inter-Bank Offered Rate LOC – Line of Credit MSA – Metropolitan Statistical Area PE – Private Equity RIA – Registered Investment Advisor SOFR – Secured Overnight Financing Rate LTD – Long Term Debt RWA – Risk Weighted Assets ACH – Automated clearing house CECL – Current Expected Credit Losses ETF – Exchange-Traded Fund FFR – Federal Funds Rate IPO – Initial Public Offering LP – Limited Partner VC – Venture Capital AI – Artificial Intelligence FFR – Federal Funds Rate FY – Full Year GFB – Global Fund Banking OBS – Off Balance Sheet Client Funds PCD – Purchased Credit Deteriorated LFI – Large Financial Institution TBV – Tangible Book Value FX – Foreign Exchange Under review - to be provided in subsequent draft Not on main pages and/or do not come up in search AOCI QTD

30 Glossary of Abbreviations and Acronyms The following is a list of certain abbreviations and acronyms used throughout this document. AFS – Available for Sale ALLL – Allowance for Loan and Lease Losses AOCI – Accumulated Other Comprehensive Income bps – Basis point(s); 1 bp = 0.01% C&I – Commercial and Industrial CET1 – Common Equity Tier 1 CRE – Commercial Real Estate EOP – End of Period EPS – Earnings Per Share FDIC – Federal Deposit Insurance Corporation FFS – Fed Funds Sold FHLB – Federal Home Loan Bank FRB – Federal Reserve Bank FY – Full Year GAAP – United States Generally Accepted Accounting Principles HQLS – High-Quality Liquid Securities HTM – Held to Maturity IBD – Interest-Bearing Deposits ID – Investor Dependent MSA – Metropolitan Statistical Area NCO – Net Charge-Off NII – Net Interest Income NIM – Net Interest Margin NM – Not Meaningful NPL – Nonperforming Loans PAA – Purchase Accounting Accretion or Amortization PPNR – Pre-Provision Net Revenue QTD – Quarter-to-date ROA – Return on Average Assets ROE – Return on Average Common Stockholders’ Equity ROTCE – Return on Average Tangible Common Stockholders’ Equity SLA – Shared Loss Agreement with the FDIC VC – Venture Capital YTD – Year-to-date 2Q25 Additions 2Q25 Removals FX – Foreign Exchange QTD – Quarter-to-date Archive ACL – Allowance for Credit Losses CAB - Community Association Banking NIB - Noninterest-bearing RBC - Risk-Based Capital TA - Tangible Assets TCE - Tangible Common Equity AUM – Assets Under Management AWA – Affluent Wealth Advisors LIBOR – London Inter-Bank Offered Rate LOC – Line of Credit MSA – Metropolitan Statistical Area PE – Private Equity RIA – Registered Investment Advisor SOFR – Secured Overnight Financing Rate LTD – Long Term Debt RWA – Risk Weighted Assets ACH – Automated clearing house CECL – Current Expected Credit Losses ETF – Exchange-Traded Fund FFR – Federal Funds Rate IPO – Initial Public Offering LP – Limited Partner VC – Venture Capital AI – Artificial Intelligence FFR – Federal Funds Rate FY – Full Year GFB – Global Fund Banking OBS – Off Balance Sheet Client Funds PCD – Purchased Credit Deteriorated LFI – Large Financial Institution TBV – Tangible Book Value Under review - to be provided in subsequent draft Not on main pages and/or do not come up in search AOCI QTD

30 Glossary of Abbreviations and Acronyms The following is a list of certain abbreviations and acronyms used throughout this document. AFS – Available for Sale ALLL – Allowance for Loan and Lease Losses AOCI – Accumulated Other Comprehensive Income bps – Basis point(s); 1 bp = 0.01% C&I – Commercial and Industrial CET1 – Common Equity Tier 1 CRE – Commercial Real Estate EOP – End of Period EPS – Earnings Per Share FDIC – Federal Deposit Insurance Corporation FFS – Fed Funds Sold FHLB – Federal Home Loan Bank FRB – Federal Reserve Bank FX – Foreign Exchange FY – Full Year GAAP – United States Generally Accepted Accounting Principles HQLS – High-Quality Liquid Securities HTM – Held to Maturity IBD – Interest-Bearing Deposits ID – Investor Dependent MSA – Metropolitan Statistical Area NCO – Net Charge-Off NII – Net Interest Income NIM – Net Interest Margin NM – Not Meaningful NPL – Nonperforming Loans PAA – Purchase Accounting Accretion or Amortization PPNR – Pre-Provision Net Revenue QTD – Quarter-to-date ROA – Return on Average Assets ROE – Return on Average Common Stockholders’ Equity ROTCE – Return on Average Tangible Common Stockholders’ Equity SLA – Shared Loss Agreement with the FDIC VC – Venture Capital YTD – Year-to-date 1Q25 Additions FY – Full Year 1Q25 Removals LFI – Large Financial Institution TBV – Tangible Book Value Archive ACL – Allowance for Credit Losses CAB - Community Association Banking NIB - Noninterest-bearing RBC - Risk-Based Capital TA - Tangible Assets TCE - Tangible Common Equity AUM – Assets Under Management AWA – Affluent Wealth Advisors LIBOR – London Inter-Bank Offered Rate LOC – Line of Credit MSA – Metropolitan Statistical Area PE – Private Equity RIA – Registered Investment Advisor SOFR – Secured Overnight Financing Rate LTD – Long Term Debt RWA – Risk Weighted Assets ACH – Automated clearing house CECL – Current Expected Credit Losses ETF – Exchange-Traded Fund FFR – Federal Funds Rate IPO – Initial Public Offering LP – Limited Partner VC – Venture Capital AI – Artificial Intelligence FFR – Federal Funds Rate FY – Full Year GFB – Global Fund Banking OBS – Off Balance Sheet Client Funds PCD – Purchased Credit Deteriorated To be updated in a subsequent draft as information becomes more concrete To be updated in subsequent draft Under review - to be provided in subsequent draft

AI Artificial Intelligence LOCOM Lower of the Cost or Fair Value

Artificial Intelligence

We are subject to regulation of our business and operations, including risk management, with respect to artificial intelligence (“AI”). In 2023, the Biden Administration issued an Executive Order on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (“Executive Order 14110”) that required certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies. On June 24, 2024, the CFPB along with the federal banking agencies, the National Credit Union Administration, and the Federal Housing Finance Agency, adopted a final rule on Quality Control Standards for Automated Valuation Models to address the use of algorithms and AI in estimating home values. The final rule implements quality control standards mandated by the Dodd-Frank Act for the use of automated valuation models by mortgage originators and secondary market issuers in determining the collateral worth of a mortgage secured by a consumer’s principal dwelling.

In addition, on March 27, 2024, the U.S. Treasury released a report that cautioned financial institutions like us to be aware of the special vulnerabilities of AI-based tools and the novel capacities that AI grants to threat actors seeking to carry out targeted cyberattacks against financial institutions. On September 23, 2024, the DOJ updated its guidance to federal prosecutors in conducting an investigation of a corporation related to the evaluation of corporate compliance programs, including an expectation that companies will have conducted a risk assessment regarding the use of new technologies like AI and taken appropriate steps to mitigate related risk. On January 20, 2025, President Trump revoked Executive Order 14110, and on January 23, 2025, President Trump issued an Executive Order on Removing Barriers to American Leadership in Artificial Intelligence, and mandating the review of policies, directives, regulations, orders and other actions taken pursuant to the revoked Executive Order 14110.

States are actively regulating the use of AI technologies, including initiatives from the California Privacy Protection Agency and the NYDFS. We continue to monitor and evaluate proposals related to AI regulation and assess their potential impact.

