Cullen/Frost Bankers Inc.

Market position and competition · Competitive pressure and market share loss

We face substantial competition in all areas of our operations from a variety of different competitors, many of which are larger and may have more financial resources than us. Such competitors primarily include national, regional, and community banks within the various markets where we operate. We also face competition from many other types of financial institutions, including, without limitation, savings and loans, credit unions, finance companies, brokerage firms, insurance companies and other financial intermediaries.

Innovation and product development · Product development and randd investment risks

From time to time, we implement new lines of business or offer new products and services within existing lines of business. For instance, we recently implemented a new residential mortgage product offering. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed.

Market position and competition · Disruptive competitors and new market entrants

Technology and other changes have lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks. In particular, the activity of fintechs/wealthtechs has grown significantly over recent years and is expected to continue to grow. Some fintechs/wealthtechs are not subject to the same regulation as we are, which may allow them to be more competitive.

Industry regulation · Regulatory compliance and changes

We, primarily through Cullen/Frost, Frost Bank and certain non-bank subsidiaries, are subject to extensive federal and state regulation and supervision, which vests a significant amount of discretion in the various regulatory authorities. Changes to statutes, regulations or regulatory policies or supervisory guidance, including changes in interpretation or implementation of statutes, regulations, policies or supervisory guidance, have and could continue to affect us in substantial and unpredictable ways.

Tax and financial reporting · Financial reporting and accounting standards

From time to time, accounting standards setters change the financial accounting and reporting standards that govern the preparation of our financial statements. These changes can be difficult to predict and can materially impact how we record and report our financial condition and results of operations.

Tax and financial reporting · Tax compliance and changes in tax law

We are subject to federal and applicable state tax laws and regulations. Changes in these tax laws and regulations, some of which may be retroactive to previous periods, could increase our effective tax rates and, as a result, could negatively affect our current and future financial performance. Federal and state taxing authorities have been aggressive in challenging tax positions taken by financial institutions.

Human capital and workforce · Key personnel dependence and succession

The unexpected loss of services of key personnel could have a material adverse impact on our business, financial condition and results of operations because of their customer relationships, skills, knowledge of our market, years of industry experience and the difficulty of promptly finding qualified replacement personnel. We do not currently have employment agreements or non-competition agreements with any of our executive officers.

Core operations · Operational disruption and business continuity

Furthermore, any new line of business, new product or service and/or new technology could have a significant impact on the effectiveness of our system of internal controls. Failure to successfully manage these risks in the development and implementation of new lines of business, new products or services and/or new technologies could have a material adverse effect on our business, financial condition and results of operations.

Economic and market conditions · Inflation and deflation pressures

Current economic conditions are being heavily impacted by recent inflationary conditions and higher interest rates, the effects of which may impact our profitability by negatively impacting our fixed costs and expenses. Economic and inflationary pressure on consumers and uncertainty regarding economic improvement could result in changes in consumer and business spending, borrowing and savings habits.

Natural and catastrophic events · Climate change and environmental impact

Our business, as well as the operations and activities of our customers, could be negatively impacted by climate-related risks in both the short-term and the long-term. Climate change exposes us and our customers to physical risk as its effects may lead to more frequent and more extreme weather events, such as prolonged droughts or flooding, tornados, hurricanes, wildfires and extreme seasonal weather; and longer-term shifts, such as increasing average temperatures, ozone depletion and rising sea levels.

Reputation and brand · Brand damage and negative publicity

Risk to our earnings, liquidity, and capital from negative public opinion, is inherent in our business. Negative public opinion could adversely affect our ability to keep and attract customers and expose us to adverse legal and regulatory consequences. Negative public opinion could result from our actual or alleged conduct in any number of activities, including (i) lending practices, (ii) branching strategy, (iii) product and service offerings, (iv) corporate governance, (v) regulatory compliance, (vi) mergers and acquisitions, (vii) disclosure, (viii) sharing or inadequate protection of customer information, (ix) successful or attempted cyber-attacks against us.

Reputation and brand · Esg environmental social governance performance

There is focus by some investors and other stakeholders on topics related to corporate policies and approaches related to environmental and social matters. Due to divergent stakeholder views on these matters, we are at increased risk that any action, or lack thereof, concerning these matters will be perceived negatively by some stakeholders, which could negatively affect our business and reputation.

Corporate governance · Internal controls and risk management

Our internal controls, including fraud detection and controls, disclosure controls and procedures, and corporate governance procedures are based in part on certain assumptions and can provide only reasonable, not absolute, assurance that the objectives of the controls and procedures are met. Any failure or circumvention of our controls and procedures; failure to comply with regulations related to controls and procedures; or failure to comply with our corporate governance procedures could have a material adverse effect on our reputation, business, financial condition and results of operations.

Credit and liquidity · Credit risk and customer defaults

There are inherent risks associated with our lending activities. These risks include, among other things, the impact of changes in interest rates and changes in the economic conditions in the markets where we operate as well as those across the State of Texas and the United States. Increases in interest rates and/or weakening economic conditions could adversely impact the ability of borrowers to repay outstanding loans or the value of the collateral securing these loans.

Capital structure and performance · Credit rating and cost of capital

Any occurrence that may limit our access to the capital markets, such as a decline in the confidence of debt purchasers, depositors of Frost Bank or counterparties participating in the capital markets, or a downgrade of Cullen/Frost's or Frost Bank's debt ratings, may adversely affect our capital costs and our ability to raise capital and, in turn, our liquidity.

Capital structure and performance · Dividend policy and capital allocation

Holders of Cullen/Frost common stock are only entitled to receive such dividends as its board of directors may declare out of funds legally available for such payments. Although Cullen/Frost has historically declared cash dividends on its common stock, it is not required to do so and may reduce or eliminate its common stock dividend in the future.

Cybersecurity and data protection · Insider threats and access controls

It is possible that employees, merchants or our third-party vendors may not follow our cybersecurity policies and procedures, which may expose us to a cyber-attack. Furthermore, even well protected information, networks, systems and facilities remain potentially vulnerable to attempted security breaches or disruptions because the techniques used in such attempts are constantly evolving.

Information management · Technology vendor dependence

We rely on certain external vendors to provide products and services necessary to maintain our day-to-day operations. These third-party vendors are sources of operational, cybersecurity, and information security risk to us, including risks associated with operational errors, coding errors, information system failures, interruptions or breaches and unauthorized disclosures of sensitive or confidential customer information.

Digital transformation and innovation · Technology obsolescence and evolution

Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations. Many of our competitors have substantially greater resources to invest in technological improvements.

Digital transformation and innovation · Artificial intelligence and automation

In addition, our implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, cloud technologies are critical to the operation of our systems, and our reliance on cloud technologies is growing.