Ethical Business Conduct

We value our relationships with associates, customers, vendors, and the communities where we work and live. In every interaction, Regions must be regarded as trustworthy, honest, and fair. The Code of Conduct is designed to provide resources and guidance to help ensure, among other matters, that:

• Regions and its associates remain in compliance with all applicable laws and regulations.
• Regions is a safe and nondiscriminatory place to work and conduct business.
• Confidential and proprietary information is protected.
• Inappropriate gifts or favors are not accepted or given.
• Conflicts of interest are avoided.

The Code of Conduct is about more than compliance; it is about what is expected of each associate and how we maintain trust with each other and those we serve. Associates are required to complete annual Business Conduct and Ethics training and attest they have read and understand the Code of Conduct. The CHR Committee reviews and approves all substantive revisions to the Code of Conduct annually and receives an annual report on the status of Regions’ ethics objectives.

Allegations of associate misconduct are investigated by the Office of Associate Conduct (OAC), with assistance from other business units as appropriate. The OAC, led by our Associate Conduct Officer, serves as the daily oversight function of all matters involving associate misconduct. The OAC provides balanced consultation and effective solutions on associate conduct matters, and the cross-functional Associate Conduct Roundtable monitors complaints, trends, and emerging issues. Investigations protect confidentiality to the extent possible, and remedial action is taken when appropriate.

Our executive-level Ethics Council is responsible for enforcing Regions’ standards of conduct and considering all potential violations of the Code of Conduct that could have a material effect on Regions, including matters alleging violations of the Sarbanes-Oxley Act of 2002, SEC reporting violations, internal insider trading policy violations, and matters involving significant Code of Conduct violations by executive-level associates. The Council meets on a quarterly basis, or more frequently if necessary, and provides quarterly reports to the CHR Committee on all matters presented, as well as an annual report regarding the overall status of Regions’ ethics objectives.

Anti-Competitive Behavior

Antitrust laws prohibit agreements among competitors to restrict competition. Regions strictly prohibits associates from conspiring with any of Regions’ competitors to fix prices, allocate markets and customers, or refuse to deal with particular suppliers or customers. When in contact with Regions’ competitors, associates must avoid discussing how Regions conducts its business.

No Retaliation Policy

Regions considers retaliation to be a serious violation of the Company’s values and the Code of Conduct. Regions prohibits retaliation of any kind for good-faith reports of alleged ethical violations or unlawful or illegal conduct. Regions’ No Retaliation Policy is set forth in the Code of Conduct as well as in other Company policies.

We want associates to be comfortable reporting potential Code of Conduct and other policy violations, and we protect the confidentiality of complaints we receive to the extent possible. When complaints regarding associates are reported, the OAC is notified so that potential retaliation and all other associate misconduct complaints are investigated promptly and fairly. Oversight by the OAC helps ensure that our preventive measures, complaint handling, and resolution efforts are effective.

At Regions, do what is right is not just a platitude; it is at the heart of all we do. We believe that our actions have yielded positive results in the form of a culture that reflects our values, and we will continue to review our processes and policies to ensure their effectiveness in reinforcing that culture.

Anti-Bribery and Anti-Corruption

Our Code of Conduct prohibits associates from engaging in bribery or corruption of any type. The specific restrictions regarding the provision of gifts and other items of value to government officials vary from jurisdiction to jurisdiction. The Code of Conduct requires associates to fully comply with all applicable laws regarding the provision of gifts and/or other items of value to government officials. Associates who are offered a gift or other item of value that would result in a violation of Regions’ policies are required to immediately report the incident to the Ethics Program Manager.

Regions also has an Anti-Bribery and Anti-Corruption Officer, who reports through Financial Crimes Risk Management. Our Anti-Bribery and Anti-Corruption Policy requires associates to comply fully with all applicable anti-bribery laws, including the Bank Bribery Act and the Foreign Corrupt Practices Act. This policy, which incorporates the guidance contained in our Code of Conduct, establishes Regions’ requirements to conduct business activity in an honest and ethical manner, with a zero-tolerance approach to bribery and corruption.

Whistleblower Protections

All associates must abide by the laws, regulations, and policies impacting the financial services industry, as well as other more broadly applicable federal and state laws and regulations, including employment laws, antitrust laws, privacy laws, insider trading laws, and criminal laws governing fraud, embezzlement, anti-corruption, and anti-bribery. Regions does not permit retaliation of any kind for good-faith reports of ethical violations or misconduct of others.

