mtb-20251231
t
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
__________________________________________________________________________________
Form 10-K
__________________________________________________________________________________
For the fiscal year ended December 31, 2025
Commission file number 1-9861
_________________________________________________________________________________
M&T BANK CORPORATION
(Exact name of registrant as specified in its charter)
__________________________________________________________________________________
New York(State of incorporation) 16-0968385(I.R.S. Employer Identification No.)
Registrant’s telephone number, including area code:
716-635-4000
Securities registered pursuant to Section 12(b) of the Act:
Title of Each Class Trading Symbols Name of Each Exchange on Which Registered
Common Stock, $0.50 par value MTB New York Stock Exchange
__________________________________________________________________________________
Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yesx No o
Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes oNox
Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months, and (2) has been subject to such filing requirements for the past 90 days. Yesx No o
Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months. Yesx No ☐
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of "large accelerated filer," "accelerated filer," "smaller reporting company," and "emerging growth company" in Rule 12b-2 of the Exchange Act.
Large accelerated filer x Accelerated filer o
Non-accelerated filer o Smaller reporting company o
Emerging growth company o
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐
Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. x
If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. o
Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). o
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes o No x
Aggregate market value of the Common Stock, $0.50 par value, held by non-affiliates of the registrant, computed by reference to the closing price as of the close of business on June 30, 2025: $29,618,092,321.
Number of shares of the Common Stock, $0.50 par value, outstanding as of the close of business on February 13, 2026: 149,000,252 shares.
Documents Incorporated By Reference:
(1) Portions of the Proxy Statement for the 2026 Annual Meeting of Shareholders of M&T Bank Corporation in Parts II and III.
Auditor Firm Id: 238 Auditor Name: PricewaterhouseCoopers LLP Auditor Location: Buffalo, NY, United States
M&T BANK CORPORATION
Form 10-K for the year ended December 31, 2025
CROSS-REFERENCE SHEET
Form 10-KPage
Glossary of terms 1
PART I
Item 1. Business 3
Disclosure pursuant to subpart 1400 of Regulation S-K
A.Average balance sheets 56
C.Rate/volume variances 57
II. Investments in debt securities
A.Maturity schedule and weighted-average yield 87
III. Loan portfolio
A.Maturity schedule 88
IV. Allowance for credit losses
B.Allocation of the allowance for credit losses 77, 135
V. Deposits
A.Average balances and rates 56
B.Uninsured deposits and time deposits over $250,000 65, 85, 89
Item 1A. Risk Factors 22
Item 1B. Unresolved Staff Comments 44
Item 1C. Cybersecurity 44
Item 2. Properties 46
Item 4. Mine Safety Disclosures 46
Executive Officers of the Registrant 47
PART II
Item 6. Selected Financial Data 50
Corporate Profile 51
Financial Overview 51
Supplemental Reporting of Non-GAAP Results of Operations 53
Taxable-equivalent Net Interest Income 55
Provision for Credit Losses 68
Other Income 78
Other Expense 83
Income Taxes 84
Liquidity Risk 85
Market Risk and Interest Rate Sensitivity 90
Segment Information 95
Critical Accounting Estimates 101
Recent Accounting Developments 103
Forward-Looking Statements 103
Quarterly Trends 105
Reconciliation of Quarterly GAAP to Non-GAAP Measures 106
Item 7A. Quantitative and Qualitative Disclosures About Market Risk 107
Item 8. Financial Statements and Supplementary Data 107
A.Report of Independent Registered Public Accounting Firm 108
G.Notes to Financial Statements 116
1. Significant accounting policies 116
3. Investment securities 126
4. Loans and allowance for loan losses 129
5. Premises and equipment 141
6. Capitalized servicing assets 143
7. Goodwill and other intangible assets 144
9. Shareholders’ equity 147
10. Revenue from contracts with customers 148
11. Stock-based compensation plans 149
12. Pension plans and other postretirement benefits 150
14. Earnings per common share 159
15. Comprehensive income 160
16. Other income and other expense 161
17. Derivative financial instruments 162
18. Variable interest entities and asset securitizations 166
19. Fair value measurements 168
20. Commitments and contingencies 174
21. Segment information 176
22. Regulatory matters 179
23. Relationship with BLG and Bayview Financial 181
24. Parent company financial statements 182
H.Quarterly Trends 105
Item 9A. Controls and Procedures 185
Item 9B. Other Information 186
Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 186
PART III
Item 10. Directors, Executive Officers and Corporate Governance 187
Item 11. Executive Compensation 187
Item 14. Principal Accountant Fees and Services 188
PART IV
Item 15. Exhibits and Financial Statement Schedules 189
Glossary of Terms
The following listing includes acronyms and terms used throughout the document.
Term Definition
AI Artificial Intelligence
AML Anti-Money Laundering
Bayview Financial Bayview Financial Holdings, L.P. together with its affiliates
BHC Bank holding company
BHCA Bank Holding Company Act of 1956, as amended
BLG Bayview Lending Group, LLC
BSA Bank Secrecy Act
CCyB Countercyclical capital buffer
CET1 Common Equity Tier 1
CFPB Consumer Financial Protection Bureau
CISO Chief Information Security Officer
CIT Collective Investment Trust
Company M&T Bank Corporation and its consolidated subsidiaries
CRA Community Reinvestment Act of 1977
DIF Deposit Insurance Fund
Dodd-Frank Act Dodd-Frank Wall Street Reform and Consumer Protection Act
DOJ U.S. Department of Justice
DUS Delegated Underwriting and Servicing
EGRRCPA Economic Growth, Regulatory Relief, and Consumer Protection Act
EVE Economic value of equity
Exchange Act Securities Exchange Act of 1934
Executive ALCO Committee Executive Asset-Liability Liquidity Capital Committee
FASB Financial Accounting Standards Board
FDIA Federal Deposit Insurance Act
FDIC Federal Deposit Insurance Corporation
Federal Reserve Board of Governors of the Federal Reserve System
FHC Financial Holding Company
FHLB Federal Home Loan Bank
FinCEN Financial Crimes Enforcement Network
FOMC Federal Open Market Committee
FRB Federal Reserve Bank
GAAP Accounting principles generally accepted in the U.S.
GDP Gross Domestic Product
GENIUS Act Guiding and Establishing National Innovation for U.S. Stablecoins Act
1
Term Definition
IDI Insured depository institution
LCR Liquidity coverage ratio
LTV Loan-to-value
M&T M&T Bank Corporation
M&T Bank Manufacturers and Traders Trust Company
M&T Realty Capital M&T Realty Capital Corporation
NDFI Nondepository Financial Institution
NSFR Net stable funding ratio
NYSDFS New York State Department of Financial Services
NYSE New York Stock Exchange
OAS Option adjusted spread
OCC Office of the Comptroller of the Currency
OFAC U.S. Department of the Treasury’s Office of Foreign Assets Control
OLA Orderly Liquidation Authority
OLF Orderly Liquidation Fund
PCD Purchased credit deteriorated
People’s United People’s United Financial, Inc.
Proxy Statement M&T’s Proxy Statement for its Annual Meeting of Shareholders
Risk Framework Enterprise Risk Framework
RWA Risk-weighted assets
SCB Stress capital buffer
SEC Securities and Exchange Commission
Securities Act Securities Act of 1933, as amended
SLR Supplementary leverage ratio
SOFR Secured Overnight Financing Rate
U.S. United States of America
Wilmington Trust, N.A. Wilmington Trust, National Association
2
PART I
Item 1. Business.
M&T is a New York business corporation that has elected to be treated as an FHC under the BHCA and is a BHC under Article III-A of the New York Banking Law. M&T was incorporated in November 1969. At December 31, 2025, M&T had two wholly-owned bank subsidiaries: M&T Bank and Wilmington Trust, N.A. The banks collectively offer a wide range of retail and commercial banking, wealth management, trust and institutional services to their customers. The Company had consolidated total assets of $213.5 billion, deposits of $166.9 billion and shareholders’ equity of $29.2 billion at December 31, 2025. The principal executive offices of M&T and M&T Bank are located in Buffalo, New York.
M&T Bank is a banking corporation that is incorporated under the laws of the State of New York. M&T Bank is a member of the Federal Reserve System and the FHLB System, and its deposits are insured by the FDIC through its DIF up to applicable limits. M&T acquired all of the issued and outstanding shares of the capital stock of M&T Bank in December 1969. The stock of M&T Bank represents a major asset of M&T. M&T Bank operates under a charter granted by the State of New York in 1892, and the continuity of its banking business is traced to the organization of Manufacturers and Traders Bank in 1856. M&T Bank provides banking products and services through a domestic banking office and ATM network located throughout New York, Maryland, New Jersey, Pennsylvania, Delaware, Connecticut, Massachusetts, Maine, Vermont, New Hampshire, Virginia, West Virginia and the District of Columbia. As a commercial bank, M&T Bank offers a broad range of financial services to a diverse base of consumers, businesses, professional clients, governmental entities and financial institutions located in its markets. Lending is generally focused on consumers residing in areas where M&T Bank maintains banking offices, and on small and medium-size businesses based in those areas, although loans are originated through offices in other states and in Ontario, Canada. M&T Bank and certain of its subsidiaries also offer commercial mortgage loans secured by income producing properties or properties used by borrowers in a trade or business. Additional financial services are provided through other operating subsidiaries of M&T Bank including M&T Realty Capital which engages in multifamily commercial real estate lending and provides loan servicing to purchasers of the loans it originates, and LEAF Commercial Capital Inc. and M&T Equipment Finance Corp. which provide equipment leasing and financing services. Trust and other fiduciary services are offered by M&T Bank and through its wholly-owned subsidiary, Wilmington Trust Company. At December 31, 2025, M&T Bank and its subsidiaries represented over 99% of the consolidated assets of the Company.
Wilmington Trust, N.A. is a national bank with total assets of $773 million at December 31, 2025. Wilmington Trust, N.A. and its subsidiaries offer various institutional client and wealth management services. Among other subsidiaries of M&T is M&T Securities, Inc. which provides institutional brokerage and securities services. M&T and its banking subsidiaries have a number of other special-purpose or inactive subsidiaries. These other subsidiaries did not represent, individually or collectively, a significant portion of the Company’s consolidated assets, net income and shareholders’ equity at December 31, 2025.
The Company from time to time considers acquiring banks, thrift institutions, branch offices of banks or thrift institutions, or other businesses within markets currently served by the Company or in other locations that would complement the Company’s business or its geographic reach. The Company has pursued acquisition opportunities in the past, reviews different opportunities from time to time and intends to continue this practice.
3
Segment Information, Principal Products/Services and Foreign Operations
Information about the Company’s business segments is included in note 21 of Notes to Financial Statements filed herewith in Part II, Item 8, "Financial Statements and Supplementary Data" and is further discussed in Part II, Item 7, "Management’s Discussion and Analysis of Financial Condition and Results of Operations." The Company engages in limited international activities including certain trust-related services in Europe, foreign currency transactions associated with customer activity, providing credit to support the international activities of domestic companies and holding certain loans to foreign borrowers. Assets and revenues associated with international activities represent less than 1% of the Company’s consolidated assets and revenues.
The only activities that, as a class, contributed 10% or more of the sum of consolidated interest income and other income in any of the last three years were interest income on loans in each of 2025, 2024 and 2023, interest income on investment securities in 2025 and interest income on deposits at banks in each of 2024 and 2023. The amount of income from such sources during those years is recorded in various business segments and is set forth in the Company’s Consolidated Statement of Income and Notes to Financial Statements filed herewith in Part II, Item 8, "Financial Statements and Supplementary Data."
Supervision and Regulation of the Company
M&T and its subsidiaries are subject to the comprehensive regulatory framework applicable to BHCs and FHCs and their subsidiaries. Regulation of financial institutions such as M&T and its subsidiaries is intended primarily for the protection of depositors, the FDIC’s DIF and the banking and financial system as a whole, and generally is not intended for the protection of shareholders, investors or creditors other than insured depositors.
Proposals to change the applicable regulatory framework may be introduced in the U.S. Congress and state legislatures, as well as by regulatory agencies and through Executive Orders by the U.S. President. Such initiatives may include proposals to expand or contract the powers of BHCs and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions and other financial institutions. A change in statutes, regulations or regulatory policies applicable to M&T or any of its subsidiaries could have a material effect on the business, financial condition or results of operations of the Company.
Described hereafter are material elements of the significant federal and state laws and regulations applicable to M&T and its subsidiaries.
Overview
M&T is registered with the Federal Reserve as an FHC and a BHC under the BHCA. As such, M&T and its subsidiaries are subject to the supervision, examination, reporting, capital and other requirements of the BHCA and the regulations of the Federal Reserve. In addition, M&T’s banking subsidiaries are subject to regulation, supervision and examination by, as applicable, the NYSDFS, the OCC, the FDIC and the Federal Reserve, and their consumer financial products and services are regulated by the CFPB. Further, financial services entities such as M&T’s investment advisor and broker-dealer subsidiaries are subject to regulation by the SEC, Financial Industry Regulatory Authority and Securities Investor Protection Corporation, among others. Certain other subsidiaries are subject to regulation by other federal and state regulators as well.
