Item 1. Business
Item 1. Business
General
The Corporation was incorporated under the laws of Pennsylvania on February 8, 1982 and became a bank holding company through the acquisition of all of the outstanding stock of Fulton Bank on June 30, 1982. In 2000, we became a financial holding company as defined in the GLBA, which gave us the ability to expand our financial services activities under our holding company structure. See "Item 1. Business - Competition and - Supervision and Regulation. " We directly own 100% of the common stock of Fulton Bank and five non-bank entities.
On July 1, 2022, we completed our acquisition of 100% of the outstanding common stock of Prudential Bancorp. Prudential Bancorp's wholly-owned subsidiary, Prudential Bank, became our wholly-owned subsidiary. Prudential Bank merged with and into Fulton Bank on November 5, 2022.
Our Internet address is www.fultonbank.com . Electronic copies of our 2023 Annual Report on Form 10-K are available free of charge by visiting "Investor Relations - Documents" at www.fultonbank.com . Electronic copies of quarterly reports on Form 10-Q and current reports on Form 8-K are also available at this Internet address. These reports, as well as any amendments thereto, are posted on our website as soon as reasonably practicable after they are electronically filed with the SEC. The information contained on our website or in any websites linked by our website is not a part of this Annual Report on Form 10-K.
Banking and Financial Services
Through our banking subsidiary, Fulton Bank, we deliver financial services primarily within our five-state market area, comprised of Pennsylvania, Delaware, Maryland, New Jersey and Virginia, in a personalized, community-oriented style that emphasizes relationship banking.
We operate in areas that are home to a wide range of manufacturing, healthcare, agriculture and other service companies. Although a large portion of our loan portfolio is comprised of commercial loans, commercial mortgage loans and construction loans, we are not dependent upon one or a few customers and the loss of any single customer or a few customers would not have a material adverse impact on our business. See "Item 1A. Risk Factors - Interest Rate and Credit Risks - Our loan portfolio composition subjects us to credit risk and A significant proportion of our loan portfolio consists of commercial mortgage loans that may pose increased credit risk."
We offer a wide range of consumer and commercial banking products and services, as well as wealth management products and services, to our customers and the communities we serve:
Consumer Banking - We offer a diversified suite of consumer banking products and services in our market area. Our consumer banking products and services include various checking account and savings deposit products and certificates of deposit. We offer home equity loans and lines of credit as well as a variety of fixed, variable and adjustable rate mortgage products, including construction loans and jumbo residential mortgage loans, all of which are underwritten based upon loan-to-value limits specified in our lending policy. Our consumer loan products also include automobile loans, student loans, personal loans and lines of credit and checking account overdraft protection.
Commercial Banking - We provide commercial banking products and services primarily to small and medium sized businesses (generally with annual gross revenue of less than $150 million) in our market area. Commercial lending products include commercial real estate loans, commercial and industrial loans and construction loans. Variable, adjustable and fixed rate loans are provided, with variable and adjustable rate loans generally tied to an index, such as the Prime Rate or SOFR, as well as interest rate derivatives. Our commercial lending policy encourages relationship banking and provides strict guidelines related to customer creditworthiness and collateral requirements for secured loans. We offer equipment lease financing, letters of credit, cash management services and traditional deposit products to commercial customers. We have established lending limits based on our internal risk rating of a borrower and for certain types of lending commitments.
Wealth Management - We offer wealth management services, which include investment management, trust, brokerage, insurance and investment advisory services, to consumer and commercial customers in our market area through Fulton Financial Advisors and Fulton Private Bank, both operating divisions of Fulton Bank.
8
We deliver these products and services through a network of financial center offices. Electronic delivery channels include a network of ATMs and telephone, mobile and online banking. The variety of available delivery channels allows customers to access their account information and perform certain transactions, such as depositing checks, transferring funds and paying bills, at any time of the day. As of December 31, 2023, we had 208 financial centers, not including remote service facilities (mainly stand-alone ATMs), and our main office located in Lancaster, Pennsylvania.
Human Capital
Our workforce, excluding temporary employees and interns, on December 31, 2023 consisted of approximately 3,400 employees, compared to approximately 3,300 employees at December 31, 2022.
Employee Engagement and Retention - We place a premium on having a highly engaged workforce because engaged employees tend to perform at a higher level, support our success, and are more likely to remain with our organization. We conduct an annual survey of our workforce to measure employee engagement, assess employee morale, and help identify areas of the employee experience that could be improved. We then task our leaders with developing and implementing communication and action plans aimed at collaborating with their respective teams to gain a better understanding of the results of the assessment and to foster enhanced future engagement.
Our leaders are held accountable for the employee engagement of their teams as each leader's engagement score is included in their annual performance review. Additionally, aggregated employee engagement assessment results are reported to our Board of Directors as a key indicator of the health and well-being of our workforce.
Culture, Diversity and Inclusion - We believe that building relationships matters. This belief includes relationships with customers and relationships among employees. We place significant emphasis on developing our corporate culture, and we consider our culture to be one of the primary components of our continuing success. Our culture-shaping program, The Fulton Experience, is a highly engaging program that is intended to create new ways of thinking about employees' individual roles, how employees collaborate, and how we and our employees grow together. We believe that we succeed as a company because we value our employees' teamwork and foster a culture around that belief. We apply that same emphasis to the development of a diverse, equitable, and inclusive workforce. We recognize that having a diverse, equitable, and inclusive culture fosters a culture of respect and is a crucial element of a successful organization.
Compensation and Rewards - The Corporation invests in its workforce by offering a comprehensive Total Rewards program which includes competitive salaries, incentives, and benefits programs. In line with the Corporation's pay for performance philosophy, we offer performance-based incentive programs designed to drive results in the business units as well as at the corporate level.
Workforce Recruitment and Development - We recruit our workforce, filling both vacant and new positions by posting these positions on our website and on social media platforms, through employee referrals and through talent recruiting efforts by internal and third-party recruiters. We provide for professional development of new and existing employees largely through the efforts of our Learning and Development area that develops and administers a wide variety of training programs for professional development. We also provide a number of third-party offerings in which employees can further enhance their skills, knowledge and leadership potential. One such example, afforded to employees with future leadership potential, is through our participation in the Stonier School of Banking sponsored by the American Bankers Association.
Safety, Health and Wellness - The safety, health and wellness of our employees remains a top priority. In addition to traditional healthcare, paid time off, paid parental leave and retirement benefits, we provide behavioral and mental health support and work-life services through our Employee Assistance Program. Following the end of the COVID-19 pandemic, we continue to iterate our approach to remote and hybrid working arrangements to support new ways of working while strengthening employee engagement.
