Item 1. Business.

M&T is a New York business corporation which is registered as a FHC under the BHCA and as a BHC under Article III-A of the New York Banking Law. The principal executive offices of M&T are located at One M&T Plaza, Buffalo, New York 14203. M&T was incorporated in November 1969. As of December 31, 2023, the Company had consolidated total assets of $208.3 billion, deposits of $163.3 billion and shareholders’ equity of $27.0 billion. The Company had 21,736 full-time and 487 part-time employees as of December 31, 2023.

At December 31, 2023, M&T had two wholly owned bank subsidiaries: M&T Bank and Wilmington Trust, N.A. The banks collectively offer a wide range of retail and commercial banking, trust and wealth management, and investment services to their customers. At December 31, 2023, M&T Bank represented over 99% of consolidated assets of the Company.

On April 1, 2022, M&T completed the acquisition of People’s United. Through its subsidiaries, People's United provided commercial banking, retail banking and wealth management services to individual, corporate and municipal customers through a network of branches located in Connecticut, southeastern New York, Massachusetts, Vermont, New Hampshire and Maine. Following the acquisition, People's United Bank, National Association, a national banking association and a wholly owned subsidiary of People's United, merged with and into M&T Bank, with M&T Bank as the surviving entity. The acquisition of People's United expanded the Company's geographical footprint and management expects the Company will benefit from greater geographical diversity and the advantages of scale associated with being a larger company.

The Company from time to time considers acquiring banks, thrift institutions, branch offices of banks or thrift institutions, or other businesses within markets currently served by the Company or in other locations that would complement the Company’s business or its geographic reach. The Company has pursued acquisition opportunities in the past, reviews different opportunities from time to time and intends to continue this practice.

Subsidiaries

M&T Bank is a banking corporation that is incorporated under the laws of the State of New York. M&T Bank is a member of the Federal Reserve System and the FHLB System, and its deposits are insured by the FDIC through its DIF up to applicable limits. M&T acquired all of the issued and outstanding shares of the capital stock of M&T Bank in December 1969. The stock of M&T Bank represents a major asset of M&T. M&T Bank operates under a charter granted by the State of New York in 1892, and the continuity of its banking business is traced to the organization of the Manufacturers and Traders Bank in 1856. The principal executive offices of M&T Bank are located at One M&T Plaza, Buffalo, New York 14203. As of December 31, 2023, M&T Bank had 961 domestic banking offices located in New York State, Maryland, New Jersey, Pennsylvania, Delaware, Connecticut, Massachusetts, Maine, Vermont, New Hampshire, Virginia, West Virginia, and the District of Columbia and a full-service commercial banking office in Ontario, Canada. As of December 31, 2023, M&T Bank had consolidated total assets of $207.8 billion, deposits of $167.3 billion and shareholder’s equity of $25.7 billion. As a commercial bank, M&T Bank offers a broad range of financial services to a diverse base of consumers, businesses, professional clients, governmental entities and financial institutions located in its markets. Lending is largely focused on consumers residing in areas where M&T Bank maintains banking offices, and on small and medium-size businesses based in those areas, although loans are originated through offices in other states and in Ontario, Canada. In addition, the Company conducts lending activities in various states through other subsidiaries. Trust and other fiduciary services are offered by M&T Bank and through its wholly owned subsidiary, Wilmington Trust Company. M&T Bank and certain of its subsidiaries also offer commercial mortgage loans secured by income producing properties or properties used by borrowers

in a trade or business. Additional financial services are provided through other operating subsidiaries of the Company.

Wilmington Trust, N.A., a national banking association and a member of the Federal Reserve System and the FDIC, commenced operations in October 1995. The deposit liabilities of Wilmington Trust, N.A. are insured by the FDIC through its DIF. The main office of Wilmington Trust, N.A. is located at 1100 North Market Street, Wilmington, Delaware 19890. Wilmington Trust, N.A. offers various trust and wealth management services. As of December 31, 2023, Wilmington Trust, N.A. had total assets of $683 million, deposits of $6 million and shareholder’s equity of $582 million.

M&T Securities is a wholly owned subsidiary of M&T that was incorporated as a New York business corporation in November 1985. M&T Securities is registered as a broker/dealer under the Exchange Act. It provides institutional brokerage and securities services. As of December 31, 2023, M&T Securities had total assets of $56 million and shareholder's equity of $55 million. M&T Securities recorded $13 million of revenue in 2023. The headquarters of M&T Securities are located at One Light Street, Baltimore, Maryland 21202.

Wilmington Funds Management is a wholly owned subsidiary of M&T that was incorporated in September 1981 as a Delaware corporation. Wilmington Funds Management is registered as an investment advisor under the Investment Advisors Act and serves as an investment advisor to the Wilmington Funds. Wilmington Funds Management had total assets of $16 million and shareholder's equity of $15 million as of December 31, 2023. Wilmington Funds Management recorded revenues of $31 million in 2023. The headquarters of Wilmington Funds Management are located at 1100 North Market Street, Wilmington, Delaware 19890.

WTIM is a wholly owned subsidiary of M&T and was incorporated in December 2001 as a Georgia limited liability company. WTIM is a registered investment advisor under the Investment Advisors Act of 1940 and provides investment management services to wealth clients. As of December 31, 2023, WTIM had total assets and shareholder’s equity of $5 million. WTIM recorded revenues of $2 million in 2023. WTIM’s headquarters is located at Terminus 27th Floor, 3280 Peachtree Road N.E., Atlanta, Georgia 30305.

WTAM is a wholly owned subsidiary of M&T and was incorporated in February 2023 as a Delaware limited liability company. WTAM is a registered investment advisor under the Investment Advisors Act and provides investment management services to certain private funds. As of December 31, 2023, WTAM had total assets and shareholder’s equity of $3 million. WTAM recorded revenues of less than $1 million in 2023. WTAM’s headquarters is located at 1100 North Market Street, Wilmington, Delaware 19890.

Wilmington Trust Company, a wholly owned subsidiary of M&T Bank, was incorporated as a Delaware bank and trust company in March 1901 and amended its charter in July 2011 to become a nondepository trust company. Wilmington Trust Company provides a variety of Delaware based trust, fiduciary and custodial services to its clients. As of December 31, 2023, Wilmington Trust Company had total assets of $1.1 billion and shareholder’s equity of $757 million. Revenues of Wilmington Trust Company were $142 million in 2023. The headquarters of Wilmington Trust Company are located at 1100 North Market Street, Wilmington, Delaware 19890.

M&T Realty Capital, a wholly owned subsidiary of M&T Bank, was incorporated as a Maryland corporation in October 1973. M&T Realty Capital engages in multifamily commercial real estate lending and provides loan servicing to purchasers of the loans it originates. As of December 31, 2023, M&T Realty Capital serviced or sub-serviced $28.0 billion of commercial mortgage loans for non-affiliates and had total assets of $1.2 billion and shareholder’s equity of $175 million. M&T Realty Capital recorded revenues of $192 million in 2023. The headquarters of M&T Realty Capital are located at One Light Street, Baltimore, Maryland 21202.

WT Investment Advisors, a wholly owned subsidiary of M&T Bank, was incorporated as a Maryland corporation in June 1995. WT Investment Advisors, a registered investment advisor under

the Investment Advisors Act, serves as an investment advisor to the Wilmington Funds, a family of proprietary mutual funds, and institutional clients. As of December 31, 2023, WT Investment Advisors had total assets of $28 million and shareholder’s equity of $17 million. WT Investment Advisors recorded revenues of $43 million in 2023. The headquarters of WT Investment Advisors are located at 1100 North Market Street, Wilmington, Delaware 19890.