M&T Bank is a New York chartered bank and a member of the Federal Reserve System. As a result, it is subject to extensive regulation, examination and oversight by the NYSDFS and the FRB of New York. New York laws and regulations govern many aspects of M&T Bank’s operations,
4
including branching, dividends, subsidiary activities, fiduciary activities, lending and deposit taking. M&T Bank is also subject to Federal Reserve regulations and guidance, including with respect to capital levels. Its deposits are insured by the FDIC, subject to certain limitations, which also exercises regulatory oversight over certain aspects of M&T Bank’s operations.
Wilmington Trust, N.A. is a national bank with operations that include fiduciary and related activities with limited lending and deposit business. It is subject to regulation, examination and oversight by the OCC, which governs many aspects of its operations, including fiduciary activities, capital levels, office locations, dividends and subsidiary activities. Its deposits are insured by the FDIC, subject to certain limitations, which also exercises regulatory oversight over certain aspects of the operations of Wilmington Trust, N.A.
Permissible Activities under the BHCA
In general, the BHCA limits the business of a BHC to banking, managing or controlling banks, and other activities that the Federal Reserve has determined to be so closely related to banking as to be a proper incident thereto. In addition, BHCs are obligated by a Federal Reserve policy to serve as a managerial and financial source of strength to their subsidiary depository institutions, including committing resources to support such subsidiaries. This support may be required at times when M&T may not be inclined or able to provide it. In addition, any capital loans by a BHC to a subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a BHC’s bankruptcy, any commitment by the BHC to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.
A BHC that qualifies and elects to be an FHC may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the Federal Reserve, by regulation or order, in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the Federal Reserve). Activities that are financial in nature include securities underwriting and dealing, insurance underwriting and merchant banking.
M&T elected to become an FHC in 2011. To maintain FHC status, an FHC and all of its depository institution subsidiaries must be "well capitalized" and "well managed." The failure of an FHC to meet such requirements could result in material restrictions on the activities of the FHC and may also adversely affect the FHC’s ability to enter into certain transactions, including acquisitions, or obtain necessary approvals in connection with those transactions, as well as loss of FHC status. Additionally, if each of an FHC’s depository institution subsidiaries has not received at least a "satisfactory" rating on its most recent examination under the CRA, the FHC would not be able to commence any new financial activities or acquire a company that engages in such activities, although it would still be allowed to engage in activities closely related to banking and make investments in the ordinary course of conducting banking activities. For a further discussion of the CRA, see the section captioned "CRA" included herein.
Enhanced Prudential Standards
Under Section 165 of the Dodd-Frank Act, as amended by the EGRRCPA, U.S. BHCs with total consolidated assets of $100 billion or more, including M&T, are subject to enhanced prudential standards. The enhanced prudential standards include risk-based capital and leverage requirements, liquidity standards, risk management and risk committee requirements, stress testing requirements and a debt-to-equity limit for companies that the Financial Stability Oversight Council has determined would pose a grave threat to systemic financial stability were they to fail such limits. Tailoring Rules adopted by the Federal Reserve and other federal bank regulators in 2019 assign each
5
U.S. BHC with $100 billion or more in total consolidated assets, as well as its bank subsidiaries, to one of four categories based on its size and five other risk-based indicators: (i) cross-jurisdictional activity, (ii) weighted short-term wholesale funding, (iii) non-bank assets, (iv) off-balance sheet exposure, and (v) status as a U.S. global systemically important BHC. Under the Tailoring Rules, M&T and its depository institution subsidiaries are subject to Category IV standards, which apply to banking organizations with at least $100 billion in total consolidated assets that do not meet any of the thresholds specified for Categories I through III. The threshold for Category III is $250 billion or more in total consolidated assets, or $100 billion or more in total consolidated assets and at least $75 billion in weighted short-term wholesale funding, non-bank assets or off-balance sheet exposures.
Under the Tailoring Rules, Category IV firms, among other things, (i) are not subject to any LCR or NSFR (or, in certain cases, are subject to reduced requirements), (ii) remain eligible to opt-out of the requirement to recognize most elements of accumulated other comprehensive income in regulatory capital, (iii) are not subject to company-run stress testing requirements, (iv) are subject to supervisory stress testing on at least a biennial basis rather than an annual basis, (v) are subject to requirements to develop and maintain a capital plan on an annual basis and (vi) are subject to certain liquidity risk management and risk committee requirements. The Federal Reserve may impose more stringent requirements (e.g. frequency of supervisory stress tests or capital plan submissions) based on a company’s financial condition, size, complexity, risk profile, scope of operations or activities, or risks to the U.S. economy. Category IV firms are not subject to (i) advanced approaches capital requirements, (ii) the SLR and (iii) the CCyB. Other elements of the Tailoring Rules are discussed in further detail throughout this section. Compared with Category IV firms, Category III firms are subject to the LCR and NSFR, company-run stress testing requirements, annual (instead of biennial) supervisory stress tests, the SLR and the CCyB.
In July 2023, the Federal Reserve, the FDIC and the OCC proposed revisions to the capital framework applicable to BHCs with $100 billion or more in assets, such as M&T, which would also apply to their depository institution subsidiaries. For further discussion of the capital framework, see the section captioned "Capital Requirements" included herein.
Capital Requirements
M&T and its subsidiary banks are required to comply with applicable Capital Rules, which are based on Basel III. The Capital Rules include both risk-based requirements, which compare three measures of capital to RWA, as well as leverage requirements, which, in the case of Category IV BHCs such as M&T, consist of the Tier 1 leverage ratio described below. Pursuant to the Capital Rules, the minimum capital ratios are as follows:
•4.5% CET1 capital to RWA;
•6.0% Tier 1 capital (CET1 plus Additional Tier 1 capital) to RWA;
•8.0% Total capital (Tier 1 plus Tier 2 capital) to RWA; and
•4.0% Tier 1 capital to average consolidated assets (the "leverage ratio").
In calculating risk-based capital ratios, M&T must assign risk weights to the Company’s assets and off-balance sheet items. M&T has an ongoing process to review data elements associated with these exposures that from time to time may affect how specific exposures are classified and could lead to increases or decreases of the regulatory risk weights assigned to such exposures.
The Capital Rules also require firms to maintain a "buffer," consisting solely of CET1 capital, in addition to the minimum risk-based requirements. Failure to satisfy the buffer requirement in full results in graduated constraints on capital distributions and discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the firm’s "eligible retained income," defined as the greater of (i) net income for the four preceding quarters net of distributions
6
and associated tax effects not reflected in net income and (ii) the average of net income over the preceding four quarters.
As a Category IV BHC, M&T’s buffer requirement, referred to as the SCB, is determined through the Federal Reserve’s supervisory stress tests, discussed herein. For M&T’s bank subsidiaries, the buffer requirement consists of the static capital conservation buffer equal to 2.5% of RWA.
CET1 capital consists of common stock instruments that meet the eligibility criteria in the Capital Rules, including common stock and related surplus, net of treasury stock, retained earnings, certain minority interests and, for certain firms, accumulated other comprehensive income. As currently permitted under the Capital Rules, M&T made a one-time permanent election to neutralize certain accumulated other comprehensive income components, with the result that those components are not recognized in M&T’s CET1 capital.
The Capital Rules provide for a number of deductions from and adjustments to CET1 capital. As a "non-advanced approaches" firm under the Capital Rules, M&T is subject to rules that provide for simplified capital requirements relating to the threshold deductions for mortgage loan servicing assets, deferred tax assets arising from temporary differences that a banking organization could not realize through net operating loss carrybacks, and investments in the capital of unconsolidated financial institutions, as well as the inclusion of minority interests in regulatory capital. M&T’s and its subsidiary banks’ regulatory capital ratios are presented in note 22 of Notes to Financial Statements filed herewith in Part II, Item 8, "Financial Statements and Supplementary Data."
In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain "unconditionally cancellable commitments," such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company.
In July 2023, the Federal Reserve, the FDIC and the OCC proposed revisions to the Capital Rules to implement the Basel Committee’s 2017 standards and make other changes to the Capital Rules. The federal banking regulators have subsequently indicated that they expect to issue a revised proposal, the timing and contents of which are uncertain.
Stress Testing and SCB
As part of the enhanced prudential requirements applicable to systemically important financial institutions, the Federal Reserve conducts periodic analyses of BHCs with at least $100 billion in total consolidated assets using baseline and severely adverse economic and financial scenarios generated by the Federal Reserve. For Category IV firms, such as M&T, these supervisory stress tests occur on a biennial basis, in even-numbered years. The Federal Reserve may also use additional components in the severely adverse scenario or additional or more complex scenarios designed to capture salient risks to specific business groups. A summary of results of the Federal Reserve’s analysis under the severely adverse stress scenario is publicly disclosed by June 30 each year. Under the Tailoring Rules, Category IV firms, including M&T, are not subject to company-run stress testing requirements.
The SCB is based on a BHC’s stressed losses in the supervisory stress test, plus four quarters of planned common stock dividends, subject to a floor of 2.5% of RWAs. Under the Tailoring Rules, for Category IV firms, the portion of the SCB based on the Federal Reserve’s supervisory stress tests will be calculated biennially, in even-numbered years. During a year in which a Category IV firm does not undergo a supervisory stress test, the firm will receive an updated SCB that reflects the firm’s updated planned common stock dividends. A Category IV firm is also able to elect to
7
participate in the supervisory stress test in a year in which the firm would not normally be subject to the supervisory stress test and consequently receive an updated SCB, and M&T elected to participate in the 2025 supervisory stress test. The Federal Reserve may impose more stringent requirements (e.g., frequency of supervisory stress tests or capital plan submissions) based on various factors.
In June 2025, the Federal Reserve released the results of its most recent supervisory stress tests. Based on those results and the current rules, on October 1, 2025, M&T's SCB of 2.7% became effective. Accordingly, it is currently subject to a CET1 capital requirement of 7.2% (a sum of the SCB and the minimum CET1 capital ratio).
In April 2025, the Federal Reserve issued a proposed rule that would result in the SCB being calculated based on an average of a firm’s stress test results over two consecutive years, which is intended to reduce volatility in firms’ capital requirements. However, a Category IV institution like M&T, which is only subject to stress tests every other year, would receive an SCB based solely on its most recent stress test, unless it opted into the supervisory stress tests in an off-cycle year.
In October 2025, the Federal Reserve issued proposals to enhance the transparency and public accountability of its annual stress test, which is used to set the SCB for large BHCs, including M&T. The proposals request comment on several elements of the stress test, including the models and scenarios used; an enhanced disclosure process for the scenarios and material model changes in future stress test cycles; modifications to reporting forms; and an adjusted timeline for the annual process to accommodate a comment period for scenarios and material model changes.
BHCs with total consolidated assets of $100 billion or more, including Category IV BHCs such as M&T, must annually submit capital plans as part of the Federal Reserve’s process. The comprehensive capital plans include a view of capital adequacy under various scenarios, including a BHC-defined baseline scenario, at least one BHC-defined stress scenario, and any scenario provided by the Federal Reserve. A BHC’s planned capital distributions in its annual capital plan submissions must be consistent with any effective distribution limitations that would apply under the firm’s own baseline projections, including its SCB. The process is intended to help ensure that these BHCs have robust, forward-looking capital planning processes that account for each company’s unique risks and that permit continued operations during times of economic and financial stress. Each of the BHCs participating in the process is also required to collect and report certain related data to the Federal Reserve on a regular basis. The Federal Reserve incorporates an assessment of the qualitative aspects of the firm’s capital planning process into regular, ongoing supervisory activities and through targeted, horizontal assessments of particular aspects of capital planning. M&T’s annual capital plan is due in April each year.
Distributions
M&T is a legal entity separate and distinct from its banking and other subsidiaries. Historically, the majority of M&T’s revenue has been from dividends paid to M&T by its subsidiary banks. M&T Bank and Wilmington Trust, N.A. are subject to laws and regulations imposing restrictions on the amount of dividends those subsidiaries may declare and pay. An IDI is prohibited from making any capital distribution to its owner, including any dividend, if, after making such distribution, the depository institution fails to meet the required minimum level for any relevant capital measure, including the risk-based capital adequacy and leverage standards discussed herein. Future dividend payments to M&T by its subsidiary banks will be dependent on a number of factors, including the earnings and financial condition of each such bank, and are subject to the limitations referred to in note 22 of Notes to Financial Statements filed herewith in Part II, Item 8, "Financial Statements and Supplementary Data," and to other statutory powers of bank regulatory agencies.
