DESCRIPTION OF BUSINESS

Zions Bancorporation (“the Parent”) is a financial holding company organized under the laws of the State of Utah in 1955, and registered under the Bank Holding Company Act (“BHC Act”), as amended. The Parent owns and operates a commercial bank with a total of 433 branches at year-end 2017 . The Parent and its subsidiaries (collectively “the Company”) provide a full range of banking and related services, primarily in Arizona, California, Colorado, Idaho, Nevada, New Mexico, Oregon, Texas, Utah, Washington, and Wyoming. The Company conducts its banking operations through seven separately managed and branded segments, which we sometimes refer to as

“affiliates” or by reference to their respective brands. Full-time equivalent employees totaled 10,083 at December 31, 2017 . For further information about the Company’s industry segments, see “Business Segment Results” on page 46 in MD&A and Note 20 of the Notes to Consolidated Financial Statements. For information about the Company’s foreign operations, see “Foreign Exposure and Operations” on page 53 in MD&A. The “Executive Summary” on page 33 in MD&A provides further information about the Company.

PRODUCTS AND SERVICES

The Company focuses on providing community banking services by continuously strengthening its core business lines of (1) small and medium-sized business and corporate banking; (2) commercial and residential development, construction and term lending; (3) retail banking; (4) treasury cash management and related products and services; (5) residential mortgage servicing and lending; (6) trust and wealth management; (7) limited capital markets activities, including municipal finance advisory and underwriting; and (8) investment activities. It operates primarily through seven geographic regions, each with its own local branding, chief executive officer and management team.

In addition to providing a wide variety of commercial products and services, the Company provides a range of personal banking services to individuals, including home mortgages, bankcard, other installment loans, home equity lines of credit, checking accounts, savings accounts, certificates of deposit of various types and maturities, trust services, safe deposit facilities, and Internet and mobile banking. The Company provides services to key market segments through its Private Client Services and Executive Banking Groups. It offers self-directed brokerage services through Zions Direct and also offers comprehensive and personalized wealth management and investment services. 

The Company has built specialized lines of business in capital markets and public finance, and is a leader in small business administration (“SBA”) lending. The Company is one of the nation’s largest providers of SBA 7(a) and SBA 504 financing to small businesses. It owns an equity interest in FAMC and is its top originator of secondary market agricultural real estate mortgage loans. The Company provides finance advisory and corporate trust services for municipalities. The Company also provides bond transfer, stock transfer, and escrow services nationally in its corporate trust business.

COMPETITION

The Company operates in a highly competitive environment. The Company’s most direct competition for loans and deposits comes from other commercial banks, credit unions, and thrifts, including institutions that do not have a physical presence in our market footprint but solicit via the Internet and other means. In addition, the Company competes with finance companies, mutual funds, insurance companies, brokerage firms, securities dealers, investment banking companies, financial technology and other non-traditional lending and banking companies, and a variety of other types of companies. These companies may have fewer regulatory constraints and some have lower cost structures or tax burdens.

The primary factors in competing for business include the quality of service delivered, our local community knowledge, convenience of office locations, online banking functionality and other delivery methods, range of products offered, and pricing. The Company must compete effectively along all of these dimensions to remain successful.

SUPERVISION AND REGULATION

This section describes the material elements of selected laws and regulations applicable to the Company. The descriptions are not intended to be complete and are qualified in their entirety by reference to the full text of the statutes and regulations described. Changes in applicable laws or regulations, and in their application by regulatory agencies, cannot be predicted, but they may have a material effect on the business and results of the Company.

On November 20, 2017, we announced a proposal to streamline our corporate structure by merging the Parent into its bank subsidiary, ZB, N.A. and, in connection with the proposed restructuring, our intention to file an application

with the Financial Stability Oversight Council (“FSOC”) seeking a determination that the resulting banking organization is not "systemically important" as defined by provisions of the Dodd-Frank Act. The merger is contingent upon approval by the Office of the Comptroller of the Currency (“OCC”), Federal Deposit Insurance Corporation (“FDIC”), and the Company’s shareholders. Assuming the restructuring is completed and the application to FSOC is approved, the resulting banking organization would no longer be subject to duplicative examinations and other overlapping regulatory requirements, or the enhanced prudential standards established by the Board of Governors of the Federal Reserve System under Section 165 of the Dodd-Frank Act. The Company’s primarily regulator would be the OCC. The Company would continue to be subject to examinations by the CFPB with respect to consumer financial regulations.

