ITEM 1. BUSINESS

The disclosures set forth in this item are qualified by Item 1A. Risk Factors and the section captioned “Forward-Looking Statements and Factors that Could Affect Future Results” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this report and other cautionary statements set forth elsewhere in this report.

The Corporation

Cullen/Frost Bankers, Inc., a Texas business corporation incorporated in 1977, is a financial holding company and a bank holding company headquartered in San Antonio, Texas that provides, through its subsidiaries, a broad array of products and services throughout numerous Texas markets. The terms “Cullen/Frost,” “the Corporation,” “we,” “us” and “our” mean Cullen/Frost Bankers, Inc. and its subsidiaries, when appropriate. We offer commercial and consumer banking services, as well as trust and investment management, insurance, brokerage, mutual funds, leasing, treasury management, capital markets advisory and item processing services. At December 31, 2017,2022, Cullen/Frost had consolidated total assets of $31.7$52.9 billion and was one of the largest independent bank holding companies headquartered in the State of Texas.

Our philosophy is to grow and prosper, building long-term relationships based on top quality service, high ethical standards, and safe, sound assets. We operate as a locally-oriented, community-based financial services organization, augmented by experienced, centralized support in select critical areas. Our local market orientation is reflected in our regional management and regional advisory boards, which are comprised of local business persons, professionals and other community representatives that assist our regional management in responding to local banking needs. Despite this local market, community-based focus, we offer many of the products available at much larger money-center financial institutions.

We serve a wide variety of industries including, among others, energy, manufacturing, services, construction, retail, telecommunications, healthcare, military and transportation. Our customer base is similarly diverse. While our loan portfolio has a significant concentration of energy-related loans totaling approximately 11.4%5.4% of total loans at December 31, 2017,2022, we are not dependent upon any single industry or customer.

Our operating objectives include expansion, diversification within our markets, growth of our fee-based income, and growth internally and through acquisitions of financial institutions, branches and financial services businesses. We generallyWhile we are currently focused on organic growth, we may seek merger or acquisition partners that are culturally similar and have experienced management and possess either significant market presence or have potential for improved profitability through financial management, economies of scale and expanded services. We regularlyFrom time to time, we evaluate merger and acquisition opportunities and conduct due diligence activities related to possible transactions with other financial institutions and financial services companies. As a result, merger or acquisition discussions and, in some cases, negotiations may take place and future mergers or acquisitions involving cash, debt or equity securities may occur. Acquisitions typically involve the payment of a premium over book and market values, and, therefore, some dilution of our tangible book value and net income per common share may occur in connection with any future transaction. Our ability to engage in certain merger or acquisition transactions, whether or not any regulatory approval is required, will be dependent upon our bank regulators’ views at the time as to the capital levels, quality of management and our overall condition and their assessment of a variety of other factors. Certain merger or acquisition transactions, including those involving the acquisition of a depository institution or the assumption of the deposits of any depository institution, require formal approval from various bank regulatory authorities, which will be subject to a variety of factors and considerations.

Although Cullen/Frost is a corporate entity, legally separate and distinct from its affiliates, bank holding companies such as Cullen/Frost are required to act as a source of financial strength for their subsidiary banks. The principal source of Cullen/Frost’s income is dividends from its subsidiaries. There are certain regulatory restrictions on the extent to which these subsidiaries can pay dividends or otherwise supply funds to Cullen/Frost. See the section captioned “Supervision and Regulation” included elsewhere in this item for further discussion of these matters.

Cullen/Frost’s executive offices are located at 100111 W. Houston Street, San Antonio, Texas 78205, and its telephone number is (210) 220-4011.

Subsidiaries of Cullen/Frost

Frost Bank

Frost Bank, the principal operating subsidiary and sole banking subsidiary of Cullen/Frost, is a Texas-chartered bank primarily engaged in the business of commercial and consumer banking through approximately 134170 financial centers across Texas in the Austin, Corpus Christi, Dallas, Fort Worth, Houston, Permian Basin, Rio Grande Valley and San Antonio regions. Frost Bank also operates over 1,300approximately 1,729 automated-teller machines (“ATMs”) throughout the State of Texas, approximately halfthe majority of which are operated in connection with a branding arrangement to beand licensing agreements with various retailers throughout the exclusive cash-machine provider for Corner Store inState of Texas. Frost Bank was originally chartered as a national banking association in 1899, but its origin can be traced to a mercantile partnership organized in 1868. At December 31, 2017,2022, Frost Bank had consolidated total assets of $31.8$53.0 billion and total deposits of $26.9$44.4 billion and was one of the largest commercial banks headquartered in the State of Texas.

Significant services offered by Frost Bank include:

Frost Insurance Agency, Inc.

Frost Brokerage Services, Inc.

Frost Investment Advisors, LLC

Frost Investment Services, LLC

Tri–Frost Corporation

Other Subsidiaries

Our operations are managed along two reportable operating segments consisting of Banking and Frost Wealth Advisors. See the sections captioned “Results of Segment Operations” in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Note 18 - Operating Segments in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data which are located elsewhere in this report.

There is significant competition among commercial banks in our market areas. In addition, we also compete with other providers of financial services, such as savings and loan associations, credit unions, consumer finance companies, securities firms, insurance companies, insurance agencies, commercial finance and leasing companies, full service brokerage firms, and discount brokerage firms, and financial/wealth technology (“fintech/wealthtech”) firms. Some of our competitors have greater resources and, as such, may have higher lending limits and may offer other services that are not provided by us. We generally compete on the basis of customer service and responsiveness to customer needs, available loan and deposit products, the rates of interest charged on loans, the rates of interest paid for funds, and the availability and pricing of trust, brokerage and insurance services. For further discussion, see the section captioned “We Operate In A Highly Competitive Industry and Market Area” in Item 1A. Risk Factors.

Supervision and Regulation

Cullen/Frost, Frost Bank and most of its non-banking subsidiaries are subject to extensive regulation under federal and state laws. The regulatory framework is intended primarily for the protection of depositors, federal deposit insurance funds and the banking system as a whole and not for the protection of shareholders and creditors.

Significant elements of the laws and regulations applicable to Cullen/Frost and its subsidiaries are described below. The description is qualified in its entirety by reference to the full text of the statutes, regulations and policies that are described. Also, such statutes, regulations and policies are continually under review by Congress and state legislatures and federal and state regulatory agencies. A change in statutes, regulations or regulatory policies applicable to Cullen/Frost and its subsidiaries could have a material effect on our business, financial condition or our results of operations. Recent political developments, including the change in administration in the United States, have added additional uncertainty to the implementation, scope and timing of regulatory reforms.