Dividend payments by M&T to its shareholders and common stock repurchases by M&T are subject to the oversight of the Federal Reserve. M&T’s ability to make capital distributions would
8
likely be impacted in the event that M&T fails to maintain its CET1 risk-based, Tier 1 risk-based and total risk-based capital ratios above minimum requirements including its SCB.
In addition, the Federal Reserve’s capital plan rule also provides that a BHC must receive prior approval for any dividend, stock repurchase, or other capital distribution, other than a capital distribution on a newly issued capital instrument, if the BHC is required to resubmit its capital plan. Among other circumstances, a firm may be required to resubmit its capital plan in connection with certain acquisitions or dispositions.
Liquidity
Under the Tailoring Rules, as a Category IV firm, the Company is not subject to the Federal Reserve and other federal banking regulators' rules that implement a U.S. version of the Basel Committee’s LCR requirement, which is intended to ensure that banks hold sufficient amounts of so-called high quality liquid assets to cover the anticipated net cash outflows during a hypothetical acute 30-day stress scenario, or the NSFR, which is designed to promote more medium- and long-term funding of the assets and activities of banks over a one-year time horizon. The Federal Reserve’s enhanced prudential standards, however, require the Company, as a BHC with $100 billion or more in total consolidated assets, to comply with enhanced liquidity and overall risk management standards, which include maintaining a level of highly liquid assets based on projected funding needs for 30 days, and increased involvement by boards of directors in liquidity and overall risk management. Under the Tailoring Rules, the liquidity risk management and reporting requirements are less stringent for Category IV BHCs as compared with BHCs in a different category.
Cross Guaranty Provision
The cross guaranty provisions in the FDIA require each IDI owned by the same BHC to be financially responsible for the failure or resolution costs of any affiliated insured institution. Generally, the amount of the cross guaranty liability is equal to the estimated loss to the DIF for the resolution of the affiliated institution(s) in default. The FDIC’s claim under the cross guaranty provision is superior to claims of shareholders of the IDI or its BHC and to most claims arising out of obligations or liabilities owed to affiliates of the institution, but is subordinate to claims of depositors, secured creditors and holders of subordinated debt (other than affiliates) of the commonly controlled IDI. The FDIC may decline to enforce the cross guaranty provision if it determines that a waiver is in the best interest of the DIF.
Volcker Rule
The Volcker Rule limits proprietary trading and investing in and sponsoring certain hedge funds and private equity funds (defined as "covered funds" in the Volcker Rule). The Company does not engage in a significant amount of proprietary trading as defined in the Volcker Rule and implemented the required procedures for those areas in which trading activities occur. In addition, the Company does not engage in any significant covered fund activities that are impacted by the Volcker Rule.
Safety and Soundness Standards and Supervision
Guidelines adopted by the federal bank regulatory agencies pursuant to the FDIA establish general standards relating to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. Additionally, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable
9
compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties. In addition, the federal bank regulatory agencies supervise and examine the risk management of FHCs, BHCs and banks, including with respect to third-party, cybersecurity, model and other risk management.
In October 2025, the FDIC and OCC issued a proposed rule that would define the term “unsafe or unsound practice” for purposes of their enforcement powers under the FDIA. The proposed definition would focus on whether the practice is likely to materially harm, or already has materially harmed, the financial condition of an institution. The Federal Reserve has not issued a similar proposal.
Limits on Undercapitalized Depository Institutions
The FDIA establishes a system of regulatory remedies to resolve the problems of undercapitalized institutions, referred to as the prompt corrective action framework. The federal banking regulators have established five capital categories ("well capitalized," "adequately capitalized," "undercapitalized," "significantly undercapitalized" and "critically undercapitalized") and must take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions which are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. The federal banking regulators have specified by regulation the relevant capital levels for each category. Under existing rules, a depository institution is deemed to be "well capitalized" if it has (i) a CET1 capital ratio of at least 6.5%, (ii) a Tier 1 capital ratio of at least 8%, (iii) a Total capital ratio of at least 10%, and (iv) a Tier 1 leverage ratio of at least 5%.
The FDIA’s prompt corrective action provisions only apply to depository institutions and not to BHCs. The Federal Reserve’s regulations applicable to BHCs separately define "well capitalized." A FHC that is not well capitalized and well managed (or whose bank subsidiaries are not well capitalized and well managed) under applicable prompt corrective action standards may be restricted in certain of its activities and ultimately may lose FHC status.
An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a BHC must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The BHC must also provide appropriate assurances of performance. An undercapitalized institution is also generally prohibited from increasing its average total assets, accepting brokered deposits or offering interest rates on any deposits significantly higher than prevailing market rates, making acquisitions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions that are significantly undercapitalized or undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions failing to submit or implement an acceptable capital restoration plan are subject to appointment of a receiver or conservator.
10
Transactions with Affiliates
There are various legal restrictions on the extent to which M&T and its non-bank subsidiaries or affiliates may borrow or otherwise obtain funding from M&T Bank and Wilmington Trust, N.A. In general, Sections 23A and 23B of the Federal Reserve Act and Federal Reserve Regulation W require that any "covered transaction" by M&T Bank and Wilmington Trust, N.A. (or any of their respective subsidiaries) with an affiliate must in certain cases be secured by designated amounts of specified collateral and must be limited as follows: (i) in the case of any single such affiliate, the aggregate amount of covered transactions of the IDI and its subsidiaries may not exceed 10% of the capital stock and surplus of such IDI, and (ii) in the case of all affiliates, the aggregate amount of covered transactions of an IDI and its subsidiaries may not exceed 20% of the capital stock and surplus of such IDI. "Covered transactions" are defined by statute to include, among other things, a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the Federal Reserve) from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. All covered transactions, including certain additional transactions (such as transactions with a third party in which an affiliate has a financial interest), must be conducted on terms and under circumstances including credit standards (i) that are substantially the same, or at least as favorable to such bank or its subsidiary, as those prevailing at the time for comparable transactions with or involving other nonaffiliated companies, or in the absence of comparable transactions, (ii) that in good faith would be offered to, or would apply to, nonaffiliated companies.
FDIC Insurance Assessments
M&T Bank and Wilmington Trust, N.A. deposits are insured by the DIF of the FDIC up to the limits set forth under applicable law. The FDIC imposes a risk-based premium assessment system that determines assessment rates for financial institutions. Deposit insurance assessments are based on average total assets minus average tangible equity. For larger institutions, such as M&T Bank, the FDIC uses a performance score and a loss-severity score to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’s capital level and supervisory ratings and certain financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations. Under the current system, premiums are assessed quarterly.
Under the FDIA, insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.
In October 2022, the FDIC finalized a rule that increased initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023. The FDIC, as required under the FDIA, established a plan in September 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35 percent within eight years. The increased assessment is intended to improve the likelihood that the DIF reserve ratio would reach the required minimum by the statutory deadline of September 30, 2028.
In November 2023, the FDIC finalized a rule that imposes a special assessment to recover the costs to the DIF resulting from the FDIC’s use in 2023 of the systemic risk exception to the least-cost resolution test under the FDIA in connection with the receiverships of certain failed banks. Under the rule, the assessment base is the estimated uninsured deposits that an IDI reported in its Consolidated Report of Condition and Income at December 31, 2022, excluding the first $5 billion in estimated uninsured deposits. For a holding company that has more than one IDI subsidiary, such as M&T, the
11
$5 billion exclusion is allocated among the company’s IDI subsidiaries in proportion to each IDI’s estimated uninsured deposits. The special assessments are tax deductible. The Company's total share of the FDIC's special assessment is estimated at $194 million, of which $98 million and $74 million was paid in 2025 and 2024, respectively. The amount of FDIC special assessment remaining to be paid and included in Accrued interest and other liabilities in the Company's Consolidated Balance Sheet at December 31, 2025 was $22 million. The FDIC has adjusted the amount of the special assessment since 2023 and has indicated that the amount of the special assessment may be adjusted in the future should its loss estimates change.
Acquisitions
Federal and state laws impose notice and approval requirements for mergers and acquisitions involving depository institutions or BHCs. For example, the BHCA requires every BHC to obtain the prior approval of the Federal Reserve before: (i) it may acquire direct or indirect ownership or control of any voting shares of any bank or savings institution, if after such acquisition, the BHC will directly or indirectly own or control 5% or more of the voting shares of the institution; (ii) it or any of its subsidiaries, other than a bank, may acquire all or substantially all of the assets of any bank or savings institution; or (iii) it may merge or consolidate with any other BHC. In addition, FHCs are required to obtain prior approval from the Federal Reserve before acquiring certain non-bank financial companies with assets exceeding $10 billion.
The BHCA further provides that the Federal Reserve may not approve any transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the U.S., or the effect of which may be to substantially lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade, unless the anticompetitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider the financial and managerial resources and future prospects of the BHCs and banks concerned and the convenience and needs of the community to be served. Consideration of financial resources generally focuses on capital adequacy and consideration of convenience and needs issues and includes the parties’ performance under the CRA and compliance with laws, especially consumer protection laws. When evaluating a transaction, the Federal Reserve must also take into account the institution's effectiveness in combating money laundering and consider the extent to which the transaction would result in greater or more concentrated risks to the stability of the U.S. banking or financial system.
The standards by which mergers and acquisitions involving depository institutions or BHCs are evaluated by regulators continue to evolve. For example, the DOJ announced in September 2024 its withdrawal from the 1995 Bank Merger Guidelines to assess the competitive effects of bank merger transactions.
Executive and Incentive Compensation
Guidelines adopted by several federal banking agencies prohibit excessive compensation as an unsafe and unsound practice and describe compensation as "excessive" when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. The Federal Reserve issued Incentive Compensation Guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The Incentive Compensation Guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide
12
incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks; (ii) be compatible with effective internal controls and risk management; and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. These three principles are incorporated into the proposed joint compensation regulations under the Dodd-Frank Act. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or perform other actions. The Incentive Compensation Guidance states that enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk-management control or governance processes pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.
The Dodd-Frank Act requires the federal bank regulatory agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets, such as M&T and M&T Bank. The agencies proposed rules to implement this requirement in 2016, but those proposed rules have not been finalized.
In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including the NYSE, to require policies mandating the recovery or "clawback" of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding a required accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The excess compensation would be based on the amount the executive officer would have received had the incentive-based compensation been determined using the restated financial statements. The NYSE’s listing standards pursuant to the SEC’s rule became effective October 2023. M&T’s clawback policy adopted in accordance with these listing standards is included as Exhibit 97.1 of this Form 10-K.
In addition, the NYSDFS issued guidance emphasizing that its regulated banking institutions, including M&T Bank, must ensure that any incentive compensation arrangements tied to employee performance indicators are subject to effective risk management, oversight and control.
Resolution Planning and Resolution-Related Requirements
Pursuant to the Dodd-Frank Act, as amended by the EGRRCPA, certain BHCs are required to report periodically to the Federal Reserve and the FDIC a resolution plan for their rapid and orderly resolution in the event of material financial distress or failure. In 2019, the Federal Reserve and FDIC issued modified rules that, among other things, adjusted the review cycles and applicability of the agencies’ resolution planning requirements. Under these rules, Category IV firms such as M&T are not required to submit resolution plans.
The FDIC has separately required IDIs with $50 billion or more in total assets, such as M&T Bank, to submit to the FDIC periodic plans for resolution in the event of the institution’s failure. In June 2024, the FDIC finalized amendments to the resolution planning requirements for IDIs with $50 billion or more in total assets. IDIs such as M&T Bank with $100 billion or more in total assets that are not affiliates of U.S. global systemically important banking organizations are required to submit resolution plans on a three-year cycle, with an interim supplement updating key information submitted in the off years. M&T Bank made its first submission under the new rule in July 2025.
In August 2023, the Federal Reserve, the FDIC and the OCC issued a proposed rule that would, among other things, require Category II through Category IV BHCs and IDIs with $100 billion or more in consolidated assets (as well as their IDI affiliates) to maintain minimum amounts of eligible long-term debt (generally, debt that is unsecured, has a maturity greater than one year from issuance
13
and satisfies additional criteria), subject to a three-year phase-in period. The proposal has not yet been finalized.
Insolvency of an IDI or a BHC
If the FDIC is appointed as conservator or receiver for an IDI such as M&T Bank or Wilmington Trust, N.A., upon its insolvency or in certain other events without limitation, the FDIC has the power:
•to transfer any of the depository institution’s assets and liabilities to a new depository institution, including a newly formed "bridge" bank without the approval of the insolvent depository institution’s creditors or equity holders;
•to enforce the terms of the depository institution’s contracts pursuant to their terms without regard to any provisions triggered by the appointment of the FDIC in that capacity; or
•to repudiate or disaffirm any contract or lease to which the depository institution is a party, the performance of which is determined by the FDIC to be burdensome and the disaffirmance or repudiation of which is determined by the FDIC to promote the orderly administration of the depository institution.
