Fulton Financial Corporation (the "Corporation") was incorporated under the laws of Pennsylvania on February 8, 1982 and became a bank holding company through the acquisition of all of the outstanding stock of Fulton Bank N.A. ("Fulton Bank") on June 30, 1982. In this Report, "the Corporation" refers to Fulton Financial Corporation and its subsidiaries that are consolidated for financial reporting purposes, except that when referring to Fulton Financial Corporation as a public company, as a bank holding company or as a financial holding company, or to the common stock or other securities issued by Fulton Financial Corporation, references to "the Corporation" refer just to Fulton Financial Corporation. References to "the Parent Company" refer just to Fulton Financial Corporation. In 2000, the Corporation became a financial holding company as defined in the Gramm-Leach-Bliley Act ("GLB Act"), which gave the Corporation the ability to expand its financial services activities under its holding company structure. See "Competition" and "Supervision and Regulation." The Corporation directly owns 100% of the common stock of sixfour community banks and eight non-bank entities. As of December 31, 2017,2018, the Corporation had approximately 3,7003,500 full-time equivalent employees.

The Corporation’s sixfour subsidiary banks are located primarily in suburban or semi-rural geographic markets throughout a five-state region (Pennsylvania, Delaware, Maryland, New Jersey and Virginia). Each of these banking subsidiaries delivers financial services in a highly personalized, community-oriented style that emphasizes relationship banking. Where appropriate, operations are centralized through common platforms and back-office functions. The Corporation has announced that it is developing plans to seek regulatory approval to beginbegun the process of consolidating its sixbank subsidiaries, having consolidated two of its bank subsidiaries into its largest bank subsidiary, banks in connection with a transition to a business model that will be less oriented on geographic boundaries and will instead focus more on alignment with the customer segments the Corporation serves. The Corporation also believes that consolidating its subsidiary banks will enhance its ability to manage risk more efficiently and effectively through a centralized risk management and compliance function.Fulton Bank, N.A., during 2018. This multi-year consolidation process is expected to eventually result in the Corporation conducting its core banking business through a single bank subsidiary, bank.which would consolidate its brands and reduce the number of government agencies that regulate the Corporation's banking operations. The timing of the commencementcompletion of this consolidation process will depend significantlydepends, in part, on theFulton Financial Corporation and its banking subsidiaries making necessary progressbank subsidiary, Lafayette Ambassador Bank, demonstrating that certain deficiencies in enhancing a largely centralizedthe compliance program designed to comply with the requirements of the Bank Secrecy Act ("BSA"), as amended by the USA Patriot Act of 2001, as well as related anti-money laundering ("AML") laws and regulations.regulations, and the corresponding requirements of the regulatory enforcement order issued to Fulton Financial Corporation and Lafayette Ambassador Bank by the Board of Governors of the Federal Reserve System, have been satisfactorily remediated. See Item 1A. "Risk Factors - Legal, Compliance and Reputational Risks - The Corporation intends to seek regulatory approvalhas begun the process of the consolidation of ourconsolidating its bank subsidiaries, which couldwill result in significant implementation costs and impact our long-term compliance obligations"in 2019" and "Risk Factors - Legal, Compliance and Reputational Risks - TheFailure to comply with the BSA, the Patriot Act and related anti-money laundering requirements could subject the Corporation to enforcement actions, fines, penalties, sanctions and three of its bank subsidiaries are subject to regulatory enforcement orders requiring improvement in compliance functions andother remedial actions."

The Corporation’s subsidiary banks are located in areas that are home to a wide range of manufacturing, distribution, health care and other service companies. The Corporation and its banks areis not dependent upon one or a few customers or any one industry, and the loss of any single customer or a few customers would not have a material adverse impact on any of the subsidiary banks.Corporation. However, a large portion of the Corporation’s loan portfolio is comprised of commercial loans, commercial mortgage loans and construction loans. See Item 1A. "Risk Factors - Economic and Credit Risks - Economic downturns and theThe composition of the Corporation’s loan portfolio and competition subject the Corporation to credit risk."

Each of the subsidiary banks offers a full range of consumer and commercial banking products and services in its local market area. Personal banking services include various checking account and savings deposit products, certificates of deposit and individual retirement accounts. The subsidiary banks offer a variety of consumer lending products to creditworthy customers in their market areas. Secured consumer loan products include home equity loans and lines of credit, which are underwritten based on loan-to-value limits specified in the Corporation's lending policy. The subsidiary banks also offer a variety of fixed, variable and adjustable rate products, including construction loans and jumbo residential mortgage loans. Residential mortgages are offered through Fulton

Mortgage Company, which operates as a division of each subsidiary bank. Consumer loan products also include automobile loans, automobile and equipment leases, personal lines of credit and checking account overdraft protection.

Commercial banking services are provided to small and medium sized businesses (generally with sales of less than $150 million) in the subsidiary banks’ market areas. The Corporation's policies limit the maximum total lending commitment to a single borrower to $50.0$55.0 million as of December 31, 2017,2018, which is significantly below the Corporation’s regulatory lending limit. In addition, the Corporation

Investment management, trust, brokerage, insurance and investment advisory services are offered to consumer and commercial banking customers in the market areas serviced by the Corporation's subsidiary banks by Fulton Financial Advisors (a division of the Corporation's largest subsidiary, Fulton Bank).

The Corporation’s subsidiary banks deliver their products and services through traditional branch banking, with a network of full service branch offices. Electronic delivery channels include a network of automated teller machines, telephone banking, mobile banking and online banking. The variety of available delivery channels allows customers to access their account information and perform certain transactions, such as depositing checks, transferring funds and paying bills, at virtually any time of the day.

The following table provides certain information for the Corporation’s banking subsidiaries as of December 31, 2017:2018:

TheFulton Financial Corporation owns 100% of the common stock of five non-bank subsidiaries, which are consolidated for financial reporting purposes: (i) Fulton Financial Realty Company, which holds title to or leases certain properties where Corporation branch offices and other facilities are located; (ii) Central Pennsylvania Financial Corp., which owns limited partnership interests in partnerships invested primarily in low- and moderate-income housing projects; (iii) FFC Management, Inc., which owns certain investment securities and other passive investments; (iv) FFC Penn Square, Inc., which owns trust preferred securities ("TruPS") issued by a subsidiary of Fulton Bank; and (v) Fulton Insurance Services Group, Inc., which engages in the sale of various life insurance products.

TheFulton Financial Corporation also owns 100% of the common stock of three non-bank subsidiaries which are not consolidated for financial reporting purposes. The following table provides information for these non-bank subsidiaries, whose sole assets consist of junior subordinated deferrable interest debentures issued by the Corporation, as of December 31, 2017:2018:

The banking and financial services industries are highly competitive. Within its geographic region, the Corporation’s subsidiaries faceCorporation faces direct competition from other commercial banks, varying in size from local community banks to larger regional and national

The industry is also highly competitive due to the various types of entities that now compete aggressively for customers that were traditionally served only by the banking industry. Under the current financial services regulatory framework, banks, insurance companies and securities firms may affiliate under a financial holding company structure, allowing their expansion into non-banking financial services activities that had previously been restricted. These activities include a full range of banking, securities and insurance activities, including securities and insurance underwriting, issuing and selling annuities and merchant banking activities. Moreover, the Corporation and its subsidiaries facefaces increased competition from certain non-bank entities, such as financial technology companies and marketplace lenders, which may or mayin many cases are not be subject to the same regulatory compliance obligations as the Corporation. While the Corporation does not currently engage in many of the activities described above, further entry into these businesses may enhance the ability of the Corporation to compete in the future.

Deposit market share information is compiled asAs of June 30 of each year byDecember 31, 2018, the Federal Deposit Insurance Corporation ("FDIC"). The Corporation’s banks maintainbanking subsidiaries maintained branch offices in 52 counties across five states. In 15 of these counties, the Corporation ranked in the top five in deposit market share (based on deposits as of June 30, 2017)2018). The following table summarizes information about the counties in which the Corporation has branch offices and its market position in each county:

The Corporation and its subsidiaries operateoperates in an industry that is subject to laws and regulations that are enforced by a number of federal and state agencies. Changes in these laws and regulations, including interpretation and enforcement activities, could impact the cost of operating in the financial services industry, limit or expand permissible activities or affect competition among banks and other financial institutions.

The Corporation is a registered financial holding company under the Bank Holding Company Act of 1956, as amended ("BHCA"), and is regulated, supervised and examined by the Board of Governors of the Federal Reserve System ("Federal Reserve Board"). The Corporation's subsidiary banks are depository institutions whose deposits are insured by the FDIC. The following table summarizes the charter types and primary regulators for each of the Corporation’s subsidiary banks:

Federal statutes that apply to the Corporation and its subsidiaries include the GLB Act, the BHCA, the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank Act"), the Federal Reserve Act, the National Bank Act and the Federal Deposit Insurance Act, among others. In general, these statutes, regulations promulgated thereunder, and related interpretations establish the eligible business activities of the Corporation, certain acquisition and merger restrictions, limitations on intercompany transactions, such as loans and dividends, cash reserve requirements, lending limitations, compliance with unfair, deceptive and abusive acts and practices prohibitions, limitations on investments, and capital adequacy requirements, among other things.

The following discussion is general in nature and seeks to highlight some of the more significant of the regulatory requirements to which the Corporation and its subsidiaries areis subject, but does not purport to be complete or to describe all laws and regulations that are applicable.