Cybersecurity
Cybersecurity is a major component of our overall risk management approach. By the very nature of our business, handling sensitive data is a part of daily operations and is taken very seriously by all employees. The cybersecurity threat environment is volatile and dynamic requiring all levels of the organization to be cognizant and aware of these threats at all times. As such, we maintain a comprehensive cybersecurity strategy that includes, but is not limited to: regular employee cybersecurity training and communications; continuous monitoring, detection, alerting, and defense in-depth technologies; regular internal and third-party program oversight; policies and procedures regularly reviewed and designed with regulatory and industry guidance; and regular reviews of vendors who maintain sensitive data on behalf of Fulton Bank.
9
Given that cybersecurity threat actors are continuously adapting their techniques, it is important to note that no cybersecurity program is completely infallible. As we continue to offer new and innovative technologies for our customers, the risk of cybersecurity attacks and our oversight of this risk will remain at a high level. See "Item 1C. Cybersecurity."
Climate Risk Management
We recognize the potential impact climate change may have on us, our clients, our suppliers, employees, shareholders, and the communities we serve. We are cognizant of our responsibility to better understand the impact of our operations on global climate change and are taking steps to help ensure our organization operates in a manner consistent with responsible environmental stewardship. We are susceptible to losses and disruptions caused by fire, power shortages, telecommunications failures, water shortages, floods, and other extreme weather conditions. Climate change may contribute to or exacerbate these conditions. We are also susceptible to losses arising from the transition to a low carbon economy, including policy changes, energy costs, and shifts in market and customer sentiment that can impact us and our clients as well as other key stakeholders. At this time, we have not experienced material losses from climate change. However, we are aware that its impact may increase in the future. As the potential impact of climate change broadens, we will continue to assess and respond to climate risks as they evolve.
Non-Bank Subsidiaries
We own 100% of the outstanding equity of five non-bank subsidiaries, which are consolidated for financial reporting purposes: (i) Fulton Financial Realty Company, which holds title to or leases certain properties where our financial centers and other facilities are located; (ii) Central Pennsylvania Financial Corp., which owns limited partnership interests in partnerships invested primarily in low- and moderate-income housing projects; (iii) FFC Penn Square, Inc., which owns TruPS issued by a subsidiary of Fulton Bank; (iv) Fulton Insurance Services Group, Inc., which engages in the sale of various life insurance products; and (v) Fulton Community Partner, LLC, whose mission is to change lives for the better by supporting community and economic development projects in distressed and underserved communities through participation in the NMTC program.
Competition
The banking and financial services industries are highly competitive. Within our geographic region, we face direct competition from other commercial banks, varying in size from local community banks to regional and national banks, credit unions and non-bank entities. As a result of the wide availability of electronic delivery channels, we also face competition from financial institutions that do not have a physical presence in our geographic markets.
The industry is also highly competitive due to the various types of entities that now compete aggressively for customers that were traditionally served only by the banking industry. Under the current financial services regulatory framework, banks, insurance companies and securities firms may affiliate under a financial holding company structure, allowing their expansion into non-banking financial services activities that had previously been restricted. These activities include a full range of banking, securities and insurance activities, including securities and insurance underwriting, issuing and selling annuities and merchant banking activities. Moreover, we face increased competition from certain non-bank entities, such as Fintechs and marketplace lenders, that in many cases, are not subject to the same regulatory compliance requirements as us.
Stock Information
The Corporation's common stock is traded on the Nasdaq Global Select Market under the ticker symbol "FULT." There are 600 million authorized shares of the Corporation's common stock, with approximately 164 million shares outstanding as of December 31, 2023. The Corporation has an additional 10 million authorized shares of preferred stock, of which approximately 200,000 shares with a liquidation preference of $1,000 per share were outstanding as of December 31, 2023.
Supervision and Regulation
We operate in an industry that is subject to laws and regulations that are enforced by a number of federal and state agencies. Changes in these laws and regulations, including interpretation and enforcement activities, could impact the cost of operating in the financial services industry, limit or expand permissible activities or affect competition among banks and other financial institutions.
The Corporation is a registered bank holding company that has elected to be treated as a financial holding company under the BHCA. The Corporation is regulated, supervised and examined by the Federal Reserve Board. Fulton Bank is a national banking association chartered under the laws of the United States and is primarily regulated by the OCC. In addition, the CFPB examines Fulton Bank for compliance with most federal consumer financial protection laws, including the laws relating to fair
10
lending and prohibiting unfair, deceptive or abusive acts or practices in connection with the offer, sale or provision of consumer financial products or services and enforces such laws with respect to Fulton Bank and our affiliates.
Federal statutes that apply to us and our subsidiaries include the GLBA, the BHCA, the Dodd-Frank Act, the Federal Reserve Act, the National Bank Act and the Federal Deposit Insurance Act, among others. In general, these statutes, regulations promulgated thereunder, and related interpretations establish the eligible business activities we can engage in, certain acquisition and merger restrictions, limitations on intercompany transactions (such as loans and dividends), cash reserve requirements, lending limitations, compliance with unfair, deceptive and abusive acts and practices prohibitions, limitations on investments, and capital adequacy requirements, among other things. Such laws and regulations are intended primarily for the protection of depositors, customers and the DIF, as well as to minimize risk to the banking system as a whole, and, as a result, these laws and regulations are not for the protection of our shareholders or non-depository creditors.
The following discussion is general in nature and seeks to highlight some of the more significant regulatory requirements to which we are subject but does not purport to be complete or to describe all applicable laws and regulations.
BHCA - The Corporation is subject to regulation and examination by the Federal Reserve Board and is required to file periodic reports and to provide additional information that the Federal Reserve Board may require. The BHCA regulates activities of bank holding companies, including requirements and limitations relating to capital, transactions with officers, directors and affiliates, securities issuances, dividend payments and extensions of credit, among others. The BHCA permits the Federal Reserve Board, in certain circumstances, to issue cease and desist orders and other enforcement actions against bank holding companies (and their non-banking affiliates) to correct or curtail unsafe or unsound banking practices. In addition, the Federal Reserve Board must approve certain proposed changes in organizational structure or other business activities before they occur. The BHCA imposes certain restrictions upon the Corporation regarding the acquisition of substantially all of the assets of, or direct or indirect ownership or control of, any bank for which it is not already the majority owner.
Source of Strength - Federal banking law requires bank holding companies like us to act as a source of financial strength and to commit capital and other financial resources to each of their banking subsidiaries. This support may be required at times when we may not be able to provide such support without adversely affecting our ability to meet other obligations or when, absent such requirements, we might not otherwise choose to provide such support. If we are unable to provide such support, the Federal Reserve Board could instead require the divestiture of our subsidiaries and impose operating restrictions pending the divestiture. If a bank holding company commits to a federal bank regulator that it will maintain the capital of its bank subsidiary, whether in response to the Federal Reserve Board's invoking its source of strength authority or in response to other regulatory measures, that commitment will be assumed by the bankruptcy trustee, and the bank will be entitled to priority payment in respect of that commitment.
