Zions Bancorporation, National Association (ZION) risk factors, FY2025 10-K

What changed since the prior 10-K

New

• New

  Our ability to generate revenue and expand our business is inherently linked to the prudent and strategic management of risk. These risks are comprehensively defined within our Risk Management Framework, which serves as the foundation for our enterprise-wide approach to risk oversight

  Our governance framework and specialized committees oversee various operational risks, including credit, interest rate, liquidity, technology, cybersecurity, and regulatory compliance.

• New

  Fluctuations in the availability and sources of liquidity and capital could restrict our operational flexibility and constrain future growth opportunities

  Fluctuations in customer deposits and alternative funding sources, impacted by emerging technologies like stablecoins, could constrain liquidity and growth.

• NewSTRATEGIC AND BUSINESS RISK

  Challenges experienced by other financial institutions could negatively impact the broader financial markets and, in turn, indirectly have an adverse effect on our operations

  Systemic risk from distress at other financial institutions, such as regional bank deposit outflows in 2023, could indirectly disrupt our operations.

• NewSTRATEGIC AND BUSINESS RISK

  We may face challenges in attracting and retaining qualified personnel or effectively fostering our corporate culture. Additionally, recruiting and compensation costs may increase as a result of evolving workplace dynamics, market conditions, economic factors, and regulatory changes

  Banking regulations restricting compensation and competition from fintechs may hinder our ability to attract and retain qualified personnel.

• NewSTRATEGIC AND BUSINESS RISK

  We operate in a highly competitive environment, both in the range of products and services we provide and across the geographic markets in which we conduct business

  Industry consolidation and market expansion by competitors with greater experience could intensify pricing and customer retention pressures.

• NewOPERATIONAL RISK

  Our operations may experience disruptions as a result of the implementation and impact of new and ongoing projects and initiatives

  Implementing strategic projects may cause operational disruptions, budget overruns, technological issues, and increased regulatory scrutiny.

• NewOPERATIONAL RISK

  Climate-related and other catastrophic events may adversely impact our organization, our customers, the broader economy, financial and capital markets, and certain industries

  Climate-related catastrophes and weather events, such as the 2025 Southern California wildfires, threaten our facilities and regional customer base in Utah, Texas, and California.

• NewOPERATIONAL RISK

  We utilize models to support the Bank’s management and decision-making processes. Inaccurate assumptions or non-representative training data within these models could lead to unreliable outputs or suboptimal decisions, which could adversely affect our operations

  Inaccurate assumptions or flawed training data in risk models used for credit losses and liquidity could lead to suboptimal management decisions.

• NewOPERATIONAL RISK

  We outsource certain operations to third-party providers, which may pose risks that could adversely affect our business and operational performance

  Outsourcing operations to third-party providers exposes us to service disruptions, cybersecurity threats, and difficulties in finding replacement vendors.

• NewOPERATIONAL RISK

  continuity, and negatively impact customer experience. Moreover, replacing or identifying suitable alternatives for underperforming suppliers can be difficult and costly, particularly when swift transitions are required due to unforeseen circumstances

• NewTECHNOLOGY RISK

  The development and use of AI technologies present risks and challenges that could materially and adversely affect our business, financial condition, and results of operations

  Integrating early-stage artificial intelligence introduces risks of hallucinations and regulatory uncertainty that could affect decision-making and compliance costs.

• NewTECHNOLOGY RISK

  We are also exposed to risks arising from the use of AI by threat actors to commit fraud, misappropriate funds, and facilitate cyberattacks. If leveraged against us—or against other financial institutions, securities exchanges, or similar organizations—AI‑enabled threats could pose risks to our operational stability

  Threat actors leveraging artificial intelligence to commit fraud or launch cyberattacks could threaten our operational stability.

• NewCYBERSECURITY RISK

  We may be unable to fully realize our DTAs, which could negatively impact our operating results and overall financial performance

• NewLEGAL/COMPLIANCE RISK

  Laws and regulations applicable to us and the broader financial services industry impose significant restrictions on our business activities, subjecting us to heightened regulatory oversight and increased compliance costs

• NewLEGAL/COMPLIANCE RISK

  Operational, regulatory, compliance, and legal risks may harm our business and brands

• NewOTHER RISKS

  Although our operations have not been materially disrupted to date, future developments—such as cyberattacks targeting the U.S., the Bank, our customers, or our suppliers—could pose substantial challenges to our ability to conduct business effectively

• NewOTHER RISKS

  For more information, see “Other Regulations and Proposals” in Supervision and Regulation on page 12

Dropped

• Dropped

  Changes in the levels and sources of liquidity and capital may limit our operations and potential growth

• DroppedSTRATEGIC AND BUSINESS RISK

  Challenges faced by other financial institutions could adversely affect financial markets as a whole and have indirect adverse effects on us