Regulatory Agencies

Cullen/Frost is a legal entity separate and distinct from Frost Bank and its other subsidiaries. As a financial holding company and a bank holding company, Cullen/Frost is regulated under the Bank Holding Company Act of 1956, as amended (“BHC Act”), and it and its subsidiaries are subject to inspection, examination and supervision by the Federal Reserve Board. The BHC Act provides generally for “umbrella” regulation of financial holding companies such as Cullen/Frost by the Federal Reserve Board, and for functional regulation of banking activities by bank regulators, securities activities by securities regulators, and insurance activities by insurance regulators. Cullen/Frost is also under the jurisdiction of the Securities and Exchange Commission (“SEC”) and is subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, as administered by the SEC. Cullen/Frost’s common stock is listed on the New York Stock Exchange (“NYSE”) under the trading symbol “CFR” and our 5.375%Depositary Shares, each representing a 1/40th interest in a share of our 4.450% Non-Cumulative Perpetual Preferred Stock, Series A,B, is listed on the NYSE under the trading symbol “CFRpA.“CFR PrB.” Accordingly, Cullen/Frost is also subject to the rules of the NYSE for listed companies.

Frost Bank is a Texas state chartered bank and a member of the Federal Reserve System. Accordingly, the Texas Department of Banking and the Federal Reserve Board are the primary regulators of Frost Bank. Deposits at Frost Bank are insured by the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits.

All member banks of the Federal Reserve System, including Frost Bank, are required to hold stock in the Federal Reserve System's Reserve Banks in an amount equal to six percent of their capital stock and surplus (half paid to acquire the stock with the remainder held as a cash reserve). Member banks do not have any control over the Federal Reserve System as a result of owning the stock and the stock cannot be sold or traded. Prior to the enactment of the Fixing America's Surface Transportation Act (“FAST Act”) in December 2015, member banks received a fixed, six percent dividend annually on their stock. Under the FAST Act, theThe annual dividend rate for larger member banks, with total assets in excess of $10 billion, including Frost Bank, changed from a fixed, six percent dividend rate to a floating dividend rateis tied to 10-year U.S. Treasuries with the maximum dividend rate capped at six percent. The total amount of stock

Most of our non-bank subsidiaries also are subject to regulation by the Federal Reserve Board and other federal and state agencies. Frost Brokerage Services, Inc. is regulated by the SEC, the Financial Industry Regulatory Authority (“FINRA”) and state securities regulators. Frost Investment Advisors, LLC and Frost Investment Services, LLC are subject to the disclosure and regulatory requirements of the Investment Advisors Act of 1940, as administered by the SEC. Our insurance subsidiary is subject to regulation by applicable state insurance regulatory agencies. Other non-bank subsidiaries are subject to both federal and state laws and regulations. Frost Bank and its affiliates are also subject to supervision, regulation, examination and enforcement by the Consumer Financial Protection Bureau (“CFPB”) with respect to consumer protection laws and regulations.

Bank Holding Company Activities

In general, the BHC Act limits the business of bank holding companies to banking, managing or controlling banks and other activities that the Federal Reserve Board has determined to be so closely related to banking as to be a proper incident thereto. In addition, bank holding companies that qualify and elect to be financial holding companies may engage in any activity, or acquire and retain the shares of a company engaged in any activity, that is either (i) financial in nature or incidental to such financial activity (as determined by the Federal Reserve Board in consultation with the Secretary of the Treasury) or (ii) complementary to a financial activity and does not pose a substantial risk to the safety and soundness of depository institutions or the financial system generally (as solely determined by the Federal Reserve Board), without prior approval of the Federal Reserve Board. Activities that are

To maintain financial holding company status, a financial holding company and all of its depository institution subsidiaries must be “well capitalized” and “well managed.” A depository institution subsidiary is considered to be “well capitalized” if it satisfies the requirements for this status discussed in the section captioned “Capital Adequacy and Prompt“Prompt Corrective Action,” included elsewhere in this item. A depository institution subsidiary is considered “well managed” if it received a composite rating and management rating of at least “satisfactory” in its most recent examination. A financial holding company’s status will also depend upon it maintaining its status as “well capitalized” and “well managed’managed” under applicable Federal Reserve Board regulations. If a financial holding company ceases to meet these capital and management requirements, the Federal Reserve Board’s regulations provide that the financial holding company must enter into an agreement with the Federal Reserve Board to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the Federal Reserve Board may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the Federal Reserve Board. If the company does not return to compliance within 180 days, the Federal Reserve Board may require divestiture of the holding company’s depository institutions. Bank holding companies and banks must also be both well capitalized and well managed in order to acquire banks located outside their home state.

In order for a financial holding company to commence any new activity permitted by the BHC Act or to acquire a company engaged in any new activity permitted by the BHC Act, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the Community Reinvestment Act. See the section captioned “Community Reinvestment Act” included elsewhere in this item.

The Federal Reserve Board has the power to order any bank holding company or its subsidiaries to terminate any activity or to terminate its ownership or control of any subsidiary when the Federal Reserve Board has reasonable grounds to believe that continuation of such activity or such ownership or control constitutes a serious risk to the financial soundness, safety or stability of any bank subsidiary of the bank holding company.

The BHC Act, the Bank Merger Act, the Texas Banking Code and other federal and state statutes regulate acquisitions of commercial banks and their parent holding companies. The BHC Act requires the prior approval of the Federal Reserve Board for the direct or indirect acquisition by a bank holding company of more than 5.0% of the voting shares of a commercial bank or its parent holding company. Under the Bank Merger Act, the prior approval of the Federal Reserve Board or other appropriate bank regulatory authority is required for a member bank to merge with another

Dividends and Stock Repurchases

The principal source of Cullen/Frost’s liquidity is dividends from Frost Bank. The prior approval of the Federal Reserve Board is required if the total of all dividends declared by a state-chartered member bank in any calendar year would exceed the sum of the bank’s net profits for that year and its retained net profits for the preceding two calendar years, less any required transfers to surplus or to fund the retirement of preferred stock. Federal law also prohibits a state-chartered, member bank from paying dividends that would be greater than the bank’s undivided profits. Frost Bank is also subject to limitations under Texas state law regarding the level of dividends that may be paid. Under the foregoing dividend restrictions, and while maintaining its “well capitalized” status, Frost Bank could pay aggregate dividends of approximately $544.8$813.6 million to Cullen/Frost, without obtaining affirmative governmental approvals, at December 31, 2017.2022. This amount is not necessarily indicative of amounts that may be paid or available to be paid in future periods.

In addition, Cullen/Frost and Frost Bank are subject to other regulatory policies and requirements relating to the payment of dividends, including requirements to maintain adequate capital above regulatory minimums. The appropriate federal regulatory authority is authorized to determine under certain circumstances relating to the financial condition of a bank holding company or a bank that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof. The appropriate federal regulatory authorities have stated that paying dividends that deplete a bank’s capital base to an inadequate level would be an unsafe and unsound banking practice and that banking organizations should generally pay dividends only out of current operating earnings. In addition, in the current financial and economic environment, theAdditionally, it is Federal Reserve Board has indicatedpolicy that bank holding companies generally should carefully review their dividend policypay dividends on common stock only out of net income available to common shareholders over the past year and has discouraged payment ratios that are at maximum allowable levels unless bothonly if the prospective rate of earnings retention appears consistent with the organization's current and expected future capital needs, asset quality and overall financial condition. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company's capital are very strong.structure.

Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act” or “Dodd-Frank”), institutions, such as Cullen/Frost and Frost Bank, with average total consolidated assets greater than $10 billion are required to conduct an annual company-run stress test of capital, consolidated earnings and losses under one base and at least two stress scenarios provided byIn July 2019, the federal bank regulators. The company-run stress tests are conducted using data as of December 31st ofregulators adopted final rules (the “Capital Simplifications Rules”) that, among other things, eliminated the preceding calendar year and scenarios released by the agencies. Stress test results must be reported to the agencies by July 31st with public disclosure of summary stress test results under the severely adverse scenario between October 15th and October 31st. Our capital ratios reflectedstandalone prior approval requirement in the stress test calculations are an important factor considered byBasel III Capital Rules for any repurchase of common stock. In certain circumstances, Cullen/Frost’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations, policies or supervisory expectations of the Federal Reserve BoardBoard. Any redemption or repurchase of preferred stock or subordinated debt remains subject to the prior approval of the Federal Reserve Board.

In August 2022, the Inflation Reduction Act of 2022 (the “IRA”) was enacted. Among other things, the IRA imposes a new 1% excise tax on the fair market value of stock repurchased after December 31, 2022 by publicly traded U.S. corporations. With certain exceptions, the value of stock repurchased is determined net of stock issued in evaluating the capital adequacy of Cullen/Frost and Frost Bank and whether the appropriateness of any proposed payments of dividends or stock repurchases may be an unsafe or unsound practice.year, including shares issued pursuant to compensatory arrangements.

Transactions with Affiliates

Transactions between Frost Bank and its subsidiaries, on the one hand, and Cullen/Frost or any other subsidiary, on the other hand, are regulated under federal banking law. The Federal Reserve Act imposes quantitative and qualitative requirements and collateral requirements on covered transactions by Frost Bank with, or for the benefit of, its affiliates, and generally requires those transactions to be on terms at least as favorable to Frost Bank as if the transaction were conducted with an unaffiliated third party. Covered transactions are defined by statute to include a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the Federal Reserve Board) from the affiliate, certain derivative transactions that create a credit exposure to an affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. In general, any such transaction by Frost Bank or its subsidiaries must be limited to certain thresholds on an individual and aggregate basis and, for credit transactions with any affiliate, must be secured by designated amounts of specified collateral.

Federal law also limits a bank’s authority to extend credit to its directors, executive officers and 10% stockholders, as well as to entities controlled by such persons. Among other things, extensions of credit to insiders are required to be made on terms that are substantially the same as, and follow credit underwriting procedures that are not less stringent than, those prevailing for comparable transactions with unaffiliated persons. Also, the terms of such extensions of credit may not involve more than the normal risk of non-repayment or present other unfavorable features and may not exceed certain limitations on the amount of credit extended to such persons individually and in the aggregate.

Source of Strength Doctrine

Federal Reserve Board policy and federal law require bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. Under this requirement, Cullen/Frost is expected to commit resources to support Frost Bank, including at times when Cullen/Frost may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary banks are subordinate in right of payment to depositors and to certain other indebtedness of such subsidiary banks. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Capital Requirements

Cullen/Frost and Frost Bank are each required to comply with applicable capital adequacy standards establishedadopted by the Federal Reserve Board. The current risk-based capital standards applicable to Cullen/Frost and Frost Bank, parts of which are currently in the process of being phased-in, are based on the December 2010 final capital framework for strengthening international capital standards, known as Basel III, of the Basel Committee on Banking Supervision (the “Basel Committee”). In July 2013, the federal bank regulators approved final rulesBoard (the “Basel III Capital Rules”) implementing the Basel III framework as well as certain provisions of the Dodd-Frank Act.. The Basel III Capital Rules became effective forrequire Cullen/Frost and Frost Bank on January 1, 2015 (subject to a phase-in period for certain provisions).maintain the following:

The Basel III Capital Rules also require a “capital conservation buffer”, composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The implementation ofand the capital conservation buffer began on January 1, 2016 at the 0.625% level and will increase by 0.625% on each subsequent January 1, until it reaches 2.5% on January 1, 2019. The Basel III Capital Rules also provide for a “countercyclical capital buffer” that is only applicable to certain covered institutions and does not have any current applicability to Cullen/Frost or Frost Bank. The capital conservation buffer is designed to absorb losses during periods of economic stress and effectively increases the minimum required risk-weighted capital ratios. Banking institutions with a ratio of CET1 to risk-weighted assets below the effective minimum (4.5% plus the capital conservation buffer and, if applicable, the countercyclical capital buffer) will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall.

In addition, under the general risk-based capital rules, the effects of accumulated other comprehensive income items included in capital were excluded for the purposes of determining regulatory capital ratios. Under the Basel III Capital Rules, the effects of certain accumulated other comprehensive income items are not excluded; however, non-advanced approaches banking organizations, including Cullen/Frost and Frost Bank, were able to make a one-time permanent election to continue to exclude these items. Both Cullen/Frost and Frost Bank made this election in order to avoid significant variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of their available-for-sale securities portfolio. Under the Basel III Capital Rules, trust preferred securities no longer included in our Tier 1 capital may nonetheless be included as a component of Tier 2 capital on a permanent basis without phase-out.

The Basel III Capital Rules prescribe a standardized approach for risk weightings that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets, generally ranging from 0% for U.S. government and agency

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee's standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provides a new standardized approach for operational risk capital. Under the Basel framework, these standards will generally be effective on January 1, 2022,2023, with an aggregate output floor phasing in through January 1, 2027.2028. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to Cullen/Frost or Frost Bank. The impact of Basel IV on us will depend on the manner in which it is implemented by the federal bank regulators.

Historically, the regulation and monitoring of bank and bank holding company liquidity has been addressed as a supervisory matter, without required formulaic measures. Liquidity risk management has become increasingly important since the financial crisis. The Basel III liquidity framework requiresand regulations of the Federal Reserve require that certain banks and bank holding companies to measure their liquidity against specific liquidity tests that, although similar in some respects to liquidity measures historically applied by banks and regulators for management and supervisory purposes, going forward would be required by regulation.tests. One test, referred to as the liquidity coverage ratio (“LCR”), is designed to ensure that the banking entity maintains an adequate level of unencumbered high-quality liquid assets equal to the entity’s expected net cash outflow for a 30-day time horizon (or, if greater, 25% of its expected total cash outflow) under an acute liquidity stress scenario. The other test, referred to as the net stable funding ratio (“NSFR”), is designed to promote more medium- and long-term funding of the assets and activities of banking entities over a one-year time horizon.

Prompt Corrective Action

The Federal Deposit Insurance Act, as amended (“FDIA”), requires among other things, the federal banking agencies to take “prompt corrective action” in respect of depository institutions that do not meet minimum capital requirements. The FDIA includes the following five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors, as established by regulation. The relevant capital measures, which reflect changes under the Basel III Capital Rules that became effective on January 1, 2015, are the total capital ratio, the CET1 capital ratio, the Tier 1 capital ratio and the leverage ratio.

A bank will be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized”; (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less than 3.0%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. A bank’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the bank’s overall financial condition or prospects for other purposes.

In addition, theThe FDIA prohibits an insured depository institution from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is well capitalized or is adequately capitalized and receives a waiver from the FDIC. A depository institution that is adequately capitalized and accepts brokered deposits under a waiver from

Additionally, the FDIC may not pay an interest rate on any deposit in excess of 75 basis points over certain prevailing market rates.