The Economic Growth Act - The Economic Growth Act amended certain provisions of the Dodd-Frank Act to raise the total asset threshold for mandatory applicability of enhanced prudential standards for bank holding companies to $250 billion and to allow the Federal Reserve Board to apply enhanced prudential standards to bank holding companies with between $100 billion and $250 billion in total assets to address financial stability risks or safety and soundness concerns. The Economic Growth Act's increased threshold took effect immediately for bank holding companies with total assets of less than $100 billion, including the Corporation.
The Economic Growth Act also enacted other important changes, for which the banking agencies issued certain corresponding guidance documents and implementing regulations, including:
• Raising the total asset threshold for Dodd-Frank Act company-run stress tests from $10 billion to $250 billion;
• Prohibiting federal banking agencies from imposing higher capital requirements for high volatility commercial real estate exposures unless such exposures meet the statutory definition for high volatility acquisition, development or construction loans in the Economic Growth Act;
• Exempting from appraisal requirements certain transactions involving real property in rural areas and valued at less than $400,000;
• Providing that reciprocal deposits are not treated as brokered deposits in the case of a "well capitalized" institution that received an "outstanding" or "good" rating on its most recent examination to the extent the amount of such deposits does not exceed the lesser of $5 billion or 20% of the bank's total liabilities; and
• Directing the CFPB to provide guidance on the applicability of the TILA-RESPA Integrated Disclosure rule to mortgage assumption transactions and construction-to-permanent home loans, as well the extent to which lenders can rely on model disclosures that do not reflect recent regulatory changes.
11
Given Fulton Bank's size, a number of additional benefits afforded to community banks under applicable asset thresholds are not available to Fulton Bank.
Consumer Financial Protection Laws and Enforcement - The CFPB and the federal banking agencies continue to focus attention on consumer protection laws and regulations. The CFPB is responsible for promoting fairness and transparency for mortgages, credit cards, deposit accounts and other consumer financial products and services and for interpreting and enforcing the federal consumer financial laws that govern the provision of such products and services. Federal consumer financial laws enforced by the CFPB include, but are not limited to, the ECOA, the TILA, the Truth in Savings Act, the Home Mortgage Disclosure Act, the RESPA, the Fair Debt Collection Practices Act, and the Fair Credit Reporting Act. The CFPB is also authorized to prevent any institution under its authority from engaging in an unfair, deceptive, or abusive act or practice in connection with consumer financial products and services. As a residential mortgage lender, we are subject to multiple federal consumer protection statutes and regulations, including, but not limited to, those statutes and regulations referenced above.
In particular, fair lending laws prohibit discrimination in the provision of banking services. Fair lending laws include the ECOA and the Fair Housing Act, both of which outlaw discrimination in credit and residential real estate transactions on the basis of prohibited factors including, among others, race, color, national origin, gender, and religion. A lender may be liable for policies that result in a disparate treatment of, or have a disparate impact on, a protected class of applicants or borrowers. If a pattern or practice of lending discrimination is alleged by a regulator, then that agency may refer the matter to the DOJ for investigation. Failure to comply with these and similar statutes and regulations could subject us to formal or informal enforcement actions, the imposition of civil money penalties and litigation.
The CFPB has exclusive examination and primary enforcement authority with respect to compliance with federal consumer financial protection laws and regulations by institutions under its supervision and is authorized, individually or jointly with the federal banking agencies, to conduct investigations to determine whether any person is, or has, engaged in conduct that violates such laws or regulations. The CFPB may bring an administrative enforcement proceeding or civil action in federal district court. In addition, in accordance with a memorandum of understanding entered into between the CFPB and the DOJ, the two agencies have agreed to coordinate efforts related to enforcing the fair lending laws, which includes information sharing and conducting joint investigations; however, the extent to which such coordination may actually occur is unpredictable and may change over time as the result of a number of factors, including changes in leadership at the DOJ and the CFPB, as well as changes in the enforcement policies and priorities of each agency. As an independent bureau funded by the Federal Reserve Board, the CFPB may impose requirements that are more stringent than those of the other bank regulatory agencies.
As an IDI with total assets of more than $10 billion, Fulton Bank is subject to the CFPB's supervisory and enforcement authorities. The Dodd-Frank Act also permits states to adopt stricter consumer protection laws and authorizes state attorneys general to enforce consumer protection rules issued by the CFPB. As a result, Fulton Bank operates in a stringent consumer compliance environment.
Ability-to-pay rules and qualified mortgages - Under the CFPB rules that implement the TILA, mortgage lenders are required to make a reasonable and good faith determination, based on verified and documented information, that a consumer applying for a residential mortgage loan has a reasonable ability to repay the loan according to its terms. These rules prohibit creditors, such as Fulton Bank, from extending residential mortgage loans without regard for the consumer's ability to repay and add restrictions and requirements to residential mortgage origination and servicing practices. In addition, these rules restrict the imposition of prepayment penalties and compensation practices relating to residential mortgage loan origination. Mortgage lenders are required to determine a consumer's ability to repay in one of two ways. The first alternative requires the mortgage lender to consider eight underwriting factors when making the credit decision. The mortgage lender may also originate "qualified mortgages" which are entitled to a presumption that the creditor making the loan satisfied the ability-to-repay requirements. In general, a QM is a residential mortgage loan that does not have certain high-risk features, such as negative amortization, interest-only payments, balloon payments, or a term exceeding 30 years. In addition, to be a QM loan, the points and fees paid by a consumer cannot exceed 3% of the total loan amount, and the borrower's total DTI ratio must be no higher than 43% (subject to certain limited exceptions for loans eligible for purchase, guarantee or insurance by a government sponsored enterprise or a federal agency).
In December 2020, the CFPB issued two final rules related to QM loans. The first rule replaces the strict DTI threshold for QM loans and provides that, in addition to existing requirements, a loan receives a conclusive presumption that the consumer had the ability to repay if the APR does not exceed the average prime offer rate for a comparable transaction by 1.5 percentage points or more as of the date the interest rate is set. Further, a loan receives a rebuttable presumption that the consumer had the ability to repay if the APR exceeds the average prime offer rate for a comparable transaction by 1.5 percentage points or more but by less than 2.25 percentage points. The second rule creates a new category of "seasoned" QM loans for those that meet certain performance requirements. Specifically, that rule allows a non-QM loan or a "rebuttable presumption" QM loan to
12
receive a safe harbor from APR liability at the end of a "seasoning" period of at least 36 months as a "seasoned QM" if it satisfies certain product restrictions, points-and-fees limits, and underwriting requirements, and the loan meets the designated performance and portfolio requirements during the "seasoning period."
Integrated disclosures under the RESPA and the TILA - Under the CFPB rules, mortgage lenders are required to provide a loan estimate, not later than the third business day after submission of a loan application, and a closing disclosure at least three days prior to the loan closing. The loan estimate must detail the terms of the loan, including, among other things, expenses, projected monthly mortgage payments and estimated closing costs. The closing disclosure must include, among other things, closing costs and a comparison of costs reported on the loan estimate to actual charges to be applied at closing.
