The Corporation owns 100% of the common stock of five non-bank subsidiaries, which are consolidated for financial reporting purposes: (i) Fulton Financial Realty Company, which holds title to or leases certain properties where Corporation branch offices and other facilities are located; (ii) Central Pennsylvania Financial Corp., which owns limited partnership interests in partnerships invested primarily in low- and moderate-income housing projects; (iii) FFC Management, Inc., which owns certain investment securities and other passive investments; (iv) FFC Penn Square, Inc., which owns trust preferred securities ("TruPS") issued by a subsidiary of Fulton Bank; and (v) Fulton Insurance Services Group, Inc., which engages in the sale of various life insurance products.

The banking and financial services industries are highly competitive. Within its geographic region, the Corporation’s subsidiaries faceCorporation faces direct competition from other commercial banks, varying in size from local community banks to larger regional and national

The industry is also highly competitive due to the various types of entities that now compete aggressively for customers that were traditionally served only by the banking industry. Under the current financial services regulatory framework, banks, insurance companies and securities firms may affiliate under a financial holding company structure, allowing their expansion into non-banking financial services activities that had previously been restricted. These activities include a full range of banking, securities and insurance activities, including securities and insurance underwriting, issuing and selling annuities and merchant banking activities. Moreover, the Corporation and its subsidiaries facefaces increased competition from certain non-bank entities, such as financial technology companies and marketplace lenders, which may or mayin many cases are not be subject to the same regulatory compliance obligations as the Corporation. While the Corporation does not currently engage in many of the activities described above, further entry into these businesses may enhance the ability of the Corporation to compete in the future.

The Corporation and its subsidiaries operateoperates in an industry that is subject to laws and regulations that are enforced by a number of federal and state agencies. Changes in these laws and regulations, including interpretation and enforcement activities, could impact the cost of operating in the financial services industry, limit or expand permissible activities or affect competition among banks and other financial institutions.

The Corporation is a registered bank holding company, and has elected to be treated as a financial holding company, under the Bank Holding Company Act of 1956, as amended ("BHCA") and. The Corporation is regulated, supervised and examined by the Board of Governors of the Federal Reserve System ("Federal Reserve Board"). The Corporation's subsidiary banks are depository institutions whose deposits are insuredFulton Bank is a national banking association chartered

under the laws of the United States and is primarily regulated by the FDIC. The following table summarizes the charter types and primary regulators for eachOffice of the Corporation’s subsidiary banks:Comptroller of the Currency ("OCC"). In addition, the Consumer Financial Protection Bureau ("CFPB") examines Fulton Bank for compliance with most federal consumer financial protection laws, including the laws relating to fair lending and prohibiting unfair, deceptive or abusive acts or practices in connection with the offer, sale or provision of consumer financial products or services, and for enforcing such laws with respect to Fulton Bank and its affiliates.

Federal statutes that apply to the Corporation and its subsidiaries include the Gramm-Leach-Bliley Act ("GLB Act,Act"), the BHCA, the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank Act"), the Federal Reserve Act, the National Bank Act and the Federal Deposit Insurance Act, among others. In general, these statutes, regulations promulgated thereunder, and related interpretations establish the eligible business activities of the Corporation, certain acquisition and merger restrictions, limitations on intercompany transactions such(such as loans and dividends,dividends), cash reserve requirements, lending limitations, compliance with unfair, deceptive and abusive acts and practices prohibitions, limitations on investments, and capital adequacy requirements, among other things. Such laws and regulations are intended primarily for the protection of depositors, customers and the Federal Deposit Insurance Fund ("DIF"), as well as to minimize risk to the banking system as a whole, and not for the protection of the Corporation's shareholders or non-depository creditors.

The following discussion is general in nature and seeks to highlight some of the more significant of the regulatory requirements to which the Corporation and its subsidiaries areis subject, but does not purport to be complete or to describe all applicable laws and regulations that are applicable.regulations.