The appropriate federal banking agency may, under certain circumstances, reclassify a well capitalized insured depository institution as adequately capitalized. The FDIA provides that an institution may be reclassified if the appropriate federal banking agency determines (after notice and opportunity for hearing) that the institution is in an unsafe or unsound condition or deems the institution to be engaging in an unsafe or unsound practice.

Cullen/Frost believes that, as of December 31, 2017,2022, its bank subsidiary, Frost Bank, was “well capitalized” based on the aforementioned ratios. For further information regarding the capital ratios and leverage ratio of Cullen/Frost and Frost Bank see the discussion under the section captioned “Capital and Liquidity” included in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations and Note 9 - Capital and Regulatory Matters in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data, elsewhere in this report.

Safety and Soundness Standards

The FDIA requires the federal bank regulatory agencies to prescribe standards, by regulations or guidelines, relating to internal controls, information systems and internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, asset growth, asset quality, earnings, stock valuation and compensation, fees and benefits, and such other operational and managerial standards as the agencies deem appropriate. Guidelines adopted by the federal bank regulatory agencies establish general standards relating to internal controls and information systems, internal audit systems, loan documentation, credit underwriting, interest rate exposure, asset growth and compensation, fees and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify and manage the risk and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or principal stockholder. In addition, the agencies adopted regulations that authorize, but do not require, an agency to order an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of the FDIA. See “Prompt Corrective Action” above. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties.

Substantially all of the deposits ofDeposits at Frost Bank are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of the FDIC and Frost Bank is subject to deposit insurance assessments to maintain the DIF. Deposit insurance assessments are based on average total assets minus average tangible equity. For larger institutions, such as Frost Bank, the FDIC uses a performance score and a loss-severity score that are used to calculate an initial assessment rate. In calculating these scores, the FDIC uses a bank’s capital level and supervisory ratings (its “CAMELS ratings”) and certain financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations.

Under the FDIA, the FDIC may terminate deposit insurance upon a finding that the institution has engaged in unsafe and unsound practices, is in an unsafe or unsound condition to continue operations, or has violated any applicable law, regulation, rule, order or condition imposed by the FDIC. In addition, the FDIC is authorized to conduct examinations of and require reporting by FDIC-insured institutions.

Enhanced Prudential Standards

The Dodd-Frank Act directed the Federal Reserve Board is required to monitor emerging risks to financial stability and enact enhanced supervision and prudential standards applicable to large bank holding companies with total consolidated assets of $50 billion or more and certain non-bank covered companies designated as systemically important by the Financial Stability Oversight Council (often referred to as systemically important financial institutions).Council. The Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) mandates that certain regulatory requirements applicable to these systemically important financial institutions be more stringent than those applicable to other financial institutions.

The Volcker Rule

The so-called Volcker Rule under the Dodd-Frank Act prohibitsrestricts banks and their affiliates from engaging in proprietary trading and investing in and sponsoring hedge funds and private equity funds. The Volcker Rule which became effective in July 2015, does not significantly impact the operations of Cullen/Frost and its subsidiaries as we do not have any significant engagement in the businesses prohibited by the Volcker Rule.

Depositor Preference

The FDIA provides that, in the event of the “liquidation or other resolution” of an insured depository institution, the claims of depositors of the institution, including the claims of the FDIC as subrogee of insured depositors, and certain claims for administrative expenses of the FDIC as a receiver, will have priority over other general unsecured claims against the institution. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will have priority in payment ahead of unsecured, non-deposit creditors, including depositors whose deposits are payable only outside of the United States and the parent bank holding company, with respect to any extensions of credit they have made to such insured depository institution.

Interchange Fees

Under the Durbin Amendment to the Dodd-Frank Act, the Federal Reserve adopted rules establishing standards for assessing whether the interchange fees that may be charged with respect to certain electronic debit transactions are “reasonable and proportional” to the costs incurred by issuers for processing such transactions.

Interchange fees, or “swipe” fees, are charges that merchants pay to us and other card-issuing banks for processing electronic payment transactions. Federal Reserve Board rules applicable to financial institutions that have assets of

Consumer Financial Protection

Community Reinvestment Act

Financial Privacy

Anti-Money Laundering and the USA Patriot Act

Office of Foreign Assets Control Regulation

Incentive Compensation

The Federal Reserve Board reviews, as part of its regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as Cullen/Frost, that are not “large, complex banking organizations.” These reviews are tailored to each organization based on the scope and complexity of the organization’s activities and the prevalence of incentive compensation arrangements. The findings of this supervisory initiative will be included in reports of examination. Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

In June 2010, the Federal Reserve Board, OCC and FDIC issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

In October 2022, the SEC adopted a final rule directing national securities exchanges and associations, including the NYSE, to implement listing standards that require listed companies to adopt policies mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would establish general qualitative requirements applicable to all covered entities, which would include (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead toresult in a material financial loss; (iii) establishing requirements for performance measuresmisstatement if the error were corrected in the current period or left uncorrected in the current period. The final rule requires us to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate record-keeping. Under the proposed rule, larger financial institutions with total consolidated assets of at least $50 billion would also be subject to additional requirements applicable toadopt a clawback policy within 60 days after such institutions’ “senior executive officers” and “significant risk-takers.” These additional requirements would not be applicable to Cullen/Frost or Frost Bank, each of which currently have less than $50 billion in total consolidated assets.listing standard becomes effective.

Cybersecurity

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations. In addition, in March 2015,2022, the SEC proposed rules that would require disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance.

The federal banking regulators issued two related statementsregularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity. One statement indicates thatcybersecurity intended to enhance cyber risk management among financial institutions. Financial institutions should design multiple layers ofare expected to comply with such guidance and standards and to accordingly develop appropriate security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack.processes. If we fail to observe thesuch regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties.

InUnder a final rule adopted by federal banking agencies in November 2021, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the ordinary coursebanking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of business, we rely on electronic communicationsits customer base, its businesses and information systems to conduct our operations and to store sensitive data. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber attacks is severe, attacks are sophisticated and increasingwould result in volume, and attackers respond rapidly to changes in defensive measures. While to date, we have not detected a significant compromise, significant datamaterial loss, or any materialits operations that would impact the stability of the United States.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial losses relatedinstitutions to implement cybersecurity attacks, our systemsprograms and many states, including Texas, have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity

Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to remain highbe elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.

See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity.

Future Legislation and Regulation

Congress may enact legislation from time to time that affects the regulation of the financial services industry, and state legislatures may enact legislation from time to time affecting the regulation of financial institutions chartered by or operating in those states. Federal and state regulatory agencies also periodically propose and adopt changes to their regulations or change the manner in which existing regulations are applied. The substance or impact of pending or future legislation or regulation, or the application thereof, cannot be predicted, although any change could impact the regulatory structure under which we or our competitors operate and may significantly increase costs, impede the efficiency of internal business processes, require an increase in regulatory capital, require modifications to our business strategy, and limit our ability to pursue business opportunities in an efficient manner. It could also affect our competitors differently than us, including in a manner that would make them more competitive. A change in statutes, regulations or regulatory policies applicable to Cullen/Frost or any of its subsidiaries could have a material, adverse effect on our business, financial condition and results of operations.

At December 31, 2017,2022, we employed 4,2704,985 full-time equivalent employees. At that date, the average tenure of all of our full-time employees was approximately 9.9 years while the average tenure of our executive officers was approximately 31.3 years. None of our employees are represented by collective bargaining agreements. We believe our employee relations to be good.

Executive OfficersOur employees are key to our success as an organization. We are committed to attracting, retaining and promoting top quality talent regardless of sex, sexual orientation, gender identity, race, color, national origin, age, religion and physical ability. We strive to identify and select the best candidates for all open positions based on qualifying factors for each job. We are dedicated to providing a workplace for our employees that is inclusive, supportive, and free of any form of discrimination or harassment; rewarding and recognizing our employees based on their individual results and performance as well as that of their department and the company overall; and recognizing and respecting all of the Registrantcharacteristics and differences that make each of our employees unique.

Under the Securities Exchange Act of 1934, we are required to file annual, quarterly and current reports, proxy statements and other information with the Securities and Exchange Commission (“SEC”). You may read and copy any document we file with the SEC at the SEC’s Public Reference Room at 100 F Street, N.E., Washington, D.C. 20549. Please call the SEC at 1-800-SEC-0330 for further information about the public reference room. The SEC maintains a website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. We file electronically with the SEC.

We make available, free of charge through our website, our reports on Forms 10-K, 10-Q and 8-K, and amendments to those reports, as soon as reasonably practicable after such reports are filed with or furnished to the SEC. Additionally, we have adopted and posted on our website a code of ethics that applies to our principal executive officer, principal financial officer and principal accounting officer. Our website also includes our corporate governance guidelines and the charters for our audit committee, our compensation and benefits committee, our risk committee, and our corporate governance and nominating committee and our technology committee. The address for our website is http://www.frostbank.com. We will provide a printed copy of any of the aforementioned documents to any requesting shareholder.

ITEM 1A. RISK FACTORS

An investment in our common stock is subject to risks inherent to our business. The material risks and uncertainties that management believes affect us are described below. Before making an investment decision, you should carefully consider the risks and uncertainties described below together with all of the other information included or incorporated by reference in this report. The risks and uncertainties described below are not the only ones facing us. Additional risks and uncertainties that management is not aware of or focused on or that management currently deems immaterial may also impair our business operations. This report is qualified in its entirety by these risk factors.

Risks Related To Our Business

We Are Subject To Interest Rate Risk

Our earnings and cash flows are largely dependent upon our net interest income. Net interest income is the difference between interest income earned on interest-earning assets such as loans and securities and interest expense paid on interest-bearing liabilities such as deposits and borrowed funds. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions, inflationary trends, changes in government spending and debt issuances and policies of various governmental and regulatory agencies and, in particular, the Federal Open Market Committee. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and securities and the amount of interest we pay on deposits and borrowings, but such changes could also affect (i) our ability to originate loans and obtain deposits, (ii) the fair value of our financial assets and liabilities, and (iii) the average duration of our mortgage-backed securities portfolio. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. Any substantial, unexpected, or prolonged change in market interest rates could have a material adverse effect on our business, financial condition and results of operations.

Our Allowance For LoanCredit Losses May Be Insufficient

We maintain anallowances for credit losses on loans, securities and off-balance sheet credit exposures. In the case of loans and securities, allowances for credit losses are contra-asset valuation accounts that are deducted from the amortized cost basis of these assets to present the net amount expected to be collected. In the case of off-balance-sheet credit exposures, the allowance for loancredit losses which is a reserve established throughliability account reported as a provision for loan losses charged to expense, whichcomponent of accrued interest payable and other liabilities in our consolidated balance sheets. The amount of each allowance account represents management’smanagement's best estimate of inherentcurrent expected credit losses that have been incurred withinon these financial instruments considering available information, from internal and external sources, relevant to assessing exposure to credit loss over the existing portfolio of loans. The allowance, in the judgment of management, is necessary to reserve for estimated loan losses and risks inherent in the loan portfolio. The levelcontractual term of the allowance reflects management’s continuing evaluation of industry concentrations; specificinstrument. Relevant available information includes historical credit risks; loan loss experience;experience, current loan portfolio quality; present economic, political and regulatory conditions and unidentified losses inherent inreasonable and supportable forecasts. As a result, the current loan portfolio. The determination of the appropriate level of the allowance for loancredit losses inherently involves a high degree of subjectivity and requires us to make significant estimates ofrelated to current and expected future credit risks and future trends, all of which may undergo material changes. Continuing deterioration in economic conditions, including the possibility of a recession, affecting borrowers and securities issuers; inflation; rising interest rates; new information regarding existing loans, credit commitments and securities holdings; the lingering effects of the COVID-19 pandemic or other global pandemics; natural disasters and risks related to climate change; and identification of additional problem loans, ratings down-grades and other factors, both within and outside of our control, may require an increase in the allowanceallowances for loan losses.credit losses on loans, securities and off-balance sheet credit exposures. In addition, bank regulatory agencies periodically review our allowance for loancredit losses and may require an increase in the provision for loan lossescredit loss expense or the recognition of further loan charge-offs, based on judgments different than those of management. Furthermore, if any charge-offs related to loans, securities or off-balance sheet credit exposures in future periods exceed the

Our Profitability Depends Significantly On EconomicWe Are Subject to Risk Arising From Conditions In The State Of TexasCommercial Real Estate Market

Our success depends primarilyAs of December 31, 2022, commercial real estate mortgage loans comprised approximately 36.0% of our loan portfolio. Commercial real estate mortgage loans generally involve a greater degree of credit risk than residential real estate mortgage loans because they typically have larger balances and are more affected by adverse conditions in the economy. Because payments on loans secured by commercial real estate often depend upon the general economic conditionssuccessful operation and management of the State of Texasproperties and the specific local markets inbusinesses which we operate. Unlike larger national or other regional banks that are more geographically diversified, we provide banking and financial services to customers across Texas through financial centersoperate from within them, repayment of such loans may be affected by factors outside the borrower’s control, such as adverse conditions in the Austin, Corpus Christi, Dallas, Fort Worth, Houston, Permian Basin, Rio Grande Valley and San Antonio regions.real estate market or the economy or changes in government regulations. In recent years, commercial real estate markets have been particularly impacted by the economic disruption resulting from the COVID-19 pandemic. The local economic conditionsCOVID-19 pandemic has also been a catalyst for the evolution of various remote work options which could impact the long-term performance of some types of office properties within our commercial real estate portfolio. Accordingly, the federal banking regulatory agencies have expressed concerns about weaknesses in these areas have a significant impact on the demand for our products and services as well as the ability of our customers to repay loans, the value of the collateral securing loans and the stability of our deposit funding sources. Moreover, approximately 98.2% of the securitiescurrent commercial real estate market. Failures in our municipal bondrisk management policies, procedures and controls could adversely affect our ability to manage this portfolio were issued by political subdivisions or agencies within the Stategoing forward and could result in an increased rate of Texas. A significant declinedelinquencies in, general economic conditions in Texas, whether caused by recession, inflation, unemployment, changes in oil prices, changes in securities markets, acts of terrorism, outbreak of hostilities or other international or domestic occurrences or other factorsand increased losses from, this portfolio, which, accordingly, could impact these local economic conditions and, in turn, have a material adverse effect on our business, financial condition and results of operations.

