DESCRIPTION OF BUSINESS

Zions Bancorporation, National Association and its subsidiaries (collectively “Zions Bancorporation, N.A.,” “the Bank,” “we,” “our,” “us”) is a national commercial bank headquartered in Salt Lake City, Utah. The Bank owns and operates 433 branches at year-end 2018 . The Bank provides a full range of banking and related services, primarily in Arizona, California, Colorado, Idaho, Nevada, New Mexico, Oregon, Texas, Utah, Washington, and Wyoming. The Bank conducts its operations through seven separately managed and branded segments, which we sometimes refer to as “affiliates” or by reference to their respective brands. Full-time equivalent employees totaled 10,201 at December 31, 2018 . For further information about the Bank’s industry segments, see “Business Segment Results” on page 43 in MD&A and Note 21 of the Notes to Consolidated Financial Statements. For information about the Bank’s foreign operations, see “Foreign Exposure and Operations” on page 50 in MD&A. The “Executive Summary” on page 31 in MD&A provides further information about the Bank.

PRODUCTS AND SERVICES

The Bank focuses on providing community banking services by continuously strengthening its core business lines of (1) small- and medium-sized business and corporate banking; (2) commercial and residential development, construction and term lending; (3) retail banking; (4) treasury cash management and related products and services; (5) residential mortgage lending and servicing; (6) trust and wealth management; (7) limited capital markets activities, including municipal finance advisory and underwriting; and (8) investment activities. It operates primarily through seven geographic regions, each with its own local branding, chief executive officer and management team.

In addition to providing a wide variety of commercial products and services, the Bank provides a range of personal banking services to individuals, including home mortgages, bankcard, other installment loans, home equity lines of credit, checking accounts, savings accounts, certificates of deposit of various types and maturities, trust services, safe deposit facilities, and Internet and mobile banking. The Bank provides services to key market segments through its Private Client Services and Executive Banking Groups. It offers self-directed brokerage services through Zions Direct and also offers comprehensive and personalized wealth management and investment services.

The Bank has built specialized lines of business in capital markets and public finance and is a leader in small business administration (“SBA”) lending. The Bank is one of the nation’s largest providers of SBA 7(a) and SBA 504 financing to small businesses. It owns an equity interest in FAMC and is its top originator of secondary market agricultural real estate mortgage loans. The Bank provides finance advisory and corporate trust services for municipalities. The Bank also provides bond transfer, stock transfer, and escrow services nationally in its corporate trust business.

COMPETITION

The Bank operates in a highly competitive environment. The Bank’s most direct competition for loans and deposits comes from other commercial banks, credit unions, and thrifts, including institutions that do not have a physical presence in our market footprint but solicit via the Internet and other means. In addition, the Bank competes with finance companies, mutual funds, insurance companies, brokerage firms, securities dealers, investment banking companies, financial technology and other non-traditional lending and banking companies, and a variety of other types of companies. These companies may have fewer regulatory constraints and some have lower cost structures or tax burdens.

The primary factors in competing for business include the quality of service delivered, our local community knowledge, convenience of office locations, online banking functionality and other delivery methods, range of products offered, pricing and the overall relationship with our clients. The Bank must compete effectively along all of these dimensions to remain successful.

SUPERVISION AND REGULATION

This section describes the material elements of selected laws and regulations applicable to the Bank. The descriptions are not intended to be complete and are qualified in their entirety by reference to the full text of the statutes and regulations described. Changes in applicable laws or regulations, and in their application by regulatory agencies, cannot be predicted, but they may have a material effect on the business and results of the Bank.

On September 30, 2018, we completed the merger of Zions Bancorporation, the Bank’s former holding company, with and into Zions Bancorporation, N.A., sometimes referred to herein as the “restructuring.” More information about the restructuring and its effects can be found in the proxy statement filed by Zions Bancorporation with the SEC on July 24, 2018. In connection with completing the restructuring, we also received approval of an application filed with the Financial Stability Oversight Council (“FSOC”) seeking a determination that the Bank is not “systemically important” as defined by provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”). As a result of the restructuring and FSOC approval:

The banking and financial services business in which we engage is and remains highly regulated. Such regulation is intended, among other things, to improve the stability of banking and financial companies and to protect the interests of customers, including both loan customers and depositors, and taxpayers. These regulations are not, however, generally intended to protect the interests of our shareholders or creditors, and in fact may have the consequence of reducing returns to our shareholders. Banking laws and regulations promulgated thereunder have given financial regulators expanded powers over many aspects of the financial services industry, which have reduced and may continue to reduce returns earned by shareholders.