Volcker Rule - Provisions of the Dodd-Frank Act, commonly known as the "Volcker Rule," prohibit banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds and other private funds that are, among other things, offered within specified exemptions to the Investment Company Act, known as "covered funds," subject to certain exemptions. Volcker Rule compliance requirements are based on the size and scope of a banking entity's trading activities. Our investing and trading activities have and will continue to depend on, among other things, further rulemaking and guidance that may be issued by the Volcker Rule Regulators and the development of market practices and standards.
Capital Requirements - The Corporation and Fulton Bank are subject to the Basel III Rules that are based upon the final framework of the Basel Committee for strengthening capital and liquidity regulation. Under the Basel III Rules, the Corporation and Fulton Bank apply the standardized approach in measuring RWA and regulatory capital.
Under the Basel III Rules, the Corporation and Fulton Bank are subject to the following minimum capital ratios:
• A minimum CET1 capital ratio of 4.50% of RWA;
• A minimum Tier 1 capital ratio of 6.00% of RWA;
• A minimum Total capital ratio of 8.00% of RWA; and
• A minimum Tier 1 leverage ratio (Tier 1 capital to a quarterly average of non-risk weighted total assets) of 4.00%.
The Basel III Rules also included a "capital conservation buffer" of 2.5%, composed entirely of CET1 capital, in addition to the minimum capital to RWA ratios outlined above, resulting in effective minimum CET1, Tier 1 and total capital ratios of 7.0%, 8.5% and 10.5%, respectively. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a capital ratio above the minimum, but below the conservation buffer, will face restrictions on dividends, equity repurchases, and executive compensation based on the amount of the shortfall and the institution's "eligible retained income" (that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income). As of December 31, 2023, the Corporation and Fulton Bank exceeded the minimum capital requirements, including the capital conservation buffer, as prescribed in the Basel III Rules.
The Basel III Rules also provide that the largest banking institutions must adhere to additional countercyclical buffer and supplementary leverage ratio requirements. The Corporation and Fulton Bank are not presently subject to these requirements.
The Basel III Rules provide for a number of required deductions from and adjustments to CET1. These deductions and adjustments include, for example, goodwill, other intangible assets, and DTAs that arise from net operating loss and tax credit carryforwards net of any related valuation allowance. MSRs, DTAs arising from temporary differences that could not be realized through net operating loss carrybacks and investments in non-consolidated financial institutions must also be deducted from CET1 to the extent that they exceed certain thresholds. Through subsequent rulemaking, the federal banking agencies provided certain forms of relief to banking organizations, such as the Corporation and Fulton Bank, that are not subject to the advanced approaches framework. The Corporation and Fulton Bank made a one-time, permanent election under the Basel III Rules to exclude the effects of certain components of AOCI included in shareholders' equity under GAAP in determining regulatory capital ratios.
Under the Basel III Rules, certain off-balance sheet commitments and obligations are converted into RWA, that together with on-balance sheet assets, are the base against which regulatory capital is measured. The Basel III Rules defined the risk-weighting categories for bank holding companies and banks that follow the standardized approach, such as the Corporation and Fulton Bank, based on a risk-sensitive analysis, depending on the nature of the exposure.
The Capital Rules eliminated the standalone prior approval requirement in the Basel III Rules for any repurchase of common stock. In certain circumstances, repurchases of our common stock may be subject to a prior approval or notice requirement
13
under other regulations or policies of the Federal Reserve Board. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the prior approval of the Federal Reserve Board.
The Basel Committee published the last version of the Basel III accord in 2017, generally referred to as "Basel IV." Among other things, these standards revise the Basel Committee's standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain "unconditionally cancellable commitments," such as unused credit card and home equity lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, these standards became effective on January 1, 2022, with an aggregate output floor phasing in through January 1, 2027. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not the Corporation or Fulton Bank. The impact of Basel IV on the Corporation and Fulton Bank will depend on the manner in which it is implemented by the federal banking agencies. As of December 31, 2023, the Corporation and Fulton Bank exceeded all capital requirements necessary to be deemed "well-capitalized" for all regulatory purposes under the capital rules.
Stress Testing and Capital Planning - As a result of the Economic Growth Act and implementing regulations adopted by the Federal Reserve Board and the OCC, the Corporation and Fulton Bank are no longer subject to company-run stress testing requirements under the Dodd-Frank Act. The Federal Reserve Board continues to supervise our capital planning and risk management practices through its regular supervisory process, which includes regular stress testing.
CECL Transitional Provisions – On August 26, 2020, the federal bank regulatory agencies adopted the CECL Transition Rule that provides banking institutions an optional five-year transition period to phase in the impact of the CECL standard on their regulatory capital. The final rule gives eligible institutions the option to mitigate the estimated capital effects of CECL for two years, followed by a three-year transition period. Taken together, these measures offer institutions a transition period of up to five years. We have elected to avail ourselves of the transition relief permitted under applicable regulations.
Prompt Corrective Action - The FDICIA established a system of prompt corrective action to attempt to resolve the problems of undercapitalized institutions. The FDICIA, among other things, establishes five capital categories for FDIC-insured banks: "well capitalized," "adequately capitalized," "undercapitalized," "significantly undercapitalized" and "critically undercapitalized." An IDI is treated as well capitalized if its total risk-based capital ratio is 10.00% or greater, its Tier 1 risk-based capital ratio is 8.00% or greater, its CET1 risk-based capital ratio is 6.50% or greater and its Tier 1 leverage capital ratio is 5.00% or greater, and it is not subject to any order or directive to meet a specific capital level . As of December 31, 2023, Fulton Bank's capital ratios were above the minimum levels required to be considered "well capitalized" by the OCC.
Under this system, the federal banking agencies are required to take certain, and authorized to take other, prompt corrective actions against undercapitalized institutions, the severity of which increase as the capital category of an institution declines, including restrictions on growth of assets and other forms of expansion. Generally, a capital restoration plan must be filed with the institution's primary federal regulator within 45 days of the date an institution receives notice that it is "undercapitalized," "significantly undercapitalized" or "critically undercapitalized." Although prompt corrective action regulations apply only to depository institutions and not to bank holding companies, bank holding companies must guarantee any such capital restoration plan in certain circumstances. The liability of a bank holding company under any such guarantee is limited to the lesser of 5.00% of the bank's relevant assets at the time it became "undercapitalized" or the amount needed to comply. A bank holding company might also be liable for civil money damages for failure to fulfill that guarantee. In the event of the bankruptcy of a bank holding company, such guarantee would take priority over the bank holding company's general unsecured creditors.
In addition, regulators consider both risk-based capital ratios and other factors that can affect a bank's financial condition, including (i) concentrations of credit risk, (ii) interest rate risk, and (iii) risks from non-traditional activities, along with an institution's ability to manage those risks, when determining capital adequacy. This evaluation is made during the institution's safety and soundness examination. An institution may be downgraded to, or deemed to be in, a capital category that is lower than is indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters.
