Responsible Business & Corporate Governance

A Message from Atlantic Union Bankshares Corporation Board Chair Ronald Tillett

2025 marked another exciting year for Atlantic Union Bank, and it has been a privilege to continue my service as Chairman of the Board of Directors of Atlantic Union Bankshares Corporation. I know that financial institutions carry a lot of responsibility to support the well-being of their communities and help them prosper. While Atlantic Union Bank has grown significantly since its founding in 1902, we have not lost sight of the importance of community and doing our part to help people and businesses thrive.

We have always worked to support local businesses, empower families and foster growth in our communities, and we have only strengthened this commitment in recent years. In 2025, Atlantic Union Bank was the top SBA 7a small business lender for a bank headquartered in Virginia. Additionally, Teammates across the bank were active in their communities in 2025, helping to expand access to financial education, provide affordable housing solutions and promote sustainable practices.

We know that the needs of our customers and communities are ever-changing, and we are constantly adjusting to meet those needs. What will never change is our commitment to be part of the fabric of our communities. 2025 was an impactful year for Atlantic Union Bank, and I am excited to keep this positive momentum going forward.

Warm regards,

Ronald Tillett
Atlantic Union Bankshares Corporation, Board Chair

Corporate Responsibility Practices

Our Board actively oversees current and emerging corporate social responsibility matters, including environmental, social, and governance (“ESG”) matters that are relevant to our business, operations, or that are otherwise pertinent to us and our shareholders, teammates, customers, communities and parties with whom we do business. The Nominating and Corporate Governance Committee of our Board is the primary committee responsible for monitoring, evaluating and overseeing the implementation of our corporate responsibility strategy. Our executive leadership, including Chief Executive Officer, Chief Financial Officer, General Counsel and Chief Human Resources Officer, establishes our corporate responsibility strategy. Our management level Corporate Responsibility Committee manages our corporate responsibility activities and makes recommendations to executive leadership on initiatives that support our corporate responsibility strategy. The Corporate Responsibility Committee also reports to the Nominating and Corporate Governance Committee, or the full Board, as appropriate, on developments in corporate responsibility and ESG, and on goals, strategies, opportunities, and risks with respect to our corporate responsibility activities. The Corporate Responsibility Committee convened four times in 2025.

We have established a risk program that includes elements of corporate responsibility as a component of our enterprise risk management framework. Risk in these areas is managed and reported periodically to management-level risk committee that fall under the purview of our Management Risk Committee and Board Risk Committee.

Committed to Responsible Marketing

Our marketing reﬂects our unwavering commitment to our customers, Teammates and communities. Marketing is a tool for connection, education and empowerment, and we hold ourselves accountable to the highest ethical standards in all we do.

Customer-Centric Approach
Our communications are designed to inform, inspire and empower customers to make conﬁdent ﬁnancial decisions.

Transparency and Trust
We are dedicated to clear communication, and seek to ensure that all materials accurately represent our products and services.

Accessibility
We strive to reﬂect the diversity of the communities we serve in our marketing and ensure our services are accessible.

Community Focus
At the heart of our marketing is an effort to connect with our communities, fostering economic growth and stability.

Financial Well-being and Security
We handle customer data in a secure and ethical manner, and we advocate for ﬁnancial literacy, sustainability, cybersecurity and fraud protection.

By upholding these principles, we seek to ensure that our marketing efforts drive business success and contribute meaningfully to the communities we serve. Our Marketing and Compliance teams work closely to ensure fair and responsible communications in service of our customers.

We work to ensure our marketing builds trust, drives positive change and strengthens our communities by aligning our efforts with ethical practices and shared values.

Marketing Purpose:

The Marketing team ampliﬁes our brand, drives growth and deepens relationships to be a trusted partner for our customers, Teammates and communities.

Customer Care

AUB has been committed to delivering exceptional customer experiences through our dedicated Customer Experience Team. Our CX organization listens to our customers, learns from their feedback, and partners across the company to continuously improve the way we serve you.

Our program includes three core areas:

Office of the President

The Office of the President oversees our enterprise wide Complaints & Dissatisfactions Program and manages all incoming feedback from Regulatory bodies, Executive inquiries, Social Media, and Digital channels.

Every AUB teammate who interacts with customers uses our centralized system to document concerns and ensure issues are resolved quickly and thoroughly. We track and address each case according to strict Service Level Agreements (SLAs), ensuring customers receive timely support and clear communication.

Business Line Experience (BLE)

Our Business Line Experience team analyzes feedback from customer complaints, dissatisfactions, and surveys to uncover insights and opportunities for improvement. These insights help guide our executive leadership’s priorities and shape enhancements across our products and services.

The BLE team also leads:

Journey Mapping & Design Sessions: Collaborating with teams across the bank to identify pain points and redesign experiences that make banking easier and more intuitive.
Customer Impact Analysis: Reviewing new or changing programs to ensure customer needs remain at the center of every decision we make.

Enterprise Incident Management

Our Enterprise Incident Management team monitors, centralizes, and manages events that may impact the customer experience. When issues arise, the team mobilizes quickly to resolve and remediate them, while providing timely communication to customers and teammates.