• DroppedSTRATEGIC AND BUSINESS RISK

  intermediaries, such as clearing agencies, clearing houses, banks, securities firms, and exchanges, with which we interact on a daily basis, and therefore, could adversely affect us

• DroppedSTRATEGIC AND BUSINESS RISK

  We may not be able to hire or retain qualified personnel or effectively promote our corporate culture, and recruiting and compensation costs may increase due to changes in the workplace, marketplace, economy, and regulatory environment

• DroppedOPERATIONAL RISK

  Our operations could be disrupted by the impact of new and ongoing projects and initiatives

• DroppedOPERATIONAL RISK

  Climate-related and other catastrophic events, including but not limited to, hurricanes, tornadoes, earthquakes, wildfires, floods, mudslides, prolonged drought, and pandemics may adversely affect us, our customers, the general economy, financial and capital markets, and specific industries

• DroppedOPERATIONAL RISK

  We utilize models in the management of the Bank. There is a risk that these models are inaccurate in various ways, potentially leading to suboptimal decisions

  Deposit volatility and funding costs followed 2023 bank closures.

• DroppedOPERATIONAL RISK

  We outsource various operations to third-party suppliers, which could adversely impact our business and operational performance

• DroppedCYBERSECURITY RISK

  We may unable to fully realize our deferred tax assets, which could adversely affect our operating results and financial performance

  Systemic risk from interconnected financial institutions.

• DroppedLEGAL/COMPLIANCE RISK

  Laws and regulations governing us and the financial services industry impose significant limitations on our business activities, subjecting us to increased regulation and additional costs

  Intermediary soundness and commercial real estate asset deterioration.

• DroppedLEGAL/COMPLIANCE RISK

  alter the purpose, funding, or enforcement powers of certain agencies; (3) significantly reduce the size of the federal government and workforce; and (4) modify, reinterpret, replace, or repeal various laws, regulations and regulatory guidance

  Hiring and compensation constraints from bank regulations.

• DroppedLEGAL/COMPLIANCE RISK

  We face various reputational risk issues arising from operational, regulatory, compliance, and legal risks

• DroppedOTHER RISKS

  Stakeholder views and developments related to environmental and social issues could lead or require us to restrict or modify certain business activities and negatively affect our business and reputation

  Operational disruptions from projects and initiatives.

Reworded

• 100% rewritten

  ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES

  Added reference to internal controls in MD&A while maintaining that third-party supplier operational and security risks cannot be fully eliminated.

• 100% rewrittenLEGAL/COMPLIANCE RISK

  Political developments—including those resulting from administrative transitions and shifts in congressional control—can introduce volatility and uncertainty, potentially leading to significant changes in the size, scope, and effectiveness of government agencies and services

  Updated political development risks to include specific emerging challenges like quantum computing, digital assets, and AI alongside climate and cybersecurity.

  Was: Political developments, including those arising from transitions in administration and shifts in congressional control, may create volatility and uncertainty, potentially resulting in significant changes in the size, scope, and effectiveness of government agencies and services

• 99% rewrittenLEGAL/COMPLIANCE RISK

  Legislative, administrative, and judicial changes to tax laws, regulations, or case law could adversely affect our business operations and financial performance

  Clarified tax law complexities, noting that management judgments and statutory interpretations remain subject to audit challenges and evolving judicial rulings.

  Was: Legislative, administrative, and judicial changes to tax laws, regulations, and case law may adversely impact our business and financial performance

• 99% rewrittenOPERATIONAL RISK

  We could be adversely affected by internal and external fraud schemes

  Expanded fraud risk to explicitly state that undetected fraudulent schemes can harm our reputation and impair customer acquisition and retention.

• 98% rewrittenCYBERSECURITY RISK

  We are exposed to risks related to information system failures and cybersecurity threats, which could adversely impact our business operations and financial performance

  Enhanced cybersecurity risk description by emphasizing the proliferation of artificial intelligence as a key driver of heightened information security threats.

  Was: We are subject to various information system failures and cybersecurity risks that could adversely affect our business and financial performance

• 97% rewrittenOTHER RISKS

  Wars, international trade policies and disputes, geopolitical conflicts, and retaliatory measures imposed by the U.S. and other countries—including the responses to such actions—may significantly disrupt both domestic and foreign economies and markets

  Refined geopolitical risk to explicitly include international trade disputes and currency valuation impacts alongside commodity pricing and inflation.

  Was: Wars, international trade policies and disputes, geopolitical conflicts, and retaliatory measures imposed by the U.S. and other countries, including the responses to such measures, may significantly disrupt domestic and foreign economies and markets

• 97% rewrittenLEGAL/COMPLIANCE RISK

  We may be adversely impacted by legal and governmental proceedings

  Added specific potential consequences of legal and governmental proceedings, including fines, civil money penalties, injunctions, and operational restrictions.