Legislative changes to laws governing the financial industry occur frequently; some of this legislation materially affects the manner in which we and other financial institutions operate, including increasing the costs and other burdens of conducting our businesses. In addition, the banking agencies regularly promulgate new regulations or modify existing regulations, which also have significant impact on the financial industry. The content and impact of such regulatory changes cannot presently be determined. The Bank is committed to both satisfying regulatory expectations and providing attractive shareholder returns. However, given the ever-evolving regulatory environment, the results of these efforts cannot yet be known.

General

The Bank is subject to the provisions of the National Bank Act and other statutes governing national banks, as well as the rules and regulations of the OCC, the CFPB, and the FDIC. It is also subject to examination and supervision by the OCC and examination by the CFPB in respect of federal consumer financial regulations. The Bank, as well as some of its subsidiaries, is also subject to regulation by other federal and state agencies. These regulatory agencies may exert considerable influence over our activities through their supervisory and examination roles. Our brokerage and investment advisory subsidiaries are regulated by the SEC, Financial Industry Regulatory Authority (“FINRA”) and/or state securities regulators.

The National Bank Act

Prior to the restructuring, Zions Bancorporation’s corporate affairs were governed by Utah state law and securities law matters were governed by the federal securities laws, including the Securities Act and Exchange Act, as administered by the SEC. Each of these legal regimes is well-developed and used widely by public companies.

Following the restructuring, the Bank’s corporate affairs are governed by the National Bank Act and related regulations administered by the OCC. With respect to securities matters, the Bank is not subject to the Securities Act, but is subject to OCC regulations governing securities offerings. The Bank’s common stock and certain other securities are registered or deemed registered under the Exchange Act, which vests the OCC with the power to administer and enforce certain sections of the Exchange Act applicable to banks such as the Bank, though the Bank continues to make filings required by the Exchange Act with the SEC as a voluntary filer. These statutory and regulatory regimes are not as well developed as the corporate and securities law regimes applicable to many other publicly held corporations. See discussion under “ Risk Factors .”

The Dodd-Frank Act

The Dodd-Frank Act and related regulations broadly affect the financial services industry. Among other things, the Dodd-Frank Act involves mandatory divestiture of certain equity investments, increasing regulation of executive and incentive-based compensation, requiring banks to pay increased fees to regulatory agencies, and requiring numerous other provisions aimed at strengthening the sound operation of the financial services sector.

Regulations promulgated under the Dodd-Frank Act require many banks to maintain greater levels of capital and liquid assets than was generally the case prior to the enactment of the Dodd-Frank Act and limit the forms of capital that such banks rely upon for regulatory purposes. Certain bank holding companies and other financial institutions, known as systemically important financial institutions, or SIFIs, are required to adhere to “enhanced prudential supervision” requirements of the Dodd-Frank Act and the annual Comprehensive Capital Analysis (“CCAR”) process administered by the FRB, which in effect requires SIFIs to maintain capital based on hypothetical scenarios dictated by the FRB. As a result of the restructuring and FSOC approval, the Bank is no longer subject to these requirements (including the prior non-objection requirement under CCAR for declaring any dividends or share repurchases), or the liquidity and capital requirements applicable to SIFIs. However, the Bank continues to be subject to the OCC’s heightened standard guidelines, which establish enhanced requirements for national banks with assets of $50 billion or more, and other regulatory requirements that reduce its flexibility to return capital to shareholders and respond to market developments and opportunities in such areas as capital raising and acquisitions. Additionally, in May 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act, also known as “the Crapo Bill,” was signed into law, reducing regulatory requirements for many banking institutions and exempting the Bank from the capital planning actions as required by the Dodd-Frank Act.

The Dodd-Frank Act’s provisions and related regulations also affect the fees we must pay to regulatory agencies and the pricing of certain products and services, including the following:

The Dodd-Frank Act also created the CFPB, which is responsible for promulgating regulations designed to protect consumers’ financial interests and examining large financial institutions for compliance with, and enforcing, those regulations. The Dodd-Frank Act adds prohibitions on unfair, deceptive or abusive acts and practices to the scope of consumer protection regulations overseen and enforced by the CFPB. The Dodd-Frank Act subjected national banks to the possibility of further regulation by restricting the preemption of state laws by federal laws. Restricting the scope of federal preemption could burden national banks with the requirement that they also comply with certain state laws covering matters already covered by federal law. In addition, the Dodd-Frank Act gives greater power to state attorneys general to pursue legal actions against banking organizations for violations of federal law.

The Bank and other companies subject to the Dodd-Frank Act are subject to a number of requirements regarding the time, manner and form of compensation given to its key executives and other personnel receiving incentive compensation, which are being imposed through the supervisory process as well as published guidance and proposed rules. These restrictions imposed by the Dodd-Frank Act include documentation and governance, deferral, risk-balancing, and clawback requirements. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or engage in other activities, or could result in regulatory enforcement actions.

During the second quarter of 2016, the U.S. financial regulators, including the FRB and the SEC, proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets (including the Bank). The proposed revised rules would establish general qualitative requirements applicable to all covered entities, additional specific requirements for entities with total consolidated assets of at least $50 billion, such as the Bank, and further, more stringent requirements for those with total consolidated assets of at least $250 billion. The general qualitative requirements include: (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (iii) establishing requirements for performance measures to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate record-keeping. For larger financial institutions, including the Bank, the proposed revised regulations would also introduce very prescriptive requirements relating to the types and percentages, the timing of the realization, and the risk of forfeiture of incentive compensation awarded to “senior executive officers” and “significant risk-takers.” The regulators have not yet issued any final rules.

Capital Standards - Basel Framework

In 2013, the FRB, FDIC, and OCC published final rules (the “Basel III capital rules”) establishing a new comprehensive capital framework for U.S. banking organizations. The Basel III capital rules effectively replaced the Basel I capital rules and implemented the Basel Committee’s December 2010 framework, commonly referred to as Basel III, for strengthening international capital standards as well as certain provisions of the Dodd-Frank Act. The Basel III capital rules substantially revised the risk-based capital requirements applicable to bank holding companies and depository institutions, including the Bank, compared to the Basel I U.S. risk-based capital rules. The Basel III capital rules became effective for the Bank on January 1, 2015 and were subject to phase-in periods for certain of their components. In November 2017, the FRB, FDIC and OCC published a final rule that extended the 2017 transition provisions for certain U.S. Basel III capital rules for non-advanced approaches banks, such as the Bank. Effective January 1, 2018, the final rule retains the 2017 Basel III transitional treatment of certain DTAs and mortgage servicing assets, among others. As a result, since January 1, 2018, our DTAs and mortgage servicing assets retained their 2017 risk weight treatment until the federal banking regulators revise the extended transitional treatment under the November 2017 transitional rule.

The Basel III capital rules define the components of capital and address other issues affecting the numerator in banking institutions’ regulatory capital ratios. The Basel III capital rules also address risk weights and other issues affecting the denominator in banking institutions’ regulatory capital ratios and replaced the risk-weighting approach derived from Basel I capital accords of the Basel Committee, with a more risk-sensitive approach based, in part, on the standardized approach in the Basel Committee’s 2004 Basel II capital accords. The Basel III capital rules also implemented the requirements of Section 939A of the Dodd-Frank Act to remove references to credit ratings from the federal banking agencies’ rules.

The Basel III capital rules, among other things, (i) introduced a new capital measure called “Common Equity Tier 1” (“CET1”), (ii) specified that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting specified requirements, (iii) applied most deductions/adjustments to regulatory capital measures to CET1 and not to the other components of capital, thus potentially requiring higher levels of CET1 in order to meet minimum ratios, and (iv) expanded the scope of the deductions/adjustments from capital as compared to prior regulations.

Under the Basel III capital rules, the minimum capital ratios are as follows:

As of January 1, 2019, the Basel III capital rules also require the Bank to maintain a 2.5% “capital conservation buffer” designed to absorb losses during periods of economic stress, composed entirely of CET1, on top of the minimum risk-weighted asset ratios, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7.0%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to risk-weighted assets of at least 10.5%. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer face constraints on dividends, equity repurchases, and compensation based on the amount of the shortfall. The severity of the constraint depends on the amount of the shortfall and the institution’s “eligible retained income” (that is four quarter trailing net income, net of distributions and tax effect not reflected in net income).

The Basel III capital rules also prescribed a standardized approach for calculating risk-weighted assets that expanded the risk-weighting categories from Basel I-derived categories (0%, 20%, 50% and 100%) to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. Government and agency securities, to 600% for certain equity exposures, to 1,250% for certain securitization exposures, and resulting in higher risk weights for a variety of asset categories. In addition, the Basel III capital rules provided more advantageous risk weights for derivatives and repurchase-style transactions cleared through a qualifying central counterparty and increased the scope of eligible guarantors and eligible collateral for purposes of credit risk mitigation.

The Basel III capital rules provided for a number of deductions from and adjustments to CET1. These include, for example, the requirement that mortgage servicing rights, DTAs dependent upon future taxable income, and significant investments in common equity issued by nonconsolidated financial entities be deducted from CET1 to the extent that any one such category exceeds 10% of CET1 or all such categories in the aggregate exceed 15% of CET1. The application of this part of the rule did not result in any deductions from CET1 for us.

Under prior Basel I capital standards, the effects of accumulated other comprehensive income (“AOCI”) items included in capital were excluded for purposes of determining regulatory capital and capital ratios. As a “non-advanced approaches banking organization,” we made a one-time permanent election as of January 1, 2015 to continue to exclude these items, as allowed under the Basel III capital rules.

Basel III also required additional regulatory capital disclosures to be made that are commonly referred to as “Pillar 3” disclosures. These disclosures require the Bank to make prescribed regulatory disclosures on a quarterly basis regarding its capital structure adequacy and risk-weighted assets. The Bank began publishing these Pillar 3 disclosures in 2015, and such disclosures are available on the Bank’s website.

The Basel Committee has issued a series of updates that propose other changes to capital regulations. In one of these, the Basel Committee finalized a revised framework for calculating minimum capital requirements for market risk, which is expected to increase market risk capital requirements for most banking organizations. The Basel Committee has set an effective date for reporting under the revised framework for market risk capital of January 1, 2022. The U.S. federal bank regulatory agencies have not yet proposed rules implementing these revisions for U.S. banking organizations. The Bank met all capital adequacy requirements under the Basel III capital rules as of December 31, 2018.

Capital Planning and Stress Testing

As a result of the successful completion of the restructuring and FSOC approval described elsewhere in this report, and the enactment of the Crapo Bill, the Bank is no longer required to participate in the FRB’s CCAR process or publicly disclose the results of stress testing or the Bank’s proposed capital actions. However, the Bank intends to continue to release the results of its internal stress tests, published to its website, as stress testing is the Bank’s

primary method of assessing capital adequacy. Prior to elimination of this requirement, however, the Bank submitted its 2018 capital plan and stress test results to the FRB. In its capital plan, the Bank was required to forecast for nine quarters, under a variety of hypothetical economic scenarios, its estimated regulatory capital ratios, and its generally accepted accounting principles (“GAAP”) tangible common equity ratio. On June 21, 2018, we filed a Form 8-K with the SEC presenting the results of the Bank’s 2018 Dodd-Frank Act stress tests (“DFAST”). The results of the stress test demonstrated that the Bank had sufficient capital to withstand a severe hypothetical economic downturn. Detailed disclosure of the Bank’s 2018 DFAST results can also be found on our website. The Bank expects to continue to utilize its internal stress testing as an important mechanism to inform its decisions on the appropriate level of capital, based upon actual and hypothetically-stressed economic conditions.

Liquidity

Historically, regulation and monitoring of bank liquidity has been addressed as a supervisory matter, both in the United States and internationally, without required formulaic measures. However, in January 2016, the FRB and other banking regulators adopted final rules (“Final Liquidity Coverage Ratio (“LCR”) Rule”) implementing a U.S. version of the Basel Committee’s LCR requirement. The LCR is intended to ensure that banks hold sufficient amounts of securities and other liquid assets to cover the anticipated net cash outflows during a hypothetical acute 30-day stress scenario. The Final LCR Rule applies to large, internationally active banking organizations (those with at least $250 billion in total assets or at least $10 billion in on-balance sheet foreign exposure) and a modified, less stringent rule applies to bank holding companies and savings and loan holding companies that have at least $50 billion in total assets but are not internationally active banking organizations.

Following the restructuring, the Bank is no longer subject to the Final LCR Rule, despite having greater than $50 billion in total assets. The Bank continues to maintain strong on-balance sheet liquidity and a portfolio of liquid assets comparable to requirements in the rule.

Financial Privacy and Cyber Security

The federal banking regulators have adopted rules that limit the ability of banks and other financial institutions to disclose non-public information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services. Federal law makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means.

In October 2016, the federal banking regulators jointly issued an advance notice of proposed rulemaking on enhanced cyber risk management standards that are intended to increase the operational resilience of large and interconnected entities under their supervision. The advance notice of proposed rulemaking addressed five categories of cyber standards: (1) cyber risk governance; (2) cyber risk management; (3) internal dependency management; (4) external dependency management; and (5) incident response, cyber resilience, and situational awareness. The comment period expired in February 2017; however, the regulators have not yet issued any revised proposed rules or final rules.

State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including date encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. In June 2018, the California legislature passed the California Consumer Privacy Act of 2018 (the “CCPA”), which is scheduled to take effect on January 1, 2020. The CCPA, which covers businesses that obtain or access personal information on California resident consumers, grants consumers enhanced privacy rights and

control over their personal information and imposes significant requirements on covered companies with respect to consumer data privacy rights. We expect this trend of state-level activity to continue and are continually monitoring developments in the states in which we operate. Other states have implemented, or are considering, similar privacy laws.

In May 2018, the General Data Protection Regulation (the “GDPR”) established new requirements regarding the handling of personal data. We believe the applicability of the GDPR to us is minimal as we do not offer goods or services to EU residents or monitor their behaviors.

Prompt Corrective Action

The Federal Deposit Insurance Corporation Improvement Act (“FDICIA”) requires each federal banking agency to take prompt corrective action to resolve the problems of insured depository institutions, including but not limited to those that fall below one or more prescribed minimum capital ratios. Pursuant to FDICIA, the FDIC promulgated regulations defining the following five categories in which an insured depository institution will be placed, based on the level of its capital ratios: well-capitalized, adequately capitalized, under-capitalized, significantly under-capitalized, and critically under-capitalized. Under the prompt corrective action provisions of FDICIA as modified by the Basel III capital rules, an insured depository institution generally will be classified as well-capitalized if it has a CET1 ratio of at least 6.5%, a Tier 1 risk-based capital ratio of at least 8%, a total capital ratio of at least 10% and a Tier 1 leverage ratio of at least 5%, and an insured depository institution generally will be classified as under-capitalized if its CET1 ratio is under 4.5%, its total risk-based capital ratio is less than 8%, its Tier 1 risk-based capital ratio is less than 6%, or its Tier 1 leverage ratio is less than 4%. An institution that, based upon its capital levels, is classified as “well-capitalized,” “adequately capitalized,” or “under-capitalized,” may be treated as though it were in the next lower capital category if the appropriate federal banking agency, after notice and opportunity for hearing, determines that an unsafe or unsound condition or an unsafe or unsound practice warrants such treatment. At each successive lower capital category, an insured depository institution is subject to more restrictions and prohibitions, including restrictions on growth, restrictions on interest rates paid on deposits, restrictions or prohibitions on payment of dividends and restrictions on the acceptance of brokered deposits. Furthermore, if a bank is classified in one of the under-capitalized categories, it is required to submit a capital restoration plan to the Federal bank regulator.

Other Regulations

The Bank is subject to a wide range of other requirements and restrictions contained in both the laws of the United States and the states in which its banks and other subsidiaries operate. These regulations include but are not limited to the following:

The Bank is subject to the Sarbanes-Oxley Act of 2002, the Dodd-Frank Act, and other federal and state laws and regulations which address, among other issues, corporate governance, auditing and accounting, executive compensation, and enhanced and timely disclosure of corporate information. The National Association of Securities Dealers Automated Quotations (“NASDAQ”) has also adopted corporate governance rules, which are intended to allow shareholders and investors to more easily and efficiently monitor the performance of companies and their directors.

The Board of Directors of the Bank has overseen management’s establishment of a comprehensive system of corporate governance and risk practices. This system includes policies and guidelines such as Corporate Governance Guidelines, a Code of Business Conduct and Ethics for Employees, a Directors Code of Conduct, a Related Party Transaction Policy, Stock Ownership and Retention Guidelines, a Compensation Clawback Policy, an insider trading policy including provisions prohibiting hedging and placing restrictions on the pledging of bank stock by insiders, and charters for the Executive, Audit, Risk Oversight, Compensation, and Nominating and Corporate Governance Committees. More information on the Bank’s corporate governance practices is available on the Bank’s website at www.zionsbancorporation.com. (The Bank’s website is not part of this Annual Report on Form 10-K).

The Bank has adopted policies, procedures and controls to address compliance with the requirements of the banking, securities and other laws and regulations described above or otherwise applicable to the Bank. The Bank intends to make appropriate revisions to reflect any changes required.

Regulators, Congress, state legislatures, and international consultative bodies continue to enact rules, laws, and policies to regulate the financial services industry and public companies and to protect consumers and investors. The nature of these laws and regulations and the effect of such policies on future business and earnings of the Bank cannot be predicted.

GOVERNMENT MONETARY POLICIES

The earnings and business of the Bank are affected not only by general economic conditions, but also by policies adopted by various governmental authorities. The Bank is particularly affected by the monetary policies of the FRB, which affect both short-term and long-term interest rates and the national supply of bank credit.

In view of the changing conditions in the economy and the effect of the FRB’s monetary policies, it is difficult to predict future changes in loan demand, deposit levels and interest rates, or their effect on the business and earnings of the Bank. FRB monetary policies have had a significant effect on the operating results of commercial banks in the past and are expected to continue to do so in the future.