Brokered Deposits - The FDICIA and FDIC regulations limit the ability of an IDI, such as Fulton Bank, to accept, renew or roll over brokered deposits unless the institution is well-capitalized under the prompt corrective action framework described above, or unless it is adequately capitalized and obtains a waiver from the FDIC. In addition, less than well-capitalized banks are subject to restrictions on the interest rates they may pay on deposits. The characterization of deposits as "brokered" may result in the imposition of higher deposit assessments on such deposits. There is a limited exception from the scope of “brokered” deposits for reciprocal deposits for IDIs that are well-rated and well-capitalized (or adequately capitalized and for which the IDI has obtained a waiver from the FDIC as mentioned above). Under this limited exception, qualified IDIs, like Fulton Bank, are
14
able to except from treatment as "brokered" deposits the lesser of up to $5 billion, or 20% of the institution's total liabilities, in reciprocal deposits.
Loans and Dividends from Bank Subsidiary - There are various restrictions on the extent to which Fulton Bank can make loans and other extensions of credit (including credit exposure arising from repurchase and reverse repurchase agreements, securities borrowing and derivative transactions) to, or enter into certain transactions with, its affiliates, which includes the Corporation and its non-bank subsidiaries. In general, these restrictions require that such transactions: (i) with the Corporation or any of its non-bank subsidiaries be limited to 10% of Fulton Bank's regulatory capital (20% in the aggregate to all such entities); (ii) satisfy certain qualitative limitations, including that any covered transaction be made on an arm's length basis; and (iii) in the case of extensions of credit, be secured by designated amounts of specified collateral.
For safety and soundness reasons, banking regulations also limit the amount of cash that can be transferred from Fulton Bank to the Corporation in the form of dividends. Generally, dividends are limited to the lesser of the amounts calculated under an earnings retention test and an undivided profits test. Under the earnings retention test, without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year's net income combined with the retained net income of the two preceding years. Under the undivided profits test, a dividend may not be paid in excess of a bank's undivided profits. In addition, banks are prohibited from paying dividends when doing so would cause them to fall below the regulatory minimum capital levels. See "Note 12 - Regulatory Matters," in the Notes to Consolidated Financial Statements in "Item 8. Financial Statements and Supplementary Data" for additional information regarding regulatory capital and dividend and loan limitations.
Federal Deposit Insurance - The deposits of Fulton Bank are insured up to the applicable limits by the DIF, generally up to $250,000 per insured depositor. Fulton Bank pays deposit insurance premiums based on assessment rates established by the FDIC. The FDIC has established a risk-based assessment system under which institutions are classified and pay premiums according to their perceived risk to the DIF. In addition, the FDIC possesses backup enforcement authority over a depository institution holding company, like us, if the conduct or threatened conduct of such bank holding company poses a risk to the DIF, although such authority may not be used if the bank holding company is generally in sound condition and does not pose a foreseeable and material risk to the DIF.
FDIC assessment rates for large institutions that have more than $10 billion in assets, such as Fulton Bank, are calculated based on a "scorecard" methodology that seeks to capture both the probability that an individual large institution will fail and the magnitude of the impact on the DIF if such a failure occurs that is based primarily on the difference between the institution's average of total assets and average tangible equity, or its assessment base. The FDIC has the ability to make discretionary adjustments to the total score, up or down, based upon significant risk factors that are not adequately captured in the scorecard. For large institutions, including Fulton Bank, after accounting for potential base-rate adjustments, the total assessment rate could range from 1.5 to 40 bps on an annualized basis. An institution's assessment is determined by multiplying its assessment rate by its assessment base.
In November 2023, the FDIC issued a final rule to implement a special assessment to recover losses to the DIF arising from the protection of uninsured depositors following the closures of Silicon Valley Bank and Signature Bank in 2023. The special assessment is based on an IDI's estimated uninsured deposits as of December 31, 2022, adjusted to excluding the first $5.0 billion of estimated uninsured deposits, and will be assessed at a quarterly rate of 3.36 bps, over eight quarterly assessment periods, beginning in the first quarter of 2024. As a result of this final rule, we accrued $6.5 million ($5.1 million after tax) related to this assessment in the fourth quarter of 2023. This amount represents our current expectation of the full amount of the assessment based on our total uninsured deposits as of December 31, 2022. Under the final rule, the estimated losses to the DIF may be revised from time to time, and the FDIC has retained the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. The extent to which any such additional future assessments will impact our future deposit insurance expense is currently uncertain.
The Tax Act disallows the deduction of FDIC deposit insurance premium payments for banking organizations with total consolidated assets of $50 billion or more. For banks with less than $50 billion in total consolidated assets, such as Fulton Bank, the premium deduction is phased out based on the proportion of the bank's assets exceeding $10 billion.
AML Requirements and the Patriot Act - The Patriot Act amended the BSA and other AML laws and regulations and imposed affirmative obligations on a wide range of financial institutions to maintain appropriate policies, procedures and controls to detect, prevent and report money laundering and terrorist financing.
15
Among other requirements, the Patriot Act and related regulations impose the following requirements on financial institutions:
• establishment of AML programs;
• establishment of a program specifying procedures for obtaining identifying information from customers seeking to open new accounts, including verifying the identity of customers within a reasonable period of time;
• establishment of enhanced due diligence policies, procedures and controls designed to detect and report money laundering; and
• prohibition on correspondent accounts for foreign shell banks and compliance with recordkeeping obligations with respect to correspondent accounts of foreign banks.
Failure to comply with the requirements of the Patriot Act and other AML laws and regulations could have serious legal, financial, regulatory and reputational consequences. In addition, bank regulators will consider a bank holding company's effectiveness in combating money laundering when ruling on BHCA and Bank Merger Act applications. In addition, financial institutions are subject to customer due diligence requirements, issued by the FinCEN, to identify and verify the identity of natural persons, known as beneficial owners, who own, control, and profit from legal entity customers when those customers open accounts. We have adopted policies, procedures and controls to address compliance with the Patriot Act and other AML laws and regulations, and we will continue to revise and update our policies, procedures and controls to reflect required changes.