We May Be Adversely Affected ByAre Subject To Volatility inRisk In Crude Oil Prices

As of December 31, 2017,2022, we had $925.7 million of energy loans which comprised approximately 11.4%5.4% of our loan portfolio.portfolio at that date. Furthermore, energy production and related industries represent a large part of the economies in some of our primary markets. In recent years, actionsActions by certain members of the Organization of Petroleum Exporting Countries (“OPEC”) impactingcan impact global crude oil production levels have ledand lead to increasedsignificant volatility in global oil supplies which has resulted in significant declines inand market oil prices. DecreasedIn recent years, decreased market oil prices compressed margins for many U.S. and Texas-based oil producers, particularly those that utilize higher-cost production technologies such as hydraulic fracking and horizontal drilling, as well as oilfield service providers, energy equipment manufacturers and transportation suppliers, among others. In March of 2020, disagreements between members of OPEC signaled that

A significant portion of our loan portfolio is secured by real property. During the ordinary course of business, we foreclose on and take title to properties securing certain loans. In doing so, there is a risk that hazardous or toxic substances could be found on these properties. If hazardous or toxic substances are found, we may be liable for remediation costs, as well as for personal injury and property damage. Environmental laws may require us to incur substantial expenses and may materially reduce the affected property’s value or limit our ability to use or ability to sell the affected property. Environmental reviews of real property before initiating foreclosure actions may not be sufficient to detect all potential environmental hazards. The remediation costs and any other financial liabilities associated with an environmental hazard could have a material adverse effect on our business, financial condition and results of operations.

We Are Subject To Liquidity Risk

We require liquidity to meet our deposit and debt obligations as they come due. Our access to funding sources in amounts adequate to finance our activities or on terms that are acceptable to us could be impaired by factors that affect us specifically or the financial services industry or economy generally. Factors that could reduce our access to liquidity sources include a downturn in the Texas economy, difficult credit markets or adverse regulatory actions against us. Our access to deposits may also be affected by the liquidity needs of our depositors. In particular, a substantial majority of our liabilities are demand, savings, interest checking and money market deposits, which are payable on demand or upon several days’ notice, while by comparison, a substantial portion of our assets are loans, which cannot be called or sold in the same time frame. We may not be able to replace maturing deposits and advances as necessary in the future, especially if a large number of our depositors sought to withdraw their accounts, regardless of the reason. Our access to deposits may be negatively impacted by, among other factors, periods of low interest rates or higher interest rates which could promote increased competition for deposits, including from new financial technology competitors, or provide customers with alternative investment options. A failure to maintain adequate liquidity could have a material adverse effect on our business, financial condition and results of operations.

Our success depends, in large part,Accounting Estimates and Risk Management Processes Rely On Analytical and Forecasting Models

The processes we use to estimate our expected credit losses and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our ability to attractfinancial condition and retain key people. Competition forresults of operations, depends upon the best people in most activities engaged in by us can be intenseuse of analytical and weforecasting models. These models reflect assumptions that may not be ableaccurate, particularly in times of market stress or other unforeseen circumstances. Even if these assumptions are adequate, the models may prove to hire peoplebe inadequate or inaccurate because of other flaws in their design or their implementation, including flaws caused by failures in controls, data management, human error or from the reliance on technology. If the models we use for interest rate risk and asset-liability management are inadequate, we may incur increased or unexpected losses upon changes in market interest rates or other market measures. If the models we use for estimating our expected credit losses are inadequate, the allowance for credit losses may not be sufficient to retain them. We dosupport future charge-offs. If the models we use to measure the fair value of financial instruments are inadequate, the fair value of such financial instruments may fluctuate unexpectedly or may not currently have employment agreementsaccurately reflect what we could realize upon sale or non-competition agreements with anysettlement of such financial instruments. Any such failure in our senior officers. The unexpected loss of services of key personnelanalytical or forecasting models could have a material adverse impacteffect on our business, financial condition and results of operations becauseoperations.

As of December 31, 2022, we had $655.3 million of goodwill and other intangible assets. A significant decline in our expected future cash flows, a significant adverse change in the business climate, slower growth rates or a significant and sustained decline in the price of Cullen/Frost’s common stock may necessitate taking charges in the future related to the impairment of our goodwill and other intangible assets which could have a material adverse effect on our business, financial condition and results of operations.

From time to time, we implement new lines of business or offer new products and services within existing lines of business. For instance, we are currently implementing a new residential mortgage product offering. There are substantial risks and uncertainties associated with these efforts, particularly in instances where the markets are not fully developed. In developing and marketing new lines of business and/or new products and services we invest significant time and resources. Initial timetables for the introduction and development of new lines of business and/or new products or services may not be achieved and price and profitability targets may not prove feasible. External factors, such as compliance with regulations, competitive alternatives, and shifting market yearspreferences, may also impact the successful implementation of a new line of business or a new product or service.

The financial services industry experienceis continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. Our future success depends, in part, upon our ability to address the difficultyneeds of promptly finding qualified replacement personnel. In addition, the scopeour customers by using technology to provide products and content of U.S. banking regulators' policies on incentive compensation,services that will satisfy customer demands, as well as changes to create additional efficiencies in our operations. Many of our competitors have substantially greater resources to invest in technological improvements. We may not be able to effectively implement new technology driven products and services or be successful in marketing these policies,products and services to our customers. In addition, our implementation of certain new technologies, such as those related to artificial intelligence, automation and algorithms, in our business processes may have unintended consequences due to their limitations or our failure to use them effectively. In addition, cloud technologies are also critical to the operation of our systems, and our reliance on cloud technologies is growing. Failure to successfully keep pace with technological change affecting the financial services industry could have a material adverse effect on our business, financial condition and results of operations.