Following the acquisition of People’s United on April 1, 2022, M&T Bank's subsidiaries also include PUA, a Connecticut corporation formed in 2018 that provides investment advisory services and financial management and planning services. As of December 31, 2023, PUA had total assets and shareholder's equity of $15 million. PUA recorded revenues of $6 million in 2023. Other subsidiaries of M&T Bank obtained in the People's United acquisition include entities that provide equipment leasing and financing services throughout the United States. Those subsidiaries are: LEAF Commercial Capital, Inc., a Delaware corporation incorporated in 2010, M&T Capital and Leasing Corp. (formerly known as People’s Capital and Leasing Corp.) a Connecticut corporation formed in 1997, and M&T Equipment Finance Corp. (formerly known as People’s United Equipment Finance Corp.), a Texas corporation formed in 1989. The combined total assets and shareholder's equity of the three entities was $6.6 billion and $440 million, respectively, at December 31, 2023. The combined revenues of the equipment leasing and financing services subsidiaries were $449 million for the year ended December 31, 2023.

M&T and its banking subsidiaries have a number of other special-purpose or inactive subsidiaries. These other subsidiaries did not represent, individually and collectively, a significant portion of the Company’s consolidated assets, net income and shareholders’ equity at December 31, 2023.

Segment Information, Principal Products/Services and Foreign Operations

Information about the Company’s business segments is included in note 23 of Notes to Financial Statements filed herewith in Part II, Item 8, “Financial Statements and Supplementary Data” and is further discussed in Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” In the fourth quarter of 2023, the Company completed modifications to its internal profitability reporting system to conform its internal management reporting with certain organizational changes that resulted in the realignment of its business operations into three reportable segments: Commercial Bank, Retail Bank, and Institutional Services and Wealth Management. Prior period reportable segment results have been presented in conformity with the new segment reporting structure. The Company’s international activities are discussed in note 18 of Notes to Financial Statements filed herewith in Part II, Item 8, “Financial Statements and Supplementary Data.”

The only activities that, as a class, contributed 10% or more of the sum of consolidated interest income and other income in any of the last three years were interest on loans each year, interest on deposits at banks in 2023 and trust income in 2021. The amount of income from such sources during those years is recorded in various business segments and is set forth in the Company's Consolidated Statement of Income and Notes to Financial Statements filed herewith in Part II, Item 8, "Financial Statements and Supplementary Data."

Supervision and Regulation of the Company

M&T and its subsidiaries are subject to the comprehensive regulatory framework applicable to BHCs and FHCs and their subsidiaries. Regulation of financial institutions such as M&T and its subsidiaries is intended primarily for the protection of depositors, the FDIC’s DIF and the banking and financial system as a whole, and generally is not intended for the protection of shareholders, investors or creditors other than insured depositors.

Proposals to change the applicable regulatory framework may be introduced in the U.S. Congress and state legislatures, as well as by regulatory agencies. Such initiatives may include proposals to

expand or contract the powers of BHCs and depository institutions or proposals to substantially change the financial institution regulatory system. Such legislation could change banking statutes and the operating environment of the Company in substantial and unpredictable ways. If enacted, such legislation could increase or decrease the cost of doing business, limit or expand permissible activities or affect the competitive balance among banks, savings associations, credit unions, and other financial institutions. A change in statutes, regulations or regulatory policies applicable to M&T or any of its subsidiaries could have a material effect on the business, financial condition or results of operations of the Company.

Described hereafter are material elements of the significant federal and state laws and regulations applicable to M&T and its subsidiaries.

Overview

M&T is registered with the Federal Reserve as a FHC and BHC under the BHCA. As such, M&T and its subsidiaries are subject to the supervision, examination, reporting, capital and other requirements of the BHCA and the regulations of the Federal Reserve. In addition, M&T’s banking subsidiaries are subject to regulation, supervision and examination by, as applicable, the NYSDFS, the OCC, the FDIC and the Federal Reserve, and their consumer financial products and services are regulated by the CFPB. Further, financial services entities such as M&T’s investment advisor and broker-dealer subsidiaries are subject to regulation by the SEC, FINRA, and Securities Investor Protection Corporation, among others. Certain other subsidiaries are subject to regulation by other federal and state regulators as well.

M&T Bank is a New York chartered bank and a member of the Federal Reserve System. As a result, it is subject to extensive regulation, examination and oversight by the NYSDFS and the FRB of New York. New York laws and regulations govern many aspects of M&T Bank’s operations, including branching, dividends, subsidiary activities, fiduciary activities, lending, and deposit taking. M&T Bank is also subject to Federal Reserve regulations and guidance, including with respect to capital levels. Its deposits are insured by the FDIC, subject to certain limitations, which also exercises regulatory oversight over certain aspects of M&T Bank’s operations.

Wilmington Trust, N.A. is a national bank with operations that include fiduciary and related activities with limited lending and deposit business. It is subject to extensive regulation, examination and oversight by the OCC which governs many aspects of its operations, including fiduciary activities, capital levels, office locations, dividends and subsidiary activities. Its deposits are insured by the FDIC, subject to certain limitations, which also exercises regulatory oversight over certain aspects of the operations of Wilmington Trust, N.A.

Permissible Activities under the BHCA

In general, the BHCA limits the business of a BHC to banking, managing or controlling banks, and other activities that the Federal Reserve has determined to be so closely related to banking as to be a proper incident thereto. In addition, BHCs are obligated by a Federal Reserve policy to serve as a managerial and financial source of strength to their subsidiary depository institutions, including committing resources to support such subsidiaries. This support may be required at times when M&T may not be inclined or able to provide it. In addition, any capital loans by a BHC to a subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a BHC’s bankruptcy, any commitment by the BHC to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.

A BHC that qualifies and elects to be a FHC may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the Federal Reserve, by regulation or order, in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a

substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the Federal Reserve). Activities that are financial in nature include securities underwriting and dealing, insurance underwriting and merchant banking.

M&T elected to become a FHC in March 2011. To maintain FHC status, a FHC and all of its depository institution subsidiaries must be “well capitalized” and “well managed.” The failure to meet such requirements could result in material restrictions on the activities of M&T and may also adversely affect M&T’s ability to enter into certain transactions, including acquisitions, or obtain necessary approvals in connection with those transactions, as well as loss of FHC status. Additionally, if each of the Company’s depository institution subsidiaries has not received at least a “satisfactory” rating on its most recent examination under the CRA, the Company would not be able to commence any new financial activities or acquire a company that engages in such activities, although it would still be allowed to engage in activities closely related to banking and make investments in the ordinary course of conducting banking activities. For a further discussion of the CRA, see the section captioned “CRA” included herein.

Enhanced Prudential Standards

Under Section 165 of the Dodd-Frank Act, as amended by the EGRRCPA, U.S. BHCs with total consolidated assets of $100 billion or more, including M&T, are subject to enhanced prudential standards. The enhanced prudential standards include risk-based capital and leverage requirements, liquidity standards, risk management and risk committee requirements, stress testing requirements and a debt-to-equity limit for companies that the Financial Stability Oversight Council has determined would pose a grave threat to systemic financial stability were they to fail such limits. Tailoring Rules adopted by the Federal Reserve and other federal bank regulators in 2019 assign each U.S. BHC with $100 billion or more in total consolidated assets, as well as its bank subsidiaries, to one of four categories based on its size and five other risk-based indicators: (i) cross-jurisdictional activity, (ii) weighted short-term wholesale funding, (iii) non-bank assets, (iv) off-balance sheet exposure, and (v) status as a U.S. global systemically important BHC. Under the Tailoring Rules, M&T and its depository institution subsidiaries are subject to Category IV standards, which apply to banking organizations with at least $100 billion in total consolidated assets that do not meet any of the thresholds specified for Categories I through III. The threshold for Category III is $250 billion or more in total consolidated assets, or $100 billion or more in total consolidated assets and at least $75 billion in weighted short-term wholesale funding, non-bank assets or off-balance sheet exposures.