Their work includes:

Swift issue response and resolution
Root cause analysis to prevent recurring problems
Proactive monitoring to identify potential issues before they affect customers

Privacy and Cybersecurity

We strive to protect the privacy and security of the sensitive information our customers entrust to our care. The cybersecurity threat environment is volatile and dynamic, requiring a robust framework to reduce and mitigate risk. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by:

Maintaining robust governance of our information security program through rigorous oversight from our Board of Directors, the Board–level Risk Committee and senior management.
Conducting annual mandatory training for Teammates on information security and providing ongoing information security education and awareness (online training classes, mock phishing attacks and information security awareness materials).
Implementing Board-approved governance and privacy policies with clear reporting requirements and accountability structures.
Integrating security-by-design principles and rigorous encryption, maintaining the highest standards of data protection and privacy for our customer.
Using independent third parties to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls and improve defenses, and to conduct independent assessments of our program for compliance with regulatory requirements and industry guidelines.
Maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks and facilitate communication to internal and external stakeholders, as needed.

Teammates completed over 2,500 hours of security related learning in 2025

Teammate Learning

We are committed to investing in the growth and development of every Teammate – our people are our most important asset. To that end, we support a wide range of training opportunities, from development programs and courses to resources and materials – all designed to foster growth and development, enhance Teammate skill sets and prepare Teammates to be successful in their roles.

In addition to job-specific training opportunities, all Teammates must complete mandatory annual compliance courses in response to regulatory requirements and changes, including anti-money laundering practices, consumer financial protection practices and anti-bribery and fair advertising policies. Training is delivered in multiple modalities: e-learning, job aids, videos, instructor-led and on-the-job practice supported by certified mentors.

In 2025, our Teams completed 76,818 hours of training, with 29,682 hours directly related to the Bank Secrecy Act (BSA) and compliance.

Cautionary Information and Forward–Looking Statements

The information provided in this report reflects Atlantic Union Bankshares Corporation’s (the “Company”) approach to corporate social responsibility related matters as of the date of publication and is subject to change without notice. Our approach to inclusion of disclosures in this report is different from disclosures included in mandatory regulatory reporting, including under U.S. Securities and Exchange Commission (“SEC”) regulations, if applicable. Any inclusion of information in this report is not an indication that the subject or information is material to us for SEC reporting purposes or any other purposes, including any investment or voting decision with respect to Company securities. This report is intended to highlight some of the work of the Company in the areas of corporate social responsibility. It is not comprehensive or necessarily representative of all of our activities in those areas.

This report contains certain forward–looking statements within the meaning of the Private Securities Litigation Reform Act of 1995, including, without limitation, statements relating to our plans, expectations, efforts, programs, goals, projections, and statements that include other projections, predictions, expectations or beliefs about future events or results or otherwise are not statements of historical fact. Such forward-looking statements are based on certain assumptions as of the time they are made, and are inherently subject to known and unknown risks, uncertainties, and other factors, some of which cannot be predicted or quantified, that may cause actual results, performance, or achievements to be materially different from those expressed or implied by such forward-looking statements. Forward–looking statements are often characterized by the use of qualified words (and their derivatives) such as “expect,” “seek to,” “strive to,” “anticipate,” “vision,” “committed,” “believe,” “intend,” “estimate,” “continue,” “plan,” “project,” “target,” “goal,” “will,” “may,” “view,” “potential,” or words of similar meaning or other statements concerning opinions of judgment of the Company and our management about future events. Although we believe that our expectations with respect to forward-looking statements are based upon reasonable assumptions within the bounds of our existing knowledge of our business and operations, there can be no assurance that actual future results, performance, or achievements of, or trends affecting, us will not differ materially from any projected future results, performance, achievements or trends expressed or implied by such forward-looking statements. Actual future results, performance, achievements or trends may differ materially from historical results or those anticipated depending on a variety of factors, including, but not limited to: changes in general economic, political, or industry conditions particularly in the markets in which we operate and which our loans are concentrated, including the effects of declines in real estate values, inflation, an increase in unemployment levels, U.S. fiscal debt budget and tax matters, U.S. government shutdowns, and slowdowns in economic growth; changes in market interest rates and their related impact on macroeconomic conditions, customer and client behavior, our funding costs, and our loan and securities portfolio; volatility and disruptions in capital and credit markets or in the financial services sector; competitive pressures on product pricing and services; success, impact, and timing of our business strategies; legislative or regulatory changes and requirements, including changes impacting the rulemaking, supervision, examination and enforcement priorities of the federal banking agencies; monetary, fiscal and regulatory policies of the U.S. government; potential claims, damages, and fines related to litigation or government actions; technological risks and developments, and cyber threats, attacks, or events; and data quality and availability. Please also refer to such other factors as discussed throughout Part I, Item 1A. “Risk Factors” and Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of our Annual Report on Form 10–K for the year ended December 31, 2025, and related disclosures in other filings, which have been filed with the SEC and are available on the SEC’s website at www.sec.gov. All risk factors and uncertainties described herein and therein should be considered in evaluating forward-looking statements, and all the forward-looking statements are expressly qualified by the cautionary statements contained or referred to herein and therein. Readers are cautioned not to rely too heavily on forward-looking statements, which speak only as of the date they are made. We do not intend or assume any obligation to update, revise or clarify any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by law.

No reports, documents or websites that are cited or referenced to in this report shall be deemed to form any part of this report. Information contained in this report that has been obtained from third-party sources, including those publicly available, is believed to be reliable, but no representation or warranty is made by the Company as to the quality, completeness, accuracy, fitness for a particular purpose or non-infringement of such information. Sources of third-party information referred to herein retain all rights with respect to such data and use of such data by the Company herein shall not be deemed to grant a license to any third party.

This report was published on March 10, 2026.