Item 1A. Risk Factors and Other Disclosures 2021 Form 10-K

• Availability — ensuring our data and systems are accessible to meet our business needs

We collect, use, store or transmit a large amount of confidential, proprietary and other information (including personal information of customers, claimants or employees) in connection with the operation of our business. Systems are subject to increased cyberattacks and unauthorized access, such as physical and electronic break-ins or unauthorized tampering.

We constantly defend against threats to our data and systems, including malware and computer virus attacks, unauthorized access, system failures and disruptions. We have experienced breaches of our data and systems, although to date none of these breaches has had a material effect on our business, operations or reputation. Events like these jeopardize the information processed and stored in, and transmitted through, our computer systems and networks and otherwise cause interruptions or malfunctions in our operations, which could result in damage to our reputation, financial losses, litigation, increased costs, regulatory penalties or customer dissatisfaction.

These risks may increase in the future as threats become more sophisticated and we continue to expand internet and mobile strategies, develop additional remote connectivity solutions to serve our employees and customers, develop and expand products and services designed to protect customers’ digital footprint, and build and maintain an integrated digital enterprise.

Our increased use of third-party services (e.g., cloud technology and software as a service) can make it more difficult to identify and respond to cyberattacks in any of the above situations. Although we may review and assess third-party vendor cyber security controls, our efforts may not be successful in preventing or mitigating the effects of such events. Third parties to whom we outsource certain functions are also subject to cybersecurity risks.

Personal information is subject to an increasing number of federal, state, local and international laws and regulations regarding privacy and data security, as well as contractual commitments. Any failure or perceived failure by us to comply with such obligations may result in governmental enforcement actions and fines, litigation or public statements against us by consumer advocacy groups or others and could cause our employees and customers to lose trust in us, which could have an adverse effect on our reputation and business.

See the Regulation section, Privacy Regulation and Data Security, for additional information.

The occurrence of a disaster, such as a natural catastrophe, pandemic, industrial accident, blackout, terrorist attack, war, cyberattack, computer virus, insider threat, unanticipated problems with our disaster recovery processes, or a support failure from external providers, could have an adverse effect on our ability to conduct business and on our results of operations and financial condition, particularly if those

events affect our computer-based data processing, transmission, storage, and retrieval systems or destroy data. If a significant number of employees were unavailable in the event of a disaster, our ability to effectively conduct business could be severely compromised. Our systems are also subject to compromise from internal threats.

Losses from changing climate and weather conditions may adversely affect our financial condition, profitability or cash flows

Climate change affects the occurrence of certain natural events, such as increasing the frequency or severity of wind, tornado, hailstorm and thunderstorm events due to increased convection in the atmosphere. There could also be more frequent wildfires in certain geographies, more flooding and the potential for increased severity of hurricanes due to higher sea surface temperatures. As a result, incurred losses from such events and the demand, price and availability of reinsurance coverages for automobile and homeowners insurance may be affected.

Climate change may also impact insurability by impairing our ability to identify and quantify potential hazards that will result in losses and offer our customers products at an affordable price. Our investment portfolio is also subject to the effects of climate change as economic shifts alter the return dynamic of long-term investments and reduce valuations.

Due to significant variability associated with future changing climate conditions, we are unable to predict the impact climate change will have on our businesses.

We are subject to extensive regulation, and potential further restrictive regulation may increase operating costs and limit growth

Many of our affiliates operate in the highly regulated insurance and broader financial services sector and are subject to extensive laws and regulations that are complex and subject to change. Changes may lead to additional expenses, increased legal exposure, or increased reserve or capital requirements limiting our ability to grow or to achieve targeted profitability. Moreover, laws and regulations are administered and enforced by governmental authorities that exercise interpretive latitude, including:

• State insurance regulators

• State securities administrators

• State attorneys general

• Federal agencies including the SEC, the Financial Industry Regulatory Authority, the Department of Labor, the U.S. Department of Justice and the National Labor Relations Board

Consequently, compliance with one regulator’s or enforcement authority’s interpretation of a legal issue may not result in compliance with another’s interpretation of the same issue.

There is risk that one regulator’s or enforcement authority’s interpretation of a legal issue may change

The Allstate Corporation 27

2021 Form 10-K Part I - Item 1A. Risk Factors and Other Disclosures

to our detriment. There is also a risk that changes in the overall legal environment may cause us to change our views regarding the actions we need to take from a legal risk management perspective. This could necessitate changes to our practices that may adversely impact our business. In some cases, state insurance laws and regulations are generally intended to protect or benefit purchasers or users of insurance products, not holders of securities that we issue. These laws and regulations may limit our ability to grow or to improve the profitability of our business.

In addition, increasing governmental and societal attention to environmental, social, and governance matters, including expanding mandatory and voluntary reporting, diligence, and disclosure on topics such as climate change, human capital, labor, and risk oversight, could expand the nature, scope, and complexity of matters that we are required to control, assess, and report.

A regulatory environment that requires rate increases to be approved, can dictate underwriting practices and mandate participation in loss sharing arrangements may adversely affect results of operations and financial condition

Political events and positions can affect the insurance market, including efforts to suppress rates to a level that may not allow us to reach targeted levels of profitability. Regulatory challenges to rate increases may restrict rate changes that may be required to achieve targeted levels of profitability and returns on equity. If we are unsuccessful, our results of operations could be negatively impacted.