There can be no assurance that the restructuring will be completed or that the FSOC application will be approved. Accordingly, the discussion below is based on the regulatory regime currently applicable to us and our current holding company structure. For a description of the material elements of the current regulatory regime applicable to us that would be eliminated if our proposals are successful, see “Regulatory Relief if Proposed Restructuring is Completed and FSOC Application is Approved” below.

The banking and financial services business in which we engage is highly regulated. Such regulation is intended, among other things, to improve the stability of banking and financial companies and to protect the interests of customers, including both loan customers and depositors, and taxpayers. These regulations are not, however, generally intended to protect the interests of our shareholders or creditors, and in fact may have the consequence of reducing returns to our shareholders. This regulatory framework has been materially revised and expanded since the 2008-2009 financial crisis and recession. In particular, the Dodd-Frank Act and regulations promulgated pursuant to it have given financial regulators expanded powers over nearly every aspect of the Company’s business. These include, among other things, new, higher regulatory capital requirements; regulation of dividends and other forms of capital distributions to shareholders through annual stress testing and capital planning processes; heightened liquidity and liquidity stress testing requirements, which include specific definitions of the types of investment securities that qualify as “high-quality liquid assets” and which effectively limit the portion of the Company’s balance sheet that can be used to meet the credit needs of its customers; specific limitations on mortgage lending products and practices; specific limits on certain consumer payment fees; and subjecting compensation practices to specific regulatory oversight and restrictions. Individually and collectively, these additional regulations have imposed and will continue to impose higher costs on the Company, and have reduced and may continue to reduce returns earned by shareholders. Some aspects of the Dodd-Frank Act continue to be subject to rulemaking, the majority of the rules that have been adopted may be subject to interpretation or clarification, and accordingly, the impact of such regulatory changes cannot be presently determined. Recent political developments, including the change in the executive administration of the United States, have increased uncertainty to the implementation, scope, and timing of regulatory reforms, including those related to the implementation of the Dodd-Frank Act. The Company is committed to both satisfying heightened regulatory expectations and providing attractive shareholder returns. However, given the still-changing regulatory environment and such uncertainty, the results of these efforts cannot yet be known.

In the first quarter of 2017, the President of the United States issued an executive order identifying “core principles” for the administration’s financial services regulatory policy and directing the Secretary of the Treasury, in consultation with the heads of other financial regulatory agencies, to evaluate how the current regulatory framework promotes or inhibits the principles and what actions have been, and are being, taken to promote the principles. In response to the executive order, on June 12, 2017, October 6, 2017 and October 26, 2017, respectively, the U.S. Department of the Treasury issued the first three of four reports recommending a number of comprehensive changes in the current regulatory system for U.S. depository institutions, the U.S. capital markets and the U.S. asset management and insurance industries. These recommendations, if implemented, could reduce some of the burdens and costs of the current regulatory framework.

General

The Parent is a bank holding company and a financial holding company as provided by the BHC Act, as modified by the GLB Act and the Dodd-Frank Act. These and other federal statutes provide the regulatory framework for

bank holding companies and financial holding companies, which have as their umbrella regulator the FRB. The supervision of ZB, N.A. and other regulated subsidiaries is conducted by each subsidiary’s primary functional regulator and the laws and regulations administered by those regulators. The GLB Act allows our subsidiary bank to engage in certain financial activities through financial subsidiaries. To qualify for and maintain status as a financial holding company, or to do business through a financial subsidiary, the Parent and its subsidiary bank must satisfy certain ongoing criteria. The Company currently engages in only limited activities for which financial holding company status is required.

ZB, N.A. is subject to the provisions of the National Bank Act and other statutes governing national banks, as well as the rules and regulations of the OCC, the Consumer Financial Protection Bureau (“CFPB”), and the FDIC. It is also subject to examination and supervision by the OCC and examination by the CFPB in respect of federal consumer financial regulations. In addition, Zions Bancorporation is subject to examination by the Federal Reserve Bank of San Francisco. Some of our nonbank subsidiaries are also subject to regulation by the Federal Reserve Board (“FRB”) and other federal and state agencies. These regulatory agencies may exert considerable influence over our activities through their supervisory and examination roles. Our brokerage and investment advisory subsidiaries are regulated by the SEC, Financial Industry Regulatory Authority (“FINRA”) and/or state securities regulators.