Reputation risk, or the risk to our earnings and capital from negative public opinion, is inherent in our business. Negative public opinion could adversely affect our ability to hire, retainkeep and motivateattract customers and expose us to adverse legal and regulatory consequences. Negative public opinion could result from our key employees.actual or alleged conduct in any number of activities, including (i) lending practices, (ii) branching strategy, (iii) product and service offerings,

Our Information Systems May Experience Failure, Interruption Or Breach In Security

In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. Any failure, interruption or breach in security of these systems could result in significant disruption to our operations. Information security breaches and cybersecurity-related incidents may include, but are not limited to, attempts to access information, including customer and company information, malicious code, computer viruses and denial of service attacks that could result in unauthorized access, theft, misuse, loss, release or destruction of data (including confidential customer information), account takeovers, unavailability of service or other events. These types of threats may derive from human error, fraud or malice on the part of external or internal parties, or may result from accidental technological failure. Further, to access our products and services our customers may use computers and mobile devices that are beyond our security control systems. Our technologies, systems, networks and software and those of other financial institutions have been and are likely to continue to be the target ofsubject to cybersecurity threats and attacks, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at us. Any failures related to upgrades and maintenance of our technology and information systems could further increase our information and system security risk. Our increased use of cloud and other technologies, such as remote work technologies, also increases our risk of being subject to a cyber attack. The risk of a security breach or disruption, particularly through cyber attack or cyber intrusion, has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

Our customers, employees and employeesthird parties that we do business with have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate passwords, bank account information or other personal information or to introduce viruses or other malware through “Trojan horse” programs to our information systems, the information systems of our merchants or third-party service providers and/or our customers' computers.personal devices, which are beyond our security control systems. Though we endeavor to mitigate these threats through product improvements, use of encryption and authentication technology and customer and employee education, such cyber attacks against us, or our merchants, our third-party service providers and our third party service providerscustomers remain a serious issue. The pervasiveness of cybersecurity incidentsissue and have been successful in general and the risks of cyber crime are complex and continue to evolve. More generally, publicized information concerning security and cyber-related problems could inhibit the use or growth of electronic or web-based applications or solutions as a means of conducting commercial transactions.past.

Although we make significant efforts to maintain the security and integrity of our information systems and have implemented various measures to manage the riskrisks of a security breach or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Even the most well protected information, networks, systems and facilities remain potentially vulnerable becauseto attempted security breaches particularly cyber attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is virtually impossible for us to entirely mitigate this risk. Furthermore, in the event of a cyber attack, we may be delayed in identifying or responding to the attack, which could increase the negative impact of the cyber attack on our business, financial condition and results of operations. While we maintain specific “cyber” insurance coverage, which would apply in the event of various breach scenarios, the amount of coverage may not be adequate in any particular case. Furthermore, because cyber threat scenarios are inherently difficult to predict and can take many forms, some breaches may not be covered under our cyber insurance coverage. A security breach or other significant disruption of our information systems or those related to our customers, merchants andor our third partythird-party vendors, including as a result of cyber attacks, could (i) disrupt the proper functioning of our networks and systems and therefore our operations and/or those of certain of our customers; (ii) result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of confidential, sensitive or otherwise valuable information of ours or our customers; (iii) result in a violation of applicable privacy, data breach and other laws, subjecting us to additional regulatory scrutiny and expose theexposing us to civil litigation, enforcement actions, governmental fines and possible financial liability; (iv) require significant management attention and resources to remedy the damages that result; or (v) harm our reputation or cause a decrease in the number of customers that choose to do business with us. The occurrence of any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

We rely on certain external vendors to provide products and services necessary to maintain our day-to-day operations. These third partythird-party vendors are sources of operational and informational security risk to us, including risks associated with operational errors, information system failures, interruptions or breaches and unauthorized disclosures of sensitive or confidential client or customer information. If these vendors encounter any of these issues, or if we have difficulty communicating with them, we could be exposed to disruption of operations, loss of service or connectivity to customers, reputational damage, and litigation risk that could have a material adverse effect on our business and, in turn, our financial condition and results of operations.

In addition, our operations are exposed to risk that these vendors will not perform in accordance with the contracted arrangements under service level agreements. WhileAlthough we have selected these external vendors carefully, we do not control their actions. The failure of an external vendor to perform in accordance with the contracted arrangements under service level agreements, because of changes in the vendor’s organizational structure, financial condition, support for existing products and services or strategic focus or for any other reason, could be disruptive to our operations, which could have a material adverse effect on our business and, in turn, our financial condition and results of operations. Replacing these external vendors could also entail significant delay and expense.

We Are Subject To Litigation Risk Pertaining To Fiduciary Responsibility

From time to Claimstime, customers make claims and take legal action pertaining to our performance of our fiduciary responsibilities. Whether customer claims and legal action related to our performance of our fiduciary responsibilities are founded or unfounded, if such claims and legal actions are not resolved in a manner favorable to us they may result in significant financial liability and/or adversely affect the market perception of us and our products and services as well as impact customer demand for those products and services. Any financial liability or

We Are Subject To Litigation Risk Pertaining toTo Intellectual Property

Banking and other financial services companies, including us, rely on technology companies to provide information technology products and services necessary to support day-to-day operations. Technology companies frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. In addition, patent holding companies seek to monetize patents they have purchased or otherwise obtained. Competitors of our vendors, or other individuals or companies, have from time to time claimed to hold intellectual property sold to us by our vendors.vendors or in use by us and we are, and may in the future be, named as defendants in various related legal claims. Such claims may increase in the future as the financial services sector becomes more reliant on information technology vendors. The plaintiffs in these actions frequently seek injunctions and substantial damages.damages and may also seek to enter into licensing agreements with us to obtain ongoing fees.

Regardless of the scope or validity of such patents or other intellectual property rights, or the merits of any claims by potential or actual litigants, we may have to engage in protracted litigation. Such litigation is often expensive, time-consuming, disruptive to our operations and distracting to management. If we are found to infringe upon one or more patents or other intellectual property rights, we may be required to pay substantial damages or royalties to a third-party. In certain cases, we have and in the future may consider entering into licensing agreements for disputed intellectual property, although no assurance can be given that such licenses can be obtained on acceptable terms or that litigation will not occur. These licenses may also significantly increase our operating expenses. If legal matters related to intellectual property claims were resolved against us or settled, we could be required to make payments in amounts that could have a material adverse effect on our business, financial condition and results of operations.

In deciding whether to extend credit or enter into other transactions, we may rely on information furnished by or on behalf of customers and counterparties, including financial statements, credit reports and other financial information. We may also rely on representations of those customers, counterparties or other third parties, such as independent auditors, as to the accuracy and completeness of that information. Reliance on inaccurate or misleading financial statements, credit reports or other financial information could have a material adverse impact on our business, financial condition and results of operations.

Risks Associated With Our Common Stock

The Trading VolumeVolumes In Our Common Stock Isand Preferred Stock Are Less Than That Of Other Larger Financial Services Companies

Although our common stock isand preferred stock are listed for trading on the New York Stock Exchange (NYSE),NYSE, the trading volume in our common stock is less than that of other, larger financial services companies. A public trading market having the desired characteristics of depth, liquidity and orderliness depends on the presence in the marketplace of willing buyers and sellers of our common stock and preferred stock at any given time. This presence depends on the individual decisions of investors and general economic and market conditions over which we have no control. Given the lower trading volumevolumes of our common stock and preferred stock, significant sales of our common stock or our preferred stock, or the expectation of these sales, could cause our stock priceprices to fall.

Cullen/Frost May Not Continue To Pay Dividends On Its Common Stock In The Future

Holders of Cullen/Frost common stock are only entitled to receive such dividends as its board of directors may declare out of funds legally available for such payments. Although Cullen/Frost has historically declared cash dividends on its common stock, it is not required to do so and may reduce or eliminate its common stock dividend in the future. This could adversely affect the market price of Cullen/Frost’s common stock. Also, Cullen/Frost is a bank holding company, and its ability to declare and pay dividends is dependent on certain federal regulatory considerations, including the guidelines of the Federal Reserve Board regarding capital adequacy and dividends.