In addition, under federal law, the claims of holders of domestic deposit liabilities and certain claims for administrative expenses against an IDI institution would be afforded a priority over other general unsecured claims against such an institution, including claims of debt holders of the institution, in the "liquidation or other resolution" of such an institution by any receiver. As a result, whether or not the FDIC ever sought to repudiate any debt obligations of M&T Bank or Wilmington Trust, N.A., the debt holders would be treated differently from, and could receive, if anything, substantially less than the depositors of the bank.
The Dodd-Frank Act created a new resolution regime known as OLA for systemically important financial companies, including BHCs and their affiliates. Under the OLA, the FDIC may be appointed as receiver for the systemically important institution, and its failed subsidiaries, for purposes of liquidating the entity if, among other conditions, it is determined at the time of the institution’s failure that it is in default or in danger of default and the failure poses a risk to the stability of the U.S. financial system. If the FDIC is appointed as receiver under the OLA, then the powers of the receiver, and the rights and obligations of creditors and other parties who have dealt with the institution, would be determined under the Dodd-Frank Act provisions, and not under the insolvency law that would otherwise apply. The powers of the receiver under the OLA were based on the powers of the FDIC as receiver for depository institutions under the FDIA. However, the provisions governing the rights of creditors under the OLA were modified in certain respects to reduce disparities with the treatment of creditors’ claims under the U.S. Bankruptcy Code as compared with the treatment of those claims under the new authority. Nonetheless, substantial differences in the rights of creditors exist as between these two regimes, including the right of the FDIC to disregard the strict priority of creditor claims in some circumstances, the use of an administrative claims procedure to determine creditors’ claims (as opposed to the judicial procedure utilized in bankruptcy proceedings), and the right of the FDIC to transfer claims to a "bridge" entity.
An OLF will fund such liquidation proceedings through borrowings from the Treasury Department and risk-based assessments made, first, on entities that received more in the resolution than they would have received in liquidation to the extent of such excess, and second, if necessary, on BHCs with total consolidated assets of $50 billion or more, such as M&T. If an orderly liquidation is triggered, M&T could face assessments for the OLF.
The FDIC has developed a strategy under the OLA referred to as the "single point of entry" strategy, under which the FDIC would resolve a failed FHC by transferring its assets (including shares of its operating subsidiaries) and, potentially, very limited liabilities to a "bridge" holding
14
company; utilize the resources of the failed FHC to recapitalize the operating subsidiaries; and satisfy the claims of unsecured creditors of the failed FHC and other claimants in the receivership by delivering securities of one or more new financial companies that would emerge from the bridge holding company. Under this strategy, management of the failed FHC would be replaced and shareholders and creditors of the failed FHC would bear the losses resulting from the failure.
Depositor Preference
Under federal law, depositors and certain claims for administrative expenses and employee compensation against an IDI would be afforded a priority over other general unsecured claims against such an institution in the "liquidation or other resolution" of such an institution by any receiver. If an IDI fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including depositors whose deposits are payable only outside of the U.S. and the parent BHC, with respect to any extensions of credit they have made to such IDI.
Financial Privacy and Cybersecurity
The federal banking regulators have adopted rules that limit the ability of banks and other financial institutions to disclose non-public and personally identifiable information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services. Federal law makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means.
The federal banking agencies require banking organizations to notify their primary regulator as soon as possible and within 36 hours of determining that a "notification incident" has occurred. A notification incident is a "computer-security incident" that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The final rule also requires specific and immediate notifications by bank service providers that become aware of similar incidents.
Financial institutions regulated by the NYSDFS, including M&T Bank, are also subject to NYSDFS regulations on cybersecurity matters, including, among other things, requirements to (i) establish and maintain a cybersecurity program designed to ensure the confidentiality, integrity and availability of their information systems; (ii) implement and maintain a written cybersecurity policy setting forth policies and procedures for the protection of their information systems and nonpublic information; and (iii) designate a CISO.
In November 2023, the NYSDFS adopted amendments to its cybersecurity regulations that represent a significant update to the regulation of cybersecurity practices. The amendments generally fall within the following five categories: (i) increased mandatory controls associated with common attack vectors; (ii) enhanced requirements for privileged accounts; (iii) enhanced notification obligations; (iv) expansion of cyber governance practices; and (v) additional cybersecurity
15
requirements for larger companies. Most of the amendments became effective in 2024, and all of the amendments were effective by the end of 2025.
In July 2023, the SEC adopted new rules that require registrants, such as M&T, to (i) report material cybersecurity incidents on Form 8-K and (ii) disclose in its Annual Report on Form 10-K cybersecurity policies and procedures and governance practices, including at the board and management levels. This disclosure is included herein in Part I, Item 1C, "Cybersecurity."
Many states and regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations, including implementing or modifying their data breach notification and data privacy requirements. One example of such state legislation is the California Consumer Privacy Act, which became effective in January 2020 and applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. Amendments expanding the scope of and requirements under the California Consumer Privacy Act generally became effective in January 2023 and additional updates to the corresponding regulations were effective on January 1, 2026.
Consumer Protection Laws and the CFPB Supervision
In connection with their respective lending and leasing activities, M&T Bank, Wilmington Trust, N.A. and certain of their subsidiaries, are each subject to a number of federal and state laws designed to protect consumers and promote lending to various sectors of the economy. Such laws include but are not limited to: the Electronic Signatures in Global and National Commerce Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transactions Act, the Gramm-Leach Bliley Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Electronic Fund Transfer Act, the Real Estate Settlement Procedures Act, the Military Lending Act, the Servicemembers Civil Relief Act, and various state law counterparts. Furthermore, the CFPB has issued integrated disclosure requirements under the Truth in Lending Act and the Real Estate Settlement Procedures Act that relate to the provision of disclosures to consumers. There are also consumer protection laws governing deposit taking/account activities (e.g. the Expedited Funds Availability Act, the Truth in Savings Act and the Electronic Fund Transfer Act), as well as securities and insurance laws governing certain aspects of the Company’s consolidated operations.
The CFPB has broad powers to supervise and enforce most federal financial consumer protection laws. The CFPB has broad rule-making authority for a wide range of consumer protection laws that apply to all banks and savings institutions, including the authority to prohibit "unfair, deceptive or abusive" acts and practices which violate the Consumer Financial Protection Act. The CFPB has examination and enforcement authority over all banks and savings institutions with more than $10 billion in assets, including M&T Bank.
In October 2024, the CFPB finalized a new rule that requires a provider of payment accounts or products, such as a bank, to make data available to consumers upon request regarding the products or services they obtain from the provider. Any such data provider also has to make such data available to third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by the consumer. Data required to be made available under the rule includes transaction information, account balance, account and routing numbers, terms and conditions, upcoming bill information, and certain account verification data. The rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products or services. The proposed rule is the subject of litigation, which is currently stayed while the CFPB considers revisions to the proposal.
During 2025, the CFPB significantly reduced its staff. The reduction in force is the subject of litigation, and the staffing cuts are currently stayed pending the federal circuit court's rehearing of the
16
case. The impact of these developments on banking organizations subject to CFPB regulation and supervision, including the Company, is uncertain.
In October 2023, the Federal Reserve proposed amendments to its rules on interchange fees. Interchange fees, or "swipe" fees, are charges that merchants pay to card-issuing banks, such as M&T Bank, for processing electronic payment transactions. If adopted as proposed, the proposed rule would lower the maximum permissible interchange fee that issuers may collect.
Federal law permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits state attorneys general to enforce compliance with both the state and federal laws and regulations. For example, in December 2023, a New York State law requiring credit card issuers such as M&T Bank to notify consumers before making changes to or terminating rewards programs associated with the credit card became effective. In January 2025, the NYSDFS proposed rules that would limit a New York State-chartered bank’s ability to charge overdraft and insufficient funds fees and returned deposited items fees in certain circumstances and impose on such banks notice and disclosure requirements in connection with those fees. States and state attorneys general may increase regulatory, investigative and enforcement activity with respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by federal regulators.
CRA
The CRA is intended to encourage depository institutions to help meet the credit needs of the communities in which they operate, including low- and moderate-income neighborhoods, consistent with safe and sound operations. CRA examinations are conducted by the federal agencies that are responsible for supervising the relevant depository institutions: the Federal Reserve, the FDIC and the OCC. For purposes of the CRA, M&T is regulated by the Federal Reserve. A financial institution’s performance in helping to meet the credit needs of its community is evaluated in the context of information about the institution (capacity, constraints and business strategies), its community (including population, income, housing, and other economic data, as well as lending, investment, and service opportunities), and its competitors and peers. Upon completion of a CRA examination, an overall CRA Rating is assigned using a four-tiered rating system. These ratings are: "Outstanding," "Satisfactory," "Needs to Improve" and "Substantial Noncompliance." The CRA evaluation is used in evaluating applications for future approval of bank activities including mergers, acquisitions, charters, branch openings and deposit facilities. An unsatisfactory CRA evaluation could result in the delay or denial of acquisition or merger applications, among other activities. M&T Bank's most recent CRA rating was "Outstanding" from the Federal Reserve. M&T Bank is also subject to New York State CRA examination and its most recent rating was "Outstanding" from the NYSDFS. Wilmington Trust, N.A. has been designated a special purpose trust company, and is therefore exempt from the requirements of the CRA.
In October 2023, the Federal Reserve, the FDIC and the OCC jointly issued a final rule to modernize CRA regulations and respond to change in the banking industry. In July 2025, those agencies issued a joint proposal to rescind the final rule.
BSA Regulation and AML Obligations
Federal laws and regulations impose obligations on U.S. financial institutions, including banks and broker-dealer subsidiaries, to implement and maintain appropriate policies, procedures and controls which are reasonably designed to prevent, detect and report instances of money laundering and the financing of terrorism and to verify the identity of their customers. These provisions also require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s AML activities when reviewing bank mergers and BHC acquisitions. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and
17
terrorist financing could have serious legal and reputational consequences for the institution, including the denial by federal regulators of proposed merger, acquisition, restructuring or other expansionary activity.
The FinCEN, which drafts regulations implementing the U.S. Patriot Act and other AML and BSA legislation, has adopted rules that require financial institutions to, among other things, obtain beneficial ownership information with respect to legal entities with which such institutions conduct business, subject to certain exclusions and exemptions. Bank regulators conduct focused examinations on AML compliance, and M&T continues to monitor and augment, where necessary, its BSA/AML Compliance Program. The AML Act of 2020, which amends the BSA, was enacted in January 2021.
In August 2024, FinCEN adopted a rule extending AML obligations, including maintenance of an AML program and filing certain reports with FinCEN, to registered investment advisers, like certain of M&T’s subsidiaries. In December 2025, FinCEN delayed the effective date of the rule to January 1, 2028 to allow FinCEN to review the rule and ensure it is effectively tailored to the diverse business models and risk profiles of investment advisors and provide such investment advisors more time to come into compliance with the rule upon the revised effective date.
OFAC Regulation
The U.S. has imposed economic sanctions that prohibit transactions with designated foreign countries, nationals and others. The OFAC-administered sanctions targeting those countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on "U.S. persons" engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g. property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences, including denial by federal regulators of proposed merger, acquisition, restructuring, or other expansionary activity.
Federal Reserve Policies
The earnings of the Company are significantly affected by the monetary and fiscal policies of governmental authorities, including the Federal Reserve. Among the instruments of monetary policy used by the Federal Reserve are open-market operations in U.S. government securities and federal funds, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These instruments of monetary policy are used in varying combinations to influence the overall level of bank loans, investments and deposits, and the interest rates charged on loans and paid for deposits. The Federal Reserve frequently uses these instruments of monetary policy, especially its open-market operations and the discount rate, to influence the level of interest rates and to affect the strength of the economy, the level of inflation or the price of the dollar in foreign exchange markets. The monetary policies of the Federal Reserve have had a significant effect on the operating results of banking institutions in the past and are expected to continue to do so in the future. It is not possible to predict the nature of future changes in monetary and fiscal policies or the effect which they may have on the Company’s business and earnings.
18
Climate-Related and Other Sustainability Developments
In recent years, certain lawmakers and regulators in and outside of the U.S. have increased their focus on financial institutions’ and other companies’ risk oversight, disclosures and practices in connection with climate change and other sustainability matters. Several states in which the Company operates have enacted or proposed statutes, regulations or guidance addressing climate change and other sustainability issues. For example, in December 2023, the NYSDFS published guidance on climate-related financial risk management applicable to NYSDFS-regulated banking and mortgage organizations, including M&T Bank. The guidance addresses material financial risks related to climate change faced by these organizations in the context of risk assessment, risk management, and risk appetite setting. In October 2023, California enacted laws requiring certain companies doing business in California to make certain climate-related disclosures, including but not limited to greenhouse gas emissions data and climate-related risks.