In particular, fair lending laws prohibit discrimination in the provision of banking services, and the enforcement of these laws has been an increasing focus for the CFPB, the Department of Housing and Urban Development ("HUD"), and other regulators.services. Fair lending laws include ECOA and the Fair Housing Act ("FHA"), which outlaw discrimination in credit and residential real estate transactions on the basis of prohibited factors including, among others, race, color, national origin, gender, and religion. A lender may be liable for policies that result in a disparate treatment of, or have a disparate impact on, a protected class of applicants or borrowers. If a pattern or practice of lending discrimination is alleged by a regulator, then that agency may refer the matter to the U.S. Department of Justice ("DOJ") for investigation. Failure to comply with these and similar statutes and regulations can result in the Corporation and its bank subsidiaries becoming subject to formal or informal enforcement actions, the imposition of civil money penalties and consumer litigation.

The CFPB has exclusive examination and primary enforcement authority with respect to compliance with federal consumer financial protection laws and regulations by institutions under its supervision and is authorized, individually or jointly with the federal bank regulatorybanking agencies, to conduct investigations to determine whether any person is, or has, engaged in conduct that violates such laws or regulations. The CFPB may bring an administrative enforcement proceeding or civil action in federal district court. In addition, in accordance with a memorandum of understanding entered into between the CFPB and the DOJ, the two agencies have agreed to coordinate efforts related to enforcing the fair lending laws, which includes information sharing and conducting joint investigations; however, the extent to which such coordination may actually occur is unpredictable and may change over time as athe result of recenta number of factors, including changes in leadership changes at the DOJ and CFPB, as well as changes in the enforcement policies and priorities of each agency, the extent to which such coordination will continue to occur in the near term is uncertain.agency. As an independent bureau funded by the Federal Reserve Board, the CFPB may impose requirements that are more stringent than those of the other bank regulatory agencies.

As an insured depository institution with total assets of more than $10 billion, Fulton Bank and the Corporation's other subsidiary banks areis subject to the CFPB’sCFPB's supervisory and enforcement authorities. The Dodd-Frank Act also permits states to adopt stricter consumer protection laws and state attorneys general to enforce consumer protection rules issued by the CFPB. As a result, the Corporation's subsidiary banks operateFulton Bank operates in a stringent consumer compliance environment and may incur additional costs related to consumer protection compliance, including but not limited to potential costs associated with CFPB examinations, regulatory and enforcement actions and consumer-oriented litigation. The CFPB, other financial regulatory agencies, including the OCC, as well as the DOJ, have, over the past several years, pursued a number of enforcement actions against depository institutions with respect to compliance with fair lending laws.environment.

Under the 1940 Act. The FinalBasel III Rules, also require regulated entities to establish an internal compliance program that is consistent with the extent to which it engages in proprietary tradingCorporation and covered fund activities covered by the Volcker Rule. Although the Final Rules provide some tiering of compliance and reporting obligations based on size, the fundamental prohibitions of the Volcker Rule apply to banking entities of any size, including the Corporation. In December 2014, the Federal Reserve Board extended, until July 21, 2016, the date by which banking entities must conform their covered fund activities and investments to the requirements of the Final Rules, and in July 2016, the Federal Reserve Board granted an additional one-year extension of the conformance period to July 21, 2017.

The U.S. Basel III Capital Rules use a standardized approach for risk weightings that expand the risk-weightings for assets and off balance sheet exposures from the previous 0%, 20%, 50% and 100% categories to a much larger and more risk-sensitive number of categories, depending on the nature of the assets and off-balance sheet exposures and resulting in higher risk weights for a variety of asset categories. In November 2017, the federal banking agencies adopted a final rule to extend the regulatory capital treatment applicable during 2017 under Basel III for certain items, including regulatory capital deductions, risk weights, and certain minority interest limitations. The relief provided under the final rule applies to banking organizations that are not subject to the capital rules’ advanced approaches, such as the Corporation. Specifically, the final rule extends the current regulatory capital treatment of mortgage servicing assets ("MSAs"), deferred tax assets ("DTAs") arising from temporary differences that could not be realized through net operating loss carrybacks, significant investments in the capital of unconsolidated financial institutions in the form of common stock, non-significant investments in the capital of unconsolidated financial institutions, significant investments in the capital of unconsolidated financial institutions that are not in the form of common stock, and CET1 minority interest, tier 1 minority interest, and total capital minority interest exceeding applicable minority interest limitations.

In October 2017, the federal banking agencies issuedThe Corporation and Fulton Bank are also required to maintain a noticeminimum Tier 1 leverage ratio (Tier 1 capital to a quarterly average of proposed rulemaking on simplifications to Basel III, a majoritynon-risk weighted total assets) of which would apply solely to banking organizations that4%. The Corporation and Fulton Bank are not subject to the advanced approachesBasel III Rules' countercyclical buffer or the supplementary leverage ratio.

The Basel III Rules provide for a number of deductions from and adjustments to CET1. These include, for example, goodwill, other intangible assets, and deferred tax assets ("DTAs") that arise from net operating loss and tax credit carryforwards net of any related valuation allowance. Mortgage servicing rights ("MSRs"), DTAs arising from temporary differences that could not be realized through net operating loss carrybacks and investments in non-consolidated financial institutions must also be deducted from CET1 to the extent that they exceed certain thresholds. In July 2019, the federal banking agencies adopted final rules intended to simplify the capital rules. Under the proposed rulemaking, non-advanced approachestreatment for certain DTAs, MSRs, investments in non-consolidated financial entities and minority interests for banking organizations, such as the Corporation and Fulton Bank, would apply a simpler regulatory capital treatmentthat are not subject to the advanced approaches framework (the "Capital Simplification Rules"). The Capital Simplification Rules were effective for MSAs, certain DTAs, investments in the capitalCorporation as of unconsolidated financial institutions,January 1, 2020.

The Corporation and capital issued by a consolidated subsidiary of a banking organization and held by third parties. Specifically, the proposed rulemaking would eliminate: (i) the 10 percent CET1 capital deduction threshold that applies individually to MSAs, temporary difference DTAs, and significant investments in the capital of unconsolidated financial institutions in the form of common stock; (ii) the aggregate 15 percent CET1 capital deduction threshold that subsequently applies on a collective basis across such items; (iii) the 10 percent CET1 capital deduction threshold for non-significant investments in the capital of unconsolidated financial institutions; and (iv) the deduction treatment for significant investments in the capital of unconsolidated financial institutions not in the form of common stock. Basel III would no longer have distinct treatments for significant and non-significant investments in the capital of unconsolidated financial institutions, but instead would require thatFulton Bank, as non-advanced approaches banking organizations, deduct from CET1made a one-time, permanent election under the Basel III Rules to exclude the effects of certain components of accumulated other comprehensive income ("AOCI") included in shareholders' equity under U.S. GAAP in determining regulatory capital any amountratios.

Under the Basel III Rules, certain off-balance sheet commitments and obligations are converted into RWA, that together with on-balance sheet assets, are the base against which regulatory capital is measured. The Basel III Rule defined the risk-weighting categories for bank holding companies and banks that follow the standardized approach, such as the Corporation and Fulton Bank, based on a risk-sensitive analysis, depending on the nature of MSAs, temporary difference DTAs, and investmentsthe exposure.

The Capital Simplifications Rules adopted in July 2019 eliminated the standalone prior approval requirement in the capitalBasel III Capital Rules for any repurchase of unconsolidated financial institutions that individually exceeds 25 percentcommon stock. In certain circumstances, the Corporation's repurchases of CET1 capital. The proposed rulemaking also includes revisionsits common stock may be subject to a prior approval or notice requirement under other regulations or policies of the Federal Reserve Board. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the treatmentprior approval of certain acquisition, development, or construction exposures that are designed to address comments regarding the current definition of high volatility commercial real estate exposure under the capital rule’s standardized approach.Federal Reserve Board.

In December 2017, the Basel Committee on Banking Supervision published the last version of the Basel III accord, generally referred to as "Basel IV." TheAmong other things, these standards revise the Basel Committee stated that a key objective of the revisions incorporated into the framework is to reduce excessive variability of risk-weighted assets, which will be accomplished by enhancing the robustness and risk sensitivity of theCommittee's standardized approachesapproach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain "unconditionally cancellable commitments," such as unused credit card and home equity lines of credit) and provides a new standardized approach for operational risk whichcapital. Under the Basel framework, these standards will facilitategenerally be effective on January 1, 2022, with an aggregate output floor phasing in through January 1, 2027. Under the comparability of banks’current U.S. capital ratios; constraining the use of internally-modeled approaches; and complementing the risk-weightedrules, operational risk capital ratio with a finalized leverage ratiorequirements and a revisedcapital floor apply only to advanced approaches institutions, and robustnot to the Corporation or Fulton Bank. The impact of Basel IV on the Corporation and Fulton Bank will depend on the manner in which it is implemented by the federal banking agencies.

As noted above, the federal banking agencies have implemented the provisions of the Economic Growth Act that provide certain capital floor. Leadershiprelief pursuant a new and narrower definition of HVCRE exposures that are subject to a heightened risk weight.

For safety and soundness reasons, banking regulations also limit the amount of cash that can be transferred from subsidiary banksFulton Bank to the parent companyParent Company in the form of dividends. Dividend limitations vary, depending onGenerally, dividends are limited to the subsidiary bank’s charter and whether or not it is a memberlesser of the Federal Reserve System. Generally, subsidiariesamounts calculated under an earnings retention test and an undivided profits test. Under the earnings retention test, without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year's net income combined with the retained net income of the two preceding years. Under the undivided profits test, a dividend may not be paid in excess of a bank's undivided profits. In addition, banks are prohibited from paying dividends when doing so would cause them to fall below the regulatory minimum capital levels. Additionally, limits may exist on paying dividends in excess of net income for specified periods. See "Note 11 - Regulatory Matters," in the Notes to Consolidated Financial Statements in Item 8 "Financial Statements and Supplementary Data" for additional information regarding regulatory capital and dividend and loan limitations.

On April 1, 2011, as required by the Dodd-Frank Act, the deposit insuranceFDIC assessment base changed from total domestic deposits to average total assets, minus average tangible equity. In addition, the FDIC also created a two scorecard system, onerates for large

The Tax Cuts and Jobs Act of 2017 (the "Tax Act"), which was signed into law on December 22, 2017, disallows the deduction of FDIC deposit insurance premium payments for banking organizations with total consolidated assets of $50 billion or more. For banks with less than $50 billion in total consolidated assets, such as Fulton Bank, the premium deduction is phased out based on the proportion of the bank’sbank's assets exceeding $10 billion. See discussion under Item 1.A. "Risk Factors - The financial services industry, as well as the broader economy, may be subject to new legislation which could result in significant changes in banking and financial services regulation."

Among other requirements, the Patriot Act and the related regulations impose the following requirements with respect toon financial institutions:

Failure to comply with the requirements of the Patriot Act and other AML laws and regulations could have serious legal, financial, regulatory and reputational consequences. In addition, bank regulators will consider a holding company’scompany's effectiveness in combating money laundering when ruling on BHCA and Bank Merger Act applications. In May 2016, the regulations implementing the BSA were amendedaddition, financial institutions are subject to explicitly include risk-based procedures for conducting ongoing customer due diligence to include understandingrequirements, issued by the nature and purpose of customer relationships for the purpose of developing a customer risk profile. In addition, banks mustFinancial Crimes Enforcement Network, to identify and verify the identity of thenatural persons, known as beneficial owners, of allwho own, control, and profit from legal entity customers (other thanwhen those that are excluded) at the time a new account is opened (other than accounts that are exempted). The Corporation and its banking subsidiaries must comply with these amendments and new requirements by May 11, 2018.customers open accounts. The Corporation has adopted policies, procedures and controls to address compliance with the Patriot Act and other AML laws and regulations, and will continue to revise and update its policies, procedures and controls to reflect required changes (including the May 2016 amendments).

The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal shareholder. In July 2010, theThe federal banking agencies have issued Guidance on Sound Incentive Compensation Policies ("Guidance")guidance that applies to all banking organizations supervised by the agencies (thereby including both the Corporation and its banking subsidiaries). Pursuant to the Guidance,provides that, to be consistent with safety and soundness principles, a banking organization’sorganization's incentive compensation arrangements should: (1) provide employees with incentives that appropriately balance risk and reward; (2) be compatible with effective controls and risk management; and (3) be supported by strong corporate governance, including active and effective oversight by the banking organization’sorganization's board of directors. Monitoring methods and processes used by a

Section 956During the second quarter of 2016, as required by the Dodd-Frank Act, requires the federal bankingbank regulatory agencies and the SEC to establish joint regulations or guidelines prohibitingproposed revised rules on incentive-based paymentcompensation arrangements at specified regulated entities that encourage inappropriate risk-taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. The federal banking agencies issued such proposed rules in April 2011 and issued a revised proposed rule in June 2016, implementing the requirements and prohibitions set forth in Section 956. The revised proposed rule would apply to all banks, among other institutions, withhaving at least $1 billion in average total consolidated assets for which it would go beyond(including the existing Guidance to (i) prohibit certain typesCorporation and features of incentive-based compensation arrangements for senior executive officers, (ii) require incentive-based compensation arrangements to adhere to certain basic principles to avoid a presumption of encouraging inappropriate risk, (iii) require appropriate board or committee oversight, (iv) establish minimum record keeping and (v) mandate disclosures to the appropriate federal banking agency.Fulton Bank), but these proposed rules have not been finalized.

The Corporation’s bank subsidiaries areFulton Bank is subject to regulatory guidelines establishing standards for safeguarding customer information. These regulations implement certain provisions of the GLB Act. The guidelines describe the federal bank regulatory agencies’agencies' expectations for the creation, implementation and maintenance of an information security program, which would include administrative, technical and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The standards set forth in the guidelines are intended to ensure the security and confidentiality of customer records and information, protect against any anticipated threats or hazards to the security or integrity of such records and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. In October 2016, the federal banking agencies issued an advance notice of proposed rulemaking on enhanced cybersecurity risk-management and resilience standards that would apply to large and interconnected banking organizations and to services provided by third parties to these firms. TheseAs proposed, these enhanced standards would apply only to depository institutions and depository institution holding companies with total consolidated assets of $50 billion or more.more; however, it is possible that if these enhanced standards are implemented, the Federal Reserve Board will consider them in connection with the examination and supervision of banking organizations below the $50 billion threshold. The federal banking agencies have not yet taken further action on these proposed standards.

Required reserves must be maintained in the form of either vault cash, an account at a Federal Reserve Bank or a pass-through account as defined by the Federal Reserve Board. Pursuant to the Emergency Economic Stabilization Act of 2008, the Federal Reserve Banks pay interest on depository institutions’institutions' required and excess reserve balances. The interest rate paid on required reserve balances is currently the average target federal funds rate over the reserve maintenance period. The rate on excess balances will be set equal to the lowest target federal funds rate in effect during the reserve maintenance period.

The Riegle-Neal ActPrior regulatory approval is also generally permitsrequired for mergers, acquisitions and consolidations involving other insured depository institutions. In reviewing acquisition and merger applications, the bank holding companies to acquire banks in any state, and preempts all state laws restrictingregulatory authorities will consider, among other things, the ownership by a holding company of banks in more than one state. The Riegle-Neal Act also permits a bank to merge with an out-of-state bank and convert any offices into branchescompetitive effect of the resulting bank, acquire branches from an out-of-state bank,transaction, financial and establishmanagerial issues, including the capital position of the combined organization, convenience and operate de novo interstate branches wheneverneeds factors, including the host state permits de novo branchingapplicant's CRA record, the effectiveness of its own state-chartered banks.

The Change in Bank Control Act prohibits a person, entity or group of persons or entities acting in concert, from acquiring "control" of a bank holding company or bank unless the Federal Reserve Board has been given prior notice and has not objected to the transaction. Under Federal Reserve Board regulations, the acquisition of 10% or more (but less than 25%) of the voting stock of a corporation would, under the circumstances set forth in the regulations, create a rebuttable presumption of acquisition of control of the corporation.