First Horizon Corp

New technologies proliferating in the financial services industry are subject to risks and uncertainties that could impair their effectiveness or have a negative impact on our business. New technologies, services, and systems based wholly or in part on artificial intelligence are proliferating within our industry, including at our Company as we are seeking to accelerate both our data capabilities and our responsible use of artificial

intelligence to deliver excellent client and associate outcomes. These technologies are subject to risks that algorithms and datasets may be flawed or insufficient or contain biased or incorrect information, risks that are exacerbated because models and processes related to artificial intelligence are not always transparent.

Fraud is a major, and increasing, operational risk for us and all banks. Two traditional areas—deposit fraud (check forging, check kiting, wire fraud, check washing, etc.) and loan fraud—continue to be major sources of fraud attempts and actual loss. Fraud directed against clients—generally using deception to persuade clients to transfer funds—has emerged as a third large source of fraud loss. The methods used to perpetrate and combat fraud continue to evolve as technology changes. In addition to cybersecurity risk (discussed below), new technologies—including the use of artificial intelligence—have made it easier for bad actors to obtain and use client personal information, mimic communications to or from clients, mimic signatures, and otherwise create false instructions and documents that appear genuine.

Cybersecurity risks for banks and other financial institutions have increased significantly in recent years in part because of the proliferation of technology-based products and services and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, nation state-supported actors, activists and other external parties. This increase is expected to continue and further intensify. The techniques used by cyber criminals change frequently, may be difficult to detect over extended periods, and can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments. In addition, the effectiveness of these techniques may be further enhanced by the use of artificial intelligence.

For example, companies which claim to offer applications and services based on artificial intelligence compete much more directly with traditional financial services companies in areas involving personal advice, including high-margin

Other technologies, services, and systems based wholly or in part on artificial intelligence and machine learning are proliferating within our industry and among many of our commercial clients, resulting in an environment which is changing rapidly. These technologies are subject to risks that algorithms and datasets may be flawed or insufficient or contain biased information, risks that are exacerbated because models and processes related to artificial intelligence and machine learning are not always transparent. Our challenge is to maintain critical stability and security while also being nimble enough to adapt quickly to changing circumstances and client demands.

We believe that, over the course of the technology-driven evolution of our industry which is well underway, the “winners” will be those institutions which can know their clients and make those clients feel they are known, even when many clients increasingly do not visit banking centers or have face-to-face live interaction. Two keys to achieving a psychological connection with such clients are (1) data management and analytics, using artificial intelligence processes, which allow an institution to provide a differentiated, personalized experience for the client at the point of interaction, and (2) seamless integration of real-time client contact with a human being through voice, chat, or other means.

Fraud is a major, and increasing, operational risk for us and all banks. Two traditional areas—deposit fraud (check forging, check kiting, wire fraud, etc.) and loan fraud—continue to be major sources of fraud attempts and actual loss. Fraud directed against clients—generally using deception to persuade clients to transfer funds—has emerged as a third large source of fraud loss. The methods used to perpetrate and combat fraud continue to evolve as technology changes. In addition to cybersecurity risk (discussed below), new technologies—including the use of artificial intelligence—have made it easier for bad actors to obtain and use client personal information, mimic communications to or from clients, mimic signatures, and otherwise create false instructions and documents that appear genuine.

Cybersecurity risks for banks and other financial institutions have increased significantly in recent years in part because of the proliferation of technology-based products and services and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, nation state-supported actors, activists and other external parties. This increase is expected to continue and further intensify. The techniques used by cyber criminals change frequently, may not be recognized until launched (or may evade detection for considerable time), can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments, and may see their frequency increased, and effectiveness enhanced, by the use of artificial intelligence.

As FHN manages it, IT risk includes cybersecurity risk, which in turn includes the risks from cyber fraud, cyber theft, cyber vandalism, cyber ransom, data and system security, and other unauthorized incursions into FHN's IT systems. IT risk management also includes IT system reliability, data integrity, IT aspects of regulatory compliance, and risks associated with the use of artificial intelligence tools and systems. The discussion in this section focuses on cybersecurity. Additional information on this topic is presented in Cybersecurity Risks within Item 1A beginning on page 35.

For example, companies which claim to offer applications and services based on artificial intelligence compete much more directly with traditional financial services companies in areas involving personal advice, including high-margin services such as financial planning and wealth management. The low-cost, high-speed nature of these “robo-advisor” services can be especially attractive to younger, less-affluent clients and potential clients, as well as persons interested in “self-service” investment management. Other industry changes, such as zero-commission securities trading offered by certain large firms, may amplify this trend.

Other technologies, services, and systems based wholly or in part on artificial intelligence are proliferating within our industry and among many of our commercial clients, resulting in an environment which is changing rapidly. Our challenge is to maintain critical stability and security while also being nimble enough to adapt quickly to changing circumstances and client demands.

We believe that, over the course of the technology-driven evolution of our industry which is well underway, the “winners” will be those institutions which can know their clients and make those clients feel they are known, even when many clients increasingly do not visit banking centers or have face-to-face live interaction. Two keys to achieving a psychological connection with such clients are (1) data management and analytics, using artificial intelligence processes, which allow an institution to provide a differentiated, personalized experience for the client at the point of interaction, and (2) seamless integration of real-time client contact with a human being through voice, chat, or other means.

Fraud is a major, and increasing, operational risk for us and all banks. Two traditional areas—deposit fraud (check forging, check kiting, wire fraud, etc.) and loan fraud—continue to be major sources of fraud attempts and actual loss. Fraud directed against clients—generally using deception to persuade clients to transfer funds—has emerged as a third large source of fraud loss. The methods used to perpetrate and combat fraud continue to evolve as technology changes. In addition to cybersecurity risk (discussed below), new technologies—including the use of artificial intelligence—have made it easier for bad actors to obtain and use client personal information, mimic communications to or from clients, mimic signatures, and otherwise create false instructions and documents that appear genuine.

As FHN manages it, IT risk includes cybersecurity risk, which in turn includes the risks from cyber fraud, cyber theft, cyber vandalism, cyber ransom, data and system security, and other unauthorized incursions into FHN's IT systems. IT risk management also includes IT system reliability, data integrity, IT aspects of regulatory compliance, and risks associated with the use of artificial intelligence tools and systems. The discussion in this section focuses on cybersecurity. Additional information on this topic is presented in Cybersecurity Risks within Item 1A beginning on page 33.

Continuous improvement Significant improvements since 2020 by implementing high-impact technology initiatives 53 2023 2022 Next-gen core, digital, and servicing platform for VirtualBank New wire and commercial loan servicing platform ‘nCino’ for commercial loan origination completed in 8 months New digital platform for our Treasury Management clients Development process modernization (DevOps) New contact center IVR and agent platform AI-powered platform piloted for deposit fraud Cyber program enhancement 2020 ACH payments system upgrade (PEP+)

What it will take In order to deliver, we plan to invest an additional ~$75 - $100 million in technology and talent 55 ~$75 – $100 million in additional investment over the next 3 years 100% A Ensure business resiliency Must-do work in regulatory compliance, cybersecurity and fraud, as well as refreshing and replacing aged systems B Elevate technology delivery Simplification of select platforms, harnessing cloud and API capabilities, hiring additional engineering talent C Enable superior experiences Upgrades, enhancements and development of new, differentiating capabilities: • Digital Banking • Wealth Management • Treasury Management • Data • Marketing / CRM • AI • Process automation 40 – 50% 50 – 60% +20% FTE We plan to increase technology FTE by up to 20% over the next two years with a focus on: • Data • Cloud • Digital • Cybersecurity “Change the bank” “Run the bank”

For example, companies which claim to offer applications and services based on artificial intelligence compete much more directly with traditional financial services companies in areas involving personal advice, including high-margin services such as financial planning and wealth management. The low-cost, high-speed nature of these “robo-advisor” services can be especially attractive to younger, less-affluent clients and potential clients, as well as persons interested in “self-service” investment management. Other industry changes, such as zero-commission securities trading offered by certain large firms, may amplify this trend.

We believe that, over the course of the technology-driven evolution of our industry which is well underway, the “winners” will be those institutions which can know their clients and make those clients feel they are known, even when many clients increasingly do not visit banking centers or have face-to-face live interaction. Two keys to achieving a psychological connection with such clients are (1) data management and analytics, using artificial intelligence processes, which allow an institution to provide a differentiated, personalized experience for the client at the point of interaction, and (2) seamless integration of real-time client contact with a human being through voice, chat, or other means.