Fair Access to Financial Services
In recent years, certain states have enacted, or have proposed to enact, statutes, regulations or policies that prohibit financial institutions from denying or canceling products or services to a person or business, or otherwise discriminating against a person or business in making available products or services, on the basis of certain social or political factors or other activities. In August 2025 Executive Order 14331, “Guaranteeing Fair Banking Access for All Americans,” was signed, which states that it is the policy of the U.S. that no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations or political views. The Executive Order directs the U.S. Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities.
Corporate Governance
In accordance with SEC rules, M&T will post on its website or file a Form 8-K to report any amendment to or waiver from any provision of the Code of Ethics for Chief Executive Officer and Senior Financial Officers or the Code of Business Conduct and Ethics that applies to its Chief Executive Officer, Chief Financial Officer, Controller, or persons performing similar functions. Copies of such governance documents are also available, free of charge, to any person who requests them. Such requests may be directed to M&T Bank Corporation, Shareholder Relations Department, One M&T Plaza, Buffalo, NY 14203 (Telephone: (716) 842-5138).
Further information regarding the Company's corporate governance, including the Board of Directors, its committee structure and membership and the Company’s governance policies and principles, is provided in the 2026 Proxy Statement, which will be filed with the SEC pursuant to Regulation 14A not later than 120 days after the end of 2025. The Company also makes available on its website at the Investor Relations link under the heading “Corporate Governance:” (i) its Corporate Governance Standards; (ii) its code of ethics, including the M&T Code of Business Conduct and Ethics and the M&T Code of Ethics for Chief Executive Officer and Senior Financial Officers; and (iii) the charters of the standing committees of the Board of Directors. If the Company makes changes in, or provides waivers from, the provisions of its code of ethics that the SEC requires it to disclose, the Company intends to disclose these events in the “Corporate Governance” section of its Investor Relations website.
19
Human Capital Resources
M&T recognizes that its employees are the difference makers that drive its success. The Company’s strategy to create and maintain a highly competitive workforce focuses on recruiting, engaging, developing and retaining high-performing individuals whose strengths align with M&T’s values, purpose and leadership competencies. As of December 31, 2025, the Company employed 21,839 full-time and 439 part-time employees. That employee base was concentrated in the Northeast and Mid-Atlantic U.S., with approximately 47% of employees residing in New York, followed by approximately 10% in Maryland, 9% in Connecticut, 7% in each of Pennsylvania and Delaware and 12% in other states where M&T Bank operates domestic banking offices. Approximately 8% of the Company’s employee base resides outside of its retail banking footprint, inclusive of 148 international employees predominantly based in the United Kingdom, Ireland, Canada and Germany. The Company’s employee base includes 5,473 employees that support customers in the retail banking office network. Overall, the average tenure of the Company’s employees is 9.5 years and the average tenure of the Company’s executive officers is 16.3 years.
Talent Attraction, Engagement and Development
The Company leverages various channels to effectively identify, develop and recruit high-caliber talent throughout its footprint including its existing employee base. Employees regularly attend recruiting events with organizations and audiences across various backgrounds. The Company also recruits at a broad range of higher education institutions throughout its footprint and engages with various industry groups and organizations to promote job opportunities. In addition, the Company leverages candidate experience surveys to help improve the applicant experience.
M&T’s commitment to recruiting top talent and regularly soliciting their feedback helps to create a highly engaged employee base that drives success. The Company conducts "Annual Engagement Surveys," with average participation rates around 90%, demonstrating a commitment to fostering candid, open and honest two-way communication with employees to enhance the workplace. M&T leverages a continuous employee listening strategy, checking-in with employees on key engagement items throughout the year to develop a more wholistic understanding of their experience, act faster on items impacting engagement and drive better prioritization and decision making. M&T also conducts other surveys at critical moments throughout an employee's journey including new hire onboarding, separation from the Company and in connection with certain key events, such as acquisitions. Survey results are reviewed with senior management and shared with individual managers, who identify and implement improvements based on employees’ feedback, and are presented to M&T's Board of Directors. Employees also participate in action planning within individual work groups.
The Company also encourages engagement with communities through the allotment of 40 hours of paid volunteer time each year. M&T employees volunteer thousands of hours and serve on the boards of hundreds of not-for-profit organizations within the communities the Company serves.
Another key pillar of engagement, employee development and growth, is fostered through the Company's strong performance management philosophy focused on reinforcing corporate values, providing continuous, transparent feedback and recognizing and rewarding outstanding performance. Additional employee development is cultivated through a variety of learning offerings on topics such as technical skills, job-specific knowledge and professional development, including courses aligned with the Company's enterprise-wide leadership competencies. The Company also invests in cultivating its leaders of tomorrow through various internal programs including its Manager Acceleration Program, Management Development Program, Executive Associate Program, Technology Development Program, Rising Leadership Development Program and Ascend Sponsorship Program.
20
Compensation, Health and Wellness
The Company provides comprehensive compensation and benefits programs intended to attract, retain and incentivize its employees. In addition to base pay, these programs (which vary by country and region) include cash incentives, long term equity-based awards, an employee stock purchase plan, a 401(k) plan, health insurance benefits, health savings and flexible spending accounts, paid time off, parental leave, family care resources, flexible work schedules, employee assistance programs and tuition assistance, among others. The Company’s wellness programs provide employees and their families with resources that may be helpful in navigating life events and are designed to help employees improve their well-being. In addition to addressing employees’ physical needs through flexible and convenient telemedicine options, M&T supports emotional health and social well-being through various mental and behavioral health programs offered to employees. The Company also supports employees' financial wellness through free educational resources.
Competition
The Company faces extensive and intensive competition in the products and services it offers. The Company competes in offering commercial and personal financial and wealth services with other banking institutions and thrifts and with firms in a number of other industries, such as credit unions, personal loan companies, sales finance companies, leasing companies, securities brokerage firms, mutual fund companies, hedge funds, private credit funds, wealth and investment advisory firms, insurance companies and other financial services-related entities. Furthermore, diversified financial services companies are able to offer a combination of these services to their customers on a nationwide basis. Financial technology companies, using digital, mobile and other technologies, including stablecoins, also are increasingly offering traditional banking products and services (or products and services that could be viewed as substitutes for traditional banking products and services), which has resulted in the Company contending with a broader range of competitors, including many that are not located within the geographic footprint of the Company’s banking office network.
Other Information
Through a link on the Investor Relations section of M&T’s website at www.mtb.com, copies of M&T’s Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, are made available, free of charge, as soon as reasonably practicable after electronically filing such material with, or furnishing it to, the SEC. Copies of such reports and other information are also available at no charge to any person who requests them or at www.sec.gov. Such requests may be directed to M&T Bank Corporation, Shareholder Relations Department, One M&T Plaza, Buffalo, NY 14203 (Telephone: (716) 842-5138).
21
Item 1A. Risk Factors.
Risk Factors Summary
Market Risk
•Weakness in the economy, or fluctuations in market factors, has adversely affected the Company in the past and may adversely affect the Company in the future.
•The Company’s business and financial performance is impacted significantly by market interest rates and movements in those rates. The monetary and other related policies of governmental agencies, including the Federal Reserve, have a significant impact on interest rates and overall financial market performance over which the Company has no control and which the Company may not be able to anticipate adequately.
•The Company is routinely subject to examinations from various governmental taxing authorities that may result in challenges to the Company’s tax return treatment.
•The Company’s business and performance is vulnerable to the impact of volatility in debt and equity markets.
•The Company’s regional concentrations expose it to adverse economic conditions in its primary retail banking office footprint.
•The discontinuation of benchmark rates as permissible rate indices in new contracts and the development of alternative benchmark indices to replace discontinued benchmarks could adversely impact the Company’s business and results of operations.
Risks Relating to Compliance and the Regulatory Environment
•The Company is subject to extensive government regulation and supervision and this regulatory environment can be and has been significantly impacted by financial regulatory reform initiatives.
•The Company may be subject to more stringent capital and liquidity requirements.
•M&T’s ability to return capital to shareholders and to pay dividends on common stock may be adversely affected by market and other factors outside of its control and will depend, in part, on the results of supervisory stress tests administered by the Federal Reserve.
•If an orderly liquidation of a systemically important BHC or non-bank financial company were triggered, M&T could face assessments for the OLF.
Credit Risk
•Deteriorating credit quality could adversely impact the Company.
•The Company may be adversely affected by the soundness of other financial institutions.
Liquidity Risk
•The Company must maintain adequate sources of funding and liquidity.
•If the Company is unable to maintain or grow its deposits, it may be subject to paying higher funding costs.
•M&T relies on dividends from its subsidiaries for its liquidity.
Strategic Risk
•The financial services industry is highly competitive and creates competitive pressures that could adversely affect the Company’s revenue and profitability.
•Difficulties in obtaining regulatory approval for acquisitions and in combining the operations of acquired entities with the Company’s own operations may prevent M&T from achieving expected benefits from acquisitions.
•The Company could suffer if it fails to attract and retain skilled personnel.
22
Operational Risk
•The Company is subject to operational risk which could adversely affect the Company’s business and reputation and create material legal and financial exposure.
•The Company’s information systems may experience interruptions or breaches in security, such as cyber attacks, including due to events beyond the Company’s control.
•The Company could incur higher costs, experience lower revenue, and suffer reputational damage in the event of the theft, loss or misuse of information, including due to a cyber attack.
•The Company is subject to laws and regulations relating to the privacy of the information of customers, clients, employees or others, and any failure to comply with these laws and regulations could expose the Company to liability and/or reputational damage.
•M&T relies on other companies to provide key components of the Company’s business infrastructure.
•The development and use of AI, including by third parties, presents risks and challenges that may adversely impact M&T.
•The Company is or may become involved from time to time in suits, legal proceedings, information-gathering requests, investigations and proceedings by governmental and self-regulatory agencies that may lead to adverse consequences.
Business Risk
•Changes in accounting standards could impact the Company’s reported financial condition and results of operations.
•The Company’s reported financial condition and results of operations depend on management’s selection of accounting methods and require management to make estimates about matters that are uncertain.
•The Company’s models used for business planning purposes could perform poorly or provide inadequate information.
•The Company's reputation may be harmed, which could negatively impact investor and customer confidence.
•The Company’s framework for managing risks may not be effective.
•Pandemics, acts of war or terrorism and other adverse external events could significantly impact the Company’s business.
•The Company’s assets, communities, operations, reputation and customers could be adversely affected by the impacts of climate-related risk.
Risk Factors
M&T and its subsidiaries face a number of potential risks and uncertainties that are difficult to predict. As a financial institution, certain risk elements are inherent in the ordinary course of the Company’s business activities and adverse experience with those risks could have a material impact on the Company’s business, financial condition, liquidity and results of operations, as well as on the values of the Company’s financial instruments and M&T’s debt and equity securities, including its common stock. The following risk factors set forth some of the risks that could materially and adversely impact the Company, although there may be additional risks that are not presently material or known that may adversely affect the Company.
23
Market Risk
Weakness in the economy, or fluctuations in market factors, has adversely affected the Company in the past and may adversely affect the Company in the future.
Poor business and economic conditions in general or specifically in markets served by the Company could have adverse effects on the Company’s business including:
•A decrease in the demand for loans and other products and services offered by the Company.
•A decrease in net interest income derived from the Company’s lending and deposit gathering activities.
•A decrease in the value of the Company’s investment securities, loans held for sale or other assets secured by residential or commercial real estate.
•A decrease in fees from the Company’s brokerage, trust, and investment management businesses associated with declines or lack of growth in stock market prices.
•Potential higher FDIC assessments due to the DIF falling below minimum required levels or special FDIC assessments relating to the failure of specific banks.
•An impairment of certain intangible assets, such as goodwill.
•An increase in the number of customers and counterparties who become delinquent, file for protection under bankruptcy laws or default on their loans or other obligations to the Company. An increase in the number of delinquencies, bankruptcies or defaults could result in higher levels of nonperforming assets, net charge-offs, provision for credit losses as well as impairment write-downs of certain investment securities and valuation adjustments on loans held for sale.
•A decrease in the value of the collateral securing the Company's loans.
If recessionary economic conditions develop, they would likely have a negative financial impact across the financial services industry, including on the Company. If recessionary economic conditions are more severe, the extent of the negative impact on the Company’s business and financial performance can increase and be more severe, including the adverse effects listed above and discussed throughout this "Risk Factors" section.