In particular, fair lending laws prohibit discrimination in the provision of banking services, and the enforcement of these laws has been an increasing focus for the CFPB, the Department of Housing and Urban Development ("HUD"), and other regulators. Fair lending laws include ECOA and the Fair Housing Act ("FHA"), which outlaw discrimination in credit and residential real estate transactions on the basis of prohibited factors including, among others, race, color, national origin, gender, and religion. A lender may be liable for policies that result in a disparate treatment of, or have a disparate impact on, a protected class of applicants or borrowers. If a pattern or practice of lending discrimination is alleged by a regulator, then that agency may refer the matter to the U.S. Department of Justice ("DOJ") for investigation. The Corporation's bank subsidiaries are cooperating with an investigation by the DOJ regarding potential violations of fair lending laws. See "Note-17 Commitments and Contingencies - Legal Proceedings," in the Notes to Consolidated Financial Statements in Item 8. "Financial Statements and Supplementary Data." Failure to comply with these and similar statutes and regulations can result in the Corporation and its bank subsidiaries becoming subject to formal or informal enforcement actions, the imposition of civil money penalties and consumer litigation.

The CFPB has exclusive examination and primary enforcement authority with respect to compliance with federal consumer financial protection laws and regulations by institutions under its supervision and is authorized, individually or jointly with the federal bank regulatory agencies, to conduct investigations to determine whether any person is, or has, engaged in conduct that violates such laws or regulations. The CFPB may bring an administrative enforcement proceeding or civil action in federal district court. In addition, in accordance with a memorandum of understanding entered into between the CFPB and the DOJ, the two agencies have agreed to coordinate efforts related to enforcing the fair lending laws, which includes information sharing and conducting joint investigations; however, as a result of recent leadership changes at the DOJ and CFPB, as well as changes in the enforcement policies and priorities of each agency, the extent to which such coordination will continue to occur in the near term is uncertain. As an independent bureau funded by the Federal Reserve Board, the CFPB may impose requirements that are more stringent than those of the other bank regulatory agencies.

As an insured depository institution with total assets of more than $10 billion, Fulton Bank and the Corporation's other subsidiary banks are subject to the CFPB’s supervisory and enforcement authorities. The Dodd-Frank Act also permits states to adopt stricter consumer protection laws and state attorneys general to enforce consumer protection rules issued by the CFPB. As a result, the Corporation's subsidiary banks operate in a stringent consumer compliance environment and may incur additional costs related to consumer protection compliance, including but not limited to potential costs associated with CFPB examinations, regulatory and enforcement actions and consumer-oriented litigation. The CFPB, other financial regulatory agencies, including the OCC, as well as the DOJ, have, over the past several years, pursued a number of enforcement actions against depository institutions with respect to compliance with fair lending laws.

In addition, in August 2017, the OCC published a notice and request for comment on whether certain aspects of the Volcker Rule should be revised to better accomplish the purposes the Dodd-Frank Act while decreasing the compliance burden on banking organizations and fostering economic growth. The request for comment invited input on ways in which to tailor the Volcker Rule’s requirements and clarify key provisions that define prohibited and permissible activities, as well as input on how the federal regulatory agencies could implement the existing Volcker Rule more effectively without revising the Final Rules. Specifically, the OCC requested comments on the scope of entities subject to the Volcker Rule, the proprietary trading prohibition, the covered funds prohibition, and the compliance program and metrics reporting requirements. WeIn July 2018, the five federal financial regulatory agencies published a joint notice of proposed rulemaking that would simplify and tailor compliance requirements relating to the Volcker Rule. The proposed changes are intended to streamline the rule by eliminating or modifying requirements that are not necessary to effectively implement the statute, while maintaining the core principles of the Volcker Rule as well as the safety and soundness of banking entities. Specifically, the proposal requested comment on narrowing the definition of what is a covered fund that a bank cannot sponsor or invest in, and broadening the "Super 23 A" exemptions to match those in the Federal Reserve Board’s Regulation W. In addition, in December 2018 pursuant to the Economic Growth Act, the five federal financial regulatory agencies invited public comment on a proposal that would exclude community banks with $10 billion or less in total consolidated assets and total trading assets and liabilities of five percent or less of total consolidated assets from the restrictions of the Volcker Rule. Due to the asset threshold under the proposal, this relief would only benefit Fulton Bank of New Jersey, The Columbia Bank, and Lafayette Ambassador Bank. The Corporation cannot predict whether regulations that would simplify compliance with the Final Rules will be adopted or, if such regulations were to be adopted, the extent to which they would reduce ourthe Corporation's compliance burdens.

burdens. If adopted, the regulations may affect the Corporation does not engage in proprietary trading orthe future by reducing some compliance costs, and expanding opportunities, but the Corporation may experience some costs in any other activities prohibited bydeveloping and implementing changes in conformance with the Final Rules, and, based on the Corporation's evaluation of its investments, none fell within the definition of a "covered fund" and none needed to be disposed of by July 31, 2017. The Corporation does not currently expect that the Final Rules will have a material effect on its business, financial condition or results of operations.rules once finalized.

The Basel Committee on Banking Supervision ("Basel") is a committee of central banks and bank regulators from major industrialized countries that develops broad policy guidelines for use by each country’s regulators with the purpose of ensuring that financial institutions have adequate capital given the risk levels of assets and off-balance sheet financial instruments. In December 2010, Basel released frameworks for strengthening international capital and liquidity regulations, referred to as Basel III.

In July 2013, the Federal Reserve Board approved final rules (the "U.S. Basel III Capital Rules") establishing a new comprehensive capital framework for U.S. banking organizations and implementing the Basel's December 2010 framework for strengthening international capital standards. The U.S. Basel III Capital Rules substantially revise the risk-based capital requirements applicable to bank holding companies and depository institutions.

The minimum regulatory capital requirements established by the U.S. Basel III Capital Rules became effective for the Corporation on January 1, 2015, and will bewere fully phased in onas of January 1, 2019.

The U.S. Basel III Capital Rules require the Corporation and its bank subsidiaries to:

The U.S. Basel III Capital Rules use a standardized approach for risk weightings that expand the risk-weightings for assets and off balance sheet exposures from the previous 0%, 20%, 50% and 100% categories to a much larger and more risk-sensitive number of categories, depending on the nature of the assets and off-balance sheet exposures and resulting in higher risk weights for a variety of asset categories. In November 2017, the federal banking agencies adopted a final rule to extend the regulatory capital treatment applicable during 2017 under Basel III for certain items, including regulatory capital deductions, risk weights, and certain minority interest limitations. The relief provided under the final rule applies to banking organizations that are not subject to the capital rules’ advanced approaches, such as the Corporation. Specifically, the final rule extends the current regulatory capital treatment of mortgage servicing assets ("MSAs"), deferred tax assets ("DTAs") arising from temporary differences that could not be realized through net operating loss carrybacks, significant investments in the capital of unconsolidated financial institutions in the form of common stock, non-significant investments in the capital of unconsolidated financial institutions, significant investments in the capital of unconsolidated financial institutions that are not in the form of common stock, and CET1 minority interest, tier 1 minority interest, and total capital minority interest exceeding applicable minority interest limitations.

WhenAs fully phased in onas of January 1, 2019, the Corporation and its bank subsidiaries will also beare required to maintain a "capital conservation buffer" of 2.50% above the minimum risk-based capital requirements. The required minimum capital conservation buffer began to be phased in incrementally, starting at 0.625%, on January 1, 2016, increasing to 1.25% on January 1, 2017, and will continue to increase, to 1.875% on January 1, 2018 and 2.50% on January 1, 2019. The rules provide that the failure to maintain the "capital conservation buffer" will result in restrictions on capital distributions and discretionary cash bonus payments to executive officers. As a result, under the U.S. Basel III Capital Rules, if any of the Corporation's bank subsidiaries fails to maintain the required minimum capital conservation buffer, the Corporation will be subject to limits, and possibly prohibitions, on its ability to obtain capital distributions from such subsidiaries. If the Corporation does not receive sufficient cash dividends from its bank subsidiaries, it may not have sufficient funds to pay dividends on its capital stock, service its debt obligations or repurchase its common stock. In addition, the restrictions on payments of discretionary cash bonuses to executive officers may make it more difficult for the

Corporation to retain key personnel. As of December 31, 2017,2018, the Corporation met the fully-phased in minimum capital requirements, including the new capital conservation buffer, as prescribed in the U.S. Basel III Capital Rules.

In October 2017, the federal banking agencies issued a notice of proposed rulemaking on simplifications to Basel III, a majority of which would apply solely to banking organizations that are not subject to the advanced approaches capital rules. Under the proposed rulemaking, non-advanced approaches banking organizations, such as the Corporation and Fulton Bank, would apply a simpler regulatory capital treatment for MSAs, certain DTAs, investments in the capital of unconsolidated financial institutions, and capital issued by a consolidated subsidiary of a banking organization and held by third parties. Specifically, the proposed rulemaking would eliminate: (i) the 10 percent CET1 capital deduction threshold that applies individually to MSAs, temporary difference DTAs, and significant investments in the capital of unconsolidated financial institutions in the form of common stock; (ii) the aggregate 15 percent CET1 capital deduction threshold that subsequently applies on a collective basis across such items; (iii) the 10 percent CET1 capital deduction threshold for non-significant investments in the capital of unconsolidated financial institutions; and (iv) the deduction treatment for significant investments in the capital of unconsolidated financial institutions not in the form of common stock. Basel III would no longer have distinct treatments for significant and non-significant investments in the capital of unconsolidated financial institutions, but instead would require that non-advanced approaches banking organizations deduct from CET1 capital any amount of MSAs, temporary difference DTAs, and investments in the capital of unconsolidated financial institutions that individually exceeds 25 percent of CET1 capital. The proposed rulemaking also includes revisions to the treatment of certain acquisition, development, or construction exposures that are designed to address comments regarding the current definition of high volatility commercial real estate exposure under the capital rule’s standardized approach.

In December 2017, the Basel Committee on Banking Supervision published the last version of the Basel III accord, generally referred to as "Basel IV." The Basel Committee stated that a key objective of the revisions incorporated into the framework is to reduce excessive variability of risk-weighted assets, which will be accomplished by enhancing the robustness and risk sensitivity of the standardized approaches for credit risk and operational risk, which will facilitate the comparability of banks’ capital ratios; constraining the use of internally-modeled approaches; and complementing the risk-weighted capital ratio with a finalized leverage ratio and a revised and robust capital floor. Leadership of the Federal Reserve Board, OCC, and FDIC, who are tasked with implementing Basel IV, supported the revisions. Although it is uncertain at this time, we anticipatethe Corporation anticipates some, if not all, of the Basel IV accord may be incorporated into the capital requirements framework applicable to the Corporation and Fulton Bank.