The Dodd-Frank Act

The most recent financial crisis led to numerous new laws in the United States and internationally for financial institutions. The Dodd-Frank Act, which was enacted in July 2010, is one of the most far reaching legislative actions affecting the financial services industry in decades and significantly restructured the financial regulatory regime in the United States. Implementation of the Dodd-Frank Act and related rulemaking activities continued in 2017.

The Dodd-Frank Act and regulations adopted under the Dodd-Frank Act broadly affect the financial services industry by creating new resolution authorities, requiring ongoing stress testing of our capital and liquidity, mandating higher capital and liquidity requirements, requiring divestiture of certain equity investments, increasing regulation of executive and incentive-based compensation, requiring banks to pay increased fees to regulatory agencies, and requiring numerous other provisions aimed at strengthening the sound operation of the financial services sector. Among other things affecting capital standards, the Dodd-Frank Act provides that:

Regulations promulgated under the Dodd-Frank Act require us to maintain greater levels of capital and liquid assets than was generally the case before the crisis and limit the forms of capital that we will be able to rely upon for regulatory purposes. In addition, in its supervisory role with respect to our stress testing and capital planning, our ability to deliver returns to our shareholders through dividends and stock repurchases is subject to prior non-objection by the FRB. The stress testing and capital plan processes also could substantially reduce our flexibility to respond to market developments and opportunities in such areas as capital raising and acquisitions.

The Dodd-Frank Act’s provisions and related regulations also affect the fees we must pay to regulatory agencies and the pricing of certain products and services, including the following:

The Dodd-Frank Act also created the CFPB, which is responsible for promulgating regulations designed to protect consumers’ financial interests and examining large financial institutions for compliance with, and enforcing, those

regulations. The Dodd-Frank Act adds prohibitions on unfair, deceptive or abusive acts and practices to the scope of consumer protection regulations overseen and enforced by the CFPB. The Dodd-Frank Act subjected national banks to the possibility of further regulation by restricting the preemption of state laws by federal laws. Restricting the scope of federal preemption could burden national banks with the requirement that they also comply with certain state laws covering matters already covered by federal law. In addition, the Dodd-Frank Act gives greater power to state attorneys general to pursue legal actions against banking organizations for violations of federal law.

The Dodd-Frank Act contains numerous provisions that limit or place significant burdens and costs on activities traditionally conducted by banking organizations, such as originating and securitizing mortgage loans and other financial assets, arranging and participating in swap and derivative transactions, proprietary trading and investing in private equity and other funds. For the affected activities, these provisions may result in increased compliance and other costs, increased legal risk, and decreased scope of product offerings and earning assets.

The Company is subject to the provisions of the Volcker Rule, issued pursuant to the Dodd-Frank Act. The Company has divested all but $3 million of private equity investments (“PEIs”) not permitted under the Volcker Rule. Such investments also provide for $4 million of potential capital calls, which the Company would fund, as allowed by the Volcker Rule, if and as the capital calls are made until the investments are sold. Nevertheless, because the remaining investments are comprised of funds that are in the later stages of their lifecycle, significant future funding requests are not anticipated. The Company continues to pursue the disposition of all non-compliant PEIs. In February 2017, the Federal Reserve Bank of San Francisco approved the Company’s application for an extended transition period of up to five years in which to dispose of its remaining PEIs in light of their illiquid nature.

The Company and other companies subject to the Dodd-Frank Act are subject to a number of requirements regarding the time, manner and form of compensation given to its key executives and other personnel receiving incentive compensation, which are being imposed through the supervisory process as well as published guidance and proposed rules. These restrictions imposed by the Dodd-Frank Act include documentation and governance, deferral, risk-balancing, and clawback requirements. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or engage in other activities, or could result in regulatory enforcement actions.