In addition, certain states have enacted laws that require an insurer conducting business in that state to participate in assigned risk plans, reinsurance facilities and joint underwriting associations. Certain states also require the insurer to offer coverage to all consumers, often restricting an insurer’s ability to charge the price it might otherwise charge for the risk acceptance. In these markets, we may be compelled to underwrite significant amounts of business at lower-than-desired rates, possibly leading to an unacceptable return on equity. Alternatively, as the facilities recognize a financial deficit, they could have the ability to assess participating insurers, adversely affecting our results of operations and financial condition. Laws and regulations of many states also limit an insurer’s ability to withdraw from one or more lines of insurance, except pursuant to a plan that is approved by the state insurance department. Certain states require an insurer to participate in guaranty funds for impaired or insolvent insurance companies. These funds periodically assess losses against all insurance companies doing business in the state. Our results of operations and financial condition could be adversely affected by any of these factors.

Regulatory reforms, and the more stringent application of existing regulations, may make it more expensive for us to conduct our business

The federal government has enacted comprehensive regulatory reforms for financial services entities. As part of a larger effort to strengthen the

regulation of the financial services market, certain reforms are applicable to the insurance industry.

The Federal Insurance Office (“FIO”) and Financial Stability Oversight Council have been established, and the federal government may enact reforms that affect the state insurance regulatory framework. The potential impact of state or federal measures that change the nature or scope of insurance and financial regulation is uncertain but may make it more expensive for us to conduct business and limit our ability to grow or achieve profitability.

We have business process and information technology operations in Canada, India and the United Kingdom that are subject to operating, regulatory and political risks in those countries. We may incur substantial costs and other negative consequences if any of these occur, including an adverse effect on our business, results of operations and financial condition.

Losses from legal and regulatory actions may be material to our results of operations, cash flows and financial condition

We are involved in various legal actions, including class-action litigation challenging a range of company practices and coverage provided by our insurance products, some of which involve claims for substantial or indeterminate amounts. We are also involved in various regulatory actions and inquiries, including market conduct exams by state insurance regulatory agencies. In the event of an unfavorable outcome in any of these matters, the ultimate liability may be more than amounts currently accrued or disclosed in our reasonably possible loss range and may be material to our results of operations, cash flows and financial condition.

See Note 15 of the consolidated financial statements.

Changes in or the application of accounting standards issued by standard-setting bodies and changes in tax laws may adversely affect our results of operations and financial condition

Our financial statements are subject to the application of accounting principles generally accepted in the United States of America, which are periodically revised, interpreted or expanded. Accordingly, we may be required to adopt new guidance or interpretations, which may have a material effect on our results of operations and financial condition and could adversely impact financial strength ratings.

• Market declines, changes in business strategies or other events impacting the fair value of goodwill or purchased intangible assets could result in an impairment charge to income

• Realization of our deferred tax assets assumes that we can fully utilize the deductions recognized for tax purposes; we may recognize additional tax expense if these assets are not fully utilized

• New tax legislative initiatives may be enacted that may impact our effective tax rate and could adversely affect our tax positions or tax liabilities

28 www.allstate.com

Part I - Item 1A. Risk Factors and Other Disclosures 2021 Form 10-K

See MD&A, Application of Critical Accounting Estimates and Note 2 of the consolidated financial statements for further details.

Loss of key vendor relationships or failure of a vendor to protect our data, confidential and proprietary information, or personal information of our customers, claimants or employees could adversely affect our operations

We rely on services and products provided by many vendors in the U.S. and abroad. These include vendors of computer hardware, software, cloud technology and software as a service, as well as vendors or outsourcing of services such as:

• Claim adjustment services

• Call center services for customer support

• Human resource benefits management

• Information technology support

• Investment management services

If any vendor becomes unable to continue to provide products or services, or fails to protect our confidential, proprietary, and other information, we may suffer operational impairments and financial losses.

Our ability to attract, develop, and retain talent to maintain appropriate staffing levels and establish a successful work culture is critical to our success

Competition from within the insurance industry and from other industries, including the technology sector, for qualified employees with highly specialized knowledge in areas such as underwriting, data and analytics, technology and e-commerce, has often been intense and we have experienced increased competition in hiring and retaining employees. The increased prevalence of remote-working arrangements that do not require employees to relocate to take a new job could contribute to higher turnover.

Factors that affect our ability to attract and retain such employees include:

• Compensation and benefits

• Training and re-skilling programs

• Reputation as a successful business with a culture of fair hiring, and of training and promoting qualified employees

• Recognition of and response to changing trends and other circumstances that affect employees

The unexpected loss of key personnel could have a material adverse impact on our business because of the loss of their skills, knowledge of our products and offerings and years of industry experience and, in some cases, the difficulty of promptly finding qualified replacement personnel.

Misconduct or fraudulent acts by employees, agents and third parties may expose us to financial loss, disruption of business, regulatory assessments and reputational harm

The company and the insurance industry are inherently susceptible to past and future misconduct

or fraudulent activities by employees, representative agents, vendors, customers and other third parties. These activities could include:

• Fraud against the company, its employees and its customers through illegal or prohibited activities

• Unauthorized acts or representations, unauthorized use or disclosure of personal or proprietary information, deception, and misappropriation of funds or other benefits