Under the Tailoring Rules, Category IV firms, among other things, (i) are not subject to any LCR or NSFR (or, in certain cases, are subject to reduced requirements), (ii) remain eligible to opt-out of the requirement to recognize most elements of accumulated other comprehensive income in regulatory capital, (iii) are no longer subject to company-run stress testing requirements, (iv) are subject to supervisory stress testing on at least a biennial basis rather than an annual basis, (v) are subject to requirements to develop and maintain a capital plan on an annual basis and (vi) are subject to certain liquidity risk management and risk committee requirements. The Federal Reserve may impose more stringent requirements (e.g. frequency of supervisory stress tests or capital plan submissions) based on a company’s financial condition, size, complexity, risk profile, scope of operations or activities, or risks to the U.S. economy. Category IV firms are not subject to (i) advanced approaches capital requirements, (ii) the SLR and (iii) the CCyB. Other elements of the Tailoring Rules are discussed in further detail throughout this section. Compared with Category IV firms, Category III firms are subject to the LCR and NSFR, company-run stress testing requirements, annual (instead of biennial) supervisory stress tests, the SLR and the CCyB.

On July 27, 2023, the Federal Reserve, the FDIC and the OCC proposed revisions to the capital framework applicable to BHCs and their depository institution subsidiaries with $100 billion or more in assets, such as M&T. The proposed rule would introduce a new approach for calculating risk-based

capital requirements and generally align the calculation of RWA and regulatory capital for firms in all four categories. Category IV firms would become subject to the SLR and CCyB and would no longer be eligible to opt-out of the requirement to recognize most elements of accumulated other comprehensive income in regulatory capital. Those firms would be required to include all accumulated other comprehensive income components in regulatory capital, except gains and losses on cash flow hedges. Those adjustments recognized in accumulated other comprehensive income, among other items, would include unrealized losses on available-for-sale debt securities and any amounts recorded in accumulated other comprehensive income attributed to defined benefit postretirement plans. The inclusion of accumulated other comprehensive income components in regulatory capital would be subject to a phase-in period beginning July 1, 2025 until June 30, 2028, with full inclusion of required accumulated other comprehensive income components starting July 1, 2028. For further discussion of the proposed revisions to the capital framework, see the section captioned “Capital Requirements” included herein.

Capital Requirements

M&T and its subsidiary banks are required to comply with applicable Capital Rules, which are based on Basel III. The Capital Rules include both risk-based requirements, which compare three measures of capital to RWA, as well as leverage requirements, which, in the case of Category IV BHCs such as M&T, consist of the Tier 1 leverage ratio described below. Pursuant to the Capital Rules, the minimum capital ratios are as follows:

4.5% CET1 to RWA;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to RWA;

8.0% Total capital (that is, Tier 1 plus Tier 2 capital) to RWA; and

4.0% Tier 1 capital to average consolidated assets (the “leverage ratio”).

In calculating risk-based capital ratios, M&T must assign risk weights to the Company’s assets and off-balance sheet items. M&T has an ongoing process to review data elements associated with these exposures that from time to time may affect how specific exposures are classified and could lead to increases or decreases of the regulatory risk weights assigned to such exposures.

The Capital Rules also require firms to maintain a “buffer,” consisting solely of CET1 capital, in addition to the minimum risk-based requirements. Failure to satisfy the buffer requirement in full results in graduated constraints on capital distributions and discretionary executive compensation. The severity of the constraints depends on the amount of the shortfall and the firm’s “eligible retained income,” defined as the greater of (i) net income for the four preceding quarters net of distributions and associated tax effects not reflected in net income and (ii) the average of net income over the preceding four quarters.

As a Category IV BHC, M&T’s buffer requirement, referred to as the SCB, is determined through the Federal Reserve’s supervisory stress tests, discussed below. For M&T’s bank subsidiaries, the buffer requirement consists of the static capital conservation buffer equal to 2.5% of RWA.

CET1 consists of common stock instruments that meet the eligibility criteria in the Capital Rules, including common stock and related surplus, net of treasury stock, retained earnings, certain minority interests and, for certain firms, accumulated other comprehensive income. As currently permitted under the Capital Rules, M&T made a one-time permanent election to neutralize certain accumulated other comprehensive income components, with the result that those components are not recognized in M&T’s CET1.

The Capital Rules provide for a number of deductions from and adjustments to CET1. As a “non-advanced approaches” firm under the Capital Rules, M&T is subject to rules that provide for simplified capital requirements relating to the threshold deductions for mortgage servicing assets, deferred tax

assets arising from temporary differences that a banking organization could not realize through net operating loss carrybacks, and investments in the capital of unconsolidated financial institutions, as well as the inclusion of minority interests in regulatory capital. M&T’s and its subsidiary banks’ regulatory capital ratios are presented in note 24 of Notes to Financial Statements filed herewith in Part II, Item 8, “Financial Statements and Supplementary Data.”

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to the Company.

On July 27, 2023, the Federal Reserve, the FDIC and the OCC proposed revisions to the Capital Rules to implement the Basel Committee’s 2017 standards and make other changes to the Capital Rules. The proposal introduces revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements (together, the “Expanded Risk-Based Approach”). The Expanded Risk-Based Approach would apply to Category I through Category IV firms and would replace the existing advanced approaches with respect to credit and operational risk. Under the proposal, banking organizations with more than $100 billion in total consolidated assets would be required to calculate RWAs using the higher of (i) the Expanded Risk-Based Approach or (ii) the current standardized approach and revised market risk requirements. Calculating RWAs under the Expanded Risk-Based Approach would impose additional operational costs, including the costs to collect the data elements that would be used in the calculations. In addition, the proposal would subject Category IV firms, like M&T, to the deductions framework for mortgage servicing assets and deferred tax assets and the methodology for calculating minority interest limitations currently applicable only to Category I and Category II firms. Category IV firms would also no longer be eligible to opt-out of including certain components of accumulated other comprehensive income in regulatory capital.

Stress Testing and SCB

As part of the enhanced prudential requirements applicable to systemically important financial institutions, the Federal Reserve conducts periodic analyses of BHCs with at least $100 billion in total consolidated assets using baseline and severely adverse economic and financial scenarios generated by the Federal Reserve. For Category IV firms, such as M&T, these supervisory stress tests occur on a biennial basis, in even-numbered years. The Federal Reserve may also use additional components in the severely adverse scenario or additional or more complex scenarios designed to capture salient risks to specific business groups. A summary of results of the Federal Reserve’s analysis under the severely adverse stress scenario is publicly disclosed by June 30 each year. Under the Tailoring Rules, Category IV firms, including M&T, are not subject to company-run stress testing requirements.

The SCB is based on a BHC’s stressed losses in the supervisory stress test, plus four quarters of planned common stock dividends, subject to a floor of 2.5% of RWAs. Under the Tailoring Rules, for Category IV firms, the portion of the SCB based on the Federal Reserve’s supervisory stress tests will be calculated biennially, in even-numbered years. During a year in which a Category IV firm does not undergo a supervisory stress test, the firm will receive an updated SCB that reflects the firm’s updated planned common stock dividends. A Category IV firm is also able to elect to participate in the supervisory stress test in a year in which the firm would not normally be subject to the supervisory stress test and consequently receive an updated SCB. The Federal Reserve may impose more stringent requirements (e.g., frequency of supervisory stress tests or capital plan submissions) based on various factors.

In connection with the acquisition of People’s United, M&T was required to participate in the 2023 supervisory stress test and received an updated SCB. In June 2023, the Federal Reserve released the results of its most recent supervisory stress tests. Based on those results, on October 1, 2023, M&T's SCB of 4.0% became effective. Accordingly, it is currently subject to a CET1 capital requirement of 8.5% (a sum of the SCB and the minimum CET1 capital ratio).

BHCs with total consolidated assets of $100 billion or more, including Category IV BHCs such as M&T, must annually submit capital plans as part of the Federal Reserve’s process. The comprehensive capital plans include a view of capital adequacy under various scenarios — including a BHC-defined baseline scenario, a baseline scenario provided by the Federal Reserve, at least one BHC-defined stress scenario, and any severely adverse scenario provided by the Federal Reserve. A BHC’s planned capital distributions in its annual capital plan submissions must be consistent with any effective distribution limitations that would apply under the firm’s own baseline projections, including its SCB. The process is intended to help ensure that these BHCs have robust, forward-looking capital planning processes that account for each company’s unique risks and that permit continued operations during times of economic and financial stress. Each of the BHCs participating in the process is also required to collect and report certain related data to the Federal Reserve on a regular basis. The Federal Reserve incorporates an assessment of the qualitative aspects of the firm’s capital planning process into regular, ongoing supervisory activities and through targeted, horizontal assessments of particular aspects of capital planning. M&T’s annual capital plan is currently due in April each year.

Distributions

M&T is a legal entity separate and distinct from its banking and other subsidiaries. Historically, the majority of M&T’s revenue has been from dividends paid to M&T by its subsidiary banks. M&T Bank and Wilmington Trust, N.A. are subject to laws and regulations imposing restrictions on the amount of dividends they may declare and pay. Future dividend payments to M&T by its subsidiary banks will be dependent on a number of factors, including the earnings and financial condition of each such bank, and are subject to the limitations referred to in note 24 of Notes to Financial Statements filed herewith in Part II, Item 8, “Financial Statements and Supplementary Data,” and to other statutory powers of bank regulatory agencies.

An IDI is prohibited from making any capital distribution to its owner, including any dividend, if, after making such distribution, the depository institution fails to meet the required minimum level for any relevant capital measure, including the risk-based capital adequacy and leverage standards discussed herein. Dividend payments by M&T to its shareholders and common stock repurchases by M&T are subject to the oversight of the Federal Reserve. M&T’s ability to make capital distributions would likely be impacted in the event that M&T fails to maintain its SCB above its minimum CET1 risk-based, Tier-1 risk-based and total risk-based capital requirements.

In addition, the Federal Reserve’s capital plan rule also provides that a BHC must receive prior approval for any dividend, stock repurchase, or other capital distribution, other than a capital distribution on a newly issued capital instrument, if the BHC is required to resubmit its capital plan. Among other circumstances, a firm may be required to resubmit its capital plan in connection with certain acquisitions or dispositions.

Liquidity

Under the Tailoring Rules, as a Category IV firm, the Company is not subject to the Federal Reserve and other federal banking regulators rules that implement a U.S. version of the Basel Committee’s LCR requirement, which is intended to ensure that banks hold sufficient amounts of so-called high quality liquid assets to cover the anticipated net cash outflows during a hypothetical acute 30-day stress scenario or the NSFR, which is designed to promote more medium- and long-term funding of the assets and activities of banks over a one-year time horizon. The Federal Reserve’s enhanced prudential

standards, however, require the Company, as a BHC with $100 billion or more in total consolidated assets, to comply with enhanced liquidity and overall risk management standards, which include maintaining a level of highly liquid assets based on projected funding needs for 30 days, and increased involvement by boards of directors in liquidity and overall risk management. Under the Tailoring Rules, the liquidity risk management and reporting requirements are less stringent for Category IV BHCs as compared with BHCs in a different category.

Cross Guaranty Provision

The cross guaranty provisions in the FDIA require each IDI owned by the same BHC to be financially responsible for the failure or resolution costs of any affiliated insured institution. Generally, the amount of the cross guaranty liability is equal to the estimated loss to the DIF for the resolution of the affiliated institution(s) in default. The FDIC’s claim under the cross guaranty provision is superior to claims of shareholders of the IDI or its BHC and to most claims arising out of obligations or liabilities owed to affiliates of the institution, but is subordinate to claims of depositors, secured creditors and holders of subordinated debt (other than affiliates) of the commonly controlled IDI. The FDIC may decline to enforce the cross guaranty provision if it determines that a waiver is in the best interest of the DIF.

Volcker Rule

The Volcker Rule limits proprietary trading and investing in and sponsoring certain hedge funds and private equity funds (defined as “covered funds” in the Volcker Rule). The Company does not engage in any significant amount of proprietary trading as defined in the Volcker Rule and implemented the required procedures for those areas in which trading does occur. In addition, the Company does not engage in any significant covered fund activities that are impacted by the Volcker Rule.

Safety and Soundness Standards

Guidelines adopted by the federal bank regulatory agencies pursuant to the FDIA establish general standards relating to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth, compensation, fees and benefits. In general, these guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. Additionally, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties.

Limits on Undercapitalized Depository Institutions

The FDIA establishes a system of regulatory remedies to resolve the problems of undercapitalized institutions, referred to as the prompt corrective action. The federal banking regulators have established five capital categories (“well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized”) and must take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions which are undercapitalized, significantly undercapitalized or critically undercapitalized. The severity of these mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. The federal banking regulators have specified by regulation the relevant capital levels for each category. Under existing rules, a depository institution is deemed to be “well

capitalized” if it has (i) a CET1 ratio of at least 6.5%, (ii) a Tier 1 capital ratio of at least 8%, (iii) a Total capital ratio of at least 10%, and (iv) a Tier 1 leverage ratio of at least 5%.

The FDIA’s prompt corrective action provisions only apply to depository institutions and not to BHCs. The Federal Reserve’s regulations applicable to BHCs separately define “well capitalized.” A FHC that is not well capitalized and well managed (or whose bank subsidiaries are not well capitalized and well managed) under applicable prompt corrective action standards may be restricted in certain of its activities and ultimately may lose FHC status.

An institution that is categorized as undercapitalized, significantly undercapitalized or critically undercapitalized is required to submit an acceptable capital restoration plan to its appropriate federal banking regulator. Under the FDIA, in order for the capital restoration plan to be accepted by the appropriate federal banking agency, a BHC must guarantee that a subsidiary depository institution will comply with its capital restoration plan, subject to certain limitations. The BHC must also provide appropriate assurances of performance. An undercapitalized institution is also generally prohibited from increasing its average total assets, accepting brokered deposits or offering interest rates on any deposits significantly higher than prevailing market rates, making acquisitions, establishing any branches or engaging in any new line of business, except in accordance with an accepted capital restoration plan or with the approval of the FDIC. Institutions that are significantly undercapitalized or undercapitalized and either fail to submit an acceptable capital restoration plan or fail to implement an approved capital restoration plan may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions failing to submit or implement an acceptable capital restoration plan are subject to appointment of a receiver or conservator.

Transactions with Affiliates

There are various legal restrictions on the extent to which M&T and its non-bank subsidiaries or affiliates may borrow or otherwise obtain funding from M&T Bank and Wilmington Trust, N.A. In general, Sections 23A and 23B of the Federal Reserve Act and Federal Reserve Regulation W require that any “covered transaction” by M&T Bank and Wilmington Trust, N.A. (or any of their respective subsidiaries) with an affiliate must in certain cases be secured by designated amounts of specified collateral and must be limited as follows: (i) in the case of any single such affiliate, the aggregate amount of covered transactions of the IDI and its subsidiaries may not exceed 10% of the capital stock and surplus of such IDI, and (ii) in the case of all affiliates, the aggregate amount of covered transactions of an IDI and its subsidiaries may not exceed 20% of the capital stock and surplus of such IDI. “Covered transactions” are defined by statute to include, among other things, a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the Federal Reserve) from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. All covered transactions, including certain additional transactions (such as transactions with a third party in which an affiliate has a financial interest), must be conducted on terms and under circumstances including credit standards, (i) that are substantially the same, or at least as favorable to such bank or its subsidiary, as those prevailing at the time for comparable transactions with or involving other nonaffiliated companies, or in the absence of comparable transactions, (ii) that in good faith would be offered to, or would apply to, nonaffiliated companies.

FDIC Insurance Assessments

M&T Bank and Wilmington Trust, N.A. deposits are insured by the DIF of the FDIC up to the limits set forth under applicable law. The FDIC imposes a risk-based premium assessment system that determines assessment rates for financial institutions. Deposit insurance assessments are based on average total assets minus average tangible equity. For larger institutions, such as M&T Bank, the FDIC uses a performance score and a loss-severity score to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’s capital level and supervisory ratings and certain financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations. Under the current system, premiums are assessed quarterly.

Under the FDIA, insurance of deposits may be terminated by the FDIC upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC.

In October 2022, the FDIC finalized a rule that increased initial base deposit insurance assessment rates by 2 basis points, beginning with the first quarterly assessment period of 2023. The FDIC, as required under the FDIA, established a plan in September 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35 percent within eight years. The increased assessment is intended to improve the likelihood that the DIF reserve ratio would reach the required minimum by the statutory deadline of September 30, 2028.

On November 16, 2023, the FDIC finalized a rule that imposes a special assessment to recover the costs to the DIF resulting from the FDIC’s use in 2023 of the systemic risk exception to the least-cost resolution test under the FDIA in connection with the receiverships of certain failed banks. The FDIC estimated in approving the rule that those assessed losses total approximately $16.3 billion. The rule provides that this loss estimate will be periodically adjusted, which will affect the amount of the special assessment. Under the rule, the assessment base is the estimated uninsured deposits that an IDI reported in its Consolidated Report of Condition and Income at December 31, 2022, excluding the first $5 billion in estimated uninsured deposits. For a holding company that has more than one IDI subsidiary, such as M&T, the $5 billion exclusion is allocated among the company’s IDI subsidiaries in proportion to each IDI’s estimated uninsured deposits. The special assessments will be collected at an annual rate of approximately 13.4 basis points per year (3.36 basis points per quarter) over eight quarters in 2024 and 2025, with the first assessment period beginning January 1, 2024. Because the estimated loss pursuant to the systemic risk determination will be periodically adjusted, the FDIC retains the ability to cease collection early, extend the special assessment collection period and impose a final shortfall special assessment on a one-time basis. The special assessments are tax deductible. The total of the assessments for M&T is estimated at $197 million and such amount was recorded as an expense in the fourth quarter of 2023 when the final rule was enacted.

Acquisitions

Federal and state laws impose notice and approval requirements for mergers and acquisitions involving depository institutions or BHCs. For example, the BHCA requires every BHC to obtain the prior approval of the Federal Reserve before: (i) it may acquire direct or indirect ownership or control of any voting shares of any bank or savings institution, if after such acquisition, the BHC will directly or indirectly own or control 5% or more of the voting shares of the institution; (ii) it or any of its subsidiaries, other than a bank, may acquire all or substantially all of the assets of any bank or savings institution; or (iii) it may merge or consolidate with any other BHC. In addition, FHCs are required to obtain prior approval from the Federal Reserve before acquiring certain non-bank financial companies with assets exceeding $10 billion.

The BHCA further provides that the Federal Reserve may not approve any transaction that would result in a monopoly or would be in furtherance of any combination or conspiracy to monopolize or attempt to monopolize the business of banking in any section of the U.S., or the effect of which may be to substantially lessen competition or to tend to create a monopoly in any section of the country, or that in any other manner would be in restraint of trade, unless the anticompetitive effects of the proposed transaction are clearly outweighed by the public interest in meeting the convenience and needs of the community to be served. The Federal Reserve is also required to consider the financial and managerial resources and future prospects of the BHCs and banks concerned and the convenience and needs of the community to be served. Consideration of financial resources generally focuses on capital adequacy and consideration of convenience and needs issues and includes the parties’ performance under the CRA and compliance with laws, especially consumer protection laws. When evaluating a transaction, the Federal Reserve must also take into account the institution's effectiveness in combating money laundering and consider the extent to which the transaction would result in greater or more concentrated risks to the stability of the U.S. banking or financial system.

Executive and Incentive Compensation

Guidelines adopted by several federal banking agencies prohibit excessive compensation as an unsafe and unsound practice and describe compensation as “excessive” when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. The Federal Reserve issued Incentive Compensation Guidance intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The Incentive Compensation Guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors. These three principles are incorporated into the proposed joint compensation regulations under the Dodd-Frank Act. Any deficiencies in compensation practices that are identified may be incorporated into the organization’s supervisory ratings, which can affect its ability to make acquisitions or perform other actions. The Incentive Compensation Guidance states that enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk-management control or governance processes pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Dodd-Frank Act requires the federal bank regulatory agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets, such as M&T and M&T Bank. The agencies proposed rules to implement this requirement but these proposed rules have not been finalized.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including the NYSE, to require policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding a required accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. The excess compensation would be based on the amount the executive officer would have received had the incentive-based compensation been determined using the restated financials. The NYSE’s listing standards pursuant to the SEC’s rule became effective October 2, 2023. M&T’s clawback policy adopted in accordance with these listing standards is included as Exhibit 97.1 to this Annual Report on Form 10-K.

In addition, the NYSDFS issued guidance emphasizing that its regulated banking institutions, including M&T Bank, must ensure that any incentive compensation arrangements tied to employee performance indicators are subject to effective risk management, oversight and control.

Resolution Planning and Resolution-Related Requirements

Pursuant to the Dodd-Frank Act, as amended by the EGRRCPA, certain BHCs are required to report periodically to the Federal Reserve and the FDIC a resolution plan for their rapid and orderly resolution in the event of material financial distress or failure. In late 2019, the Federal Reserve and FDIC issued modified rules that, among other things, adjusted the review cycles and applicability of the agencies’ resolution planning requirements. Under these rules, Category IV firms such as M&T are not required to submit resolution plans.

The FDIC has separately required IDIs with $50 billion or more in total assets, such as M&T Bank, to submit to the FDIC periodic plans for resolution in the event of the institution’s failure. In January 2021, the FDIC lifted its existing moratorium on resolution plans, resuming the requirement for resolution plan submissions for IDIs with $100 billion or more in assets. The FDIC also announced its intention to engage in targeted engagement and capabilities testing related to resolution planning with select firms, for which M&T Bank most recently participated during 2021. In June 2021, the FDIC issued a Statement on Resolution Plans for IDIs, which, among other things, provides general information regarding the content that filers are expected to prepare and extends the submission frequency for specified IDIs to a three-year resolution plan filing cycle. Pursuant to this filing cycle, M&T Bank submitted its most recent resolution plan to the FDIC in November 2022.

On August 29, 2023, the FDIC proposed amendments to the resolution planning requirements for IDIs with $50 billion or more in total assets. Under the proposed revisions, IDIs such as M&T Bank with $100 billion or more in total assets would be required to submit resolution plans on a two-year cycle, with an interim supplement updating key information submitted in the off years. The proposed rule would, among other things, revise the required contents of a resolution plan for an IDI with $100 billion or more in total assets and address the IDI’s capabilities to produce valuations that the FDIC could use to conduct the statutorily required least-cost analysis in the event of the IDI’s failure.

On August 29, 2023, the Federal Reserve, the FDIC and the OCC issued a proposed rule that would require Category II through Category IV BHCs and IDIs with $100 billion or more in consolidated assets (as well as their IDI affiliates) to maintain minimum amounts of eligible long-term debt (generally, debt that is unsecured, has a maturity greater than one year from issuance and satisfies additional criteria), subject to a three-year phase-in period. Under the proposal, BHCs and IDIs would be required to maintain eligible long-term debt in an amount equal to the greatest of 6% of RWAs, 3.5% of total consolidated assets and, if subject to the SLR, 2.5% of total leverage exposure (the denominator of the SLR). The proposal would also apply “clean holding company” requirements to Category II through IV BHCs, which would, among other things, prohibit entering into derivatives and certain other financial contracts with third parties.

Insolvency of an IDI or a BHC

If the FDIC is appointed as conservator or receiver for an IDI such as M&T Bank or Wilmington Trust, N.A., upon its insolvency or in certain other events without limitation, the FDIC has the power:

to transfer any of the depository institution’s assets and liabilities to a new depository institution, including a newly formed “bridge” bank without the approval of the insolvent depository institution’s creditors or equity holders;

to enforce the terms of the depository institution’s contracts pursuant to their terms without regard to any provisions triggered by the appointment of the FDIC in that capacity; or

to repudiate or disaffirm any contract or lease to which the depository institution is a party, the performance of which is determined by the FDIC to be burdensome and the disaffirmance or repudiation of which is determined by the FDIC to promote the orderly administration of the depository institution.

In addition, under federal law, the claims of holders of domestic deposit liabilities and certain claims for administrative expenses against an IDI institution would be afforded a priority over other general unsecured claims against such an institution, including claims of debt holders of the institution, in the “liquidation or other resolution” of such an institution by any receiver. As a result, whether or not the FDIC ever sought to repudiate any debt obligations of M&T Bank or Wilmington Trust, N.A., the debt holders would be treated differently from, and could receive, if anything, substantially less than, the depositors of the bank.

The Dodd-Frank Act created a new resolution regime (known as “orderly liquidation authority”) for systemically important financial companies, including BHCs and their affiliates. Under the orderly liquidation authority, the FDIC may be appointed as receiver for the systemically important institution, and its failed subsidiaries, for purposes of liquidating the entity if, among other conditions, it is determined at the time of the institution’s failure that it is in default or in danger of default and the failure poses a risk to the stability of the U.S. financial system.

If the FDIC is appointed as receiver under the orderly liquidation authority, then the powers of the receiver, and the rights and obligations of creditors and other parties who have dealt with the institution, would be determined under the Dodd-Frank Act provisions, and not under the insolvency law that would otherwise apply. The powers of the receiver under the orderly liquidation authority were based on the powers of the FDIC as receiver for depository institutions under the FDIA. However, the provisions governing the rights of creditors under the orderly liquidation authority were modified in certain respects to reduce disparities with the treatment of creditors’ claims under the U.S. Bankruptcy Code as compared with the treatment of those claims under the new authority. Nonetheless, substantial differences in the rights of creditors exist as between these two regimes, including the right of the FDIC to disregard the strict priority of creditor claims in some circumstances, the use of an administrative claims procedure to determine creditors’ claims (as opposed to the judicial procedure utilized in bankruptcy proceedings), and the right of the FDIC to transfer claims to a “bridge” entity.

An OLF will fund such liquidation proceedings through borrowings from the Treasury Department and risk-based assessments made, first, on entities that received more in the resolution than they would have received in liquidation to the extent of such excess, and second, if necessary, on BHCs with total consolidated assets of $50 billion or more, such as M&T. If an orderly liquidation is triggered, M&T could face assessments for the OLF.

The FDIC has developed a strategy under the orderly liquidation authority referred to as the “single point of entry” strategy, under which the FDIC would resolve a failed FHC by transferring its assets (including shares of its operating subsidiaries) and, potentially, very limited liabilities to a “bridge” holding company; utilize the resources of the failed FHC to recapitalize the operating subsidiaries; and satisfy the claims of unsecured creditors of the failed FHC and other claimants in the receivership by delivering securities of one or more new financial companies that would emerge from the bridge holding company. Under this strategy, management of the failed FHC would be replaced and shareholders and creditors of the failed FHC would bear the losses resulting from the failure.

Depositor Preference

Under federal law, depositors and certain claims for administrative expenses and employee compensation against an IDI would be afforded a priority over other general unsecured claims against such an institution in the “liquidation or other resolution” of such an institution by any receiver. If an IDI fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead

of unsecured, non-deposit creditors, including depositors whose deposits are payable only outside of the U.S. and the parent BHC, with respect to any extensions of credit they have made to such IDI.

Financial Privacy and Cybersecurity

The federal banking regulators have adopted rules that limit the ability of banks and other financial institutions to disclose non-public and personally identifiable information about consumers to non-affiliated third parties. These limitations require disclosure of privacy policies to consumers and, in some circumstances, allow consumers to prevent disclosure of certain personal information to a non-affiliated third party. These regulations affect how consumer information is transmitted through diversified financial companies and conveyed to outside vendors. In addition, consumers may also prevent disclosure of certain information among affiliated companies that is assembled or used to determine eligibility for a product or service, such as that shown on consumer credit reports and asset and income information from applications. Consumers also have the option to direct banks and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services. Federal law makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means.

The federal banking agencies require banking organizations to notify their primary regulator as soon as possible and within 36 hours of determining that a “notification incident” has occurred. A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The final rule also requires specific and immediate notifications by bank service providers that become aware of similar incidents.

Financial institutions regulated by the NYSDFS, including M&T Bank, are also subject to NYSDFS regulations on cybersecurity matters, including, among other things, requirements to (i) establish and maintain a cybersecurity program designed to ensure the confidentiality, integrity and availability of their information systems, (ii) implement and maintain a written cybersecurity policy setting forth policies and procedures for the protection of their information systems and nonpublic information and (iii) designate a CISO.

On November 1, 2023, the NYSDFS adopted amendments to its cybersecurity regulations that represent a significant update to the regulation of cybersecurity practices. The amendments generally fall within the following five categories: (i) increased mandatory controls associated with common attack vectors; (ii) enhanced requirements for privileged accounts; (iii) enhanced notification obligations; (iv) expansion of cyber governance practices; and (v) additional cybersecurity requirements for larger companies. Most of the amendments will become effective 180 days after adoption.

On July 6, 2023, the SEC adopted new rules that require registrants, such as M&T, to (i) report material cybersecurity incidents on Form 8-K and (ii) disclose in its Annual Report on Form 10-K cybersecurity policies and procedures and governance practices, including at the board and management levels. This disclosure is included herein in Part I, Item 1C, “Cybersecurity.”

Many states and regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations, including implementing or modifying their data breach notification and data privacy requirements. One example of recent state legislation is the California Consumer Privacy Act, which became effective on January 1, 2020 and applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. Amendments expanding the scope of and requirements under the California Consumer Privacy Act generally became effective on January 1, 2023.

Consumer Protection Laws and the CFPB Supervision

In connection with their respective lending and leasing activities, M&T Bank, Wilmington Trust, N.A. and certain of their subsidiaries, are each subject to a number of federal and state laws designed to protect consumers and promote lending to various sectors of the economy. Such laws include but are not limited to: the Electronic Signatures in Global and National Commerce Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair and Accurate Credit Transactions Act, the Gramm-Leach Bliley Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Electronic Fund Transfer Act, the Real Estate Settlement Procedures Act, the Military Lending Act, the Servicemembers Civil Relief Act, and various state law counterparts. Furthermore, the CFPB has issued integrated disclosure requirements under the Truth in Lending Act and the Real Estate Settlement Procedures Act that relate to the provision of disclosures to consumers. There are also consumer protection laws governing deposit taking/account activities (e.g. the Expedited Funds Availability Act, the Truth in Savings Act and the Electronic Fund Transfer Act), as well as securities and insurance laws governing certain aspects of the Company’s consolidated operations.

The CFPB has broad powers to supervise and enforce most federal consumer protection laws. The CFPB has broad rule-making authority for a wide range of consumer protection laws that apply to all banks and savings institutions, including the authority to prohibit “unfair, deceptive or abusive” acts and practices which violate the Consumer Financial Protection Act. The CFPB has examination and enforcement authority over all banks and savings institutions with more than $10 billion in assets, including M&T Bank.

On October 19, 2023, the CFPB proposed a new rule that would require a provider of payment accounts or products, such as a bank, to make data available to consumers upon request regarding the products or services they obtain from the provider. Any such data provider would also have to make such data available to third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by the consumer. Data that would be required to be made available under the rule would include transaction information, account balance, account and routing numbers, terms and conditions, upcoming bill information, and certain account verification data. The proposed rule is intended to give consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of consumer financial products or services. For banks with at least $50 billion and less than $500 billion in total assets, compliance with the proposed rule’s requirements would be required approximately one year after adoption of the final rule.

On October 25, 2023, the Federal Reserve proposed amendments to its rules on interchange fees. Interchange fees, or “swipe” fees, are charges that merchants pay to card-issuing banks, such as M&T Bank, for processing electronic payment transactions. The current interchange fee limitations establish a maximum possible fee for many types of debit interchange transactions that is equal to no more than 21 cents per transaction plus five basis points multiplied by the value of the transaction. The proposed changes would establish a maximum permissible interchange fee of no more than 14.4 cents per transaction plus four basis points multiplied by the value of the transaction. The current rules allow a debit card issuer to recover one cent per transaction for fraud prevention purposes if the issuer complies with certain fraud-related requirements. Under the proposed changes, the fraud prevention adjustment would be increased to 1.3 cents per transaction. The proposed rule would also establish an automatic update of the interchange fee cap every other year based on a survey of debit card issuers.

On January 17, 2024, the CFPB proposed a rule that would significantly reform the regulatory framework governing overdraft practices applicable to banks such as M&T Bank that have more than $10 billion in assets. The proposed rule would modify or eliminate several long-standing exclusions from requirements generally applicable to consumer credit that previously exempted certain overdraft practices. Under the proposal, if banks charge overdraft fees that exceed their breakeven cost or a

to-be-established threshold, banks would have to restructure discretionary overdraft arrangements as separate consumer credit accounts that would be subject to consumer credit requirements. Depending on the final rules and the approach M&T Bank adopts, these changes to the regulatory framework could result in M&T Bank, among other things, facing higher compliance costs in charging overdraft fees, experiencing a decreased ability to recover amounts extended as overdraft protection under a separate credit arrangement, reducing the availability of overdraft protection, and/or charging lower per item overdraft fees.

In addition, federal law permits states to adopt consumer protection laws and standards that are more stringent than those adopted at the federal level and, in certain circumstances, permits state attorneys general to enforce compliance with both the state and federal laws and regulations. For example, in December 2023, a New York law requiring credit card issuers such as M&T Bank to notify consumers before making changes to or terminating rewards programs associated with the credit card became effective.

CRA

The CRA is intended to encourage depository institutions to help meet the credit needs of the communities in which they operate, including low- and moderate-income neighborhoods, consistent with safe and sound operations. CRA examinations are conducted by the federal agencies that are responsible for supervising the relevant depository institutions: the Federal Reserve, the FDIC and the OCC. For purposes of the CRA, M&T is regulated by the Federal Reserve. A financial institution’s performance in helping to meet the credit needs of its community is evaluated in the context of information about the institution (capacity, constraints and business strategies), its community (demographic and economic data, lending, investment, and service opportunities), and its competitors and peers. Upon completion of a CRA examination, an overall CRA Rating is assigned using a four-tiered rating system. These ratings are: “Outstanding,” “Satisfactory,” “Needs to Improve” and “Substantial Noncompliance.” The CRA evaluation is used in evaluating applications for future approval of bank activities including mergers, acquisitions, charters, branch openings and deposit facilities. An unsatisfactory CRA evaluation could result in the delay or denial of acquisition or merger applications, among other activities. M&T Bank has a current rating of “Outstanding.” M&T Bank is also subject to New York State CRA examination and is assessed using a 1 to 4 scoring system. M&T Bank currently has a rating of 1, or “Outstanding” from the NYSDFS. Wilmington Trust, N.A. has been designated a special purpose trust company, and is therefore exempt from the requirements of the CRA.

On October 24, 2023, the Federal Reserve, the FDIC, and the OCC jointly issued a final rule to modernize regulations implementing the CRA and respond to changes in the banking industry. Among other items, the final rule introduces new tests under which the performance of banks will be assessed and includes data collection and reporting requirements, many of which are applicable only to banks with $10 billion or more in assets, such as M&T Bank. The effective date of the final rule is April 1, 2024; however, banks will not be required to begin complying with certain provisions of the final rule until January 1, 2026, with other reporting requirements becoming applicable on January 1, 2027.

BSA Regulation and AML Obligations

Federal laws and regulations impose obligations on U.S. financial institutions, including banks and broker/dealer subsidiaries, to implement and maintain appropriate policies, procedures and controls which are reasonably designed to prevent, detect and report instances of money laundering and the financing of terrorism and to verify the identity of their customers. These provisions also require the federal financial institution regulatory agencies to consider the effectiveness of a financial institution’s AML activities when reviewing bank mergers and BHC acquisitions. Failure of a financial institution to maintain and implement adequate programs to combat money laundering and terrorist financing

could have serious legal and reputational consequences for the institution, including the denial by federal regulators of proposed merger, acquisition, restructuring or other expansionary activity.

The Financial Crimes Enforcement Network, which drafts regulations implementing the U.S. Patriot Act and other AML and BSA legislation, has adopted rules that require financial institutions to, among other things, obtain beneficial ownership information with respect to legal entities with which such institutions conduct business, subject to certain exclusions and exemptions. Bank regulators conduct focused examinations on AML compliance, and M&T continues to monitor and augment, where necessary, its BSA/AML Compliance Program.

The AMLA, which amends the BSA, was enacted in January 2021. The AMLA was intended to comprehensively reform and modernize U.S. bank secrecy and AML laws. Among other things, it codified a risk-based approach to AML compliance for financial institutions; required the U.S. Department of the Treasury to promulgate priorities for AML and countering the financing of terrorism policy; required the development of standards for testing technology and internal processes for BSA compliance; expanded enforcement and investigation-related authority, including increasing available sanctions for certain BSA violations; and expanded BSA whistleblower incentives and protections. In June 2021, the Financial Crimes Enforcement Network issued the priorities for AML and countering the financing of terrorism policy required under AMLA. The priorities include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing. M&T reviews and monitors its AML compliance program to ensure it complies with the changes reflected in the AMLA and the regulations that implement it.

OFAC Regulation

The U.S. has imposed economic sanctions that prohibit transactions with designated foreign countries, nationals and others. The OFAC-administered sanctions targeting those countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on “U.S. persons” engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g. property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences, including denial by federal regulators of proposed merger, acquisition, restructuring, or other expansionary activity. The OFAC rules are included as part of M&T’s BSA/AML Compliance Program, which M&T continues to monitor and augment, where necessary.

Federal Reserve Policies

The earnings of the Company are significantly affected by the monetary and fiscal policies of governmental authorities, including the Federal Reserve. Among the instruments of monetary policy used by the Federal Reserve are open-market operations in U.S. government securities and federal funds, changes in the discount rate on member bank borrowings and changes in reserve requirements against member bank deposits. These instruments of monetary policy are used in varying combinations to influence the overall level of bank loans, investments and deposits, and the interest rates charged on loans and paid for deposits. The Federal Reserve frequently uses these instruments of monetary policy, especially its open-market operations and the discount rate, to influence the level of interest rates and to affect the strength of the economy, the level of inflation or the price of the dollar in foreign exchange markets. The monetary policies of the Federal Reserve have had a significant effect on the operating results of banking institutions in the past and are expected to continue to do so in the future. It is not

possible to predict the nature of future changes in monetary and fiscal policies or the effect which they may have on the Company’s business and earnings.

Climate-Related and Other Sustainability Developments

In recent years, federal, state and international lawmakers and regulators have increased their focus on financial institutions’ and other companies’ risk oversight, disclosures and practices in connection with climate change and other sustainability matters. For example, on October 24, 2023, the Federal Reserve, the FDIC, and the OCC finalized interagency guidance on principles for climate-related financial risk management applicable to regulated financial institutions with more than $100 billion in total consolidated assets, including the Company. The principles are intended to support efforts by large financial institutions to focus on key aspects of climate-related financial risk management and cover six areas: (i) governance; (ii) policies, procedures and limits; (iii) strategic planning; (iv) risk management; (v) data, risk measurement and reporting; and (vi) scenario analysis. On December 21, 2022, the NYSDFS proposed guidance on climate-related financial risk management applicable to NYSDFS-regulated banking and mortgage organizations, including M&T Bank. The proposed guidance would address material financial risks related to climate change faced by these organizations in the context of risk assessment, risk management, and risk appetite setting. On March 21, 2022, the SEC issued a proposed rule on the enhancement and standardization of climate-related disclosures for investors. The proposed rule would require public issuers, including the Company, to significantly expand the scope of climate-related disclosures in their SEC filings. In addition, several states in which the Company operates have enacted or proposed statutes or regulations addressing climate change and other sustainability issues. For example, in 2023 California enacted laws that will require, once final rules are promulgated, certain climate-related disclosures, including but not limited to greenhouse gas emissions data and climate-related risks.

Corporate Governance

M&T’s Corporate Governance Standards and the following corporate governance documents are also available on M&T’s website at the Investor Relations link: Audit Committee Charter; Compensation and Human Capital Committee Charter; Executive Committee Charter; Nomination and Governance Committee Charter; Risk Committee Charter; Code of Business Conduct and Ethics; Code of Ethics for Chief Executive Officer and Senior Financial Officers; and Disclosure and Regulation FD Policy. In accordance with SEC rules, M&T will post on its website or file a Form 8-K to report any amendment to or waiver from any provision of the Code of Ethics for Chief Executive Officer and Senior Financial Officers or the Code of Business Conduct and Ethics that applies to our Chief Executive Officer, Chief Financial Officer, Controller, or persons performing similar functions. Copies of such governance documents are also available, free of charge, to any person who requests them. Such requests may be directed to M&T Bank Corporation, Shareholder Relations Department, One M&T Plaza, Buffalo, NY 14203-2399 (Telephone: (716) 842-5986).

Human Capital Resources

M&T recognizes employees are the difference makers that drive its success. The Company’s talent strategy focuses on recruiting, engaging, developing and retaining high-performing individuals whose strengths align with M&T’s values, purpose and leadership competencies to create and maintain a highly competitive and diverse workforce.

As of December 31, 2023, the Company employed 22,223 full-time and part-time employees. The Company’s current employee base is concentrated in the Northeast and Mid-Atlantic U.S., with approximately 46% of employees residing in New York, followed by approximately 10% in Maryland, 9% in Connecticut and 7% in Delaware. The remainder are primarily concentrated in other states where M&T Bank maintains a retail bank branch presence. Approximately 7% of the Company’s employee

base resides outside of its retail banking footprint. Inclusive in the above, as of December 31, 2023, the Company employed 133 international employees predominantly based in the UK, Ireland, Canada and Germany. The Company’s employee base includes 5,513 employees that support customers in the retail branch network. Overall, the average tenure of the Company’s employees is 9.6 years and the average tenure of the Company’s executive officers is 17.0 years. The SEC has announced plans to propose rules to require enhanced disclosure regarding human capital management and board diversity for public issuers.

Talent Attraction and Diversity, Equity and Inclusion

The Company leverages various channels to effectively identify, develop and recruit high-caliber talent throughout its footprint including its current employee base. The Employee Referral Program is a powerful tool for generating applicants and accounted for 19% of new hires in 2023. In addition, the Company’s Talent Acquisition Ambassador Program, which currently includes 61 employees throughout different business lines, has contributed over 1,800 hours towards promoting awareness of M&T career opportunities within the Company’s communities.

The Company’s recruitment team strives to create and maintain diverse representation at all levels and in all areas of the organization to promote a sense of belonging among employees and maintain a workforce that reflects the communities the Company serves. Employees attended 74 individual diversity-based recruiting events in 2023 with target audiences crossing many diversity dimensions, such as people of color, veterans, LGBTQ+, individuals with disabilities and women. The Company also works with diversity-focused schools and organizations as part of its efforts to recruit and maintain a diverse workforce. In 2023, 44% of total corporate hires were people of color and 55% were women, 45% of summer interns were people of color, and 58% of the participants in the Company’s Technology Internship Program were people of color. As of December 31, 2023, the entire Company’s workforce consisted of approximately 59% women and 28% people of color. M&T also partners with the Department of Defense on two programs focused on providing active members approaching the end of their service with civilian work experience, industry training, and career development opportunities, post military.

To further drive diversity within the Company, M&T also supports several employee resource group charters and chapters, which are voluntary, employee-driven groups organized around a particular shared interest and characteristic, such as race, ethnicity, gender, sexual orientation or differing abilities. Approximately 35% of the Company’s employees and 51% of managers are involved in these groups. The Company’s diversity efforts are led by its Chief Diversity Officer, who is a member of senior leadership, and the Senior Leadership Diversity & Inclusion Council, both of which champion inclusion efforts throughout the Company. M&T’s Board of Directors also receives regular updates on the Company’s diversity, inclusion and belonging efforts.

Engagement and Development

M&T’s commitment to recruiting top talent and regularly soliciting their feedback helps to create a highly engaged employee base that drives the Company’s success. Since 2001, the Company has conducted 18 “Annual Engagement Surveys,” with average participation rates around 90%, demonstrating a commitment to fostering candid, open and honest two-way communication with employees to enhance the workplace. In 2023, M&T transitioned to a more continuous employee listening strategy, checking in with employees on key engagement items throughout the year to develop a more holistic understanding of their experience, act faster on items impacting engagement and drive better prioritization and decision making. M&T also conducts other surveys at critical moments throughout an employees’ journey, such as new hire onboarding or separation from the Company, as well as in connection with key events, such as acquisitions. Survey results are reviewed with senior management and shared with individual managers, who identify and implement improvements based

on employees’ feedback, and are presented to M&T's Board of Directors. Employees also participate in action planning within individual work groups.

The Company also encourages engagement with communities through the allotment of 40 hours of paid volunteer time each year. In 2023, M&T employees volunteered approximately 249,000 hours and served on the boards of 946 not-for-profit organizations.

Another key pillar of engagement, employee development and growth, is fostered through the Company's strong performance management philosophy focused on reinforcing corporate values, providing continuous, transparent feedback and recognizing and rewarding outstanding performance. Additional employee development is cultivated through a variety of learning offerings on topics such as technical skills, job-specific knowledge and professional development, including courses aligned with the Company's enterprise-wide leadership competencies. Training content is made available as synchronous, asynchronous, and blended learning solutions to promote employee access. The Company also invests in creating its leaders of tomorrow through various internal programs including its Manager Acceleration Program, Management Development Program, Executive Associate Program, Technology Development Program and two additional programs focused on the Company's high-performing diverse employees, the Rising Leadership Development Program and Equity One.

Compensation, Health and Wellness

The Company provides comprehensive compensation and benefits programs intended to attract, retain and incentivize its employees. In addition to base pay, these programs (which vary by country and region) include cash incentives, long term equity-based awards, an employee stock purchase plan, a 401(k) Plan, healthcare and insurance benefits, health savings and flexible spending accounts, paid time off, parental leave, family care resources, flexible work schedules (if applicable), employee assistance programs and tuition assistance, among others. The Company is also dedicated to providing enhanced employee transparency around the efforts to ensure fair and equitable compensation for all team members.

The Company’s wellness programs provide employees and their families with resources that may be helpful in navigating life events and are designed to provide support to help improve their well-being. In addition to addressing employees’ physical needs through flexible and convenient medical plan and telemedicine options, M&T supports employees’ emotional health and social well-being through various programs offered to employees. The Company also works to help employees manage their financial wellness through free educational resources.

Competition

The Company faces extensive and intensive competition in the products and services it offers. The Company competes in offering commercial and personal financial and wealth services with other banking institutions and thrifts and with firms in a number of other industries, such as credit unions, personal loan companies, sales finance companies, leasing companies, securities brokerage firms, mutual fund companies, hedge funds, wealth and investment advisory firms, insurance companies and other financial services-related entities. Furthermore, diversified financial services companies are able to offer a combination of these services to their customers on a nationwide basis. Financial technology companies, using digital, mobile and other technologies, also are increasingly offering traditional banking products and services, which has resulted in the Company contending with a broader range of competitors, including many that are not located within the geographic footprint of the Company’s banking office network.

Other Information

Through a link on the Investor Relations section of M&T’s website at www.mtb.com, copies of M&T’s Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q and Current Reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, are made available, free of charge, as soon as reasonably practicable after electronically filing such material with, or furnishing it to, the SEC. Copies of such reports and other information are also available at no charge to any person who requests them or at www.sec.gov. Such requests may be directed to M&T Bank Corporation, Shareholder Relations Department, One M&T Plaza, Buffalo, NY 14203-2399 (Telephone: (716) 842-5986).