During the second quarter of 2016, the U.S. financial regulators, including the FRB and the SEC, proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets (including Zions). The proposed revised rules would establish general qualitative requirements applicable to all covered entities, additional specific requirements for entities with total consolidated assets of at least $50 billion, such as Zions, and further, more stringent requirements for those with total consolidated assets of at least $250 billion. The general qualitative requirements include: (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (iii) establishing requirements for performance measures to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate record-keeping. For larger financial institutions, including Zions, the proposed revised regulations would also introduce very prescriptive requirements relating to the types and percentages, the timing of the realization, and the risk of forfeiture of incentive compensation awarded to “senior executive officers” and “significant risk-takers.” The regulators have not yet issued any final rules.

Some aspects of the Dodd-Frank Act continue to be subject to rulemaking, and many of the rules that have been adopted may be subject to interpretation or clarification. In 2017, the U.S. House of Representatives approved a bill that would significantly amend the post-financial crisis regulatory framework implemented under the Dodd-Frank Act, and a bipartisan group of senators also introduced legislation that would revise various post-financial crisis regulatory requirements and provide targeted relief to certain financial institutions, which may include Zions. If passed, this legislative initiative could result in the Company no longer being deemed a systemically important financial institution (“SIFI”) or subject to the enhanced prudential supervision standards applicable to SIFIs. The

likelihood and impact of any regulatory and legislative changes are difficult to predict and cannot be presently determined.

Capital Standards - Basel Framework

In 2013, the FRB, FDIC, and OCC published final rules (the “Basel III capital rules”) establishing a new comprehensive capital framework for U.S. banking organizations. The Basel III capital rules effectively replaced the Basel I capital rules and implemented the Basel Committee’s December 2010 framework, commonly referred to as Basel III, for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The Basel III capital rules substantially revised the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Company, compared to the Basel I U.S. risk-based capital rules. The Basel III capital rules became effective for the Company on January 1, 2015 and were subject to phase-in periods for certain of their components. In November 2017, the FRB, FDIC and OCC published a final rule for non-advanced approaches banks that extends the regulatory capital treatment applicable during 2017 under the regulatory capital rules for certain items.

The Basel III capital rules define the components of capital and address other issues affecting the numerator in banking institutions’ regulatory capital ratios. The Basel III capital rules also address risk weights and other issues affecting the denominator in banking institutions’ regulatory capital ratios and replaced the risk-weighting approach derived from Basel I capital accords of the Basel Committee, with a more risk-sensitive approach based, in part, on the standardized approach in the Basel Committee’s 2004 Basel II capital accords. The Basel III capital rules also implemented the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the federal banking agencies’ rules.

The Basel III capital rules, among other things, (i) introduced a new capital measure called “Common Equity Tier 1” (“CET1”), (ii) specified that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, (iii) applied most deductions/adjustments to regulatory capital measures to CET1 and not to the other components of capital, thus potentially requiring higher levels of CET1 in order to meet minimum ratios, and (iv) expanded the scope of the deductions/adjustments from capital as compared to prior regulations.

Under the Basel III capital rules, the minimum capital ratios are as follows:

When fully phased-in the Basel III capital rules will also require the Company and its subsidiary bank to maintain a 2.5% “capital conservation buffer” designed to absorb losses during periods of economic stress, composed entirely of CET1, on top of the minimum risk-weighted asset ratios, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7.0%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to risk-weighted assets of at least 10.5%. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall. The implementation of the capital conservation buffer began on January 1, 2016 at the 0.625% level and progressively increases over time, as determined by regulation.

The Basel III capital rules also prescribed a standardized approach for calculating risk-weighted assets that expanded the risk-weighting categories from Basel I-derived categories (0%, 20%, 50% and 100%) to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. Government and agency securities, to 600% for certain equity exposures, and resulting in higher risk weights for a variety of asset categories. In addition, the Basel III capital rules provided more advantageous risk weights for derivatives and repurchase-style transactions cleared through a qualifying central counterparty and increased the scope of eligible guarantors and eligible collateral for purposes of credit risk mitigation.

The Basel III capital rules provided for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, deferred tax assets (“DTAs”) dependent upon future taxable income, and significant investments in common equity issued by nonconsolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. The application of this part of the rule did not result in any deductions from CET1 for us.

Under prior Basel I capital standards, the effects of accumulated other comprehensive income (“AOCI”) items included in capital were excluded for purposes of determining regulatory capital and capital ratios. As a “non-advanced approaches banking organization,” we made a one-time permanent election as of January 1, 2015 to continue to exclude these items, as allowed under the Basel III capital rules.