On January 1, 2021, the NDAA was signed into law, which enacted the most significant overhaul of BSA and other AML-related laws since the Patriot Act. Notable aspects of the NDAA include: (i) significant changes to the collection of beneficial ownership and the establishment of a beneficial ownership registry that requires corporate entities (generally, any corporation, limited liability company, or other similar entity with 20 or fewer employees and annual gross income of $5 million or less) to report beneficial ownership information to the FinCEN (which will be maintained by the FinCEN and made available upon request to financial institutions); (ii) enhanced whistleblower provisions that provide that one or more whistleblowers who voluntarily provide original information leading to the successful enforcement of violations of the BSA or other AML-related laws in any judicial or administrative action brought by the Secretary of the Treasury or the U.S. Attorney General resulting in monetary sanctions exceeding $1 million (including disgorgement and interest but excluding forfeiture, restitution, or compensation to victims) will receive not more than 30 percent of the monetary sanctions collected and will receive increased protections; (iii) increased penalties for violations of the BSA; (iv) improvements to existing information sharing provisions that permit financial institutions to share information relating to suspicious activity reports with foreign branches, subsidiaries, and affiliates (except those located in China, Russia, or certain other jurisdictions) for the purpose of combating illicit finance risks; and (v) expanded duties and powers of the FinCEN. Many of the new provisions, including those with respect to beneficial ownership, require the Department of Treasury and the FinCEN to promulgate rules. On December 8, 2021, the FinCEN issued proposed regulations that would implement the amendments with respect to beneficial ownership. On September 29, 2022, the FinCEN issued a final rule establishing a beneficial ownership information reporting requirement, pursuant to the CTA. The rule requires most corporations, limited liability companies, and other entities created in or registered to do business in the United States to report information about their beneficial owners—the persons who ultimately own or control the company, to the FinCEN. On December 22, 2023, FinCEN issued a final rule regarding access by authorized recipients to BOI that will be reported to FinCEN pursuant to Sec. 6403 of the CTA, which is part of the NDAA. The regulations implement strict protocols required by the CTA to protect sensitive personally identifiable information reported to FinCEN and establish the circumstances in which specified recipients have access to BOI, along with data protection protocols and oversight mechanisms applicable to each recipient category. The disclosure of BOI to authorized recipients in accordance with appropriate protocols and oversight will help law enforcement and national security agencies prevent and combat money laundering, terrorist financing, tax fraud, and other illicit activity, as well as protect national security.
Commercial Real Estate Guidance — Under guidance issued by the federal banking agencies, the agencies have expressed concerns with institutions that ease commercial real estate underwriting standards and have directed financial institutions to maintain underwriting discipline and exercise risk management practices to identify, measure and monitor lending risks. The agencies have also issued guidance that requires a financial institution to employ enhanced risk management practices if the institution is exposed to significant concentration risk. Under that guidance, an institution is potentially exposed to significant concentration risk if: (i) total reported loans for construction, land development, and other land represent 100% or more of total capital or (ii) total reported loans secured by multi-family and non-farm residential properties, loans for construction, land development, and other land loans otherwise sensitive to the general commercial real estate market, including loans to commercial real estate related entities, represent 300% or more of total capital, and the outstanding balance of the institution's commercial real estate loan portfolio has increased by 50% or more during the prior 36 months.
Community Reinvestment — Under the CRA, Fulton Bank has a continuing and affirmative obligation, consistent with its safe and sound operation, to ascertain and meet the credit needs of its entire community, including low- and moderate-income areas.
16
The CRA does not establish specific lending requirements or programs for financial institutions, nor does it limit an institution's discretion to develop the types of products and services that it believes are best suited to its particular community. The CRA requires an institution's primary federal regulator, in connection with its examination of the institution, to assess the institution's record of meeting the credit needs of its community and to take such record into account in its evaluation of certain applications by such institution. The assessment focuses on three tests: (i) a lending test, to evaluate the institution's record of making loans, including community development loans, in its designated assessment areas; (ii) an investment test, to evaluate the institution's record of investing in community development projects, affordable housing, and programs benefiting low- or moderate-income individuals and areas and small businesses; and (iii) a service test, to evaluate the institution's delivery of banking services throughout its CRA assessment area, including low- and moderate-income areas. The CRA also requires all institutions to make public disclosure of their CRA ratings. As of December 31, 2023, Fulton Bank was rated as "outstanding." Current regulations require that Fulton Bank publicly disclose certain agreements that are in fulfillment of CRA. Fulton Bank is not a party to any such agreements at this time.
On October 24, 2023, the federal banking agencies issued a final rule implementing updates to CRA reform. Among other things, the final rule: (a) adopts four new performance tests to evaluate the CRA performance of large banks (assets of $2 billion or more) - the Retail Lending Test, Retail Services and Products Test, Community Development Financing Test, and Community Development Services Test; (b) retains a strategic plan option, with modifications to reflect the new performance tests and updates to the approval standards; (c) clarifies community development activities by updating the definition of community development, providing a process by which banks may request confirmation that an activity is eligible for community development consideration, and providing for a publicly available interagency illustrative list of qualifying community development activities; (d) updates delineation requirements for facility-based assessment areas and establishes new retail lending assessment areas for certain large banks; (e) updates data collection, maintenance, and reporting requirements for large banks, tailoring those requirements based on large bank asset size and leveraging existing data where possible, while not imposing new data collection and reporting requirements for small and intermediate banks; and (f) continues public file and public notice disclosure requirements and creates a new public comment process to facilitate public engagement. The April 1, 2024, effective date is applicable to certain provisions of the final rule that are similar to the current CRA regulations: facility-based assessment area delineations, effect of CRA on applications, public file, bank public notice, and CRA examination schedule public notice provisions, as well as the new public engagement provision. As of January 1, 2026, banks are required to comply with all other provisions of the final rule, except for certain reporting requirements, which will be applicable on January 1, 2027.
Standards for Safety and Soundness - Pursuant to the requirements of the FDICIA, as amended by the Riegle Community Development and Regulatory Improvement Act of 1994, the federal bank regulatory agencies adopted guidelines establishing general standards relating to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risks and exposures specified in the guidelines. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If the institution fails to submit an acceptable compliance plan or fails in any material respect to implement an accepted compliance plan, the regulator must issue an order directing corrective actions and may issue an order directing other actions of the types to which a significantly undercapitalized institution is subject under the "prompt corrective action" provisions of FDICIA. If the institution fails to comply with such an order, the regulator may seek to enforce such order in judicial proceedings and to impose civil money penalties.
The guidelines prohibit excessive compensation to any executive officer, employee, director or principal shareholder as an unsafe and unsound practice. The guidelines provide that compensation will be considered excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal shareholder. The federal banking agencies have issued guidance that provides that, to be consistent with safety and soundness principles, a banking organization's incentive compensation arrangements should: (i) provide employees with incentives that appropriately balance risk and reward; (ii) be compatible with effective controls and risk management; and (iii) be supported by strong corporate governance, including active and effective oversight by the banking organization's board of directors. Monitoring methods and processes used by a banking organization should be commensurate with the size and complexity of the organization and its use of incentive compensation.
The Dodd-Frank Act requires federal banking agencies and the SEC to establish joint regulations or guidelines for specified entities, including the Corporation and Fulton Bank, that have at least $1 billion in total assets, prohibiting incentive-based compensation arrangements that encourage inappropriate risk-taking by an executive officer, employee, director or principal shareholder that could lead to material financial loss to the entity. In addition, these regulations or guidelines must require enhanced disclosure with respect to incentive-based compensation arrangements. On October 15, 2022, the SEC adopted final
17
rules implementing the incentive-based compensation recovery (clawback) provisions, which largely track the proposed rules originally announced in 2015. Notwithstanding the issuance of these final rules, the scope and content of the federal banking agencies' policies on executive compensation may continue to evolve in the near future. We have had a clawback policy in place since 2012 and have updated such policy to comply with the new requirements.