Cybersecurity risks for large banking institutions, such as FCB, have significantly increased in recent years in part because of the proliferation of new technologies, including generative AI, the use of the internet and mobile banking to conduct financial transactions, and the increased sophistication of criminal activities. In March 2024, the U.S. Treasury cautioned financial institutions with respect to AI vulnerabilities and threat-actor capabilities, and in September 2024, the DOJ updated guidance to prosecutors in their investigations of corporations, including an expectation of corporations having conducted risk assessments regarding use of new technologies like AI. Refer to Item 1. Business—Regulatory Considerations—Artificial Intelligence for additional information. Cyberattacks involving LFIs, including distributed denial of service attacks designed to disrupt external customer-facing services, nation state cyberattacks and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution’s information systems and data or that of its customers, are becoming more common and increasingly sophisticated. In particular, there has been an observed increase in the number of distributed denial of service attacks against the financial sector in recent years, which increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. These risks are expected to continue and further intensify in the future. Even the most advanced control environment may be vulnerable to compromise given the possibility of employee error, failures to follow security procedures or malfeasance. Additionally, the increase of supply chain attacks, including potential attacks on third parties with access to our data or those providing critical services to us, remain an operational risk. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. Furthermore, past and future business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

As technology continues to evolve, criminals are using increasingly more sophisticated techniques to commit fraud, hide fraudulent activity, and proliferate effective techniques through social media. Fraudulent activity that we have been and are likely to continue to be exposed to can come in many forms, including debit card/credit card fraud, check fraud, wire fraud, electronic scanning devices attached to automated teller machines, use of AI to facilitate the perpetration of social engineering and impersonation schemes and identity theft, peer-to-peer payment fraud, social engineering, digital fraud, malware, and phishing, smishing, or vishing attacks to obtain personal information and fraudulent impersonation of our customers through the use of falsified documents, fake identification, or stolen credentials. We expect that combating fraudulent activities as they evolve will require continued ongoing investments and attention in the future as significant fraud could cause us direct losses for which insurance coverage may not be available, or where available, that exceed insurance limits, result in potential legal actions as a result of operational deficiency or noncompliance with regulatory standards, or impair our customer relationships, among other potential consequences, adversely impacting our reputation or results of operation.

10 2Q24 Financial Results - Takeaways Quarter-to-date Year-to-date Mar 23 Dec 22 Mar 22 Mar 23 Dec 21 EPS $ 16.67 $ 20.94 $ 19.25 $ 20.77 $ 12.09 $ 12.82 $ 67.40 $ 77.24 $ 53.88 $ 51.88 ROE 11.05 % 13.89 % 12.49 % 13.47 % 10.96 % 11.63 % 11.15 % 12.78 % 12.84 % 12.36 % ROTCE 11.70 % 14.71 % 13.17 % 14.20 % 12.00 % 12.72 % 11.78 % 13.50 % 14.12 % 13.60 % ROA 0.93 % 1.15 % 1.16 % 1.24 % 1.20 % 1.09 % 1.01 % 1.15 % 1.33 % 1.10 % PPNR ROA 1.70 % 1.81 % 1.72 % 1.86 % 1.33 % 1.17 % 1.84 % 1.64 % 1.41 % 1.11 % NIM 3.36 % 3.36 % 3.40 % 3.40 % 2.56 % 2.56 % 3.14 % 3.14 % 2.55 % 2.55 % Net charge-off ratio 0.14 % 0.14 % 0.10 % 0.10 % 0.04 % 0.04 % 0.12 % 0.12 % 0.08 % 0.08 % Efficiency ratio 61.74 % 54.08 % 61.91 % 53.32 % 65.40 % 62.51 % 60.50 % 56.40 % 64.43 % 64.34 % Reported Adjusted (Non-GAAP) Reported Adjusted (Non-GAAP) Reported Adjusted (Non-GAAP) Reported Adjusted (Non-GAAP) Reported Adjusted (Non-GAAP) Approved a share repurchase plan in July 2024 for the repurchase of up to $3.5 billion in Class A common shares with repurchases expected to begin during the third quarter. 1 Achieved solid adjusted EPS, ROE and ROA results beating our expectations.2 Deposits grew $1.5 billion (4.0% annualized) from the linked quarter due to growth in the SVB Commercial and General Bank segments. 6 Second quarter venture activity revealed green shoots, partly attributed to an uptick in AI investment. While headwinds remain in 2024, we expect gradual improvements in 2H24 and into 2025. 7 Loans grew at an annualized rate of 11.8% during the quarter. Growth was strong across all segments with SVB Commercial continuing to experience loan growth. 5 Linked quarter NII increased for the first time since 3Q23. Headline NIM declined slightly (pace of decline slowed), while NIM ex accretion remained relatively stable. 3 Net charge-offs remained below 2H23 levels, and there are no emerging problems outside of pressure points previously disclosed. 4 Continued to refine and mature our regulatory capabilities and infrastructure to meet current requirements and to ensure future scalability. 8

7 SVB Today 1,000+ New SVB clients were acquired since the acquisition 80% of CNBC’s Disruptor 50 List are SVB clients Our Clients SVB banks the companies shaping the future. 80% of VC firms represented on Forbes’ Midas List are served by SVB ~20 Years of average experience of the SVB Leadership team ~80% of bankers and relationship advisors have not changed Our Team SVB comprises a knowledgeable team of bankers, working to increase the probability of our clients’ success. ~1,500 Bankers and relationship advisors serving the innovation economy Against a backdrop of slowing deployments and diminishing LP interest, VC fundraising last year hit its lowest level since 2017: • Fund managers closed $53 B in 2023, a 62% drop from the record high in 2022, and we anticipate FY’24 will end at a similar level. • In 2022, the typical fund manager closed a new fund 1.7 years after its last fund closed. Last year the pace slowed to 2.5 years. Most VCs recently surveyed believe the fundraising environment in 2023 will be about the same as 2024. • The temporary drawback in fundraising among established firms that we witnessed in 2023 is continuing into 2024 given many of these firms have plenty of dry powder to invest. Exit-ready companies are poised once the IPO window opens: • There are 725 tech unicorns in the US and a record backlog of companies ready to exit given market conditions in 2023. • As late-stage VC investment remains suppressed, and investors push for liquidity, these companies will be looking to exit if the IPO window opens in 2024. The promise of generative AI is propelling big tech stocks to new heights, but smaller tech companies are making progress: • The Renaissance IPO ETF, a proxy for recent tech IPOs, is up approximately 70% as of March 31, 2024 from its low point in December 2022, and public revenue multiples are up across most tech sectors. State of the Innovation Market (1) One Year After the Acquisition, SVB Remains Critical to the Innovation Economy Please do not review - awaiting final data and language from SVB marketing/communications team. To be provided in subsequent draft (1) Market commentary sourced from SVB’s innovation economy outlook report titled “State of the Markets H1 2024”.

On October 30, 2023, the Biden Administration issued an Executive Order on the use of and risks associated with artificial intelligence (“AI”) systems, requiring certain federal agencies, including the CFPB, to address potential discrimination in the housing and consumer financial markets relating to the use by financial institutions of AI technologies.

Cybersecurity risks for large banking institutions, such as FCB, have significantly increased in recent years in part because of the proliferation of new technologies, including generative AI, the use of the internet and mobile banking to conduct financial transactions, and the increased sophistication of criminal activities. Cyberattacks involving large financial institutions, including distributed denial of service attacks designed to disrupt external customer-facing services, nation state cyberattacks and ransomware attacks designed to deny organizations access to key internal resources or systems or other critical data, as well as targeted social engineering and phishing email and text message attacks designed to allow unauthorized persons to obtain access to an institution’s information systems and data or that of its customers, are becoming more common and increasingly sophisticated. In particular, there has been an observed increase in the number of distributed denial of service attacks against the financial sector over the past year, which increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. These risks are expected to continue and further intensify in the future. For example, we will likely see an increase in cybersecurity risks in the future as we continue to augment our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications. In addition, financially motivated attacks remain a challenge from a cybercrime perspective due to the increased sophistication and activities of threat actors, which may include organized crime groups, hackers, terrorist organizations, hostile foreign governments, disgruntled employees or vendors, activists and other external parties, including those involved in corporate espionage. Even the most advanced control environment may be vulnerable to compromise given the possibility of employee error, failures to follow security procedures or malfeasance. Additionally, the increase of supply chain attacks, including potential attacks on third parties with access to our data or those providing critical services to us, remain an operational risk. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. Furthermore, past and future business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.