Basel III also required additional regulatory capital disclosures to be made that are commonly referred to as “Pillar 3” disclosures. These disclosures require the Company to make prescribed regulatory disclosures on a quarterly basis regarding its capital structure adequacy and risk-weighted assets. The Company began publishing these Pillar 3 disclosures in 2015, and such disclosures are available on the Company’s website.

The Basel Committee has issued a series of updates that propose other changes to capital regulations. In one of these, the Basel Committee finalized a revised framework for calculating minimum capital requirements for market risk, which is expected to increase market risk capital requirements for most banking organizations. The Basel Committee has set an effective date for reporting under the revised framework for market risk capital of December 31, 2019. The U.S. federal bank regulatory agencies have not yet proposed rules implementing these revisions for U.S. banking organizations. The Company met all capital adequacy requirements under the Basel III capital rules as of December 31, 2017.

Capital Planning and Stress Testing

The Company is required by the Dodd-Frank Act to participate in annual stress tests known as the Dodd-Frank Act Stress Test (“DFAST”) and the FRB’s Horizontal Capital Review, also referred to as Comprehensive Capital Analysis and Review (“HCR/CCAR”). The Company submitted its 2017 capital plan and stress test results to the FRB on April 5, 2017. In its capital plan, the Company was required to forecast, under a variety of economic scenarios for nine quarters, its estimated regulatory capital ratios, and its generally accepted accounting principles (“GAAP”) tangible common equity ratio. On June 28, 2017, we announced that the FRB notified us that it did not object to the capital actions outlined in our 2017 capital plan. The plan included (1) the increase of the quarterly common dividend to $0.24 per share by the second quarter of 2018, following the path of $0.12 per share in the third quarter of 2017, $0.16 per share in the fourth quarter of 2017, $0.20 per share in the first quarter of 2018 and $0.24 per share in the second quarter of 2018; and (2) up to $465 million in total repurchases of common equity.

On June 22, 2017, we filed a Form 8-K with the SEC presenting the results of the 2017 DFAST. The results of the stress test demonstrated that the Company has sufficient capital to withstand a severe hypothetical economic downturn. Detailed disclosure of the stress test results can also be found on our website. In addition, we submitted on October 5, 2017, our mid-cycle company-run DFAST, based upon the Company’s June 30, 2017 financial position. Zions’ mid-cycle DFAST results, based on the hypothetical severely adverse scenario, indicate the Company would maintain capital ratios at sufficient levels throughout the nine-quarter forecasting horizon. As discussed in the mid-cycle press release, published October 5, 2017, Zions’ hypothetical severely adverse scenario was designed to create a stressful idiosyncratic environment, including a 10% unemployment rate and a 35% decline in commercial property values. During the nine-quarter projection period, the minimum CET1 ratio was 9.9%.

Zions has participated in the annual HCR/CCAR/DFAST exercise since 2014. Prior to 2017, the FRB could object to Zions’ capital plan on either quantitative or qualitative grounds. On January 30, 2017, the FRB announced a final rule for the 2017 cycle, removing from the qualitative assessment of the exercise those bank holding companies that have total consolidated assets of at least $50 billion but less than $250 billion, on-balance sheet foreign exposure of less than $10 billion, and nonbank assets of less than $75 billion (referred to as large and non-complex (“LNC”)

firms). However, the FRB may still object to a capital plan based on the results of its quantitative assessment. As an LNC firm, Zions will still be subject to regular supervisory assessments to examine the Company’s capital planning processes. Our annual capital plan is due by April each year, and the FRB will publish results of its supervisory HCR/CCAR review of our capital plan by June 30 of each year.

On February 17, 2014, the FRB published final rules to implement Section 165, Enhanced Supervision and Prudential Standards for Nonbank Financial Companies Supervised by the Board of Governors and Certain Bank Holding Companies , of the Dodd-Frank Act. The Company believes that it is in compliance with these rules.

Liquidity

Historically, regulation and monitoring of bank and bank holding company liquidity has been addressed as a supervisory matter, both in the United States and internationally, without required formulaic measures. However, in January 2016, Zions became subject to final rules adopted by the FRB and other banking regulators (“Final Liquidity Coverage Ratio (“LCR”) requirement Rule”) implementing a U.S. version of the Basel Committee’s LCR requirement. The LCR is intended to ensure that banks hold sufficient amounts of so-called HQLA to cover the anticipated net cash outflows during a hypothetical acute 30-day stress scenario. Zions is subject to the modified LCR, which is the ratio of an institution’s amount of HQLA (the numerator) over 70% of projected net cash out-flows over the 30-day horizon (the denominator), in each case, as calculated pursuant to the Final LCR Rule. The Final LCR Rule requires institutions subject to the modified LCR to maintain the modified ratio equal to at least 100% in order to satisfy this regulatory requirement. Only specific classes of assets, including U.S. Treasury securities, other U.S. government obligations and agency mortgage-backed securities, qualify under the rule as HQLA, with classes of assets deemed relatively less liquid and/or subject to greater degree of credit risk subject to certain haircuts and caps for purposes of calculating the numerator under the Final LCR Rule. The total assumed projected net cash outflows amount is determined under the rule by applying certain hypothetical outflow and inflow rates, which reflect certain standardized stressed assumptions, against the balances of the banking organization’s funding sources, obligations, transactions and assets over the 30-day stress period. Inflows that can be included to offset outflows are limited to 75% of outflows (which effectively means that banking organizations must hold HQLA equal to 25% of outflows even if outflows perfectly match inflows over the stress period).

The Basel III framework also included a second standard, referred to as the net stable funding ratio (“NSFR”), which is designed to promote more medium- and long-term funding of the assets and activities of banks over a one-year time horizon. In May 2016, the FRB and other federal banking regulators issued a proposed rule that would implement the NSFR for large U.S. banking organizations. Under the proposed rule, the most stringent requirements would apply to bank holding companies with $250 billion or more in total consolidated assets or $10 billion or more in on-balance sheet foreign exposure, and would require such organizations to maintain a minimum NSFR of 1.0 on an ongoing basis, calculated by dividing the organization’s available stable funding by its required stable funding. Bank holding companies with less than $250 billion, but more than $50 billion, in total consolidated assets and less than $10 billion in on-balance sheet foreign exposure, such as Zions, would be subject to a modified NSFR requirement which would require such bank holding companies to maintain a minimum NSFR of 0.7 on an ongoing basis. Under the proposed rule, a banking organization’s available stable funding would be calculated by applying specified standard weightings to its equity and liabilities based on their expected stability over a one-year time horizon and its required stable funding would be calculated by applying specified standardized weightings to its assets, derivative exposures and commitments based on their liquidity characteristics over the same one-year time horizon. The U.S. federal bank regulatory agencies have not released the final rule. We do not expect this to have a material impact on the Company.

Financial Privacy and Cyber Security

The federal banking regulators have adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may

also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services. Federal law makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means.

In October 2016, the federal banking regulators jointly issued an advance notice of proposed rulemaking on enhanced cyber risk management standards that are intended to increase the operational resilience of large and interconnected entities under their supervision. The advance notice of proposed rulemaking addressed five categories of cyber standards: (1) cyber risk governance; (2) cyber risk management; (3) internal dependency management; (4) external dependency management; and (5) incident response, cyber resilience, and situational awareness. The comment period expired in February 2017; however, the regulators have not yet issued any revised proposed rules or final rules.

Prompt Corrective Action

The Federal Deposit Insurance Corporation Improvement Act (“FDICIA”) requires each federal banking agency to take prompt corrective action to resolve the problems of insured depository institutions, including but not limited to those that fall below one or more prescribed minimum capital ratios. Pursuant to FDICIA, the FDIC promulgated regulations defining the following five categories in which an insured depository institution will be placed, based on the level of its capital ratios: well-capitalized, adequately capitalized, under-capitalized, significantly under-capitalized, and critically under-capitalized. Under the prompt corrective action provisions of FDICIA as modified by the Basel III capital rules, an insured depository institution generally will be classified as well-capitalized if it has a CET1 ratio of at least 6.5%, a Tier 1 capital ratio of at least 8%, a total capital ratio of at least 10% and a Tier 1 leverage ratio of at least 5%, and an insured depository institution generally will be classified as under-capitalized if its CET1 ratio is under 3%, its total risk-based capital ratio is less than 8%, its Tier 1 risk-based capital ratio is less than 6%, or its Tier 1 leverage ratio is less than 4%. An institution that, based upon its capital levels, is classified as “well-capitalized,” “adequately capitalized,” or “under-capitalized,” may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice warrants such treatment. At each successive lower capital category, an insured depository institution is subject to more restrictions and prohibitions, including restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits. Furthermore, if a bank is classified in one of the under-capitalized categories, it is required to submit a capital restoration plan to the Federal bank regulator, and the holding company must guarantee the performance of that plan.