Regions encourages and expects all associates to voice ethical concerns about matters such as accounting, internal controls, auditing, discrimination, and harassment; to report violations or suspected violations of laws or regulations, the Code of Conduct, or other Regions policies or procedures; and to report potentially unlawful or illegal conduct by customers, associates, or vendors. We offer several channels through which associates and others may raise such concerns:

• Associates may choose to report the activity directly to our HR Connect team via telephone or using the HR Connect online messaging function.
• Two other channels, the Report It! Hotline and the Report It! website, are administered by a third party and are available 24 hours a day, seven days a week to enable associates to make reports anonymously.
• The Raise the Red Flag online referral form allows associates to immediately refer potentially suspicious activity or behavior to internal investigators.
• Associates may also anonymously send a letter directly to the Associate Conduct Officer.

We also recognize the important role our customers can play in ensuring we are meeting the obligations of our Code of Conduct. The Regions CCC Program is used to identify opportunities to enhance our products, services, and the customer experience. This enterprise-wide program helps us ensure that each individual customer complaint is timely addressed, and it also allows us to identify complaint trends and areas for improvement.

Compliance Training

Regions strives to remain a leader in the banking industry, and for us, leadership and learning go hand-in-hand. Continuing education is a critical component of our culture, so we provide our associates with directed educational opportunities to better understand the business of banking; the risks Regions faces; and our responsibilities to protect our customers and comply with laws and regulations.

In addition to job-specific training, we require that associates complete six Mandatory Annual Compliance (MAC) training courses. Additional MAC courses are required for many associates based on their business units, roles, and functions. All of Regions’ MAC online courses are reviewed and updated as necessary in response to regulatory changes, industry events, and evolving risks. Completion of MAC training is a condition of continued employment at Regions; new hires must complete this training within 30 calendar days of their start date, and then again annually. In 2021, Regions associates completed over 238,000 total hours of MAC training.

The following course descriptions provide the major topics contained within the six MAC courses required of every Regions associate.

Regions established a Fair and Responsible Lending (FRL) Policy to which all business groups are expected to adhere. Additionally, Regions is strongly committed to making the financial products and services we offer available to prospective and existing customers on a fair and responsible basis. Accordingly, Enterprise Customer Protection and Privacy Compliance (ECPPC), a component of Risk Management, is an essential part of Regions’ business and growth strategies. The ECPPC team identifies, measures, mitigates, monitors, and reports compliance with all fair lending laws and UDAAP. Regions, as part of its overall Compliance Management Program, works to foster and promote a culture of compliance with regulatory requirements, internal policies, and industry guidance impacting consumer and business products and services.

The MAC courses that all Regions associates must complete include modules on fair and responsible banking as well as business ethics. Every associate also has a responsibility to adhere to Regions’ FRL Policy, as well as to ensure all aspects of the lending process, including application, underwriting, closing, servicing, and beyond, are executed consistently, fairly, and accurately without regard to any specific characteristic or basis as prohibited by law.

Regions’ commitment to fair and responsible lending is incorporated throughout the product lifecycle, including product development, advertising, marketing, training, and our established Customer Assistance Program. Regions has also established credit policies, procedures, and product guidelines that direct all phases of the lending process and govern activities such as pricing, product eligibility, servicing, and other functions of offering and extending credit.

In an effort to better understand our customers, Regions captures concerns and feedback to identify opportunities to improve our products, services, and processes. This includes capturing issues raised by our customers in the CCC database. In addition, we conduct customer surveys and participate in national syndicated studies, and then use this information to measure satisfaction and further enhance our customer service.

All Regions associates are expected to adhere to both the letter and spirit of fair and equal treatment laws and principles. For example, our Mortgage team has a programmatic focus on meeting Regions’ fair and responsible banking commitment. The program includes a needs-based, customer-focused strategy designed to further transparency and clarity throughout the loan process. Our online mortgage application, along with the consumer portal, creates increased efficiencies and allows borrowers to track loan progress and receive the information necessary to make informed decisions during the origination process. A communication and training plan also helps ensure all Mortgage associates understand our fair and responsible banking/lending commitment.

Fair and Responsible Banking Objectives

• Inform customers about products and services that meet their needs and give them the information required to use these solutions appropriately.
• Share product communications and disclosures in a clear, transparent way.
• Deliver financial education to customers and communities.
• Improve customer satisfaction and loyalty through fair and responsible banking practices.
• Comply with all regulations and laws related to fair and responsible banking.

Regions’ customer clarity documents, in both English and Spanish, tell customers in straightforward language about our products and services. These Regions Quick Guides^® support our Regions Simplicity Pledge^®, which is our commitment to providing customers with the information they need to make sound financial decisions and to understand how their accounts and our services work — simply, clearly, and using plain language.

Centralized Customer Complaint Program

Regions’ CCC Program is one of our many Voice of the Customer programs and is designed to consistently record customer complaints in order to help us measure and enhance our products and processes, services, and overall customer experience. All associates, regardless of their role, are trained on the CCC Program and have access to and a responsibility to record customer complaints in the CCC database.

Through the CCC Program, we can more thoroughly document and address each individual customer complaint; further, the CCC Program allows us to identify emerging trends and areas for improvement. Key components of the program include:

• A centralized application, the CCC database, that is used to record customer complaints and any actions taken to resolve the customer’s concerns.
• A process to ensure every customer complaint is reviewed for timely and thorough resolution.
• Root cause analysis that is performed by leadership and subject-matter experts throughout the Company — analysis is used to identify and correct issues and find ways to enhance our products and services and our customers’ experience.

Sales Practices

Putting the Customer First

A company can be successful in a variety of ways, but how it achieves that success is just as important as the success itself. At Regions, our values and our culture serve as the foundation for how we want to be successful — by listening to our customers, understanding their needs, and meeting those needs. Placing the customer first ensures that we are furthering their interests and helping them reach their unique financial goals. This customer-centric culture is reinforced through a series of communications and controls that help to ensure we work in our customers’ best interests. Examples include:

• Branch Incentive Plan Design: The Consumer Banking Group is committed to administering an incentive plan that rewards associates whose behaviors promote growth of the organization and sound risk management by utilizing the customer-focused, needs-based approach. Branch bankers only receive incentives for opening products or providing services that meet certain customer usage or balance requirements. One quality metric excludes closing an active account and reopening a new account; another excludes accounts that close before predetermined timeframes. Also, all incentive plans are governed through the Incentive Compensation Oversight Committee.
• Retail Integrity Team: Our team proactively monitors sales practices of branch bankers using data analytics. Potential concerns regarding failure to adhere to the needs-based process and/or deviation from the spirit and intent of the incentive plan are escalated to the OAC for further investigation. Retail Integrity processes continue to evolve as the environment changes.
• Routes for Protection: Information from our CCC Program, service quality survey program, and our internal Report It! Hotline and Report It! website are several of the numerous channels used to help identify potential instances of sales practices that are not aligned with our needs-based approach. Such identified activity is escalated to the OAC for further investigation and appropriate action.
• Training: All branch associates and leaders are required to complete a semiannual Banker Integrity training that reinforces our needs-based approach to serving and acting in the best interest of our customers. Completion of this semiannual training is a requirement for incentive plan participation.

Deposit Account Policy Changes

Regions has updated its non-sufficient funds/overdraft policies to provide customers with intuitive tools, data feeds, and simplified processes to help them manage their accounts and achieve financial success. In 2021, we began rolling out the following policy changes:

Financial Crimes Risk Management

Regions is committed to complying with both the letter and the spirit of the laws and regulations that govern sanctions and prohibit money laundering, terrorist financing, bribery and corruption, and other financial crimes. We continuously review our Financial Crimes Risk Management policies and procedures and update them as needed. Regions remains committed to ensuring not only that all our policies and procedures fully comply with rules and regulations, but also that these policies and procedures are clearly communicated and accessible to our associates.

Our comprehensive, Company-wide, Corporate BSA/AML and OFAC Programs consist of corporate policies and standards applicable to all Regions associates, management, affiliates, subsidiaries, and business units. The Corporate BSA/AML and OFAC Policies and Standards, as well as Business Unit BSA/AML/OFAC Procedures are posted on our intranet site. Additionally, as part of our effort to ensure that the BSA/AML and OFAC Programs are widely understood and observed, we track participation in Regions’ mandatory BSA/AML/OFAC training programs. We also provide targeted, supplemental training for associates in certain positions.

BSA/AML and OFAC risk governance is accomplished through formal oversight by the Board and its Risk Committee, which approve both the BSA/AML and OFAC Programs. The Risk Committee receives reports related to BSA/AML and OFAC from management on at least a quarterly basis. We also have a Financial Crimes Risk Management department responsible for BSA/AML and OFAC Compliance oversight, a BSA/AML/OFAC team within the Financial Crimes operations and technology unit, a Corporate BSA/AML Officer and an OFAC Officer, and a BSA/AML and OFAC Committee (BAOC), which is a management-level special purpose committee. All of these governing bodies and their roles are intended to oversee and monitor the effectiveness of the controls and processes in place to identify, measure, mitigate, monitor, and report on BSA/AML and OFAC risks.

The effectiveness of the BSA/AML and OFAC Programs, as well as associates’ adherence to the requirements of these programs, are subject to ongoing testing by our Internal Audit department. Regions is also subject to periodic BSA/AML- and OFAC-focused regulatory examinations. Our Board and senior management receive regular reports on regulatory submissions filed by Regions as required by various laws and regulations and by our BSA/AML and OFAC Programs.

Individual recognition and accountability are paramount to the success of our BSA/AML and OFAC Programs. Accordingly, Regions has a program that is administered by Corporate Security, with oversight by the BAOC, to reward associates for exceptional efforts in monitoring and referring potentially suspicious activity. Additionally, adherence to the requirements of the BSA/AML and OFAC Programs is built into associates’ performance evaluations.

• Values: At Regions, we have a set of core values that drive everything we do: put people first, do what is right, focus on your customer, reach higher, and enjoy life. We apply these same values to the building and use of AI at Regions by adopting a people-first, technology-second approach. We view AI as one important tool among many options designed to meet customer needs, and we carefully consider the impact on customers before building or using any AI.
• Governance: The development and use of AI solutions at Regions is well-governed. At the starting point, one of our business units identifies a customer need. Then, an analytical team structures a solution, considering AI as one of many potential components thereof. At that point, risk management evaluates any resulting AI models for privacy, bias, potential risk, mathematical soundness, and other considerations. Throughout the process, our builders and users of AI follow clear guidelines on the ethical creation and use of algorithms. A management-level committee provides oversight of the entire AI lifecycle, from development/acquisition to implementation and monitoring. Together, these strong preventive and detective controls help us keep our focus on the customer while improving services.
• Rigorous Testing: Regions is committed to rigorous testing of AI solutions, whether developed internally or sourced externally. As a standard, our risk management function performs rigorous testing on any AI models we use, in order to detect transparency in the AI’s decisioning. We take advantage of advancements in the fields of data science and model risk management, leveraging performance and explainability tools and algorithms to provide insight into how the AI makes decisions. Regions tests model design, data, ongoing monitoring, re-tuning and re-training, hyperparameters, edge-cases and limitations, model stability, implementation, and multiple other aspects of all AI models.
• Diverse and Inclusive Teams: It is crucial that AI be built in a thoughtful, fair and reliable manner and evolve to be non-discriminatory. As part of this evolution, Regions seeks to develop analytical teams that reflect the diversity of the communities we serve, thereby better enabling us to leverage AI in a way that more consistently benefits our customer base. Our teams’ work is supplemented by enhanced training, thorough consideration of customer impact, preventive and detective controls, and the ability to address potential issues rapidly.
• Continuous Learning: Continuous learning is a cornerstone of Regions’ analytical capabilities. Ongoing training opportunities, which are arranged and offered internally by numerous analytical teams, include Data Science Days, Model Risk Trainings, Data Science Exchanges, and many more. Together, these opportunities further enhance our associates’ skills at building algorithms with high levels of transparency, explainability, and replicability, as well as testing algorithms and data for bias. These ongoing learning events track the evolution of technology, complementing Regions’ overall culture of continuous improvement. AI can be used to uncover insights from data that can greatly benefit our customers. All consumers should expect that this AI is being implemented in a responsible manner. At Regions, we are committed to meeting this expectation and doing what is right for our customers. In that same vein, Regions envisions the evolution of these principles as time and experience prompt the evolution of AI, both at Regions and in the surrounding environment.