Privacy Protection and Cybersecurity — Fulton Bank is subject to regulations implementing the privacy protection provisions of the GLBA. These regulations require Fulton Bank to disclose its privacy policy, including identifying with whom it shares "nonpublic personal information," to customers at the time of establishing the customer relationship and annually thereafter. The regulations also require Fulton Bank to provide its customers with initial and annual notices that accurately reflect its privacy policies and practices. In addition, to the extent its sharing of such information is not covered by an exception, Fulton Bank is required to provide its customers with the ability to "opt-out" of having Fulton Bank share a customer's nonpublic personal information with unaffiliated third parties.
Fulton Bank is also subject to regulatory guidelines establishing standards for safeguarding customer information. These regulations implement certain provisions of the GLBA. The guidelines describe the federal bank regulatory agencies' expectations for the creation, implementation and maintenance of an information security program, that includes administrative, technical and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The standards set forth in the guidelines are intended to ensure the security and confidentiality of customer records and information, protect against any anticipated threats or hazards to the security or integrity of such records and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information security and the use of third parties in the provision of financial services.
Certain states have enacted laws establishing consumer privacy protections and data security requirements in their respective states. For example, the CCPA gives California residents rights to receive certain disclosures regarding the collection, use, and sharing of "personal information" as well as rights to access, delete, and restrict the sale of certain personal information. The CCPA, which was amended in November 2020 by a ballot initiative titled the California Privacy Rights Act, went into effect on January 1, 2020, and Fulton Bank is required to comply with the CCPA in serving the small number of its customers that are residents of California. Attempts by state and local governments to regulate consumer privacy have the potential to create a patchwork of differing and/or conflicting state regulations. In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents experienced and describe the material aspects of their nature, scope and timing. The rules, which supersede their previously interpreted guidance published in February 2018, also require annual disclosures describing a company's cybersecurity risk management, strategy and governance. These SEC rules, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.
Federal Reserve System — Federal Reserve Board regulations require depository institutions to maintain cash reserves against specified deposit liabilities. The dollar amount of a depository institution's reserve requirement is determined by applying the reserve ratios specified in the Federal Reserve Board's Regulation D to an institution's reservable liabilities (primarily net transaction accounts such as negotiable order of withdrawal and demand deposit accounts). A reserve of 3% must be maintained against aggregate transaction account balances of between $16.9 million and $127.5 million (subject to adjustment by the Federal Reserve Board) plus a reserve of 10% (subject to adjustment by the Federal Reserve Board within a range of between 8% and 14%) against that portion of total transaction account balances in excess of $127.5 million. The first $16.9 million of otherwise reservable balances (subject to adjustment by the Federal Reserve Board) are exempt from the reserve requirements. Fulton Bank is in compliance with the foregoing requirements.
Required reserves must be maintained in the form of either vault cash, an account at a FRB or a pass-through account as defined by the Federal Reserve Board. Pursuant to the Emergency Economic Stabilization Act of 2008, the FRB pays interest on depository institutions' required and excess reserve balances. The interest rate paid on required reserve balances is currently the average target federal funds rate over the reserve maintenance period. The rate on excess balances will be set equal to the lowest target federal funds rate in effect during the reserve maintenance period.
On December 22, 2020, the Federal Reserve Board issued a final rule that amends Regulation D by lowering the reserve requirement ratios on transaction accounts maintained at depository institutions to 0%. It is currently unclear if the reduction of the reserve requirements on transaction accounts is permanent.
18
Acquisitions — The BHCA requires a bank holding company to obtain the prior approval of the Federal Reserve Board before:
• the company acquires direct or indirect ownership or control of any voting shares of any bank or savings and loan association, if after such acquisition the bank holding company will directly or indirectly own or control more than five percent of any class of voting securities of the institution;
• any of the company's subsidiaries, other than a bank, acquires all or substantially all of the assets of any bank or savings and loan association; or
• the company merges or consolidates with any other bank or financial holding company.
Prior regulatory approval is also generally required for mergers, acquisitions and consolidations involving other IDIs. In reviewing acquisition and merger applications, bank regulatory authorities will consider, among other things, the competitive effect of the transaction, financial and managerial issues, the capital position of the combined organization, convenience and needs factors, including the applicant's CRA record, the effectiveness of the subject organizations in combating money laundering activities, and the transaction's effect on the stability of the U.S. banking or financial system.
On July 9, 2021, President Biden issued an Executive Order on Promoting Competition in the U.S. Economy. Among other initiatives, the Executive Order encouraged the federal banking agencies to review their current merger oversight practices under the BHCA and the BMA and adopt a plan for revitalization of such practices. There are many steps that must be taken by the agencies before any formal changes to the framework for evaluating bank mergers can be finalized, and the prospects for such action are uncertain at this time. In January 2024, the OCC issued a notice of proposed rulemaking to amend its procedural regulations and adopt a new policy statement relating to its approach to evaluating business combinations under the BMA. The adoption of more expansive or prescriptive standards may have an impact on our acquisition activities.
The Change in Bank Control Act prohibits a person, entity or group of persons or entities acting in concert, from acquiring "control" of a bank holding company or bank unless the Federal Reserve Board has been given prior notice and has not objected to the transaction. Under Federal Reserve Board regulations, the acquisition of 10% or more (but less than 25%) of the voting stock of a corporation would, under the circumstances set forth in the regulations, create a rebuttable presumption of acquisition of control of the corporation.
Effective September 30, 2020, the Federal Reserve finalized a rule that simplifies and increases the transparency of its rules for determining when one company controls another company for purposes of the BHCA and, on March 31, 2021, the Federal Reserve Board published interpretive guidance regarding the final rule and related regulatory control matters. The amended control rule has had, and will likely continue to have, a meaningful impact on control determinations related to investments in banks and bank holding companies and investments by bank holding companies in nonbank companies.
On January 29, 2024, the OCC issued a notice of proposed rulemaking and Policy Statement on Bank Mergers, wherein the OCC requested comment on a proposal to update its rules for business combinations involving national banks and federal savings associations. The proposal also includes a policy statement to clarify the OCC's review of applications under the BMA. The proposed rulemaking is part of the OCC's effort to enhance transparency around its process of reviewing transactions under the BMA. It would also serve to provide additional guidance to stakeholders around the OCC's review of applications. The proposed policy statement specifically would discuss: (a) general principles for the OCC's review of applications under the BMA, including indicators for applications likely consistent with approval and applications that raise supervisory or regulatory concerns; (2) the OCC's consideration of the financial stability; managerial and financial resources and future prospects; and convenience and needs statutory factors under the BMA; and (3) the OCC's decision process for extending the public comment period or holding a public meeting.
Permissible Activities — As a bank holding company, the Corporation may engage in the business of banking, managing or controlling banks, performing servicing activities for subsidiaries, and engaging in activities that the Federal Reserve Board has determined, by order or regulation, are so closely related to banking as to be a proper incident thereto. As a financial holding company, the Corporation may also engage in or acquire and retain the shares of a company engaged in activities that are financial in nature or incidental or complementary to activities that are financial in nature as long as the Corporation continues to meet the eligibility requirements for financial holding companies, including that the Corporation and each of its U.S. depository institution subsidiaries remain "well-capitalized" and "well-managed."
A depository institution is considered "well-capitalized" if it satisfies the requirements of the Prompt Corrective Action framework described above. A depository institution is considered "well-managed" if it received a composite rating and management rating of at least "satisfactory" in its most recent examination. If a financial holding company ceases to be well-capitalized and well-managed, the financial holding company must enter into a non-public confidential agreement with the Federal Reserve Board to comply with all applicable capital and management requirements. Until the financial holding
19
company returns to compliance, the Federal Reserve Board may impose limitations or conditions on the conduct of its activities, and the company may not commence any new non-banking financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the Federal Reserve Board. If the company does not timely return to compliance, the Federal Reserve Board may require divestiture of the financial holding company's banking subsidiaries. Bank holding companies and banks must also be well-capitalized and well-managed in order to acquire banks located outside their home state. A financial holding company will also be limited in its ability to commence non-banking financial activities or acquire a company engaged in such financial activities if any of its IDI subsidiaries fails to maintain a "satisfactory" rating under the CRA.
Activities that are "financial in nature" include securities underwriting, dealing and market making, advising mutual funds and investment companies, insurance underwriting and agency, merchant banking, and activities that the Federal Reserve Board, in consultation with the Secretary of the Treasury, determines to be financial in nature or incidental to such financial activity.
"Complementary activities" are activities that the Federal Reserve Board determines upon application to be complementary to a financial activity and that do not pose a safety and soundness issue.
Enforcement Powers of Federal Banking Regulators — The Federal Reserve Board and other U.S. banking agencies have broad enforcement powers with respect to an IDI and its holding company, including the power to (i) impose cease and desist orders, substantial fines and other civil penalties, (ii) terminate deposit insurance, and (iii) appoint a conservator or receiver. Failure to comply with applicable laws or regulations could subject the Corporation or Fulton Bank, as well as their officers and directors, to administrative sanctions and potentially substantial civil and criminal penalties.
In addition, under the BHCA, the Federal Reserve Board has the authority to require a bank holding company to terminate any activity or to relinquish control of a non-bank subsidiary upon the Federal Reserve Board's determination that such activity or control constitutes a serious risk to the financial soundness and stability of a depository institution subsidiary of the bank holding company.
Federal Securities Laws — The Corporation is subject to the periodic reporting, proxy solicitation, tender offer, insider trading, corporate governance and other requirements under the Exchange Act and the rules of the Nasdaq that apply to companies listed on the Nasdaq Global Select Market. Among other things, the federal securities laws require management to issue a report on the effectiveness of its internal controls over financial reporting. In addition, the Corporation's independent registered public accountants are required to issue an opinion on the effectiveness of its internal control over financial reporting. See "Item 8. Financial Statements and Supplementary Data - Report of Independent Registered Public Accounting Firm." Certifications of the Chief Executive Officer and the Chief Financial Officer as required by the Sarbanes-Oxley Act of 2002 and the resulting SEC rules can be found in the Signatures and Exhibits sections.
Climate-Related Regulation - In recent years the federal banking agencies have increased their focus on climate-related risks impacting the operations of banks, the communities they serve and the broader financial system. Accordingly, the agencies have begun to enhance their supervisory expectations regarding the climate risk management practices of larger banking organizations, including by encouraging such banks to: (i) ensure that management of climate-related risk exposures has been incorporated into existing governance structures; (ii) evaluate the potential impact of climate-related risks on the bank's financial condition, operations and business objectives as part of its strategic planning process; (iii) account for the effects of climate change in stress testing scenarios and systemic risk assessments; (iv) revise expectations for credit portfolio concentrations based on climate-related factors; (v) consider investments in climate-related initiatives and lending to communities disproportionately impacted by the effects of climate change; (vi) evaluate the impact of climate change on the bank's borrowers and consider possible changes to underwriting criteria to account for climate-related risks to mortgaged properties; (vii) incorporate climate-related financial risk into the bank's internal reporting, monitoring and escalation processes; and (viii) prepare for the transition risks associated with the adjustment to a low-carbon economy as well as related changes in laws, regulations, governmental policies, technology, and consumer behavior and expectations.
On October 21, 2021, the FSOC published a report identifying climate-related financial risks as an "emerging threat" to financial stability. On October 24, 2023, the OCC issued principles for climate-related financial risk management for national banks with more than $100 billion in total assets. Although these risk management principles, would not apply to Fulton Bank based upon its current size, the OCC has indicated that all banks, regardless of their size, may have material exposures to climate-related financial and other risks that require prudent management. The final guidance is substantively similar to the guidance previously proposed by the agencies, with targeted modifications in response to commenter feedback. These modifications include clarification on the applicability to large foreign banking organizations and clarification on the role of boards of directors and management. The final guidance contains high-level principles covering six areas: governance; policies, procedures, and limits; strategic planning; risk management; data, risk measurement, and reporting; and scenario
20
analysis. Additionally, the final principles describe how climate-related financial risks can be addressed in the management of traditional risk areas. The final principles neither prohibit nor discourage large financial institutions from providing banking services to customers of any specific class or type, as permitted by law or regulation. The decision regarding whether to make a loan or to open, close, or maintain an account rests with the financial institution, so long as the financial institution complies with applicable laws and regulations. The agencies are providing guidance to large financial institutions through these principles on the management of climate-related financial risks just as the agencies provide guidance to financial institutions in identifying and managing other risks. The final principles are intended to promote a consistent understanding of the effective management of climate-related financial risks.
In addition, states are considering taking similar actions on climate-related financial risks, including certain states in which we operate. For example, the Governor of Pennsylvania has announced the Pennsylvania Climate Action Plan of 2021 that will, in part, focus on the negative impact businesses have on greenhouse gas emissions. Further, Virginia's omnibus Virginia Clean Economy Act enacted provisions with the goal of the Commonwealth being carbon-free by 2045; after the Governor of Maryland reauthorized the Greenhouse Gas Emissions Reduction Act of 2016, the Maryland Department of Environment released the 2030 Greenhouse Gas Reduction Act Plan; and in 2023, Delaware enacted the Delaware Climate Solutions Act of 2023 that established targets for reduction in greenhouse gas emissions. Once fully implemented, these measures will, at least in part, focus on the greenhouse gases impact that businesses have in the respective states in which they operate.
21