As more fully discussed in Note 9 - Capital and Regulatory Matters in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data which are located elsewhere in this report, our ability to declare or pay dividends on our common stock may also be subject to certain restrictions in the event that we elect to defer the payment of interest on our junior subordinated deferrable interest debentures or do not declare and pay dividends on our Series AB Preferred Stock.

An Investment In Our Common Stock or Preferred Stock Is Not An Insured Deposit

Our common stock isand preferred stock are not a bank depositdeposits and, therefore, isare not insured against loss by the Federal Deposit Insurance Corporation (FDIC)(“FDIC”), any other deposit insurance fund or by any other public or private entity. Investment in our common stock or preferred stock is inherently risky for the reasons described in this “Risk Factors” section and elsewhere in this report and is subject to the same market forces that affect the price of common stock or preferred stock in any company. As a result, if you acquire our common stock or preferred stock, you could lose some or all of your investment.

Provisions of federal banking laws, including regulatory approval requirements, could make it more difficult for a third party to acquire us, even if doing so would be perceived to be beneficial to our shareholders. These provisions effectively inhibit a non-negotiated merger or other business combination, which, in turn, could adversely affect the market price of our common stock.

None

Our headquarters is located in downtown San Antonio, Texas. These facilities,This facility, which we lease, househouses our executive and primary administrative offices, as well as the principal banking headquarters of Frost Bank. We also own or lease other facilities within our primary market areas in the regions of Austin, Corpus Christi, Dallas, Fort Worth, Houston, Permian Basin, Rio Grande Valley and San Antonio. We consider our properties to be suitable and adequate for our present needs.

We are subject to various claims and legal actions that have arisen in the course of conducting business. Management does not expect the ultimate disposition of these matters to have a material adverse effect on our business, financial condition and results of operations.

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

Market for Our Common Stock Market Prices and Dividends

Our common stock is traded on the New York Stock Exchange, Inc. (“NYSE”)NYSE under the symbol “CFR”. The tables below set forth for each quarter of 2017 and 2016 the high and low intra-day sales prices per share of Cullen/Frost’s common stock and the cash dividends declared per share.

Stock-Based Compensation Plans

Information regarding stock-based compensation awards outstanding and available for future grants as of December 31, 2017,2022, segregated between stock-based compensation plans approved by shareholders and stock-based compensation plans not approved by shareholders, is presented in the table below. Additional information regarding stock-based compensation plans is presented in Note 11 - Employee Benefit Plans in the notes to consolidated financial statements included in Item 8. Financial Statements and Supplementary Data located elsewhere in this report.

Stock Repurchase Plans

From time to time, our board of directors has authorized stock repurchase plans. In general, stock repurchase plans allow us to proactively manage our capital position and return excess capital to shareholders. Shares purchased under such plans also provide us with shares of common stock necessary to satisfy obligations related to stock compensation awards. On October 24, 2017,January 25, 2023, our board of directors authorized a $150.0$100.0 million stock repurchase program,plan, allowing us to repurchase shares of our common stock over a two-yearone-year period from time to time at various prices in the open market or through private transactions. No shares were repurchased under thisUnder a prior stock repurchase plan, during 2017. Under prior plans, we repurchased 1,134,966177,834 shares at a total cost of $100.0$13.7 million during 2017 and 1,485,4932020. No shares atwere repurchased under a total cost of $100.0 millionstock repurchase plan during 2015.2022 or 2021.

The following table provides information with respect to purchases made by or on behalf of us or any “affiliated purchaser” (as defined in Rule 10b-18(a)(3) under the Securities Exchange Act of 1934), of our common stock during the fourth quarter of 2017.2022.

Net income available to common shareholders increased $59.9$136.6 million for 20172022 compared to 2016.2021. The increase was primarily the result of a $90.1$306.4 million increase in net interest income and a $16.2$18.1 million decreaseincrease in the provision for loan lossesnon-interest income partly offset by a $26.1$142.3 million increase in non-interest expense a $13.2 million decrease in non-interest income and a $7.1$43.2 million increase in income tax expense. Income tax expense for 2017 was impacted by the enactment of the Tax Cuts and Jobs Act on December 22, 2017, as further discussed below. Net income available to common shareholders increased $24.9 million for 2016 compared to 2015. The increase was primarily the result of a $39.7 million increase in net interest income, a $21.0 million increase in non-interest income and a $3.3 million decrease in income tax expense partly offset by a $39.2 million increase in non-interest expense.

Details of the changes in the various components of net income are further discussed below.

Net Interest Income

Net interest income is the difference between interest income on earning assets, such as loans and securities, and interest expense on liabilities, such as deposits and borrowings, which are used to fund those assets. Net interest income is our largest source of revenue, representing 72.0%76.1% of total revenue during 2017.2022. Net interest margin is the ratio of taxable-equivalent net interest income to average earning assets for the period. The level of interest rates and the volume and mix of earning assets and interest-bearing liabilities impact net interest income and net interest margin.

The Federal Reserve influences the general market rates of interest, including the deposit and loan rates offered by many financial institutions. Our loan portfolio is significantly affected by changes in the prime interest rate. TheAs of December 31, 2022, approximately 42.7% of our loans had a fixed interest rate, while the remaining loans had floating interest rates that were primarily tied to the prime interest rate (approximately 27.7%) or the London Interbank Offered Rate (“LIBOR”) (approximately 8.2%). We discontinued originating LIBOR-based loans effective December 31, 2021 and have begun to negotiate loans using our preferred replacement index, the American Interbank Offered Rate (“AMERIBOR”), a benchmark developed by the American Financial Exchange, the Secured Overnight Financing Rate (“SOFR”) or a benchmark developed by Bloomberg Index Services (“BSBY”). As of December 31, 2022, approximately, 21.4% of our loans were tied to one of these three indexes. For our currently outstanding LIBOR-based loans, the timing and manner in which each customer’s contract transitions from LIBOR to another rate will vary on a case-by-case basis. Our goal is to complete all transitions by the end of first quarter of 2023.

As of December 31, 2022, the target range for the federal funds rate offered on loanswas 4.25% to borrowers with strong credit, remained at 3.25% during most of 2015.4.50%. In December 2015,2022, the primeFederal Reserve released projections whereby the midpoint of the projected appropriate target range for the federal funds rate would rise to 5.1% by the end of 2023 and subsequently decrease to 4.1% by the end of 2024. While there can be no such assurance that any increases or decreases in the federal funds rate will occur, these projections imply up to a 75 basis point increase in the federal funds rate during 2023, followed by a 100 basis point decrease in 2024. The target range for the federal funds rate was increased 25 basis points to 3.50% and remained at that level through most of 2016. In December 2016, the prime rate increased 25 basis points4.50% to end the year at 3.75%. During 2017, the prime rate increased 75 basis points (25 basis points in each of March, June and December) to end the year at to 4.50%. Our loan portfolio is also significantly impacted, by changes in the London Interbank Offered Rate (LIBOR). At December 31, 2017, the one-month and three-month U.S. dollar LIBOR rates were 1.56% and 1.69%, respectively, while at December 31, 2016, the one-month and three-month U.S. dollar LIBOR rates were 0.77% and 1.00%, respectively.