In recent years, there have been significant changes in rates of inflation and interest rates. Volatility and uncertainty related to inflation and the effects of inflation, including potential volatility in interest rates, could lead to increased costs for businesses and consumers and potentially contribute to poor business and economic conditions generally, which could also enhance or contribute to some of the risks discussed herein. For example, higher inflation, or volatility and uncertainty related to inflation, could reduce demand for the Company’s products, adversely affect the creditworthiness of the Company’s borrowers, result in lower values for the Company’s investment securities and other interest-earning assets and increase expense related to talent acquisition and retention.
Additionally, economic conditions, financial markets and inflationary pressures may be adversely affected by the impact of current or anticipated geopolitical uncertainties; military conflicts; political uncertainty in the U.S.; potential changes to federal taxation rates; the impact of international trade policies, including tariffs; pandemics; and global, national and local responses thereto by governmental authorities and other third parties. These unpredictable events could create, increase or prolong economic and financial disruptions and volatility that adversely affects the Company’s business, financial condition, capital and results of operations.
Concern regarding the ability of Congress to reach agreement on federal budgetary matters (including the debt ceiling), or total or partial governmental shutdowns, also can adversely affect the economy and increase the risk of economic instability or market volatility, which could have adverse consequences on the Company's business, financial condition, liquidity and results of operations.
24
The Company’s business and financial performance is impacted significantly by market interest rates and movements in those rates. The monetary and other related policies of governmental agencies, including the Federal Reserve, have a significant impact on interest rates and overall financial market performance over which the Company has no control and which the Company may not be able to anticipate adequately.
The Federal Reserve, through the FOMC, may raise or lower interest rates in response to economic conditions, particularly inflationary pressures and unemployment statistics. The FOMC increased the federal funds target interest rate through several hikes during 2022 and 2023 and held that interest rate at the elevated level until it began decreasing the federal funds target interest rate in September through December 2024. The FOMC then maintained the target interest rate in 2025, before decreasing it in each of September, October and December 2025. As a result of the high percentage of the Company’s assets and liabilities that are in the form of interest-bearing or interest-related instruments, changes in interest rates, including in the shape of the yield curve or in spreads between different market interest rates, as well as changes linked to inflation, can have a material effect on the Company’s business and profitability and the value of the Company’s assets and liabilities. For example, changes in interest rates or interest rate spreads may:
•Affect the difference between the interest that the Company earns on assets and the interest that the Company pays on liabilities, which impacts the Company’s overall net interest income and profitability.
•Adversely affect the ability of borrowers to meet obligations under variable or adjustable-rate loans and other debt instruments (including due to an inability to refinance loans), which, in turn, affects the Company’s loss rates on those assets.
•Decrease the demand for interest rate-based products and services, including loans and deposits.
•Affect the Company’s ability to hedge various forms of market and interest rate risk and may decrease the profitability or protection or increase the risk or cost associated with such hedges.
•Affect mortgage prepayment speeds and result in the impairment of capitalized mortgage loan servicing assets, reduce the value of loans held for sale and increase the volatility of mortgage banking revenues, potentially adversely affecting the Company’s results of operations.
The monetary and other related policies of the government and its agencies, including the Federal Reserve, have a significant impact on interest rates and overall financial market performance. These governmental policies can thus affect the activities and results of operations of banking organizations such as the Company. An important function of the Federal Reserve is to regulate the national supply of bank credit and certain interest rates. The actions of the Federal Reserve influence the rates of interest that the Company charges on loans and that the Company pays on borrowings and interest-bearing deposits and can also affect the value of the Company’s on-balance sheet and off-balance sheet financial instruments.
The Company is routinely subject to examinations from various governmental taxing authorities that may result in challenges to the Company’s tax return treatment.
The Company is routinely subject to examinations from various governmental taxing authorities. Such examinations may result in challenges to the tax return treatment applied by the Company to specific transactions. Management believes that the assumptions and judgment used to record tax-related assets or liabilities have been appropriate. Should tax laws change or the tax authorities' interpretations of tax laws and regulations differ from management’s assumptions or interpretations,
25
the result and adjustments required could have a material effect on the Company’s results of operations. M&T cannot predict the nature or timing of future changes in monetary, tax and other policies or the effect that they may have on the Company’s business activities, financial condition and results of operations.
The Company’s business and performance is vulnerable to the impact of volatility in debt and equity markets.
As most of the Company’s assets and liabilities are financial in nature, the Company’s performance is sensitive to the performance of the financial markets. Turmoil and volatility in U.S. and global financial markets can be a major contributory factor to overall weak economic conditions, leading to some of the risks discussed herein, including the impaired ability of borrowers and other counterparties to meet obligations to the Company. Financial market volatility may:
•Affect the value or liquidity of the Company’s on-balance sheet and off-balance sheet financial instruments.
•Affect the value of capitalized servicing assets.
•Affect M&T’s ability to access capital markets to raise funds. Inability to access capital markets if needed, at cost effective rates, could adversely affect the Company’s liquidity and results of operations.
•Affect the value of the assets that the Company manages or otherwise administers or services for others. Although the Company is not directly impacted by changes in the value of such assets, decreases in the value of those assets would affect related fee income and could result in decreased demand for the Company’s services.
•Impact the nature, profitability or risk profile of the financial transactions in which the Company engages.
Volatility in the markets for real estate and other assets commonly securing financial products has been and may continue to be a significant contributor to overall volatility in financial markets. In addition, unfavorable or uncertain economic and market conditions can be caused by supply chain disruptions, the imposition of tariffs or other limitations on international trade, travel and immigration, as well as elevated inflation, which can result in market volatility, negatively impact client activity, and adversely affect the Company’s financial condition and results of operations.
The Company’s regional concentrations expose it to adverse economic conditions in its primary retail banking office footprint.
The Company’s core banking business is largely concentrated within the Company’s retail banking office network footprint, located principally in the Northeast and Mid-Atlantic regions. Therefore, the Company is, or in the future may be, particularly vulnerable to adverse changes in economic conditions in the Northeast and Mid-Atlantic regions, as well as events particularly affecting those regions. The credit quality of the Company’s borrowers may deteriorate for reasons that are outside the Company’s control, including prevailing economic and market conditions and asset valuations. The trends and risks affecting borrower credit quality, particularly in the Northeast and Mid-Atlantic regions, have caused, and in the future may cause, the Company to experience impairment charges, which are reductions in the recoverable value of an asset, and higher costs (e.g. servicing, foreclosure, property maintenance), each of which could have a material adverse effect on the Company’s business, financial condition and results of operations.
26
The discontinuation of benchmark rates as permissible rate indices in new contracts and the development of alternative benchmark indices to replace discontinued benchmarks could adversely impact the Company’s business and results of operations.
The Company’s floating-rate funding, certain hedging transactions and a significant portion of the Company’s products, such as floating-rate loans and mortgages, determine the applicable interest rate or payment amount by reference to a benchmark rate or to an alternative index.
In the past, the regulators and administrators of certain benchmark rates have determined to cease publication of those rates, and they may do so again in the future with respect to other benchmark rates the Company utilizes. Any cessation of a benchmark rate and resulting transition to a successor benchmark would be complex and unpredictable, giving rise to a variety of risks, including operational risks, risks of value transfer between contract parties, the potential for customer disputes and litigation, as well as regulatory scrutiny.
Risks Relating to Compliance and the Regulatory Environment
The Company is subject to extensive government regulation and supervision and this regulatory environment can be and has been significantly impacted by financial regulatory reform initiatives.
The Company is subject to extensive federal and state regulation and supervision. Banking regulations are primarily intended to protect consumers, depositors and the financial system as a whole, not securities holders, including the holders of common stock. These regulations and supervisory guidance affect the Company’s sale and lending practices, capital structure, capital distributions and dividend policy, investment practices, growth and expansionary activity, among other things. Failure to comply with laws, regulations or policies, or to meet supervisory expectations, could result in civil or criminal penalties, including monetary penalties, the loss of FDIC insurance, the revocation of a banking charter, other sanctions by regulatory agencies, such as restrictions on growth, and/or reputational damage, which could have a material adverse effect on the Company’s business, financial condition and results of operations. Following the failures of certain banks in 2023, banking regulators proposed changes, or indicated the potential for changes, regarding the regulation and supervision of banking organizations, in particular those, such as M&T, with $100 billion or more in assets. States and state regulatory authorities may also revise their regulatory and supervisory frameworks, or increase investigative and enforcement activity, in response to changes in regulation, supervision and enforcement by federal regulators. The introduction of new or more stringent regulatory requirements, as well as further heightening of supervisory expectations, could require the Company to maintain additional capital or liquidity or incur significant expenses.
Government authorities, including the bank regulatory agencies, can pursue aggressive enforcement actions with respect to compliance and other legal matters involving financial activities, which heightens the risks associated with actual and perceived compliance failures and may also adversely affect the Company’s ability to enter into certain transactions or engage in certain activities, or obtain necessary regulatory approvals in connection therewith. In general, the amounts paid by financial institutions in settlement of proceedings or investigations have increased substantially and are likely to remain elevated. In some cases, governmental authorities have required criminal pleas or admissions of wrongdoing as part of such settlements, which could have significant collateral consequences for a financial institution, including loss of customers, restrictions on the ability to access the capital markets, and the inability to operate certain businesses or offer certain products for a period of time. In addition, enforcement matters could impact the Company’s supervisory and CRA ratings, which may in turn restrict or limit the Company’s activities. A prior enforcement action also increases the risk that regulators and governmental authorities pursue formal
27
enforcement actions in connection with the resolution of an inquiry or investigation, even if unrelated to the prior enforcement action.
Any new regulatory requirements, changes to existing requirements, or changes to interpretations of requirements could require changes to the Company’s businesses, result in increased compliance costs and affect the profitability of such businesses. Additionally, such activity could affect the behaviors of third parties with which the Company deals in the ordinary course of business, such as rating agencies, insurance companies and investors. Litigation challenging actions or regulations by Federal or state authorities could, depending on the outcome, significantly affect the regulatory and supervisory framework affecting the Company’s operations. For example, there is litigation pending to challenge the Federal Reserve’s regulation on permissible interchange fees on the grounds that the regulations allow higher interchange fees than permitted by statute, which, if successful, could significantly and adversely affect the fees banks can charge on debit card transactions. In August 2025, a district court ruled against the Federal Reserve and vacated the regulation, but its order is stayed pending appeal to the circuit court. Heightened regulatory scrutiny, requirements or expectations could have significant effects on the Company, including through restrictions on growth or required remediation activities and associated resource requirements, and, in turn, could have a material adverse effect on the Company’s business, financial condition and results of operations.
For more information on the regulations to which the Company is subject and recent initiatives to reform financial institution regulation, see Part I, Item 1, "Business."
The Company may be subject to more stringent capital and liquidity requirements.
BHCs, including M&T, are subject to capital and liquidity requirements and standards imposed as a result of the Dodd-Frank Act (as amended by EGRRCPA) and the U.S. Basel III-based capital rules. For additional information, see "Capital Requirements" under Part I, Item 1, "Business."
Regulators have implemented and may, from time to time, implement changes to these regulatory capital adequacy and liquidity requirements. If the Company fails to meet these minimum capital adequacy and liquidity requirements and other regulatory requirements, its business activities, including lending, and its ability to expand, either organically or through acquisitions, could be limited. It could also result in M&T being required to take steps to increase its regulatory capital that may be dilutive to shareholders or limit its ability to pay dividends or otherwise return capital to shareholders, or sell or refrain from acquiring assets. In addition, the liquidity-related provisions of the Federal Reserve’s liquidity-related enhanced prudential supervision requirements may reduce the Company’s ability to invest in other longer-term assets even if deemed more desirable from a balance sheet management perspective, which could adversely affect its net interest income and net interest margin. A determination by the Federal Reserve that M&T does not meet supervisory expectations regarding capital planning or liquidity risk management could have a variety of adverse consequences, including ratings downgrades, heightened supervisory scrutiny, expenses associated with remediation activities and potentially an enforcement action.
See "Capital Requirements" and "Resolution Planning and Resolution-Related Requirements" under Part I, Item 1, "Business" for information regarding the federal banking regulators’ July 2023 proposal implementing revisions to the Basel capital framework and August 2023 long-term debt proposal. The long-term debt proposal, if adopted, would require the Company to maintain more long-term debt than it does currently, which would likely adversely affect interest expense, net interest income and net interest margin.
28
M&T’s ability to return capital to shareholders and to pay dividends on common stock may be adversely affected by market and other factors outside of its control and will depend, in part, on the results of supervisory stress tests administered by the Federal Reserve.
Any decision by M&T to return capital to shareholders, whether through a common stock dividend or a common stock share repurchase program, requires the approval of M&T’s Board of Directors and must comply with applicable capital regulations, including the maintenance of capital ratios exceeding specified minimum levels and applicable buffers.
Under the Tailoring Rules, for BHCs designated as Category IV institutions, including M&T, the Federal Reserve conducts biennial supervisory stress tests required under the Dodd-Frank Act whereby the BHC’s financial position is tested under assumed severely adverse economic conditions. The results of those stress tests are incorporated in the determination of M&T’s SCB. As a general matter, if M&T is unable to maintain capital in excess of regulatory minimum levels inclusive of its SCB, it would be subject to limitations on its ability to make capital distributions, including paying dividends and repurchasing stock. At December 31, 2025 M&T's SCB was 2.7%. The results of future supervisory stress tests and the impact of proposed revisions to capital requirements upon the stress testing framework are uncertain, and a more severe outcome may result in a higher SCB and an increase in M&T’s effective capital requirements. An increased SCB may restrict M&T’s ability to return capital to shareholders, including through paying dividends, entering into acquisitions or repurchasing its common stock, which in turn could negatively impact market and investor perceptions of M&T.
The Federal Reserve has in the past implemented, and may in the future implement, restrictions on share repurchase programs and common stock dividends at large BHCs such as M&T, including in response to adverse or uncertain economic conditions.
If an orderly liquidation of a systemically important BHC or non-bank financial company were triggered, M&T could face assessments for the OLF.
The Dodd-Frank Act created a mechanism, the OLF, for liquidation of systemically important BHCs and non-bank financial companies. The OLF is administered by the FDIC and is based on the FDIC’s bank resolution model. The Secretary of the U.S. Treasury may trigger a liquidation under this authority after consultation with the President of the U.S. and after receiving a recommendation from the boards of the FDIC and the Federal Reserve upon a two-thirds vote. Liquidation proceedings will be funded by the OLF, which will borrow from the U.S. Treasury and impose risk-based assessments on covered financial companies. Risk-based assessments would be first made on entities that received more in the resolution than they would have received in the liquidation to the extent of such excess, and second, if necessary, on, among others, BHCs with total consolidated assets of $50 billion or more, such as M&T. Any such assessments may adversely affect the Company’s business, financial condition or results of operations.
Credit Risk
Deteriorating credit quality could adversely impact the Company.
As a lender, the Company is exposed to the risk that customers will be unable to repay their loans and other obligations in accordance with the terms of the relevant agreements, and that any collateral securing the loans and obligations may be insufficient to assure full repayment. Credit losses are inherent in the business of making loans and entering into other financial arrangements.
Factors that influence the Company’s credit loss experience include: (i) overall economic conditions affecting businesses and consumers, generally; (ii) the impact of commercial and residential real estate values on loans to real estate builders and developers and other loans secured by such real estate; (iii) the concentration of commercial real estate loans in the Company’s loan
29
portfolio, including construction loans, loans secured by office, retail, health services, hospitality and multifamily properties and loans secured by property in the New York City and certain other large metropolitan areas; (iv) the concentration of commercial and industrial loans to businesses in the Northeastern and Mid-Atlantic regions of the U.S.; (v) the repayment performance associated with first and second lien loans secured by residential real estate; and (vi) the size of the Company’s portfolio of loans to individual consumers, which historically have experienced higher net charge-offs as a percent of loans outstanding than loans to other types of borrowers. The Company’s credit risk and the performance of its lending portfolios may be affected by concentration in an industry, geography or asset type. As described further in this "Risk Factors" section, the Company’s credit risks may be increased by the impacts of elevated inflation, poor or recessionary economic conditions and financial market volatility.
Commercial real estate valuations can be highly subjective as they are based upon many assumptions. Such valuations can be significantly affected over relatively short periods of time by changes in business climate, economic conditions, interest rates and, in many cases, the results of operations of businesses and other occupants of the real property. Evolving factors such as the shift to work-from-home or hybrid-work arrangements, changing consumer preferences (including for online shopping), and resulting changes in occupancy rates as a result of these and other trends can also impact such valuations over relatively short periods. Similarly, residential real estate valuations can be impacted by housing trends, the availability of financing at reasonable interest rates, governmental policy regarding housing and housing finance, and general economic conditions affecting consumers, as described above.
The Company maintains an allowance for loan losses that represents, in management’s judgment, the amount of losses expected in the loan portfolio. The allowance is determined by management’s evaluation of the loan portfolio based on such factors as the differing economic risks associated with each loan category, the current financial condition of specific borrowers, the current and forecasted economic environment in which borrowers operate, the level of delinquent loans, the value of any collateral and, where applicable, the existence of any guarantees or indemnifications. Management believes that the allowance for loan losses as of December 31, 2025 appropriately reflects expected credit losses in the loan portfolio. However, there is no assurance that the allowance is sufficient to cover all credit losses that may occur.
The Company may be adversely affected by the soundness of other financial institutions.
Financial services institutions are interrelated as a result of trading, clearing, counterparty, and other relationships. The Company has exposure to many different industries and counterparties, and routinely executes transactions with counterparties in the financial services industry, including commercial banks, brokers and dealers, investment banks, and other institutional clients. Many of these transactions expose the Company to credit risk in the event of a default by a counterparty or client. In addition, the Company’s credit risk may be exacerbated when the collateral held by the Company cannot be realized or is liquidated at prices not sufficient to recover the full amount of the credit due to or derivative exposure of the Company. Any resulting losses could have a material adverse effect on the Company’s financial condition and results of operations.
In addition, adverse developments at other financial institutions, including failures of other financial institutions, could result in negative media coverage regarding the financial services industry, which may negatively influence the perceptions of investors, borrowers or depositors regarding the financial services industry in general, a subset of financial institutions or M&T in particular.
30
Liquidity Risk
The Company must maintain adequate sources of funding and liquidity.
The Company must maintain adequate funding sources in the normal course of business to support its operations and fund outstanding liabilities, as well as meet regulatory requirements and supervisory expectations. The Company primarily relies on core customer deposits to be a reasonable cost and stable source of funding for the loans it makes and the operations of its business. Core customer deposits, which include noninterest-bearing deposits, interest-bearing transaction accounts, savings deposits and time deposits of $250,000 or less, have historically provided the Company with a sizeable source of relatively stable and low-cost funds. In addition to customer deposits, other sources of liquidity, including brokered deposits and borrowings from securities dealers, the FHLB of New York and the FRB of New York, as well as the debt and equity capital markets, are available to the Company.
The Company’s liquidity position and ability to fund and operate the business could be materially adversely affected by a variety of conditions and factors, including financial and credit market disruptions and volatility or a lack of market or customer confidence in financial markets in general, which may result in a loss of customer deposits or outflows of cash or collateral and/or ability to access capital markets on favorable terms. Negative news about the Company or the financial services industry generally may reduce market or customer confidence in the Company, which could in turn materially adversely affect the Company’s liquidity position and ability to raise funding. Such reputational damage may result in the loss of customer deposits, the inability to sell or securitize loans or other assets, and downgrades in one or more of the Company’s credit ratings, and may also negatively affect the Company’s ability to access the capital markets. A downgrade in the Company’s credit ratings, which could result from general industry-wide or regulatory factors not solely related to the Company, could adversely affect the Company’s ability to borrow funds, including by raising the cost of borrowings substantially, and could cause creditors and business counterparties to raise collateral requirements or take other actions that could adversely affect M&T’s ability to raise capital at a reasonable cost. Many of the above conditions and factors may be caused by events over which M&T has little or no control. There can be no assurance that significant disruption and volatility in the financial markets will not occur in the future.
Regulatory changes relating to liquidity and risk management may also negatively impact the Company’s results of operations and competitive position. Various regulations have been adopted to impose more stringent liquidity requirements for large financial institutions, including the Company. These regulations address, among other matters, liquidity stress testing and minimum liquidity requirements. The application of certain of these regulations to banking organizations, such as the Company, have been modified, including in connection with the implementation of the Tailoring Rules in the EGRRCPA.
If the Company is unable to continue to fund assets through customer deposits or access to other funding sources at reasonable terms or if the Company suffers an increase in borrowing costs or otherwise fails to manage liquidity effectively, the Company’s liquidity, operating margins, financial condition and results of operations may be materially adversely affected. The Company may also need to raise additional capital and liquidity through the issuance of stock, which could dilute the ownership of existing stockholders, or reduce or even eliminate common stock dividends or share repurchases to preserve capital and liquidity.
If the Company is unable to maintain or grow its deposits, it may be subject to paying higher funding costs.
The total amount that the Company pays for funding is dependent, in part, on the Company’s ability to maintain or grow its customer deposits. If the Company is unable to sufficiently maintain or grow
31
its deposits to meet liquidity objectives, it may be subject to paying higher funding costs. The Company competes with banks and other financial services companies for deposits and competition for those deposits remains robust. If competitors are slow to reduce rates they pay on deposits, the Company’s funding costs could be adversely impacted, either because the Company could be forced to hold rates higher to avoid losing deposits or the Company loses deposits and must rely on more expensive sources of funding. Customers may also move noninterest-bearing deposits to interest-bearing accounts, increasing the cost of those deposits. Checking and savings account balances and other forms of customer deposits may decrease when customers perceive alternative investments, such as the stock market, as providing a better risk/return tradeoff. The Company’s bank customers could withdraw their money and put it in alternative investments, causing the Company to lose a lower cost source of funding. Higher funding costs could reduce the Company’s net interest margin and net interest income.
The Company could be subject to sudden withdrawals of deposits, including because of negative media coverage, which may be spread through social media, regarding the financial services industry generally, a subset of financial institutions or M&T specifically. Online and mobile banking have made it easier for customers to withdraw their deposits or transfer funds to other accounts with short notice. This may make retaining deposits during periods of stress more difficult. In addition, depositors of certain types of deposits, such as uninsured or uncollateralized deposits, may be more likely to withdraw their deposits and do so more quickly. Any such withdrawals could result in higher funding costs to the Company as it loses a lower cost source of funding, and significant unanticipated withdrawals could materially and adversely affect the Company’s liquidity, financial condition and results of operations.
In July 2025 the GENIUS Act, which establishes a regulatory framework for “payment stablecoins” and their issuers, was signed into law. Consumers and businesses may view payment stablecoins as a substitute for traditional bank deposits, which could result in reduced levels of deposits in the banking system. Depending on consumer and business interest in payment stablecoins, and the characteristics and utility of payment stablecoins, the passage of the GENIUS Act could result in increased competition with respect to M&T’s bank subsidiaries’ deposit products. However, the GENIUS Act requires the U.S. Treasury Department and federal and state regulators to issue regulations on numerous topics to interpret and implement the statute, so the effect of the GENIUS Act will depend on what those regulations provide.
M&T relies on dividends from its subsidiaries for its liquidity.
M&T is a separate and distinct legal entity from its subsidiaries. M&T has typically received a substantial amount of its revenue from subsidiary dividends. These subsidiary dividends have been M&T’s principal source of funds to pay dividends on M&T common and preferred stock, pay interest and principal on its debt, and fund purchases of its common stock. Various federal and/or state laws and regulations, as well as regulatory expectations, limit the amount of dividends that M&T’s banking subsidiaries and certain non-bank subsidiaries may pay. Events in the banking industry have in the past resulted, and could in the future result, in increased regulatory focus on all aspects of capital planning, including dividends and other distributions to shareholders of banks, such as parent BHCs. See Part I, Item 1, "Business," "Supervision and Regulation of the Company" and "Distributions" for discussions of regulatory and other restrictions on dividend declarations. Also, M&T’s right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of that subsidiary’s creditors. Limitations on M&T’s ability to receive dividends from its subsidiaries could have a material adverse effect on its liquidity and ability to pay dividends on its stock or interest and principal on its debt, and ability to fund purchases of its common stock.
32
Strategic Risk
The financial services industry is highly competitive and creates competitive pressures that could adversely affect the Company’s revenue and profitability.
The financial services industry in which the Company operates is highly competitive. The Company competes not only with commercial and other banks and thrifts, but also with private credit funds, insurance companies, mutual funds, hedge funds, securities brokerage firms, financial technology companies and other companies offering financial services in the U.S., globally and over the Internet. Some of the Company’s non-bank competitors are not subject to the same extensive regulations the Company is, and may have greater flexibility in competing for business. In particular, the activity and prominence of so-called marketplace lenders and other technological financial services companies has grown significantly in recent years and is expected to continue growing. The Company competes on the basis of several factors, including capital, access to capital, revenue generation, products, services, transaction execution, innovation, reputation, and price. Over time, certain sectors of the financial services industry have become more concentrated, as institutions involved in a broad range of financial services have been acquired by or merged into other firms. These developments have and could continue to result in the Company’s competitors gaining greater capital and other resources, such as a broader range of products and services and geographic diversity. The Company has and may continue to experience pricing pressures as a result of these factors and as some of its competitors seek to increase market share.
Technological change is influencing how individuals and firms conduct their financial affairs and is changing the delivery channels for financial services. Financial technology providers, who invest substantial resources in developing and designing new technology (in particular digital and mobile technology) are beginning to offer more traditional banking products (either directly or through bank partnerships), or products that may be viewed as substitutes for traditional banking products, and may in the future be able to provide additional services by obtaining a bank-like charter, such as the OCC’s financial technology company charter. In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in robotic process automation and AI, could significantly affect the competition for financial services. As a result, the Company has had and will likely continue to have to contend with a broader range of competitors including many that are not located within the geographic footprint of its banking office network. Further, along with other participants in the financial services industry, the Company frequently attempts to introduce new technology-driven products and services that are aimed at allowing the Company to better serve customers and to reduce costs. The Company may not be able to effectively implement new technology-driven products and services that allow it to remain competitive or be successful in marketing these products and services to its customers.
Difficulties in obtaining regulatory approval for acquisitions and in combining the operations of acquired entities with the Company’s own operations may prevent M&T from achieving expected benefits from acquisitions.
M&T has expanded its business through acquisitions in the past and may do so in the future. The Company’s ability to complete acquisitions is in many instances subject to regulatory approval, and the Company cannot be certain when or if, or on what terms and conditions, any required regulatory approvals would be granted. Any requisite approval could be delayed or not obtained at all, including due to, among other factors, an adverse development in either party’s regulatory standing or in any other factors considered by regulators when granting such approval, including factors not known at the time of entering into the definitive agreement for the acquisition or submission of the related application for regulatory approval, and factors that may arise subsequently; governmental, political
33
or community group inquiries, investigations or opposition, including those based on concerns regarding policies or practices related to fair access to financial services; or changes in legislation or the political environment more generally. Anticipated challenges in obtaining any requisite regulatory approval, or uncertainty as to the prospects for obtaining approvals, could also prevent the Company from pursuing a potential acquisition it may otherwise view as attractive.
In addition, inherent uncertainties exist when integrating the operations of an acquired entity. Acquiring other entities involves potential risks that could have a material adverse impact on the Company’s business, financial condition and results of operations, including:
•Inability to fully achieve the Company’s strategic objectives and planned operating efficiencies in an acquisition.
•Issues arising during transition and integration.
•Disruption of the Company’s business and diversion of management’s time and attention.
•Exposure to unknown or contingent liabilities of acquired institutions.
•Loss of key employees and customers of acquired institutions.
•Dilution in the ownership percentage of holders of M&T common stock.
•Payment of a premium over book and market values that may dilute the Company’s tangible book value and earnings per common share in the short and long-term.
•Inability to realize the expected benefits of the acquisition due to lower financial results pertaining to the acquired entity. For example, the Company could experience higher credit losses, incur higher operating expenses or realize less revenue than originally anticipated related to an acquired entity.
•Changes in banking or tax laws or regulations that could impair or eliminate the expected benefits of merger and acquisition activities.
•Risks of harm to the Company's reputation.
The Company could suffer if it fails to attract and retain skilled personnel.
The Company's success depends, in large part, on its ability to attract and retain key individuals and to have a workforce of broad and varied skill sets. Competition for qualified and high-performing candidates in the activities in which the Company engages and markets that the Company serves is significant, and the Company may not be able to hire candidates and retain them. Growth in the Company’s business, including through acquisitions, may increase its need for additional qualified personnel. The Company is increasingly competing for personnel with financial technology providers and other less regulated entities who may not have the same limitations on compensation as the Company does. Recruiting and compensation costs may increase as a result of changes in the marketplace, which may increase costs and adversely impact the Company. The increase in remote and hybrid-work arrangements and opportunities in regional, national and global labor markets has also increased competition for the Company to attract and retain skilled personnel. The Company’s current or future approach to in-office and remote-work arrangements may not meet the needs or expectations of current or prospective employees or may not be perceived as favorable as compared with the arrangements offered by other companies, which could adversely affect the Company’s ability to attract and retain employees. If the Company is not able to hire or retain highly skilled and qualified individuals, it may be unable to execute its business strategies and may suffer adverse consequences to its business, financial condition and results of operations.
The Company’s compensation practices are subject to review and oversight by the Federal Reserve, the OCC, the FDIC and other regulators. The federal banking agencies have issued joint guidance on incentive compensation designed to help ensure that a banking organization’s incentive compensation policies do not encourage imprudent risk taking and are consistent with the safety and soundness of the organization. In addition, the Dodd-Frank Act required those agencies, along with
34
the SEC, to adopt rules to require reporting of incentive compensation and to prohibit certain compensation arrangements. If as a result of complying with such rules the Company is unable to attract and retain qualified employees, or do so at rates necessary to maintain its competitive position, or if the compensation costs required to attract and retain employees become more significant, the Company’s performance, including its competitive position, could be materially adversely affected.
Operational Risk
The Company is subject to operational risk which could adversely affect the Company’s business and reputation and create material legal and financial exposure.
Like all businesses, the Company is subject to operational risk, which represents the risk of loss resulting from human error or misconduct, inadequate or failed internal processes and systems, and external events, including the risk of loss resulting from fraud by employees or persons outside the Company, and breaches in data security. Operational risk also encompasses risks of harm to the Company's reputation, and compliance and legal risk, which is the risk of loss from violations of, or noncompliance with, laws, rules, regulations, prescribed practices or ethical standards, as well as the risk of noncompliance with contractual and other obligations. The Company is also exposed to the above referenced operational risks through outsourcing arrangements, as such outsourced vendors are exposed to operational risks themselves, as well as the effects that changes in circumstances or capabilities of its outsourced vendors can have on the Company’s ability to continue to perform operational functions necessary to its business. Although the Company seeks to mitigate operational risk through a system of internal controls that are reviewed and updated, no system of controls, however well designed and maintained, is infallible. Control weaknesses or failures or other operational risks could result in charges, increased operational costs, harm to the Company’s reputation, regulatory scrutiny or foregone business opportunities.
The Company’s information systems may experience interruptions or breaches in security, such as cyber attacks, including due to events beyond the Company’s control.
The Company relies heavily on communications and information systems, including those of third-party service providers, to conduct its business. Any failure, interruption or breach in security of these systems could result in disruptions to its accounting, deposit, loan and other systems, and adversely affect the Company’s customer relationships. Disruption of operating systems caused by events beyond the Company’s control may include computer viruses, electrical or telecommunications outages, quality of vulnerability patches, coding errors, cyber attacks (including Distributed Denial of Service attacks, which occur when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious cyber threat actor), damage to property or physical assets, or events arising from political protests or terrorist acts. Like other U.S. financial services companies, the Company is constantly the target of cyber attacks and other attempts to disrupt its operations. While the Company has policies and procedures designed to prevent or limit the effect of these possible events, there can be no assurance that any failure, disruption, interruption or security breach will not occur or, if any does occur, that it can be sufficiently or timely remediated.
Information security risks for large financial institutions such as M&T have increased significantly in recent years in part because of the proliferation of new technologies, such as AI and digital and mobile banking to conduct financial transactions, the increased connectivity of third parties (including contractors) and electronic devices to the Company's systems, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties. There have been increasing efforts on the part of third parties, including through cyber attacks, to breach data security at financial institutions or with respect to financial transactions.
35
There have been numerous instances involving financial services and consumer-based companies reporting unauthorized access to and disclosure of client or customer information or the destruction or theft of corporate data, including by executive impersonation and third party vendors, or the freezing of operating systems and databases making them inaccessible or unusable. There have also been several highly publicized cases where hackers have requested "ransom" payments in exchange for not disclosing customer information or for restoring access to, or the usage of, operating systems and databases. Ransomware is a form of malicious software, known as "malware," designed to block access to, and often encrypt, computer systems or data. Once the victim’s computer system or data is locked down and encrypted, rendering it essentially useless, the malicious cyber actor then extorts the victim by demanding a ransom payment in exchange for providing a method to decrypt it. The attacker may also copy the victim’s data in the course of the attack and threaten to sell or publish the data if the ransom is not paid. Ransomware attacks can result in a loss of business functionality and of sensitive data.
As cyber threats continue to evolve, the Company expects to continue to expend significant additional resources to modify or enhance its layers of defense or to investigate and remediate any information security vulnerabilities especially in light of heightened regulatory expectations around information security. The techniques used by cyber criminals change frequently, may not be recognized until launched and can be initiated by a variety of actors, including terrorist organizations and hostile foreign governments. These techniques may include attempts to fraudulently induce employees, customers or others to disclose sensitive information in order to gain access to data or systems. These risks may increase as the use of mobile payment and other Internet-based applications expands.
Further, third parties with which the Company does business, as well as vendors and other third parties with which the Company’s customers do business, can also be sources of information security risk to the Company, particularly where activities of customers are beyond the Company’s security and control systems, such as through the use of the Internet, personal computers, tablets, smart phones and other mobile services. Risks relating to cyber attacks on vendors and other third parties, including supply chain attacks affecting software and information technology service providers, have been rising as such attacks become increasingly frequent and severe. For example, in 2023, a widely reported global cybersecurity incident occurred involving MOVEit, a file transfer software product owned by Progress Software Corporation that is used by thousands of public and private sector entities worldwide. As reported, this incident resulted in the theft of sensitive data from a large number of organizations, and certain Company customer information in the possession of the Company’s external service providers was compromised in connection with it, while no information was obtained from the Company’s internal systems and these systems were not at risk from the MOVEit incident.
Security breaches affecting the Company’s customers, or systems breakdowns, failures, security breaches or employee misconduct affecting such other third parties, may require the Company to take steps to protect the integrity of its own systems or to safeguard confidential information of the Company or its customers, thereby increasing the Company’s operational costs and adversely affecting its business. Additionally, successful cyber attacks at other large financial institutions, whether or not the Company is impacted, could lead to a general loss of customer confidence in financial institutions that could negatively affect M&T, including harming the market perception of the effectiveness of the Company’s security measures or the financial system in general which could result in reduced use of the Company’s financial products. Though the Company has insurance against some cyber risks and attacks, it may not be sufficient to offset the impact of a material loss event.
36
The Company, as well as third parties with which the Company does business, has expanded the use of cloud service providers, which could experience system breakdowns or failures, outages, downtime, cyber attacks, negative changes to financial condition, bankruptcy, or other adverse conditions, which could have a material adverse effect on the Company’s business and reputation. For example, in recent years, there have been a number of widely publicized cases of outages in connection with access to cloud service providers. Thus, increasing the amount of infrastructure that the Company or its vendors and service providers outsource to the cloud or to other parties may increase M&T’s risk exposure. The failure to properly upgrade or maintain the computer systems could result in greater susceptibility to attacks, particularly in light of the greater frequency and severity of attacks in recent years, as well as the growing prevalence of supply-chain attacks affecting software and information technology service providers. Failures related to upgrades and maintenance also increase risks related to unauthorized access and misuse, as well as the Company’s ability to achieve its business continuity and resiliency objectives.
The Company could incur higher costs, experience lower revenue, and suffer reputational damage in the event of the theft, loss or misuse of information, including due to a cyber attack.
Like other financial services firms, the systems, networks and devices of the Company, its customers, employees, service providers or other third parties with whom the Company interacts continue to be the subject of attempted unauthorized access, denial-of-service attacks, computer viruses, hacking, malware, ransomware, phishing or other forms of social engineering, and cyber attacks designed to obtain confidential information, destroy data, disrupt or degrade service, eliminate access or cause other damage. These threats may arise from human error, fraud on the part of employees, insiders or third parties or may result from accidental technology failure or vulnerabilities of suppliers through supply-chain attacks. Further, cybersecurity and information security risks for financial institutions have generally increased because of, among other things, the growth of new technologies (including AI), the use of the Internet and telecommunications technologies (including computers, smartphones, and other mobile devices outside the Company’s systems) by customers to conduct financial transactions, and the increased sophistication and activities of organized crime, fraudsters, hackers, terrorists, activists, instrumentalities of foreign governments and other external parties.
Although the Company believes that a robust suite of authentication and layered security controls, data encryption and tokenization, threat intelligence, anti-malware defenses and vulnerability management tools exist, the failure of any of these controls could result in a failure to detect, mitigate or remediate these risks in a timely manner. Moreover, potential new regulations may require the Company to disclose information about a cybersecurity event before it has been resolved or fully investigated. Further, as the Company expands its mobile and digital capabilities, cybersecurity risks increase.
A disruption or breach, including as a result of a cyber attack, or media reports of perceived security vulnerabilities at the Company or at third-party service providers could result in significant legal and financial exposure, regulatory intervention, remediation costs, damage to the Company's reputation, or loss of confidence in the security of systems, products and services that could adversely affect the Company’s business. Like other U.S. financial services providers, the Company continues to be targeted with evolving and adaptive cyber threats from sophisticated third parties. Although the Company is not aware of any material losses relating to cybersecurity incidents, there can be no assurance that unauthorized access or cybersecurity incidents will not become known or occur or that the Company will not suffer such losses in the future.
37