  Was: We could be adversely affected by legal and governmental proceedings

• 95% rewrittenSTRATEGIC AND BUSINESS RISK

  Our ability to effectively develop, adopt, implement, and deliver technological innovations may significantly impact our financial performance and could adversely affect our business

  Updated technological innovation risks to contrast larger bank economies of scale directly with the expanding presence of fintech platforms.

  Was: Our ability to develop, adopt, implement, and deliver technological advancements could adversely affect us

• 95% rewrittenLEGAL/COMPLIANCE RISK

  We are subject to restrictions on permissible activities, which limit the scope of business we can conduct and may complicate the acquisition of other financial institutions

  Was: We are subject to restrictions on permissible activities, which limit the types of business we may conduct and may complicate acquisitions of other financial companies

• 94% rewrittenCYBERSECURITY RISK

  We may be adversely affected by risks related to accounting, financial reporting, and regulatory compliance

  Was: We could be adversely affected by risks related to accounting, financial reporting, and regulatory compliance

• 93% rewrittenLEGAL/COMPLIANCE RISK

  Differences between the requirements of the National Bank Act and applicable state laws governing mergers could hinder our ability to execute acquisitions as efficiently or advantageously as bank holding companies and other financial institutions

  Was: Differences between the National Bank Act and state law requirements regarding mergers could hinder our ability to execute acquisitions as efficiently and advantageously as bank holding companies or other financial institutions

• 93% rewritten

  Our business performance is highly correlated with local economic conditions in specific geographic regions of the U.S

  Was: Our business is highly correlated with local economic conditions in a specific geographic region of the U.S

• 89% rewrittenLEGAL/COMPLIANCE RISK

  The corporate and securities laws applicable to us are less developed than those governing state-chartered corporations, which may impact our ability to execute corporate transactions efficiently and effectively

  Was: The corporate and securities laws governing us are less developed than those for state-chartered corporations, potentially impacting our ability to execute corporate transactions efficiently and optimally

• 89% rewrittenCYBERSECURITY RISK

  Regulatory requirements, prevailing economic conditions, and other factors may require us to raise capital under circumstances or in amounts that are unfavorable to us

  Was: Regulatory requirements, economic conditions, and other factors may require us to raise capital at times or in amounts that are unfavorable to us

• 89% rewritten

  We have a concentration of risk within our loan portfolio, including, but not limited to, loans secured by real estate, oil and gas-related lending, and leveraged and enterprise value lending. These loan types carry unique risk characteristics that could adversely impact our financial results

  Was: We have a concentration of risk in our loan portfolio, including, but not limited to, loans secured by real estate, oil and gas-related lending, and leveraged and enterprise value lending. These loans may have unique risk characteristics that may adversely affect our results

• 88% rewritten

  Failure to adequately manage interest rate risk could have a material adverse impact on our financial results

  Was: Failure to effectively manage our interest rate risk could adversely affect our results

• 88% rewritten

  Unfavorable rating actions by credit rating agencies could negatively impact our organization as well as the holders of our securities

  Was: Unfavorable rating actions from rating agencies could adversely affect both us and the holders of our securities

• 87% rewrittenOPERATIONAL RISK

  We could be adversely affected by failures in our internal controls

• 86% rewrittenCYBERSECURITY RISK

  Internal stress testing and capital management requirements, together with provisions of the National Bank Act and OCC regulations, may limit our ability to increase dividends, repurchase shares of our stock, or access capital markets

  Was: Internal stress testing and capital management, along with provisions of the National Bank Act and OCC regulations, may limit our ability to increase dividends, repurchase shares of our stock, and access capital markets

• 86% rewritten

  Adverse economic conditions could negatively affect our performance and overall financial condition

  Was: We could be negatively affected by adverse economic conditions

• 85% rewritten

  Credit quality has negatively impacted our performance in the past and may continue to do so in the future

  Was: Credit quality has adversely affected us in the past and may adversely affect us in the future

• 84% rewrittenCYBERSECURITY RISK

  The value of our goodwill may decline in the future

• 82% rewrittenTECHNOLOGY RISK

  Our operations and customer-facing services may be adversely affected by system vulnerabilities, failures, or outages

  Was: Our operations and customer services could be adversely impacted by system vulnerabilities, failures, or outages

• 82% rewritten

  We have a concentration of risk associated with certain counterparties, which may present unique risk characteristics that could adversely impact our financial results

  Was: We have a concentration of risk from counterparties, which may have unique risk characteristics that may adversely affect our results

All 41 risk factors

Headings as the filing states them, in filing order.

Other Zions Bancorporation, National Association 10-Ks

• FY2024 10-K risk factors

  37 risks

  Zions Bancorporation faces prominent credit and interest rate risks, commercial real estate exposure, and extensive federal banking regulations.

  Filed Feb 25, 2025

About this page

The headings are the filing's own. The one-line readings and the overview are automated and can be wrong: read Item 1A of the 10-K for the exact wording.