Other Regulations

The Company is subject to a wide range of other requirements and restrictions contained in both the laws of the United States and the states in which its banks and other subsidiaries operate. These regulations include but are not limited to the following:

stress test and capital plan to which the FRB has not objected. See discussion under “Liquidity Management Actions” on page 74 .

The Parent is subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, both as administered by the SEC. As a company listed on the NASDAQ Global Select Market, the Parent is subject to NASDAQ listing standards for quoted companies.

The Company is subject to the Sarbanes-Oxley Act of 2002, the Dodd-Frank Act, and other federal and state laws and regulations which address, among other issues, corporate governance, auditing and accounting, executive

compensation, and enhanced and timely disclosure of corporate information. NASDAQ has also adopted corporate governance rules, which are intended to allow shareholders and investors to more easily and efficiently monitor the performance of companies and their directors.

The Board of Directors of the Parent has overseen management’s establishment of a comprehensive system of corporate governance and risk practices. This system includes policies and guidelines such as Corporate Governance Guidelines, a Code of Business Conduct and Ethics for Employees, a Directors Code of Conduct, a Related Party Transaction Policy, Stock Ownership and Retention Guidelines, a Compensation Clawback Policy, an insider trading policy including provisions prohibiting hedging and placing restrictions on the pledging of company stock by insiders, and charters for the Audit, Risk Oversight, Compensation, and Nominating and Corporate Governance Committees. More information on the Company’s corporate governance practices is available on the Company’s website at www.zionsbancorporation.com. (The Company’s website is not part of this Annual Report on Form 10-K).

The Company has adopted policies, procedures and controls to address compliance with the requirements of the banking, securities and other laws and regulations described above or otherwise applicable to the Company. The Company intends to make appropriate revisions to reflect any changes required.

Regulators, Congress, state legislatures, and international consultative bodies continue to enact rules, laws, and policies to regulate the financial services industry and public companies and to protect consumers and investors. The nature of these laws and regulations and the effect of such policies on future business and earnings of the Company cannot be predicted.

GOVERNMENT MONETARY POLICIES

The earnings and business of the Company are affected not only by general economic conditions, but also by policies adopted by various governmental authorities. The Company is particularly affected by the monetary policies of the FRB, which affect both short-term and long-term interest rates and the national supply of bank credit.

In view of the changing conditions in the economy and the effect of the FRB’s monetary policies, it is difficult to predict future changes in loan demand, deposit levels and interest rates, or their effect on the business and earnings of the Company. FRB monetary policies have had a significant effect on the operating results of commercial banks in the past and are expected to continue to do so in the future.

REGULATORY RELIEF IF PROPOSED RESTRUCTURING IS COMPLETED AND FSOC APPLICATION IS APPROVED

As discussed above, on November 20, 2017, we announced a proposal to streamline our corporate structure by merging the Parent into its bank subsidiary, ZB, N.A. In connection with the proposed restructuring, we also intend to file an application with FSOC (the “FSOC Appeal”) that, if successful, could potentially eliminate “enhanced” regulation of the “Company” as a SIFI.

If completed, the proposed restructuring would eliminate the bank holding company structure and associated regulatory framework and would result in ZB, N.A. becoming the top-level publicly-traded entity within our corporate structure. If the proposed restructuring and FSOC Appeal are successful, the Company expects that:

heightened standards for national banks with assets of $50 billion or more, and the DFAST process, as described above under “Capital Planning and Stress Testing.”

In addition, if the restructuring is completed, the Company generally would no longer be subject to the Securities Law of 1933, but would remain subject to the requirements of the Securities Exchange Act of 1934, including the reporting requirements thereunder. However, the Company would be subject to OCC regulations governing securities offerings and make any filings required under the Securities Exchange Act with the OCC instead of the SEC.