The Basel III liquidity framework also includes new liquidity requirements that require financial institutions to maintain increased levels of liquid assets or alter their strategies for liquidity management. The Basel III liquidity framework requires banks and bank holding companies to measure their liquidity against specific ratios. In September 2014, the Federal Reserve Board approved final rules (the "U.S. Liquidity Coverage Ratio Rule") implementing portions of the Basel III liquidity framework for large, internationally active banking organizations, generally those having $250 billion or more in total assets, and similar, but less stringent, rules, applicable to bank holding companies with consolidated assets of $50 billion or more. The U.S. Liquidity Coverage Ratio Rule requires banking organizations to maintain a Liquidity Coverage Ratio ("LCR") that is designed to ensure that sufficient

The Basel III liquidity framework also introduced a second ratio, referred to as the Net Stable Funding Ratio ("NSFR"), which is designed to promote funding resiliency over longer-term time horizons by creating additional incentives for banks to fund their activities with more stable sources of funding on an ongoing structural basis. The federal banking agencies published a notice of proposed rulemaking regarding the NSFR in May 2016. In June 2017, the U.S. Treasury Department ("UST") recommended a delay in the implementation of the proposed NSFR out of concern that the rule could be duplicative of the liquidity requirements discussed above and could therefore impose unnecessary compliance costs upon banking organizations. Accordingly, the prospects for final implementation of the federal banking agencies’ proposed NSFR are uncertain at this time. Because of the Corporation's size, neither the U.S. Liquidity Coverage Ratio Rule nor any additional proposed rules under the Basel III liquidity framework are applicable to it.

For safety and soundness reasons, banking regulations also limit the amount of cash that can be transferred from subsidiary banks to the parent companyParent Company in the form of dividends. Dividend limitations vary, depending on the subsidiary bank’s charter and whether or not it is a member of the Federal Reserve System. Generally, subsidiaries are prohibited from paying dividends when doing so would cause them to fall below the regulatory minimum capital levels. Additionally, limits may exist on paying dividends in excess of net income for specified periods. See "Note 11 - Regulatory Matters," in the Notes to Consolidated Financial Statements in Item 8 "Financial Statements and Supplementary Data" for additional information regarding regulatory capital and dividend and loan limitations.

On April 1, 2011, as required by the Dodd-Frank Act, the deposit insurance assessment base changed from total domestic deposits to average total assets, minus average tangible equity. In addition, the FDIC also created a two scorecard system, one for large

The FDIC annually establishes for the DIF a designated reserve ratio, or DRR, of estimated insured deposits. The FDIC has announced that the DRR for 20182019 will remain at 2.00%, which is the same ratio that has been in effect since January 1, 2011. The FDIC is authorized to change deposit insurance assessment rates as necessary to maintain the DRR, without further notice-and-comment rulemaking, provided that: (1) no such adjustment can be greater than three basis points from one quarter to the next, (2) adjustments cannot result in rates more than three basis points above or below the base rates and (3) rates cannot be negative.

The Dodd-Frank Act increased the minimum DIF reserve ratio to 1.35% of insured deposits, which must be reached by September 30, 2020, and provides that, in setting the assessment rates necessary to meet the new requirement, the FDIC shall offset the effect of this provision on insured depository institutions with total consolidated assets of less than $10 billion, so that more of the cost of raising the reserve ratio will be borne by the institutions with more than $10 billion in assets. In October 2010, the FDIC adopted a restoration plan to ensure that the DIF reserve ratio reaches 1.35% by September 30, 2020.

On October 22, 2015,September 30, 2018, the FDIC issued a proposal to increase theDIF reserve ratio forreached 1.36 percent, exceeding the DIF tostatutorily required minimum reserve ratio of 1.35 percent ahead of the September 30, 2020, deadline required under the Dodd-Frank Act. FDIC regulations provide that, upon reaching the minimum, level of 1.35% as required by the Reform Act. The FDIC adopted the final rule, which became effective on July 1, 2016, that imposessurcharges on insured depository institutions with total consolidated assets of $10 billion or more will cease. The last quarterly surcharge was reflected in total consolidated assets (such as Fulton Bank)Bank’s December 2018 assessment invoice, which covered the assessment period from July 1 through September 30. March 2019 assessment invoices, which covers the assessment period from October 1, 2018, through December 31, 2018, no longer will include a quarterly surcharge equalsurcharge.

Assessment rates, which declined for all banks when the reserve ratio first surpassed 1.15 percent in the third quarter of 2016, are expected to an annual rate of 4.5 basis points appliedremain unchanged. Assessment rates are scheduled to decrease when the deposit insurance assessment base, after making certain adjustments. reserve ratio exceeds 2 percent.

In addition, the Tax Cuts and Jobs Act of 2017 (the "Tax Act"), which was signed into law on December 22, 2017, disallows the deduction of FDIC deposit insurance premium payments for banking organizations with total consolidated assets of $50 billion or more. For banks with less than $50 billion in total consolidated assets, such as Fulton Bank, the premium deduction is phased out based on the proportion of the bank’s assets exceeding $10 billion. See discussion under Item 1.A. "Risk Factors - The financial services industry, as well as the broader economy, may be subject to new legislation which could result in significant changes in banking and financial services regulation."

Among other requirements, the Patriot Act and the related regulations impose the following requirements with respect to financial institutions:

Failure to comply with the requirements of the Patriot Act and other AML laws and regulations could have serious legal, financial, regulatory and reputational consequences. In addition, bank regulators will consider a holding company’s effectiveness in combating money laundering when ruling on BHCA and Bank Merger Act applications. In May 2016, the regulations implementing the BSA were amended, effective May 2018, to explicitly include risk-based procedures for conducting ongoing customer due diligence, to include understanding the nature and purpose of customer relationships for the purpose of developing a customer

risk profile. In addition, banks must identify and verify the identity of the beneficial owners of all legal entity customers (other than those that are excluded) at the time a new account is opened (other than accounts that are exempted). The Corporation and its banking subsidiaries must comply with these amendments and new requirements by May 11, 2018. The Corporation has adopted policies, procedures and controls to address compliance with the Patriot Act and will continue to revise and update its policies, procedures and controls to reflect required changes (including the May 2016 amendments).

The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director or

principal shareholder. In July 2010, the federal banking agencies issued Guidance on Sound Incentive Compensation Policies ("Guidance") that applies to all banking organizations supervised by the agencies (thereby including both the Corporation and its banking subsidiaries). Pursuant to the Guidance, to be consistent with safety and soundness principles, a banking organization’s incentive compensation arrangements should: (1) provide employees with incentives that appropriately balance risk and reward; (2) be compatible with effective controls and risk management; and (3) be supported by strong corporate governance, including active and effective oversight by the banking organization’s board of directors. Monitoring methods and processes used by a

Section 956 of the Dodd-Frank Act requires the federal banking agencies and the SEC to establish joint regulations or guidelines prohibiting incentive-based payment arrangements at specified regulated entities that encourage inappropriate risk-taking by providing an executive officer, employee, director or principal shareholder with excessive compensation, fees, or benefits or that could lead to material financial loss to the entity. The federal banking agencies issued such proposed rules in April 2011 and issued a revised proposed rule in June 2016, implementing the requirements and prohibitions set forth in Section 956. The revised proposed rule would apply to all banks, among other institutions, with at least $1 billion in average total consolidated assets, for which it would go beyond the existing Guidance to (i) prohibit certain types and features of incentive-based compensation arrangements for senior executive officers, (ii) require incentive-based compensation arrangements to adhere to certain basic principles to avoid a presumption of encouraging inappropriate risk, (iii) require appropriate board or committee oversight, (iv) establish minimum record keeping and (v) mandate disclosures to the appropriate federal banking agency.

The Corporation’s bank subsidiaries are subject to regulatory guidelines establishing standards for safeguarding customer information. These regulations implement certain provisions of the GLB Act. The guidelines describe the federal bank regulatory agencies’ expectations for the creation, implementation and maintenance of an information security program, which would include administrative, technical and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The standards set forth in the guidelines are intended to ensure the security and confidentiality of customer records and information, protect against any anticipated threats or hazards to the security or integrity of such records and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. In October 2016, the federal banking agencies issued an advance notice of proposed rulemaking on enhanced cybersecurity risk-management and resilience standards that would apply to large and interconnected banking organizations and to services provided by third parties to these firms. These enhanced standards would apply only to depository institutions and depository institution holding companies with total consolidated assets of $50 billion or more. The federal banking agencies have not yet taken further action on these proposed standards.

Required reserves must be maintained in the form of either vault cash, an account at a Federal Reserve Bank or a pass-through account as defined by the Federal Reserve Board. Pursuant to the Emergency Economic Stabilization Act of 2008, the Federal Reserve Banks pay interest on depository institutions’ required and excess reserve balances. The interest rate paid on required reserve balances is currently the average target federal funds rate over the reserve maintenance period. The rate on excess balances will be set equal to the lowest target federal funds rate in effect during the reserve maintenance period.

The Riegle-Neal Act generally permits bank holding companies to acquire banks in any state, and preempts all state laws restricting the ownership by a holding company of banks in more than one state. The Riegle-Neal Act also permits a bank to merge with an out-of-state bank and convert any offices into branches of the resulting bank, acquire branches from an out-of-state bank, and establish and operate de novo interstate branches whenever the host state permits de novo branching of its own state-chartered banks.

Bank or financial holding companies and banks seeking to engage in mergers authorized by the Reigle-NealRiegle-Neal Act must be at least adequately capitalized as of the date that the application is filed, and the resulting institution must be well-capitalizedwell capitalized and managed upon consummation of the transaction.

The Change in Bank Control Act prohibits a person, entity or group of persons or entities acting in concert, from acquiring "control" of a bank holding company or bank unless the Federal Reserve Board has been given prior notice and has not objected to the transaction. Under Federal Reserve Board regulations, the acquisition of 10% or more (but less than 25%) of the voting stock of a corporation would, under the circumstances set forth in the regulations, create a rebuttable presumption of acquisition of control of the corporation.

The Corporation's results of operations and financial condition are affected by conditions in the economy and the capital markets generally. The Corporation's financial performance is highly dependent upon the business environment in the markets where the Corporation operates and in the U.S. as a whole. Unfavorable or uncertain economic and market conditions can be caused byby: declines in economic growth, business activity or investor or business confidence,confidence; limitations on the availability, or increases in the cost, of credit and capital,capital; changes in the rate of inflation or in interest rates; high unemployment; governmental fiscal and monetary policies; the level of, or changes in, interest rates, high unemployment,prices of raw materials, goods or commodities; global economic conditions and trade policies; geopolitical events; natural disasters,disasters; acts of war or terrorism, global economic conditions and geopolitical factors,terrorism; or a combination of these or other factors.

Specifically, the business environment impacts the ability of borrowers to pay interest on, and repay principal of, outstanding loans and the value of collateral securing those loans, as well as demand for loans and other products and services the Corporation offers. If the quality of the Corporation’sCorporation's loan portfolio declines, the Corporation may have to increase its provision for credit losses, which would negatively impact its results of operations, and could result in charge-offs of a higher percentage of its loans. Unlike large, national institutions, the Corporation is not able to spread the risks of unfavorable local economic conditions across a large number of diversified economies and geographic locations. If the communities in which the Corporation operates do not grow, or if prevailing economic conditions locally or nationally are unfavorable, its business could be adversely affected. In addition, increased market competition in a lower demand environment could adversely affect the profit potential of the Corporation.

The allowance for credit losses consists of the allowance for loan losses, which is recorded as a reduction to loans on the consolidated balance sheet, and the reserve for unfunded lending commitments.commitments, which is included in other liabilities on the consolidated balance sheet. While the Corporation believes that its allowance for credit losses as of December 31, 20172018 is sufficient to cover incurred losses in the loan portfolio on that date, the Corporation may need to increase its provision for credit losses due to changes in the risk characteristics of the loan portfolio, thereby negatively impacting its results of operations.

The allowance for loancredit losses represents management’smanagement's estimate of losses inherent in the loan portfolio as of the balance sheet date and is recorded as a reduction to loans. Management’sdate. Management's estimate of losses inherent in the loan portfolio is dependent on the proper application of its methodology for determining its allowance needs. The most critical judgments underpinning that methodology include: the ability to identify potential problem loans in a timely manner; proper collateral valuation of loans evaluated for impairment; proper measurement of allowance needs for pools of loans evaluated for impairment; and an overall assessment of the risk profile of the loan portfolio.

The Corporation determines the appropriate level of the allowance for credit losses based on many quantitative and qualitative factors, including, but not limited to: the size and composition of the loan portfolio; changes in risk ratings; changes in collateral values; delinquency levels; historical losses; and economic conditions. In addition, as the Corporation’sCorporation's loan portfolio grows, it will generally be necessary to increase the allowance for credit losses through additional provisions for credit losses, which will impact the Corporation’sCorporation's operating results.

If the Corporation’sCorporation's assumptions and judgments regarding such matters prove to be inaccurate, its allowance for credit losses might not be sufficient, and additional provisions for credit losses might need to be made. Depending on the amount of such provisions for credit losses, the adverse impact on the Corporation’sCorporation's earnings could be material.

Furthermore, banking regulators may require the Corporation to make additional provisions for credit losses or otherwise recognize further loan charge-offs or impairments following their periodic reviews of the Corporation’sCorporation's loan portfolio, underwriting procedures and allowance for credit losses. Any increase in the Corporation’sCorporation's allowance for credit losses or loan charge-offs as required by such regulatory agencies could have a material adverse effect on the Corporation’sCorporation's financial condition and results of operations. See Item 7. "Management’s"Management's Discussion and Analysis of Financial Condition and Results of Operations-Financial Condition-Provision and Allowance for Credit Losses."

Approximately 74.0%73% of the Corporation’sCorporation's loan portfolio was in commercial loans, commercial mortgage loans, and construction loans at December 31, 2017.2018. Commercial loans, commercial mortgage loans and construction loans generally involve a greater degree of credit risk than residential mortgage loans and consumer loans because they typically have larger balances and are likely to be more sensitive to broader economic factors and conditions. Because payments on these loans often depend on the successful operation and management of businesses and properties, repayment of such loans may be affected by factors outside the borrower’sborrower's control, such as adverse conditions in the real estate markets, adverse economic conditions or changes in governmentgovernmental regulation. In

After having risen significantly in recent years, the pace of commercial real estate marketsprice appreciation slowed during 2018. Capitalization rates, which measure annual income relative to prices for recently transacted properties, have been experiencing substantial growth, andfalling, even as yields on U.S. Treasury securities increased competitive pressures have contributed significantlythrough much of 2018. As a result, the returns to historically low capitalization rates and rising property values. Commercial real estate prices, according to many U.S. commercial real estate indices, are currently above the 2007 peak levels that contributed to the financial crisis. Accordingly, the federalinvestors reflect a relatively low premium over very safe alternative investments, which may limit further appreciation of, or create downward pressure on, commercial real estate prices. Federal bank regulatory agencies have expressed concerns about weaknesses in the current commercial real estate market and the extent to which prevailing underwriting standards have been eased by lenders. The Corporation’sCorporation's failure to adequately implement enhanced risk management policies, procedures and controls could adversely affect its ability to increase this portfolio going forward and could result in an increased rate of delinquencies in, and increased losses from, this portfolio.

Furthermore, intense competition among both bank and non-bank lenders, coupled with moderate levels of recent economic growth, cancould increase pressure on the Corporation to relax its credit standards and/or underwriting criteria in order to achieve the Corporation’sCorporation's loan growth targets. A relaxation of credit standards or underwriting criteria could result in greater challenges in the repayment or collection of loans should economic conditions, or individual borrower performance, deteriorate to a degree that could impact loan performance. Additionally, competitive pressures could drive the Corporation to consider loans and customer relationships that are outside of the Corporation’sCorporation's established risk appetite or target customer base. See Item 7. "Management’s"Management's Discussion and Analysis of Financial Condition and Results of Operations-Financial Condition-Loans."

The Corporation cannot predict or control changes in interest rates. The Corporation is affected by fiscal and monetary policies of the federal government, including those of the Federal Reserve Board, which regulates the national money supply and engages in other lending and investment activities in order to manage recessionary and inflationary pressures, many of which affect interest rates charged on loans and paid on deposits.

Net interest income is the difference between interest earned on interest-earning assets and interest paid on interest-bearing liabilities. Net interest income is the most significant component of the Corporation's net income, accounting for approximately 74%76% of total revenues in 2017.2018. In recent years, as the narrowinggeneral level of short-term interest rate spreads,rates has increased, the Corporation's net interest margin, or the difference between interest rates earned on loans and investments and interest rates paid on deposits and borrowings, has adversely affectedincreased, contributing to growth in the Corporation's net interest income.

In the event that the general level of interest rates declines, the net interest margin in recent years. Interest-earningmay come under pressure as interest-earning assets, such as loans and investments, have beenare originated, acquired or repriced at lower rates, reducing the average rate earned on those assets. While the average rate paid on interest-bearing liabilities, such as deposits and borrowings, hasmay also declined,decline, the decline hasmay not always occurredoccur at the same pace as the decline in the average rate earned on interest-earning assets, resulting in a narrowing of the net interest margin. See Item 7. "Management’s"Management's Discussion and Analysis of Financial Condition and Results of Operations-Net Interest Income."

Changes in interest rates may also affect the average life of loans and certain investment securities, most notably mortgage-backed securities. Decreases in interest rates can result in increased prepayments of loans and certain investment securities, as borrowers

or issuers refinance to reduce their borrowing costs. Under those circumstances, the Corporation would be subject to reinvestment risk to the extent that it is not able to reinvest the cash received from such prepayments at rates that are comparable to the rates on the loans and investment securities which are prepaid. Conversely, increases in interest rates may extend the average life of fixed rate assets, which could restrict the Corporation’sCorporation's ability to reinvest in higher yielding alternatives, and may result in customers withdrawing certificates of deposit early so long as the early withdrawal penalty is less than the interest they could receive as a result of the higher interest rates. The Federal Open Market Committee ("FOMC") of the Federal Reserve Board increased the federal funds rate three times during 2017, and recent statements from the FOMC have caused research analysts and economists to expect additional increases in 2018. In addition, the bond markets have experienced rate increases for medium- and longer-term instruments.

Changes in interest rates also affect the fair value of interest-earning investment securities. Generally, the value of interest-earning investment securities moves inversely with changes in interest rates. In the event that the fair value of an investment security declines below its amortized cost, the Corporation is required to determine whether the decline constitutes an other-than-temporary impairment. The determination of whether a decline in fair value is other-than-temporary depends on a number of factors, including whether the Corporation has the intent and ability to retain the investment security for a period of time sufficient to allow for any anticipated recovery in fair value. If a determination is made that a decline is other-than-temporary, an other-than-temporary impairment charge is recorded.

Movements in interest rates can cause demand for some of the Corporation’sCorporation's products and services to be cyclical. For example, demand for residential mortgage loans has historically tended to increase during periods when interest rates were declining and to decrease during periods when interest rates were rising. As a result, the Corporation may need to periodically increase or decrease the size of certain of its businesses, including its personnel, to more appropriately match increases and decreases in demand and volume. The need to change the scale of these businesses is challenging, and there is often a lag between changes in the businesses and the Corporation’sCorporation's reaction to these changes. For example, demand for residential mortgage loans has historically tended to increase during periods when interest rates were declining and to decrease during periods when interest rates were rising.

The market value of the Corporation's securities investments, which include mortgage-backed securities, state and municipal securities, auction rate securities, and corporate debt securities, as well as the revenues the Corporation earns from its trust and investment management services business, are particularly sensitive to price fluctuations and market events. Declines in the values of the Corporation’sCorporation's securities holdings, combined with adverse changes in the expected cash flows from these investments, could result in other-than-temporary impairment charges.

The Corporation's investment management and trust services revenue, which is partially based on the value of the underlying investment portfolios, can also be impacted by fluctuations in the securities markets. If the values of those investment portfolios decrease, whether due to factors influencing U.S. or international securities markets, in general, or otherwise, the Corporation's revenue could be negatively impacted. In addition, the Corporation's ability to sell its brokerage services is dependent, in part, upon consumers' level of confidence in securities markets. See Item 7A. "Quantitative and Qualitative Disclosures About Market Risk."

The Corporation must maintain sufficient sources of liquidity to meet the demands of its depositors and borrowers, support its operations and meet regulatory expectations. The Corporation’sCorporation's liquidity management policies and practices emphasize core deposits and repayments and maturities of loans and investments as its primary sources of liquidity. These primary sources of liquidity can be supplemented by Federal Home Loan Bank ("FHLB") advances, borrowings from the Federal Reserve Bank, proceeds from the sales of loans and use of liquidity resources of the holding company,Corporation, including capital markets funding. Lower-cost, core deposits may be adversely affected by changes in interest rates, and secondary sources of liquidity can be more costly to the Corporation than funding provided by deposit account balances having similar maturities. In addition, adverse changes in the Corporation’sCorporation's results of operations or financial condition, downgrades in the Corporation’sCorporation's credit ratings, regulatory actions involving the Corporation, or changes in regulatory, industry or market conditions could lead to increases in the cost of these secondary sources of liquidity, the inability to refinance or replace these secondary funding sources as they mature, or the withdrawal of unused borrowing capacity under these secondary funding sources.

While the Corporation attempts to manage its liquidity through various techniques, the assumptions and estimates used do not always accurately forecast the impact of changes in customer behavior. For example, the Corporation may face limitations on its ability to fund loan growth if customers move funds out of the Corporation’sCorporation's bank subsidiaries’ deposit accounts in response to increases in interest rates. In the years following the 2008 financial crisis, even as the general level of market interest rates remained low by historical standards, depositors frequently avoided higher-yielding and higher-risk alternative investments, in favor of the safety and liquidity of non-maturing deposit accounts. These circumstances contributed to significant growth in non-maturing deposit account balances at the Corporation, and at depository financial institutions generally. Further, deposits from state and municipal entities, primarily in non-maturing, interest-bearing accounts, are a significant source of deposit funding for the Corporation, representing approximately 13%12% of total deposits at December 31, 2017.2018. State and municipal customers frequently maintain large deposit account balances substantially in excess of the per depositorper-depositor limit of FDIC insurance. Should interest rates continue to rise, customers, including state and municipal entities, may become more sensitive to interest rates when making

Market conditions have been negatively impacted by disruptions in the liquidity markets in the past, and such disruptions or an adverse change in the Corporation's results of operations or financial condition could, in the future, have a negative impact on secondary sources of liquidity. If the Corporation is not able to continue to rely primarily on customer deposits to meet its liquidity and funding needs, continue to access secondary, non-deposit funding sources on favorable terms or otherwise fails to manage its liquidity effectively, the Corporation’sCorporation's ability to continue to grow may be constrained, and the Corporation’sCorporation's liquidity, operating margins, results of operations and financial condition may be materially adversely affected. See Item 7A. "Quantitative and Qualitative Disclosures About Market Risk-Interest Rate Risk, Asset/Liability Management and Liquidity."

Virtually every aspect of the Corporation's and its bank subsidiaries’subsidiaries' operations is subject to extensive regulation and supervision by federal and state regulatory agencies, including the Federal Reserve Board, OCC, FDIC, CFPB, DOJ, UST, SEC, HUD, state attorneys general and state banking, financial services, securities and insurance regulators. Under this regulatory framework, regulatory agencies have broad authority in carrying out their supervisory, examination and enforcement responsibilities to address compliance with applicable laws and regulations, including laws and regulations relating to capital adequacy, asset quality, liquidity, risk management and financial accounting and reporting, as well as laws and regulations governing consumer protection, fair lending, privacy, information security and cybersecurity risk management, third-party vendor risk management, and AML and anti-terrorism laws, among other aspects of the Corporation’sCorporation's business. Failure to comply with these regulatory requirements, including inadvertent or unintentional violations, may result in the assessment of fines and penalties, or the commencement of further informal or formal regulatory enforcement actions against the Corporation or its bank subsidiaries. Other negative consequences

Compliance with banking and financial services statutes and regulations is also important to the Corporation’sCorporation's ability to engage in new activities or to expand upon existing activities. Regulators continue to scrutinize banks through longer and more intensive examinations. Federal and state banking agencies possess broad powers to take supervisory actions, as they deem appropriate. These supervisory actions may result in higher capital requirements, higher deposit insurance premiums and limitations on the Corporation’sCorporation's operations and expansion activities that could have a material adverse effect on its business and profitability. As noted below and as examplesan example of such limitations, the regulatory enforcement ordersorder to which the CorporationParent Company and three of its bank subsidiariessubsidiary, Lafayette Ambassador Bank, are subject imposeimposes certain restrictions on the expansion activities of the CorporationParent Company and those bank subsidiaries.Lafayette Ambassador Bank.

The Corporation has sixfour bank subsidiaries, and the Corporation and its subsidiaries are subject to regulation by a relatively large number ofmultiple federal and state regulatory agencies. This corporate structure presents challenges, specifically, the need for compliance with different, and potentially inconsistent, regulatory requirements and expectations. The time, expense and internal and external resources associated with regulatory compliance continue to increase, and balancing the need to address regulatory changes and effectively manage overall non-interest expenses has become more challenging than it has been in the past. As a result, the Corporation’sCorporation's compliance obligations increase the Corporation's expense, require increasing amounts of management's attention and can be a disadvantage from a competitive standpoint with respect to non-regulated competitors and larger bank competitors with more extensive resources.

The Corporation has announced that it is developing plans to seek regulatory approval to beginbegun the process of consolidating its six bank subsidiaries.subsidiaries, having consolidated two of its bank subsidiaries into its largest bank subsidiary, Fulton Bank, during 2018. This multi-year consolidation process is expected to eventually result in the Corporation conducting its core banking business through a single bank subsidiary, which would reduce the number of government agencies that regulate the Corporation’sCorporation's banking operations. The timing of the commencementcompletion of this consolidation process will depend significantlydepends, in part, on

The CorporationBSA/AML Requirements mandate that financial institutions develop programs to prevent financial institutions from being used for money laundering and threeterrorist activities. If such activities are detected, financial institutions are obligated to file Suspicious Activity Reports with the U.S. Department of the Treasury's Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts, as well as a customer's beneficial owners.

During 2014 and 2015, the Parent Company and each of its bank subsidiaries arebecame subject to regulatory enforcement orders requiring improvement in compliance functions and remedial actions.

since been terminated, as mentioned above, the form of consent orders or ordersParent Company and Lafayette Ambassador Bank remain subject to ceasea Cease and desist issued upon consentDesist Order Issued Upon Consent (the "Consent Orders"Order"), generally require, among other things, that issued by the Corporation and the affected bank subsidiaries undertake a number of required actions to strengthen and enhance the BSA/AML Compliance Program, and, in some cases, conduct retrospective reviews of past account activity and transactions, as well as certain reports filed in accordance with the BSA/AML Requirements, to determine whether suspicious activity and certain transactions in currency were properly identified and reported in accordance with the BSA/AML Requirements.

Additional expenses and investments have been incurred in recent years as the Corporation expanded its hiring of personnel and use of outside professionals, such as consulting and legal services, and made capital investments in operating systems to strengthen and support the BSA/AML Compliance Program, as well as the Corporation’sCorporation's broader compliance and risk management infrastructures. The expense and capital investment associated with all of these efforts, including those undertaken in connection with the Consent Orders,Order, have had an adverse effect on the Corporation’sCorporation's results of operations in recent periods and could have a material adverse effect on the Corporation’sCorporation's results of operations in one or more future periods.

Finally, due to the existence of the Consent Orders,Order, some counterparties may not be permitted to, due to their internal policies, or may choose not to do business with the Corporation or one or more of its bank subsidiaries. Should counterparties upon which the Corporation or its bank subsidiaries rely for the conduct of their business become unwilling to do business with the Corporation or its bank subsidiaries, the Corporation’sCorporation's results of operations and/or financial condition could be materially adversely effected.

While the Corporation believes that it has made significant progress in improving its BSA/AML Compliance Program, there is no assurance as to when the Consent OrdersOrder will be terminated.

The Dodd-Frank Act has had a substantial impact on many aspects of the financial services industry. The Corporation has been impacted, and will likely continue to be impacted in the future, by the so-called Durbin Amendment to the Dodd-Frank Act, which reduced debit card interchange revenue of banks, and revised FDIC deposit insurance assessments. The Corporation has also been impacted by the Dodd-Frank Act in the areas of corporate governance, capital requirements, risk management stress testing and regulation under federal consumer protection laws.

The Dodd-Frank Act established the CFPB, which was given rulemaking authority over most providers of consumer financial services in the U.S., examination and enforcement authority over the consumer operations of large banks, as well as interpretive authority with respect to numerous existing consumer financial services regulations. As an independent bureau funded by the Federal Reserve Board, the CFPB has imposed requirements more stringent than those imposed by the bank regulatory agencies that were previously responsible for consumer financial protection. The CFPB has also been directed to write and enforce rules identifying practices or acts that areit deems to be unfair, deceptive or abusive in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service.

The CFPB has initiated enforcement actions against a variety of bank and non-bank market participants with respect to a number of consumer financial products and services that has resulted in those participants expending significant time, money and resources to adjust to the initiatives being pursued by the CFPB. These enforcement actions may serve as precedent for how the CFPB interprets and enforces consumer protection laws, including practices or acts that are deemed to be unfair, deceptive or abusive, with respect to all supervised institutions, which may result in the imposition of higher standards of compliance with such laws. In connection with such actions, the CFPB has developed a number of new enforcement theories and applications of federal consumer financial laws. Other federal financial regulatory agencies, including the OCC, as well as state attorneys general and state banking agencies and other state financial regulators, also have been increasingly active in this area with respect to institutions over which they have jurisdiction. See Item 1. "Business-Supervision and Regulation."

Fulton Bank and the Corporation’sCorporation's other bank subsidiaries became, as of March 31, 2017, subject to supervision and examination by the CFPB for compliance with the CFPB’sCFPB's regulations and policies. The costs and limitations related to this additional regulatory regimen have yet to be fully determined, however they could result in material adverse effects on the Corporation’sCorporation's profitability.

The U.S. Congress and state legislatures and federal and state regulatory agencies continually review banking and other laws, regulations and policies for possible changes. Changes in federal or state laws, regulations or governmental policies may affect the Corporation and its business. The effects of such changes are difficult to predict and may produce unintended consequences. New laws, regulations or changes in the regulatory environment could limit the types of financial services and products the Corporation may offer, alter demand for existing products and services, increase the ability of non-banks to offer competing

corresponding community bank relief provided by the Economic Growth Act, such as the community bank leverage ratio, reducing the regulatory reporting burden, and permitting an 18-month on-site examination cycle. However, many provisions of the Dodd-Frank Act that have increased the Corporation's compliance costs, such as the Volcker Rule, the Durbin amendment restricting interchange fees, and the additional supervisory authority of the CFPB, remain in place for the Corporation's largest bank subsidiary, Fulton Bank. Further, to the extent the Corporation is successful in consolidating all of its subsidiary banks into one bank, the benefits afforded under the Economic Growth Act to the Corporation's smaller subsidiary banks would be eliminated.

Certain of the provisions amended by the Economic Growth Act took effect immediately, while others are subject to ongoing joint agency rulemakings. It is not possible to predict when any final rules would ultimately be issued through any such rulemakings, and what the specific content of such rules will be. Although the Corporation expects to benefit from many aspects of this legislative reform, the legislation and any implementing rules that are ultimately issued could have adverse implications on the financial industry, the competitive environment, and the Corporation's ability to conduct business. In addition, the federal banking agencies indicated through interagency guidance that the capital planning and risk management practices of institutions with total assets less than $100 billion would continue to be reviewed through the regular supervisory process, which we compete.may offset the impact of the Economic Growth Acts changes regarding stress testing and risk management.

As a result of the change of Administration and the current composition and recent actions of Congress, it is possible that certain aspects of the existing banking and financial services regulatory framework, as amended by the Dodd-Frank Act, will be repealed or modified in the near-term. For example, the President, senior members of the Administration, and senior members of Congress have advocated for substantial changes to the regulations implementing the Dodd-Frank Act. The federal banking agencies are presently experiencinghave experienced leadership changes, which could impact the supervision, enforcement and rulemaking policies of suchthose agencies. In 2017 and early 2018, Congress confirmed a new Chairman of the Federal Reserve Board, a new Comptroller of the Currency and a new Vice Chairman for Supervision at the Federal Reserve Board. In addition,Board, a new Comptroller of the President nominatedCurrency, a new Chairwoman of the FDIC and thea new Director of the CFPB resigned and was replaced by an interim Director. Consistent with the views of the Administration and Congress, certain members of this new leadership group have advocated for a reduction in financial services regulation, supervision and enforcement.CFPB. Moreover, the senior staffs of these agencies charged with carrying out agency policies and responsibilities have experienced significant turnover as a result of these changes. Consequently,As a result of these changes, and political and economic trends, certain new regulatory initiatives may be delayed or suspended and existing regulations may be re-evaluated, modified or repealed. In November 2018, the Democrats became the majority party of the U.S. House of Representatives and assumed leadership of the House Committee on Financial Services. At this time, however, the full impact of these and other pending leadership changes, as well as the potential impact to financial services regulation to result from such changes, is uncertain. It is also difficult to predict the impact that any legislative or regulatory changes will have on the Corporation, ourits competitors and on the financial services industry as a whole. OurThe Corporation's results of operations also could be adversely affected by changes in the way in which existing statutes, regulations, and laws are interpreted or applied by courts and government agencies.

We areThe Corporation is subject to changes in tax law that could increase ourthe Corporation's effective tax rates. These law changes may be retroactive to previous periods and as a result could negatively affect ourthe Corporation's current and future financial performance. In December 2017, the Tax Cuts and Jobs Act (the "Tax Act") was signed into law enacting the most significant changes to the U.S. Internal Revenue Code of 1986, as amended (the "Code"), in more than 30 years. The full impact of the Tax Act onreduced the Corporation is subject to further evaluation and analysis, although it is likely to have both positive and negative effects on our financial performance. For example, the Tax Act reduces ourCorporation's Federal corporate income tax rate to 21% beginning in 2018, which will have a favorable impact on our earnings and capital generation abilities.2018. However, the Tax Act also imposesimposed limitations on ourthe Corporation's ability to take certain deductions, such as the deduction for FDIC deposit insurance premiums, which will partially offset the anticipated increase in net earningsincome from the lower tax rate.

In addition, as a result of the lower corporateCorporation's customers are likely to experience varying effects from both the individual and business tax rate, we were required under GAAP to re-measure the value of our deferred tax assets and liabilities utilizing the lower tax rate during the fourth quarter of 2017, and, as a result, recorded a $15.6 million charge to income tax expense. The ultimate impactprovisions of the Tax Act may differ from the foregoing description, possibly materially, due to changes in interpretationsand such effects, whether positive or in assumptions that we have made, guidance or regulations thatnegative, may be promulgated, and other actions that we may take as a result of the Tax Act.

Reputation risk, or the risk to the Corporation's earnings and capital from negative public opinion, is inherent in the Corporation's business. Negative public opinion could result from the Corporation's actual, alleged or perceived conduct in any number of activities, including lending practices, litigation, corporate governance, regulatory, compliance, mergers and acquisitions, and disclosure, sharing or inadequate protection of customer information, and from actions taken by government agencies and community organizations in response to that conduct. In addition, unfavorable public opinion regarding the broader financial services industry, or arising from the actions of individual financial institutions, can have an adverse effect on the Corporation’sCorporation's reputation. Because the Corporation conducts the majority of its businesses under the "Fulton" brand, negative public opinion about one line of business could affect the Corporation's other lines of businesses. Any of these or other events that impair the Corporation’sCorporation's reputation can affect the Corporation’sCorporation's ability to attract and retain customers and employees, and access sources of

funding and capital, any of which could have materially adverse effect on the Corporation’sCorporation's results of operations and financial condition.

Many aspects of the Corporation’sCorporation's business involve substantial risk of legal liability. From time to time, the Corporation and its subsidiaries havehas been named or threatened to be named as defendantsdefendant in various lawsuits arising from its business activities (and in some cases from the activities of companies that were acquired). In addition, the Corporation and its bank subsidiaries areis regularly the subject of governmental investigations and other forms of regulatory or governmental inquiry. For example, the Corporation is cooperating with the DOJ in an investigation regarding potential violations of the fair lending laws by Fulton Bank, Fulton Bankits bank subsidiaries, and is responding to an investigation by the staff of New Jersey, The Columbia Bankthe Division of Enforcement of the U.S. Securities and Lafayette Ambassador Bank due to potential lending discrimination onExchange Commission regarding certain accounting determinations that could have impacted the basis of race and national origin.Corporation's reported earnings per share. Like other large financial institutions, the Corporation is also subject to risk from potential employee misconduct, including non-compliance with policies and improper use or disclosure of confidential information. These lawsuits, investigations, inquiries and other matters

Currently, the CorporationParent Company and three of its bank subsidiariesLafayette Ambassador Bank are the subject of a regulatory proceedingsproceeding in the form of the Consent Orders.Order described above. The Corporation can provide no assurance as to the outcome or resolution of legal or administrative actions or investigations, and such actions and investigations may result in judgments against usthe Corporation for significant damages or the imposition of regulatory restrictions on ourthe Corporation's operations. Resolution of these types of matters can be prolonged and costly, and the ultimate results or judgments are uncertain due to the inherent uncertainty in the outcomes of litigation and other proceedings.

The Corporation’sCorporation's business plan includes the pursuit of profitable growth. Under current economic, competitive and regulatory conditions, profitable growth may be difficult to achieve due to one or more of the following factors:

To achieve profitable growth, the Corporation may pursue new lines of business or offer new products or services, all of which can involve significant costs, uncertainties and risks. Any new activity the Corporation pursues may require a significant investment of time and resources, and may not generate the anticipated return on that investment. Sustainable growth requires that the Corporation manage risks by balancing loan and deposit growth at acceptable levels of risk, maintaining adequate liquidity and capital, hiring and retaining qualified employees, successfully managing the costs and implementation risks with respect to strategic projects and initiatives, and integrating acquisition targets while managing costs. In addition, the Corporation may not be able to effectively implement and manage any new activities. External factors, such as the need to comply with additional regulations, the availability, or introduction, of competitive alternatives in the market, and changes in customer preferences may also impact the successful implementation of any new activity. Any new activity could have a significant impact on the effectiveness of the Corporation’sCorporation's system of internal controls. If the Corporation is not able to adequately identify and manage the risks associated with new activities, the Corporation’sCorporation's business, results of operations and financial condition could be materially and adversely impacted.

There is significant competition among commercial banks in the market areas served by the Corporation. In addition, the Corporation also competes with other providers of financial services, such as savings and loan associations, credit unions, consumer finance companies, securities firms, insurance companies, commercial finance and leasing companies, the mutual funds industry, full service brokerage firms and discount brokerage firms, some of which are subject to less extensive regulation than the Corporation is with respect to the products and services they provide and have different cost structures. Some of the Corporation's competitors have greater resources, higher lending limits, lower cost of funds and may offer other services not offered by the Corporation. The Corporation also experiences competition from a variety of institutions outside its market areas. Some of these institutions conduct business primarily over the Internet and, as a result, may be able to realize certain cost savings and offer products and services at more favorable rates and with greater convenience to the customer. The financial services industry could become even more competitive as a result of legislative, regulatory and technological changes and continued consolidation. In addition, technology has lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks, such as funds transfers, payment services, residential mortgage loans, consumer loans and wealth and investment management services.

Competition may adversely affect the rates the Corporation pays on deposits and charges on loans, and could result in the loss of fee income, as well as the loss of customer deposits and the income generated from those deposits, thereby potentially adversely affecting the Corporation's profitability and its ability to continue to grow. The Corporation's profitability and continued growth depends upon its continued ability to successfully compete in the market areas it serves. See Item 1. "Business-Competition."

In the past, the Corporation supplemented its internal growth with strategic acquisitions of banks, branches and other financial services companies. In the future, the Corporation may seek to supplement organic growth through additional acquisitions. If the purchase price of an acquired company exceeds the fair value of the company's net assets, the excess is carried on the acquirer's balance sheet as goodwill. As of December 31, 2017,2018, the Corporation had $530.6 million of goodwill recorded on its balance sheet. The Corporation is required to evaluate goodwill for impairment at least annually. Write-downs of the amount of any impairment, if necessary, are to be charged to earnings in the period in which the impairment occurs. There can be no assurance that future evaluations of goodwill will not result in impairment charges.

The preparation of the Corporation’sCorporation's financial statements in accordance with U.S. generally accepted accounting principles requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities as of the date of the financial statements, as well as revenues and expenses during the period. A summary of the accounting policies that the Corporation considers to be most important to the presentation of its financial condition and results of operations, because they require management’smanagement's most difficult judgments as a result of the need to make estimates about the effects of matters that are inherently uncertain, including those related to the allowance for credit losses, goodwill, income taxes, and fair value measurements, is set forth in Item 7. "Management’s"Management's Discussion and Analysis of Financial Condition and Results of Operations-Critical Accounting Policies" and within "Note 1-Summary of Significant Accounting Policies," in the Notes to Consolidated Financial Statements in Item 8. "Financial Statements and Supplementary Data."

A variety of factors could affect the ultimate values of assets, liabilities, income and expenses recognized and reported in the Corporation’sCorporation's financial statements, and these ultimate values may differ materially from those determined based on management’smanagement's estimates and assumptions. In addition, the Financial Accounting Standards Board ("FASB"), regulatory agencies, and other bodies that establish accounting standards from time to time change the financial accounting and reporting standards governing the preparation of the Corporation’sCorporation's financial statements. Further, those bodies that establish and interpret the accounting standards (such as the FASB, the Securities and Exchange Commission, and banking regulators) may change prior interpretations or positions regarding how these standards should be applied. These changes can be difficult to predict and can materially affect how the Corporation records and reports its financial condition and results of operations.

For example, during 2016, the FASB issued a new accounting standard, Accounting Standards Update 2016-13, that will require the recognition of credit losses on loans and other financial assets based on an entity’sentity's current estimate of expected losses over the lifetime of each loan or other financial asset, referred to as the current expected credit loss ("CECL") model, as opposed to current accounting standards, which require recognition of losses on loans and other financial assets only when those losses are "probable." The Corporation’sOn December 21, 2018, the bank regulatory agencies approved a final rule modifying the agencies' regulatory capital rules and providing an option to phase in over a period of three years the day-one regulatory capital effects of adoption of thisthe CECL model. The final rule also revises the agencies' other rules to reflect the update to the accounting standards. The final rule will take effect April 1, 2019. The new CECL standard which is requiredwill become effective for interim and annual reporting periodsthe Corporation for fiscal years beginning after December 15, 2019 could materially affectand for interim periods within those fiscal years. The Corporation is currently evaluating the Corporation’simpact the CECL model will have on its financial statements, but expects to recognize a one-time cumulative-effect adjustment to the allowance for credit losses methodology,as of the beginning of the first reporting period in which the new standard is adopted, or January 1, 2020 for the Corporation. The Corporation also expects to incur both transition costs and ongoing costs in developing and implementing the CECL methodology. The Corporation cannot yet determine the magnitude of any such one-time cumulative adjustment or of the overall impact of the new standard on its financial condition capital levels andor results of operations, including expenses the Corporation may incur in implementing this accounting standard.operations. See "Note 1 - Summary of Significant Accounting Policies - Recently Issued Accounting Standards" in the Notes to Consolidated Financial Statements in Item 8. "Financial Statements and Supplementary Data."

The Corporation is exposed to many types of operational risk, including the risk of human error or fraud by employees and other third parties, intentional and inadvertent misrepresentation by loan applicants, borrowers or guarantors, unsatisfactory performance by employees and vendors, clerical and record-keeping errors, computer and telecommunications systems malfunctions or failures and reliance on data that may be faulty or incomplete. In an environment characterized by continual, rapid technological change, as discussed below, when the Corporation introduces new products and services, or makes changes to its information technology systems and processes, these operational risks are increased. Any of these operational risks could result in the Corporation's diminished ability to operate one or more of its businesses, financial loss, potential liability to customers, inability to secure insurance, reputational damage and regulatory intervention, which could materially adversely affect the Corporation.

The Corporation’sCorporation's risk management framework is subject to inherent limitations, and risks may exist, or develop in the future, that the Corporation has not anticipated or identified. If the Corporation's risk management framework proves to be ineffective, the Corporation could suffer unexpected losses and could be materially adversely affected. As noted above, the Corporation’s historical decentralized banking strategy further challenges the Corporation's efforts to manage risk efficiently and effectively through a centralized risk management and compliance function.

The Corporation relies upon certain third-party vendors to provide products and services necessary to maintain its day-to-day operations, including, notably, responsibility for the core processing system that services all of the Corporation’sCorporation's bank subsidiaries. Accordingly, the Corporation’sCorporation's operations are exposed to the risk that these vendors might not perform in accordance with applicable contractual arrangements or service level agreements. The failure of an external vendor to perform in accordance with applicable contractual arrangements or service level agreements could be disruptive to the Corporation’sCorporation's operations, which could have a material adverse effect on the Corporation’sCorporation's financial condition and/or results of operations.operations, and damage its reputation. Further, third-party vendor risk

The commercial soundness of many financial institutions may be closely interrelated as a result of credit, trading, execution of transactions or other relationships between the institutions. As a result, concerns about, or a default or threatened default by, one institution could lead to significant market-wide liquidity and credit problems, losses or defaults by other institutions. This risk is sometimes referred to as "systemic risk" and may adversely affect financial intermediaries, such as clearing agencies, clearing houses, banks, securities firms and exchanges, with which the Corporation interacts on a daily basis, and therefore could adversely affect the Corporation.

Any of these operational or other risks could result in the Corporation's diminished ability to operate one or more of its businesses, financial loss, potential liability to customers, inability to secure insurance, reputational damage and regulatory intervention, which could materially adversely affect the Corporation.

One critical component of the Corporation’sCorporation's risk management framework is its system of internal controls. Management regularly reviews and updates the Corporation’sCorporation's internal controls, disclosure controls and procedures, and corporate governance policies and procedures. Any system of controls, however well designed and operated, is based in part on certain assumptions and can provide reasonable, but not absolute, assurances that the objectives of the controls are met. Any failure or circumvention of the Corporation’sCorporation's controls and procedures or failure to comply with regulations related to controls and procedures could have a material adverse effect on the Corporation’sCorporation's business, results of operations, financial condition and reputation. See Item 9A. "Controls and Procedures."

The Corporation’sCorporation's business is highly dependent on information systems and technology and the ability to collect, process, transmit and store significant amounts of confidential information regarding customers, employees and others on a daily basis. While the Corporation performs some of the functions required to operate its business directly, it also outsources significant business functions, such as processing customer transactions, maintenance of customer-facing websites, including its online and mobile banking function,functions, and developing software for new products and services, among others. These relationships require the Corporation to allow third parties to access, store, process and transmit customer information. As a result, the Corporation may be subject to cyber security risks directly, as well as indirectly through the vendors to whom it outsources business functions. The increased use of smartphones, tablets and other mobile devices, as well as cloud computing, may also heighten these and other operational risks. Cyber threats could result in unauthorized access, loss or destruction of customer data, unavailability, degradation or denial of service, introduction of computer viruses and other adverse events, causing the Corporation to incur additional costs (such as repairing systems or adding new personnel or protection technologies). Cyber threats may also subject the Company to regulatory investigations, litigation or enforcement require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cyber security incident, all or any of which could adversely affect the Corporation’sCorporation's business, financial condition or results of operations and damage its reputation.

The Corporation attempts to reduce its exposure to its vendors’vendors' cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions, among other things. The Corporation also uses monitoring and preventive controls to detect and respond to cyber threats to its own systems before they become significant. The Corporation regularly evaluates its systems and controls and implements upgrades as necessary. The additional cost to the Corporation of our cyber security monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting and forensic testing firms, insurance premium costs and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cyber security.

There can be no assurance that the measures employed by the Corporation to combat direct or indirect cyber threats will be effective. In addition, because the methods of cyber attacks change frequently or, in some cases, are not recognized until launched, the Corporation may be unable to implement effective preventive control measures or proactively address these methods and the probability of a successful attack cannot be predicted. The Corporation’sCorporation's or a vendor’svendor's failure to promptly identify and counter a cyber attack may result in increased costs and other negative consequences, such as the loss of, a successful cyber attack.or inability to access, data, degradation or denial of service and introduction of computer viruses. Although the Corporation maintains insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, such insurance coverage may be inapplicable or otherwise insufficient to cover any or all losses. Further, a successful cyber security attack that results in

Account data compromise events at large retailers, health insurers, a national consumer credit reporting agency and others in recent years have resulted in heightened legislative and regulatory focus on privacy, data protection and information security. New or revised laws and regulations may significantly impact the Corporation’sCorporation's current and planned privacy, data protection and information security-related practices, the collection, use, sharing, retention and safeguarding of consumer and employee information, and current or planned business activities. Compliance with current or future privacy, data protection and information security laws to which the Corporation is subject could result in higher compliance and technology costs and could restrict the Corporation’sCorporation's ability to provide certain products and services, which could materially and adversely affect the Corporation’sCorporation's profitability. The Corporation’sCorporation's failure to comply with privacy, data protection and information security laws could result in potentially significant regulatory and governmental investigations and/or actions, litigation, fines, sanctions and damage to the Corporation’sCorporation's reputation and its brand.

The financial services industry is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve customers and to reduce costs. The Corporation’sCorporation's future success depends, in part, upon its ability to address the needs of its customers by using technology to provide products and services that will satisfy customer demands, as well as to create additional efficiencies in the Corporation’sCorporation's operations. The costs of new technology, including personnel, can be high, in both absolute and relative terms. Many of the Corporation’sCorporation's financial institution competitors have substantially greater resources to invest in technological improvements. In addition, new payment, credit and investment and wealth management services developed and offered by non-bank or non-traditional competitors pose an increasing threat to the products and services traditionally provided by financial institutions like the Corporation. The Corporation may not be able to effectively implement new technology-driven products and services, be successful in marketing these products and services to its customers, or effectively deploy new technologies to improve the efficiency of its operations. Failure to successfully keep pace with technological change affecting the

financial services industry could have a material adverse impact on the Corporation’sCorporation's business, financial condition and results of operations.

There can be no assurance, given the past pace of change and innovation, that the Corporation’sCorporation's technology, either purchased or developed internally, will meet or continue to meet the needs of the Corporation and the needs of its customers.

In addition, advances in technology, as well as changing customer preferences favoring access to the Corporation’sCorporation's products and services through digital channels, could decrease the value of the Corporation’sCorporation's branch network and other assets. If customers increasingly choose to access the Corporation’sCorporation's products and services through digital channels, the Corporation may find it necessary to consolidate, close or sell branch locations or restructure its branch network. These actions could lead to losses on assets, expenses to reconfigure branches and the loss of customers in affected markets. As a result, the Corporation’sCorporation's business, financial condition or results of operations may be adversely affected.

The Corporation’sCorporation's success depends, in large part, on its ability to attract and retain skilled people. Competition for talented personnel in most activities engaged in by the Corporation can be intense, and the Corporation may not be able to hire sufficiently skilled people or to retain them. The unexpected loss of services of one or more of the Corporation’sCorporation's key personnel could have a material adverse impact on the Corporation’sCorporation's business because of their skills, knowledge of the Corporation’sCorporation's markets, years of industry experience and the difficulty of promptly finding qualified replacement personnel.

The Corporation is required by regulatory agencies to maintain adequate levels of capital to support its operations. The Corporation anticipates that current capital levels will satisfy regulatory requirements for the foreseeable future. The Corporation, however, may at some point choose to raise additional capital to support future growth. The Corporation's ability to raise additional capital will depend, in part, on conditions in the capital markets at that time, which are outside of the Corporation's control. Accordingly, the Corporation may be unable to raise additional capital, if and when needed, on terms acceptable to the Corporation, or at all. If the Corporation cannot raise additional capital when needed, its ability to expand operations through internal growth and

The fully phased-in capital standards under the U.S. Basel III Capital Rules require banks to maintain more capital than the minimum levels required under former regulatory capital standards. The new minimum regulatory capital requirements began to apply to the Corporation on January 1, 2015. The required minimum capital conservation buffer began to be phased in incrementally on January 1, 2016 and will bebecame fully phased in on January 1, 2019. The failure to meet the established capital requirements could result in the federal banking regulators placing limitations or conditions on the activities of the Corporation or its bank subsidiaries or restricting the commencement of new activities, and such failure could subject the Corporation or its bank subsidiaries to a variety of enforcement remedies, including limiting the ability of the Corporation or its bank subsidiaries to pay dividends, issuing a directive to increase capital and terminating FDIC deposit insurance. In addition, the failure to comply with the capital conservation buffer will result in restrictions on capital distributions and discretionary cash bonus payments to executive officers. As of December 31, 2017,2018, the Corporation's current capital levels met the fully phased-in minimum capital requirements, including capital conservation buffers, as set forth in the U.S. Basel III Capital Rules. See Item 1. "Business-Supervision and Regulation-Capital Requirements."

TheFulton Financial Corporation is a separate and distinct legal entity from its bank and nonbank subsidiaries, and depends on the payment of dividends and other payments and distributions from its subsidiaries, principally its bank subsidiaries, for substantially all of its revenues. As a result, the Corporation's ability to make dividend payments on its common stock depends primarily on certain federal and state regulatory considerations and the receipt of dividends and other distributions from its subsidiaries. There are various regulatory and prudential supervisory restrictions, which may change from time to time, that impact the ability of the Corporation’sCorporation's bank subsidiaries to pay dividends or make other payments to it. There can be no assurance that the Corporation’sCorporation's bank subsidiaries will be able to pay dividends at past levels, or at all, in the future. If the Corporation does not receive sufficient cash dividends or is unable to borrow from its bank subsidiaries, then the Corporation may not have sufficient funds to pay dividends to its shareholders, repurchase its common stock or service its debt obligations. See Item 1. "Business-Supervision and Regulation-Loans and Dividends from Subsidiary Banks."

In addition, as noted above, liquidity and capital planning at both the bank and holding company levels has become an area of increased regulatory emphasis. In recent years, the Corporation has pursued a strategy of capital management under which it has sought to deploy its capital, through stock repurchases, increased regular dividends and special dividends, in a manner that is beneficial to the Corporation’sCorporation's shareholders. This capital management strategy is subject to regulatory supervision. The Federal Reserve Board recently has expressed its position that all stock repurchase programs by a bank holding company require the prior approval of the Federal Reserve Board. To the extent the Federal Reserve Board maintains this position, the Corporation may not be able to enter the market for stock repurchases on a timely basis when the Corporation's board of directors and management believe such repurchases to be most opportune, or at all.

Fitch, Inc., Moody's Investors Service, Inc. and DBRS, Inc. continuously evaluate the Corporation and its subsidiaries, and their ratings of the Corporation and its subsidiary's long-term and short-term debt are based on a number of factors, including financial strength, as well as factors not entirely within the Corporation’sCorporation's and its subsidiaries' control, such as conditions affecting the financial services industry generally. In light of these reviews and the continued focus on the financial services industry generally, the Corporation and its subsidiaries may not be able to maintain their current respective ratings. Ratings downgrades by any of these credit rating agencies could have a significant and immediate impact on the Corporation's funding and liquidity through cash obligations, reduced funding capacity and collateral triggers. A reduction in the Corporation's or its subsidiaries' credit ratings could also increase the Corporation's borrowing costs and limit its access to the capital markets.

Provisions of banking laws, Pennsylvania corporate law and of the Corporation's Amended and Restated Articles of Incorporation and Bylaws could make it more difficult for a third party to acquire control of the Corporation or have the effect of discouraging a third party from attempting to acquire control of the Corporation. To the extent that these provisions discourage such a transaction, holders of the Corporation's common stock may not have an opportunity to dispose of part or all of their stock at a higher price than that prevailing in the market. These provisions may also adversely affect the market price of the Corporation’sCorporation's stock. In addition, some of these provisions make it more difficult to remove, and thereby may serve to entrench, the Corporation's incumbent directors and officers, even if their removal would be regarded by some shareholders as desirable.

Certain provisions of Pennsylvania corporate law applicable to the Corporation and the Corporation's Amended and Restated Articles of Incorporation and Bylaws include provisions which may be considered to be "anti-takeover" in nature because they may have the effect of discouraging or making more difficult the acquisition of control of the Corporation by means of a hostile tender offer, exchange offer, proxy contest or similar transaction. These provisions are intended to protect the Corporation's shareholders by providing a measure of assurance that the Corporation's shareholders will be treated fairly in the event of an unsolicited takeover bid and by preventing a successful takeover bidder from exercising its voting control to the detriment of the other shareholders. However, these provisions, taken as a whole, may also discourage a hostile tender offer, exchange offer, proxy

solicitation or similar transaction relating to the Corporation's common stock, even if the accomplishment of a given transaction may be favorable to the interests of shareholders.

The ability of a third party to acquire the Corporation is also limited under applicable banking regulations. The BHCA requires any "bank holding company" (as defined in that Act) to obtain the approval of the Federal Reserve Board prior to acquiring more than 5% of the Corporation’sCorporation's outstanding common stock. Any person other than a bank holding company is required to obtain prior approval of the Federal Reserve Board to acquire 10% or more of the Corporation’sCorporation's outstanding common stock under the Change in Bank Control Act of 1978 and, under certain circumstances, such approvals are required at an even lower ownership percentage. Any holder of 25% or more of the Corporation’sCorporation's outstanding common stock, other than an individual, is subject to regulation as a bank holding company under the BHCA. In addition, the delays associated with obtaining necessary regulatory approvals for acquisitions of interests in bank holding companies also tend to make more difficult certain methods of effecting acquisitions. While these provisions do not prohibit an acquisition, they would likely act as deterrents to an unsolicited takeover attempt.

The following table summarizes the Corporation’s other significant administrative properties. Banking subsidiaries also maintain administrative offices at their respective main banking branches, which are included within the preceding table.

The following table provides information about options outstanding under the Corporation’s Amended and Restated Equity and Cash Incentive Compensation Plan ("Employee Equity Plan") and the number of securities remaining available for future issuance under the Employee Equity Plan, the 2011 Directors' Equity Participation Plan and the Employee Stock Purchase Plan as of December 31, 2017:2018: