The West Coast's serial acquirer has finished its conversions and stopped buying — its public AI record is a client survey on AI impacts, a breach disclosed 119 days late, and a promise of no more deals.
Columbia Banking System is the $66 billion Tacoma-based parent of Columbia Bank, formed by the 2023 combination with Umpqua and enlarged by the $2 billion acquisition of Irvine's Pacific Premier, announced in April 2025, closed on 31 August 2025 and converted in the first quarter of 2026 along with nine branch consolidations, with all related cost savings expected by mid-2026. CEO Clint Stein, who conceded the Umpqua integration 'took longer and came with more challenges than expected', said in October 2025 that Columbia would make no further acquisitions in the foreseeable future and would instead buy back up to $700 million of stock, a response in part to an activist campaign. On AI the bank has disclosed no platform, agent count, budget or leadership role; its published AI voice is the 2026 Business Barometer, which asked nearly 1,200 small and midsize businesses about AI impacts alongside growth, tariffs and fraud, finding a record share prioritising investment over cost-cutting while three in five delay major decisions. The most consequential technology event of 2026 was defensive: an intruder was inside Columbia Bank's systems from early October to late December 2025, the bank discovered it on 19 December and cut access three days later, but notified 7,067 affected customers only from 17 April 2026, 119 days later and nearly four times Washington's 30-day limit, prompting a class action. For a bank that has spent three years converting systems, the next chapter is running one platform rather than building another.
Lead bank
Columbia Bank
Assets (lead bank, Mar 31, 2026)
$66 billion
Charter
Oregon state nonmember bank (FDIC)
Headquarters
Tacoma, WA
Flagship platform
Integration-built infrastructure, not a disclosed AI platform
AI leadership
Clint Stein · Chris Merrywell · Tory Nixon
- Integration done: Pacific Premier ($2 billion) closed 31 August 2025, systems converted and nine branches consolidated in Q1 2026, all cost savings expected by 30 June 2026.
- No more deals: the CEO ruled out acquisitions 'in the foreseeable future' in October 2025 and announced a $700 million buyback amid activist pressure.
- Breach and disclosure: an intrusion from early October to late December 2025 affecting 7,067 people, disclosed 119 days after discovery, against a 30-day state limit; a class action followed.
- AI as a client survey: the 2026 Business Barometer covers AI impacts, tariffs and fraud for nearly 1,200 businesses; 63% will prioritise investment over cost-cutting.
- No disclosed AI platform, agent count, budget or AI leadership role; loan origination volume rose 38% year on year in Q1 2026 with Pacific Premier bankers on board.
- Leadership: Clint Stein (CEO), Chris Merrywell (president, Columbia Bank), Tory Nixon (president, Columbia Bank, on the Business Barometer).
What is Integration-built infrastructure, not a disclosed AI platform?
Columbia's technology record is defined by two mergers: Umpqua in 2023, which took longer than expected, and Pacific Premier, a $2 billion deal announced in April 2025, closed on 31 August 2025 and converted in the first quarter of 2026 with nine branch consolidations, which the CEO promised would 'avoid the snags of the last one'. The bank has not published an AI platform, use-case count or budget. Its 2026 Business Barometer surveys nearly 1,200 small and midsize businesses on AI impacts among other themes, and CEO Clint Stein has said the company will not pursue another acquisition 'in the foreseeable future', redirecting capital to a $700 million buyback.[1][5][7][2]
What has Columbia done on AI, and when?
- Jul 23, 2026
Second-quarter 2026 results[6]
Reported by the company.
- Jun 25, 2026
2026 Business Barometer[7]
Nearly 1,200 businesses on growth, AI impacts, tariffs and fraud.
- Apr 23, 2026
First-quarter 2026 results[5]
Loan originations up 38% year on year; total assets $66.0 billion.
- Apr 17, 2026
Breach notices begin, 119 days after discovery[3]
7,067 people affected; a class action alleges negligence and consumer-protection violations.
- Mar 31, 2026
Systems conversion and branch consolidations complete[5]
Nine branches consolidated in the first quarter; cost savings on track for mid-2026.
- Dec 19, 2025
Intrusion discovered[3]
An attacker inside 'certain Columbia Bank applications' since early October; access cut on 22 December.
- Oct 30, 2025
No more acquisitions; $700 million buyback[2]
The CEO ends West Coast consolidation talk as an activist presses.
- Aug 31, 2025
Pacific Premier closes[5]
Per the first-quarter 2026 results.
- Apr 28, 2025
'A very different deal'[1]
The CEO on why this integration will avoid the Umpqua merger's snags.
- Apr 24, 2025
Pacific Premier acquisition announced[4]
A $2 billion all-stock deal for Southern California scale.
Where does Columbia use AI today?
| System | What it does | Status | Use case |
|---|---|---|---|
| Post-merger systems conversion[5] | Pacific Premier converted in Q1 2026 after the Umpqua integration. | In production | AI governance (general) |
| Intrusion response and breach notification[3] | Attacker removed within three days of discovery; notification 119 days later. | In production | Cybersecurity |
| AI impacts survey for business clients[7] | Business Barometer research rather than a disclosed internal deployment. | In production | Generative & agentic AI |
Use-case links open the tracker's rules-by-use-case matrix: which documents govern each system type.
What has Columbia disclosed in numbers?
| Metric | Value | As of |
|---|---|---|
| Pacific Premier acquisition | $2 billion, closed 31 August 2025[5][4] | Apr 23, 2026 |
| Individuals affected by the 2025 breach / days to notify | 7,067 / 119[3] | May 15, 2026 |
| Share buyback authorised | up to $700 million[2] | Oct 30, 2025 |
| Loan origination growth, Q1 2026 | +38% year on year[5] | Apr 23, 2026 |
| Total assets | $66.0 billion[5] | Mar 31, 2026 |
“As we scan the horizon and look at things, our view is, the greatest investment we can make is in our own stock, our own company.”[2]
Clint Stein · President and CEO · Oct 30, 2025
“Our teams delivered a strong quarter, continuing to generate relationship-based commercial business while successfully supporting customers through a core systems conversion.”[5]
Chris Merrywell · President, Columbia Bank · Apr 23, 2026
Who runs AI at Columbia?
Clint SteinLinkedIn ↗
Chris Merrywell
President, Columbia Bank[5]
Tory NixonLinkedIn ↗
President, Columbia Bank (Business Barometer)[7]
Which regulators govern Columbia's AI?
| Authority | Why it matters here | Documents |
|---|---|---|
| FDIC | Columbia Bank is an Oregon-chartered, FDIC-insured nonmember bank; the FDIC is its primary federal supervisor for technology and any AI. | FDIC FIL-15-2026 |
| Federal Reserve | Columbia Banking System is the holding company; core and conversion vendors are third-party relationships. | SR 23-4 |
| California CPPA | Pacific Premier's Southern California customers bring the CPPA's automated-decision and cybersecurity rules into scope. | CPPA ADMT, risk-assessment and cybersecurity-audit regulations |
| CFPB | Consumer deposit and lending products keep UDAAP and ECOA obligations in view for any future AI use. | ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9) |
What does the public record suggest about Columbia's AI strategy?
Analysis by BankingNewsAI from the sources cited on this page. Observations, not advice.
01
One platform at last
Three years of conversions are over; a bank that has ruled out deals can now spend technology capacity on capabilities rather than migrations, which is where AI disclosure from peers begins.
02
The breach timeline is the governance story regulators will remember
Detection in three days was good; 119 days to notify was not. Incident-response automation and disclosure discipline are a more urgent technology investment than any assistant.
03
Surveying clients about AI is not the same as running it
The Business Barometer gives Columbia a view of what small businesses expect from AI; matching that with its own tools is the obvious next product step.
04
Buybacks over builds is a choice with a shelf life
$700 million to shareholders is defensible after two integrations, but peers of similar size are now reporting adoption figures; investors will eventually ask for both.
Does Columbia Banking System use AI?
It has not disclosed an AI platform, use-case count, budget or leadership role. Its public AI content is the 2026 Business Barometer, a survey of nearly 1,200 small and midsize businesses that covers AI impacts alongside growth, tariffs and fraud. The bank's 2025–2026 technology work was the Pacific Premier systems conversion, completed in the first quarter of 2026.
What happened with the Columbia Bank data breach?
An attacker was inside certain Columbia Bank applications from early October to late December 2025. The bank discovered the intrusion on 19 December and cut off access three days later, but began notifying the 7,067 affected people only on 17 April 2026, 119 days after discovery, according to American Banker. A class action alleging negligence and consumer-protection violations followed.
- Columbia CEO: Latest merger will avoid snags of the last one
- Columbia eschews more M&A amid activist investor heat
- How Columbia Bank (Wash.) kept a breach quiet for 119 days
- Columbia to expand in SoCal with $2B acquisition of Pacific Premier
- Columbia Banking System, Inc. Reports First Quarter 2026 Results
- Columbia Banking System, Inc. Reports Second Quarter 2026 Results
- 2026 Columbia Bank Business Barometer: U.S. Small and Midsize Businesses Poised for Growth, Waiting to Make Significant Moves
When Columbia moves on AI, you'll read it here first.
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →