CITIZENS FINANCIAL GROUP INCRI

Previous wording

We are subject to a number of risks potentially impacting our business, financial condition, results of operations and cash flows. As a financial services organization, certain elements of risk are inherent in our transactions and operations and the business decisions we make. Therefore, we encounter risk as part of the normal course of our business and design a risk management framework and associated processes to help manage these risks.

Current wording

We are subject to a number of risks potentially impacting our business, financial condition, results of operations and cash flows. As a financial services organization, certain elements of risk are inherent in what we do and the decisions we make. Therefore, we encounter risk as part of the normal course of our business and design risk management processes to help manage these risks. See the “Risk Governance” section in Item 7 for a discussion of our risk management framework and the primary risks we face.

Previous wording

You should carefully consider the following risk factors that may affect our business, financial condition, results of operations or cash flows. Other factors that could affect us are discussed in the “Forward-Looking Statements” section above. However, there may be additional risks that are not currently material or known, and factors besides those discussed below, or in this or other reports that we file or furnish with the SEC, that could adversely affect us. Therefore, the risks described in the risk factors below should not be considered a complete list of risks that we may encounter.

Current wording

You should carefully consider the following risk factors that may affect our business, financial condition, results of operations or cash flows. However, the risk factors described below are not the only ones we face and should not be considered a complete list of risks that we may encounter. Additional risks not presently known to us or that we believe to be immaterial may also adversely affect our business. See the “Forward-Looking Statements” section above for other factors that could affect us.

Previous wording

Our business strategy is designed to maximize the full potential of our business and drive sustainable growth and enhanced profitability, with our success resting on our ability to distinguish ourselves. Our future success and the value of our stock depends, in part, on our ability to effectively implement our business strategy, including the cost savings and efficiency components, and achieve our financial performance goals, including the anticipated benefits of the Private Bank start-up investment and Investors acquisition. There are risks and uncertainties, many of which are not within our control, associated with each element of our strategy. If we are not able to successfully execute our business strategy, we may not achieve our financial performance goals and any shortfall may be material. See the “Business Strategy” section in Item 1 for further information.

Current wording

Our business strategy is designed to maximize the full potential of our business, drive sustainable growth and enhance profitability, with our success resting on our ability to distinguish ourselves. Our future success and the value of our stock depends, in part, on our ability to effectively implement our business strategy and achieve our financial performance goals across our Consumer and Commercial businesses, including our Private Bank. There are risks and uncertainties, many of which are not within our control, associated with each element of our strategy. If we are not able to successfully execute our business strategy, we may not achieve our financial performance goals and any shortfall may be material. See the “Business Strategy” section in Item 1 for further information.

Previous wording

Our operations are subject to extensive regulation, supervision and examination by the federal banking regulators, as well as the CFPB. As part of the supervisory and examination process, if we are unsuccessful in meeting the requirements and expectations that apply to us, regulatory agencies may from time to time take supervisory actions against us that may not be publicly disclosed. Such actions may include restrictions on our activities or the activities of our subsidiaries, informal (nonpublic) or formal (public) supervisory actions or public enforcement actions, including the payment of civil money penalties, which could increase our costs and limit our ability to implement our strategic plans and expand our business, and as a result could have a material adverse effect on our business, financial condition or results of operations. See the “Regulation and Supervision” section in Item 1 for further information.

Current wording

Our operations are subject to extensive regulation, supervision and examination by the federal banking regulators, as well as the CFPB. As part of the supervisory and examination process, if we are unsuccessful in meeting the regulatory requirements and supervisory expectations that apply to us, regulatory agencies may from time to time take supervisory actions against us, including actions that may not be publicly disclosed. Such actions may include restrictions on our activities or the activities of our subsidiaries, informal (nonpublic) or formal (public) supervisory actions or public enforcement actions, including the payment of civil money penalties, which could increase our costs and limit our ability to implement our strategic plans and expand our business, and as a result could have a material adverse effect on our business, financial condition or results of operations. See the “Regulation and Supervision” section in Item 1 for further information.

Previous wording

Prolonged periods of inflation may impact our profitability by negatively impacting our costs and expenses, including increasing funding costs and expense related to talent acquisition and retention, and negatively impacting consumer demand and client purchasing power for our products and services. If significant inflation continues, our business could be negatively affected by, among other things, increased default rates leading to credit losses which could adversely impact our earnings and capital.

Current wording

Volatility and uncertainty related to inflation and the effects of inflation may enhance or contribute to some of the risks of our business by negatively impacting our costs and expenses, including increasing funding costs and expenses related to talent acquisition and retention, and negatively impacting consumer demand and client purchasing power for our products and services, as well as the ability of borrowers to repay their obligations. These inflationary pressures would likely have an adverse impact on our business, financial position and results of operations.

Previous wording

Liquidity risk is the risk arising from the inability to meet our obligations when they come due. We must maintain adequate funding to meet current and future obligations, including customer loan requests, customer deposit maturities and withdrawals, debt service, equipment and premises leases, and other cash commitments, under both normal operating conditions and under periods of company-specific and/or market stress.

Current wording

Liquidity risk is the risk arising from the inability to meet our obligations when they come due. We must maintain adequate funding to meet current and future obligations, including customer loan requests, deposit maturities and withdrawals, debt service, leases, and other cash commitments, under both normal operating conditions and periods of company-specific and/or market stress.

Previous wording

We primarily rely on customer deposits to be a relatively stable and low-cost source of funding. In addition to customer deposits, our funding sources also include our ability to securitize loans in secondary markets, raise funds in the debt and equity capital markets, pledge loans and/or securities for borrowing from the FHLB, pledge securities as collateral for borrowing under repurchase agreements, and sell AFS securities.

Current wording

We rely on customer deposits to be our primary stable and low-cost source of funding. Our funding sources also include our ability to securitize loans in secondary markets, raise funds in the debt and equity capital markets, pledge loans and/or securities for borrowing from the FHLB, pledge securities as collateral for borrowing under repurchase agreements, and sell AFS securities.

Previous wording

Changes in interest rates can have a material impact on the value of our securities, a primary objective of which is to provide a ready source of contingent liquidity. An increase in rates could lower the collateral value of these securities, reducing the amount we could borrow, and lead to losses in the event of their sale.

Current wording

Changes in interest rates can have a material impact on the value of our securities portfolio, the primary objective of which is to provide a readily available source of liquidity. An increase in rates could lower the collateral value of these securities, reducing the amount we could borrow, and lead to losses in the event of their sale.

Previous wording

Since our earning assets are primarily in the form of loans and debt securities, changes in interest rates can have a material impact our net interest income, net interest margin, fee income, and credit costs. Changes in interest rates can affect our net interest income and margin as our asset yields and funding costs may not rise or fall in parallel, causing our net interest income to increase or decrease and our margin to expand or contract. If our funding costs rise faster than our asset yields, or if our asset yields fall faster than our funding costs, our net interest income could decrease, and our margin could contract.

Current wording

Since our earning assets are primarily in the form of loans and debt securities, changes in interest rates can have a material impact on our net interest income, net interest margin, fee income, and credit costs. Our asset yields and funding costs may not rise or fall in parallel in response to changes in interest rates, causing our net interest income to increase or decrease and our net interest margin to expand or contract. If our funding costs rise faster than our asset yields, or if our asset yields fall faster than our funding costs, our net interest income could decrease, and our net interest margin could contract.

Previous wording

An increase in interest rates could cause lower demand for loans by customers, reducing our net interest income due to lower loan balances and origination-related fee income due to lower production volume, and could also have an adverse impact on our credit costs, as borrowers may have difficulty in making higher interest payments. Additionally, an increase in rates could cause recognition of losses on the debt securities in our AFS portfolio if the securities needed to be sold.

Current wording

An increase in interest rates could cause lower demand for loans by customers, reducing our net interest income due to lower loan balances and origination-related fee income due to lower production volume, and could also have an adverse impact on our credit costs, as borrowers may have difficulty in making higher interest payments. Additionally, an increase in rates could cause the recognition of losses on our AFS securities portfolio if the securities needed to be sold.

Previous wording

Similarly, a decrease in interest rates could lower our net interest income, net interest margin and fee income. We may be adversely affected by a prolonged period of low interest rates as it may result in us holding lower yielding loans and securities should rates rise rapidly after the period of low interest rates.

Current wording

Similarly, a decrease in interest rates could reduce our net interest income, net interest margin and fee income. A prolonged period of low interest rates may result in us holding lower yielding loans and securities should rates rise rapidly after the period of low interest rates.

Previous wording

Changes in the spread between short-term and long-term interest rates (i.e., the yield curve) can also have a material impact on our net interest income and net interest margin. Typically, the yield curve is upward sloping, with short-term rates being lower than long-term rates. When the yield curve flattens or inverts, our net interest income and net interest margin may decrease if the cost of our short-term funding increases relative to the yield we can earn on our long-term assets.

Current wording

Changes in the spread between short-term and long-term interest rates (i.e., the yield curve) can also have a material impact on our net interest income and net interest margin. If the yield curve, typically upward sloping with short-term rates lower than long-term rates, were to flatten or invert, our net interest income and net interest margin may decrease if the cost of our short-term funding increases relative to the yield we can earn on our long-term assets.

Previous wording

Interest rates and the yield curve are highly sensitive to many factors that are beyond our control, including general economic conditions and the policies of various governmental and regulatory agencies and, in particular, the Federal Open Market Committee. Although we have policies and procedures designed to manage our interest rate risks, as further discussed in the “Risk Governance” section in Item 7, there can be no assurance that these policies and procedures will be effective in avoiding material adverse effects on our profitability.

Current wording

Interest rates and the yield curve are highly sensitive to many factors that are beyond our control, including general economic conditions and the policies of various governmental and regulatory agencies and, in particular, the Federal Open Market Committee. Although we have policies and procedures designed to manage our interest rate risk, as further discussed in the “Risk Governance” section in Item 7, there can be no assurance that these policies and procedures will be effective in avoiding material adverse effects on our profitability.

Previous wording

Credit ratings affect the cost and other terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, and their ratings are based on a number of factors, including our financial strength and conditions affecting the financial services industry generally. Any downgrade in our ratings would likely increase our borrowing costs and could limit our access to capital markets, which would adversely affect our business. For example, a ratings downgrade could adversely affect our ability to sell or market our securities, including long-term debt, engage in certain longer-term derivatives transactions and retain our customers, particularly corporate customers who may require a minimum rating threshold in order to place funds with us. In addition, under the terms of our derivatives contracts, we may be required to maintain a minimum credit rating, post additional collateral or terminate such contracts. Any of these results of a ratings downgrade could increase our cost of funding, reduce our liquidity and have adverse effects on our business, financial condition and results of operations. For more information regarding our credit ratings, see the “Liquidity” section in Item 7.

Current wording

Credit ratings affect the cost and associated terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, with their ratings based on a number of factors, including our financial strength and conditions affecting the financial services industry generally. Any downgrade in our ratings would likely increase our borrowing costs and could limit our access to capital markets, which would adversely affect our business. For example, a ratings downgrade could adversely affect our ability to sell or market our securities, including long-term debt, engage in certain longer-term derivative transactions and retain customers, who may require a minimum credit rating in order to place funds with us. In addition, under the terms of our derivatives contracts, we may be required to maintain a minimum credit rating, post additional collateral or terminate such contracts. Any of these impacts of a ratings downgrade could increase our cost of funding, reduce our liquidity and have adverse effects on our business, financial condition and results of operations. For more information regarding our credit ratings, see the “Liquidity” section in Item 7.

Previous wording

A significant portion of our earnings assets are in the form of loans to borrowers across the U.S., primarily for residential, commercial and industrial, commercial real estate, education, auto and other retail purposes. A deterioration in economic conditions or changes in consumer or business behavior that negatively impacts home property or commercial property values could, in event of the borrower’s default, result in materially higher credit losses. Similarly, higher unemployment levels and higher interest rates can adversely affect our customers’ ability to repay their loans, which can negatively impact our credit performance.

Current wording

A significant portion of our earnings assets are in the form of loans to borrowers across the U.S., primarily for residential, commercial and industrial, commercial real estate, education, and other retail purposes. A deterioration in economic conditions or changes in consumer or business behavior that negatively impacts home or commercial property values could, in event of the borrower’s default, result in materially higher credit losses. Similarly, elevated unemployment levels and higher interest rates can adversely affect our customers’ ability to repay their loans, which can negatively impact our credit performance.

Previous wording

In addition, we have undertaken certain actions to enhance our credit policies and guidelines to address potential risks associated with particular industries or types of customers. However, we may not be able to effectively implement these initiatives, or consistently follow and refine our credit risk management system. If any of the foregoing were to occur, it may result in an increase in the level of nonaccrual loans and a higher risk exposure for us, which could have a material adverse effect on us.

Current wording

In addition, we have undertaken certain actions to enhance our credit policies and guidelines to address potential risks associated with particular industries or types of customers. However, we may not be able to effectively implement these initiatives, or consistently follow and refine our credit risk management system, which may result in an increase in the level of nonaccrual loans and a higher risk exposure for us, which could have a material adverse effect on us.

Previous wording

Changes in our accounting policies or in accounting standards could materially affect how we report our financial results and condition.

Current wording

Changes in our accounting policies or standards could materially affect how we report our financial results and condition.

Previous wording

The FASB and SEC periodically change the financial accounting and reporting standards that govern the accounting for our financial results and the preparation of our consolidated financial statements. These changes can be hard to predict and can materially impact how we record and report our financial condition and results of operations. In some cases, we could be required to apply a new or revised standard retroactively, which would result in the recasting of our prior period financial statements.

Current wording

The FASB and SEC periodically change financial accounting and reporting standards that govern accounting for our financial results and preparation of our consolidated financial statements. These changes can be hard to predict and can materially impact how we record and report our financial condition and results of operations. In some cases, we could be required to apply a new or revised standard retroactively, which would result in the recasting of our prior period financial statements.

Previous wording

The processes we use to estimate loan losses, measure the fair value of financial instruments and estimate the effects of changing interest rates and other market measures on our financial condition and results of operations are reliant upon the use of analytical and forecasting models. Some of our tools and metrics for managing risk are based on observed historical market behavior, and we rely on quantitative models to measure risks and to estimate certain financial values. Models may be used in processes such as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting losses, assessing capital adequacy and calculating regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items. Poorly designed or implemented models could adversely affect our business decisions if the information is inadequate. In addition, our models may fail to predict future risk exposures if the information used is inaccurate, obsolete or not sufficiently comparable to actual events as they occur. We seek to incorporate appropriate historical data in our models, but the range of market values and behaviors reflected in any period of historical data is not always predictive of future developments in any particular period and the period of data we incorporate into our models may turn out to be inappropriate for the future period being modeled. In these instances, our ability to manage risk would be limited and our risk exposure and losses could be significantly greater than our models indicated, which could harm our reputation and adversely affect our revenues and profits. Finally, information provided to our regulators based on poorly designed or implemented models could be inaccurate or insufficient. Some of the decisions that our regulators make, including those related to capital distributions to our stockholders, could be adversely affected due to their perception that the quality of the models used to generate the relevant information is insufficient.

Current wording

The processes we use to estimate loan losses, measure the fair value of financial instruments and estimate the effects of changing interest rates and other market measures on our financial condition and results of operations are reliant upon the use of analytical and forecasting models. Some of our tools and metrics for managing risk are based on observed historical market behavior, and we rely on quantitative models to measure risks and to estimate certain financial values. Models may be used in processes such as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting losses, assessing capital adequacy and calculating regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items, including goodwill. Poorly designed or implemented models could adversely affect our business decisions if the information is inadequate. In addition, our models may fail to predict future risk exposures if the information used is inaccurate, obsolete or not sufficiently comparable to actual events as they occur. We seek to incorporate appropriate historical data in our models, but the range of market values and behaviors reflected in any period of historical data is not always predictive of future developments in any particular period and the period of data we incorporate into our models may turn out to be inappropriate for the future period being modeled. In these instances, our ability to manage risk would be limited and our risk exposure and losses could be significantly greater than our models indicated, which could harm our reputation and adversely affect our revenues and profits. Finally, information provided to our regulators based on poorly designed or implemented models could be inaccurate or insufficient, which could adversely affect some of the decisions that our regulators make, including those related to capital distributions to our stockholders, and subject us to supervisory criticism and costs relating to remediation.

Previous wording

The preparation of consolidated financial statements in conformity with GAAP requires management to make significant estimates that affect the financial statements. Ouraccounting policies and methods are fundamental to how we record and report our financial condition and results of operations and, at times, require management to exercise judgment in their application so as to report our financial condition and results of operations in the most appropriate manner. Certain accounting policies are critical because they require management to make difficult, subjective or complex judgments about matters that are inherently uncertain and the likelihood that materially different estimates would result under different conditions or through the utilization of different assumptions. Our critical accounting estimates include the ACL, estimations of fair value and review of goodwill for impairment. If our estimates are inaccurate or need to be adjusted periodically, our financial condition and results of operations could be materially impacted. For more information regarding our use of estimates in the preparation of our consolidated financial statements, see Note 1 in Item 8 and the “Critical Accounting Estimates” section in Item 7.

Current wording

The preparation of consolidated financial statements in conformity with GAAP requires management to make significant estimates that affect the financial statements. Ouraccounting policies and methods are fundamental to how we record and report our financial condition and results of operations and, at times, require management to exercise judgment in their application so as to report our financial condition and results of operations in the most appropriate manner. Certain accounting policies are critical because they require management to make difficult, subjective or complex judgments about matters that are inherently uncertain and the likelihood that materially different estimates would result under different conditions or through the utilization of different assumptions. Our critical accounting estimates include the ACL, fair value measurements and the evaluation and measurement of goodwill for impairment. If our estimates are inaccurate or need to be adjusted periodically, our financial condition and results of operations could be materially impacted. For more information regarding our use of estimates in the preparation of our consolidated financial statements, see Note 1 in Item 8 and the “Critical Accounting Estimates” section in Item 7.

Previous wording

Our operations depend on our ability to process a very large number of transactions efficiently and accurately while complying with applicable laws and regulations. Operational risk and losses can result from internal and external fraud; improper conduct or errors by employees or third parties; failure to document transactions properly or to obtain proper authorization; failure to comply with applicable legal and regulatory requirements and business conduct rules; equipment failures, including those caused by natural disasters or by electrical, telecommunications or other essential utility outages; business continuity and data security system failures, including those caused by computer viruses, cyber-attacks against us or our vendors, or unforeseen problems encountered while implementing new computer systems or upgrades to existing systems; or the inadequacy or failure of systems and controls, including those of our suppliers or counterparties. Although we implement risk controls and loss mitigation actions and devote substantial resources to developing efficient procedures, identifying and rectifying weaknesses in existing procedures and training staff, it is not possible to be certain that such actions have been or will be effective in controlling each of the operational risks we face. Any weakness in these systems or controls, or any breaches or alleged breaches of such laws or regulations, could result in increased regulatory supervision, enforcement actions and other disciplinary action, and have an adverse impact on our business, applicable authorizations and licenses, reputation and results of operations.

Current wording

Our operations depend on our ability to process a very large number of transactions efficiently and accurately while complying with applicable laws and regulations. Operational risk and losses can result from internal and external fraud; improper conduct or errors by employees or third parties; failure to document transactions properly or to obtain proper authorization; failure to comply with applicable legal and regulatory requirements and business conduct rules; equipment failures, including those caused by natural disasters or by electrical, telecommunications or other essential utility outages; business continuity and data security system failures, including those caused by computer viruses, cyber-attacks against us or our vendors, coding errors, or unforeseen problems encountered while implementing new computer systems or upgrades to existing systems; or the inadequacy or failure of systems and controls, including those of our suppliers or counterparties. Although we implement risk controls and loss mitigation actions and devote substantial resources to developing efficient procedures, identifying and rectifying weaknesses in existing procedures and training staff, it is not possible to be certain that such actions have been or will be effective in controlling each of the operational risks we face. Any weakness in these systems or controls, or any breaches or alleged breaches of such laws or regulations, could result in increased regulatory supervision, enforcement actions and other disciplinary action, especially in light of heightened regulatory expectations around information security, and have an adverse impact on our business, applicable authorizations and licenses, reputation and results of operations.

Previous wording

Technology within the financial services industry continues to evolve and new, unexpected technological changes could have a transformative effect on the way banks offer products and services. We believe our success depends, to a great extent, on our ability to utilize technology to offer products and services that address the needs of our customers and to create efficiencies in our operations. However, we may not be able to, among other things, keep up with the rapid pace of technological changes, effectively implement new technology-driven products and services, or be successful in marketing these products and services to our customers. As a result, our ability to compete effectively to attract or retain business may be impaired, and our business, financial condition or results of operations may be adversely affected.

Current wording

Technology within the financial services industry continues to evolve and new, unexpected technological changes, including those related to artificial intelligence, could have a transformative effect on the way banks offer products and services. We believe our success depends, to a great extent, on our ability to utilize technology to offer products and services that address the needs of our customers and to create efficiencies in our operations. However, we may not be able to, among other things, keep up with the rapid pace of technological changes, effectively implement new technology-driven products and services, or be successful in marketing these products and services to our customers. As a result, our ability to compete effectively to attract or retain business may be impaired, and our business, financial condition or results of operations may be adversely affected.

Previous wording

Evolving technologies and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties present a significant information security risk to large financial institutions such as us. Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. Risks related to cyber-attacks on our vendors and other third parties, including supply chain attacks affecting our software and information technology service providers, are on the rise as such attacks become more frequent and severe. Employee error, failure to follow security procedures, or malfeasance also present these risks. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks as well as in the third-party computer systems and networks used to provide products and services on our behalf. Although we believe that we have appropriate information security procedures and controls based on our adherence to applicable laws and regulations and industry standards, our technologies, systems, and networks may be the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, theft, sale or loss or destruction of the confidential and/or proprietary information of CFG, and our customers, vendors, counterparties, or employees. We and our third-party vendors are under continuous threat of loss or network degradation due to cyber-attacks, such as computer viruses, malicious or destructive code, phishing attacks, ransomware, and Distributed Denial of Service (“DDoS”) attacks (collectively, “fraudulent schemes”). Also, our customers are routinely the target of fraudulent schemes. This is especially true as we continue to expand customer capabilities to utilize the Internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face as a result of these fraudulent schemes are potential loss of funds resulting from customers falling victim to cybercriminal communications directed to them or unauthorized access to sensitive customer data. Cybercriminals can use fraudulent schemes directly targeting our customers or our own systems to compromise and directly extract funds from a customer’s account or access sensitive customer data. Certain technology protections such as Customer Profiling and Step-Up Authentications are implemented so that we are compliant with the FFIEC Authentication and Access to Financial Institution Services and Systems guidelines.

Current wording

Evolving technologies, including the introduction of Generative Artificial Intelligence and Large Language Models, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties present a significant information security risk to large financial institutions such as us. Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. Risks related to cyber-attacks on our vendors and other third parties, including supply chain attacks affecting our software and information technology service providers, are on the rise as such attacks become more frequent and severe. Employee error, failure to follow security procedures, or malfeasance also present these risks. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks as well as in the third-party computer systems and networks used to provide products and services on our behalf. Although we believe that we have appropriate information security procedures and controls based on our adherence to applicable laws and regulations and industry standards, our technologies, systems, and networks may be the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, theft, sale or loss or destruction of the confidential and/or proprietary information of CFG, and our customers, vendors, counterparties, or employees. We and our third-party vendors are under continuous threat of loss or network degradation due to cyber-attacks, such as computer viruses, malicious or destructive code, phishing attacks, ransomware, and Distributed Denial of Service (“DDoS”) attacks (collectively, “fraudulent schemes”). Also, our customers are routinely the target of fraudulent schemes. This is especially true as we continue to expand customer capabilities to utilize the Internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face as a result of these fraudulent schemes are potential loss of funds resulting from customers falling victim to cybercriminal communications directed to them or unauthorized access to sensitive customer data. Cybercriminals can use fraudulent schemes directly targeting our customers or our own systems to compromise and directly extract funds from a customer’s account or access sensitive customer data. Certain technology protections such as Customer Profiling and Step-Up Authentications have been implemented, but there can be no assurance that these protections will be effective.

Previous wording

Despite our efforts to prevent a cyber-attack, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, could take considerable time for us to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised. During the course of an investigation, we may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Moreover, new regulations may require us to disclose information about a cybersecurity event before it has been resolved or fully investigated.

Current wording

Despite our efforts to prevent a cyber-attack, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, could take considerable time for us to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised. During the course of an investigation, we may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Moreover, existing regulations may require us to disclose information about a cybersecurity event before it has been resolved or fully investigated.

Previous wording

The techniques used by cyber criminals change frequently, may not be recognized until launched and can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments. These actors may attempt to fraudulently induce employees, customers or other third-party users of our systems to disclose sensitive information in order to gain access to data or our systems. In the event that a cyber-attack is successful, our business, financial condition or results of operations may be adversely affected. For a discussion of the guidance that regulators have released regarding cybersecurity and cyber risk management standards, see the “Regulation and Supervision” section of Item 1.

Current wording

The techniques used by cyber criminals change frequently, may not be recognized until launched and can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments. These actors may attempt to fraudulently induce employees, customers or other third-party users of our systems to disclose sensitive information in order to gain access to data or our systems. In the event that a cyber-attack is successful, our business, financial condition or results of operations may be adversely affected.

Previous wording

We rely on third parties for the performance of a significant portion of our information technology functions and the provision of information technology and business process services including, but not limited to, the operation of our data communications networks, hosted services, and a wide range of other support services. The success of our business depends in part on the continuing ability of third parties to perform these functions and services in a timely and satisfactory manner, which performance could be disrupted or otherwise adversely affected due to failures or other information security events originating at the third parties or at the third parties’ suppliers or vendors (so-called “fourth party risk”). We may not be able to effectively monitor or mitigate third or fourth-party risk, in particular as it relates to the use of common suppliers or vendors by the third parties that perform functions and services for us. If we experience a disruption in the provision of any functions or services performed by third parties, we may have difficulty in finding alternate providers on terms favorable to us and in reasonable time frames. If these services are not performed in a satisfactory manner, we would not be able to adequately serve our customers. In either situation, our business could incur significant costs and be adversely affected.

Current wording

Third parties perform a significant portion of our information technology functions and the provision of information technology and business process services including, but not limited to, the operation of our data communications networks, hosted services, and a wide range of other support services. The success of our business depends in part on the continuing ability of third parties to perform these functions and services in a timely and satisfactory manner, which performance could be disrupted or otherwise adversely affected due to failures or other information security events originating at the third parties or at the third parties’ suppliers or vendors (so-called “fourth party risk”). We may not be able to effectively monitor or mitigate third or fourth-party risk, in particular as it relates to the use of common suppliers or vendors by the third parties that perform functions and services for us. If we experience a disruption in the provision of any functions or services performed by third parties, we may have difficulty in finding alternate providers on terms favorable to us and in reasonable time frames. If these services are not performed in a satisfactory manner, we would not be able to adequately serve our customers. In either situation, our business could incur significant costs and be adversely affected.

Previous wording

Our success and results depend on our reputation and the strength of our brands. We are vulnerable to adverse market perception as we operate in an industry where integrity, customer trust and confidence are paramount. We are exposed to the risk that litigation, employee misconduct, operational failures, the outcome of regulatory or other investigations or actions, press speculation and negative publicity, perception of our environmental, social and governance practices and disclosures, among other factors, could damage our brands or reputation. Our brands and reputation could also be harmed if we sell products or services that do not perform as expected or customers’ expectations for the product are not satisfied.

Current wording

Our success and results depend on our reputation and the strength of our brands. We are vulnerable to adverse market perception as we operate in an industry where integrity, customer trust and confidence are paramount. We are exposed to the risk that litigation, employee misconduct, operational failures, the outcome of regulatory or other investigations or actions, press speculation and negative publicity, and perception of our environmental, social and governance practices and disclosures, among other factors, could damage our brands or reputation. Our brands and reputation could also be harmed if we sell products or services that do not perform as expected or customers’ expectations for the product are not satisfied.

Previous wording

Unpredictable catastrophic events, including pandemics, terrorist attacks, extreme weather events and other large-scale catastrophes, could have an adverse effect on our business, financial position and results of operations.

Current wording

Unpredictable catastrophic events could have an adverse effect on our business, financial position and results of operations.

Previous wording

Furthermore, although we maintain both business continuity and disaster recovery plans, if a terrorist attack, extreme weather event, or other catastrophe rendered our production and recovery data unusable, there can be no assurance that these plans and related capabilities will adequately protect us from such events, and our business, financial condition or results of operations could be adversely affected.

Current wording

Furthermore, although we maintain both business continuity and disaster recovery plans, if a catastrophic event rendered our production and recovery data unusable, there can be no assurance that these plans and related capabilities will adequately protect us from such an event, and our business, financial condition or results of operations could be adversely affected.

Previous wording

With respect to non-banking financial institutions, technology and other changes have lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks. For example, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds. Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in robotic process automation, could significantly affect the competition for financial services. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. Some of our non-bank competitors are not subject to the same extensive regulations we are and, therefore, may have greater flexibility in competing for business. As a result of these and other sources of competition, we could lose business to competitors or be forced to price products and services on less advantageous terms to retain or attract clients, either of which would adversely affect our profitability.

Current wording

With respect to non-banking financial institutions, technology and other changes have lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks. For example, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds and can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in automation, artificial intelligence and robotics, could significantly affect the competition for financial services. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. Some of our non-bank competitors are not subject to the same extensive regulations we are and, therefore, may have greater flexibility in competing for business. As a result of these and other sources of competition, we could lose business to competitors or be forced to price products and services on less advantageous terms to retain or attract clients, either of which would adversely affect our profitability.

Previous wording

There is increasing global concern over the risks of climate change and related environmental sustainability matters. The physical risks of climate change include discrete events, such as flooding and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged drought. Such events could disrupt our operations or those of our clients, customers, or service providers, including through direct damage to assets and indirect impacts from supply chain disruption and market volatility.

Current wording

There is global concern over the risks of climate change and related environmental sustainability matters. The physical risks of climate change include discrete events, such as flooding and wildfires, and longer-term shifts in climate patterns, such as extreme heat, sea level rise, and more frequent and prolonged droughts. Such events could disrupt our operations or those of our clients, customers, or service providers, including through direct damage to assets and indirect impacts from supply chain disruption and market volatility.

Previous wording

We are also exposed to risks associated with the transition to a lower-carbon economy in response to concerns around climate change. Such risks may result from changes in policies, laws and regulations, technologies, or market preferences that are intended to address climate change. These changes could materially and negatively impact our or our customers’ business, results of operations, financial condition and reputation. This could occur as a result of our or our customers’ involvement in, or decision not to participate in, certain industries or projects associated with exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations related to climate change. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and costs.

Current wording

We are also exposed to risks associated with the transition to a lower-carbon economy in response to concerns around climate change. Such risks may result from changes in policies, laws and regulations, technologies, or market preferences that are intended to address climate change. These changes could adversely impact our or our customers’ business, results of operations, financial condition and reputation. This could occur as a result of our or our customers’ involvement in, or decision not to participate in, certain industries or projects associated with exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations related to climate change. For example, a number of states in which we operate have enacted or proposed statutes and regulations addressing climate change and sustainability issues, while certain other states have enacted, or have proposed to enact, divergent or sometimes conflicting statutes, regulations or policies. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and costs.

Previous wording

Financial services institutions are typically interconnected as a result of trading, investment, liquidity management, clearing, counterparty and other relationships. Within the financial services industry, the default by any one institution could lead to defaults by other institutions. Concerns about, or a default by, one institution could lead to significant market and customer perception of the risk of similar problems at other institutions. This perception of risk could, in and of itself, lead to adverse impacts on liquidity. Liquidity problems and losses or defaults by other institutions, as the financial soundness of financial institutions is closely related as a result of these credit, trading, clearing and other relationships. Even the perceived lack of creditworthiness of, or questions about, a counterparty may lead to market-wide liquidity problems and losses or defaults by various institutions. This systemic risk may adversely affect financial intermediaries, such as clearing agencies, banks and exchanges with which we interact on a daily basis, or key funding providers such as the FHLBs, any of which could have a material adverse effect on our access to liquidity or otherwise have a material adverse effect on our business, financial condition and results of operations.

Current wording

Financial services institutions are typically interconnected as a result of trading, investment, liquidity, clearing, counterparty and other relationships. Within the financial services industry, the default by any one institution could lead to defaults by other institutions. Concerns about, or a default by, one institution could lead to significant market and customer perception of the risk of similar problems at other institutions. This perception of risk could, in and of itself, lead to adverse impacts on liquidity, as the financial soundness of financial institutions is closely related as a result of these credit, trading, clearing and other relationships. Even the perceived lack of creditworthiness of, or questions about, a counterparty may lead to market-wide liquidity problems and losses or defaults by various institutions. This systemic risk may adversely affect financial intermediaries, such as clearing agencies, banks and exchanges with which we interact on a daily basis, or key funding providers such as the FHLBs, any of which could have a material adverse effect on our access to liquidity or otherwise have a material adverse effect on our business, financial condition and results of operations.

Previous wording

While there have been significant revisions to the laws and regulations applicable to us that have been finalized in recent years, there are other rules to implement changes that have yet to be proposed or enacted by our regulators. The final timing, scope and impact of these changes to the regulatory framework applicable to financial institutions remains uncertain. For more information on regulations to which we are subject and recent initiatives to reform financial institution regulation, see the “Regulation and Supervision” section in Item 1.

Current wording

While there have been significant revisions to the laws and regulations applicable to us that have been finalized in recent years, there are other rules to implement changes that have yet to be proposed or enacted by our regulators. The final timing, scope and impact of these changes to the regulatory framework applicable to financial institutions remains uncertain. Uncertainty exists with respect to new laws or regulations or changes in the interpretation or enforcement of existing laws or regulations, including potential deregulation in some areas. In addition, litigation challenging actions or regulations by federal or state authorities could, depending on the outcome, significantly affect the regulatory and supervisory framework affecting our operations. For more information on regulations to which we are subject and recent initiatives to reform financial institution regulation, see the “Regulation and Supervision” section in Item 1.

Previous wording

We are subject to several capital adequacy and liquidity standards. To the extent that we are unable to meet these standards, our ability to make distributions of capital will be limited and we may be subject to additional supervisory actions and limitations on our activities. See “Regulation and Supervision” in Item 1 and the “Capital and Regulatory Requirements” and “Liquidity” sections in Item 7, for further discussion of the regulations to which we are subject.

Current wording

We are subject to several capital adequacy and liquidity standards. To the extent that we are unable to meet these standards, our ability to make distributions of capital will be limited and we may be subject to additional supervisory actions and limitations on our activities. See “Regulation and Supervision” in Item 1 for further discussion of the regulations to which we are subject.

Previous wording

•In the event of a BHC’s bankruptcy, any commitment that the BHC had been required to make to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Current wording

•In the event of a BHC’s bankruptcy, any commitment that the BHC had been required to make by a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Previous wording

•In the event of impairment of the capital stock of CBNA, the Parent Company, as CBNA’s stockholder, could be required to pay such deficiency.

Current wording

•In the event of impairment of the capital stock of CBNA, the Parent Company, as CBNA’s stockholder, could be assessed for the deficiency and required to pay that amount to CBNA.

Previous wording

The Parent Company depends on CBNA for substantially all of its revenue, and restrictions on dividends and other distributions by CBNA could affect its liquidity and ability to fulfill our obligations.

Current wording

The Parent Company depends on CBNA for substantially all of its revenue, and restrictions on dividends and other distributions by CBNA could affect its liquidity and ability to fulfill its obligations.

Previous wording

As a BHC, the Parent Company is a separate and distinct legal entity from CBNA, our banking subsidiary. The Parent Company typically receives substantially all of its revenue from dividends from CBNA. These dividends are the principal source of funds to pay dividends on our equity and interest and principal on our debt. Various federal and/or state laws and regulations, as well as regulatory expectations, limit the amount of dividends that CBNA may pay to the Parent Company. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event CBNA is unable to pay dividends to the Parent Company, it may not be able to service debt, pay obligations or pay dividends on its common stock. The inability to receive dividends from CBNA could have a material adverse effect on our business, financial condition and results of operations. See the “Regulation and Supervision” section in Item 1 and the “Capital and Regulatory Matters” section in Item 7.

Current wording

As a BHC, the Parent Company is a separate and distinct legal entity from CBNA, our banking subsidiary. The Parent Company typically receives substantially all of its revenue from dividends from CBNA and are the principal source of funds utilized to pay dividends on our equity and interest and principal on our debt. Various federal and/or state laws and regulations, as well as regulatory expectations, limit the amount of dividends that CBNA may pay to the Parent Company. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event CBNA is unable to pay dividends to the Parent Company, it may not be able to make debt service payments, pay obligations or pay dividends on its common stock. The inability to receive dividends from CBNA could have a material adverse effect on our business, financial condition and results of operations. See the “Regulation and Supervision” section in Item 1 for further discussion of dividends payable by CBNA as a national bank subsidiary.

Previous wording

Our operations are diverse and complex and we operate in legal and regulatory environments that expose us to potentially significant litigation risk. In the normal course of business, we have been named, from time to time, as a defendant in various legal actions, including arbitrations, class actions and other litigation, arising in connection with our activities as a financial services institution, including with respect to alleged unfair or deceptive business practices, mis-selling of certain products, violations of contract or intellectual property rights, and other compliance or operational failures. Certain of the actual or threatened legal actions include claims for substantial compensatory and/or punitive damages or claims for indeterminate amounts of damages. In some cases, the entities that would otherwise be the primary defendants in such cases are bankrupt or in financial distress. Moreover, a number of recent judicial decisions have upheld the right of borrowers to sue lending institutions on the basis of various evolving legal theories, collectively termed “lender liability.” Generally, lender liability is founded on the premise that a lender has either violated a duty, whether implied or contractual, of good faith and fair dealing owed to the borrower or has assumed a degree of control over the borrower resulting in the creation of a fiduciary duty owed to the borrower or its other creditors or stockholders. This could increase the amount of private litigation to which we are subject. For more information regarding ongoing significant legal proceedings in which we may be involved, see Note 19 in Item 8.

Current wording

Our operations are diverse and complex and we operate in legal and regulatory environments that expose us to potentially significant litigation risk. In the normal course of business, we have been named, from time to time, as a defendant in various legal actions, including arbitrations, class actions and other litigation. These actions arise in connection with our activities as a financial services institution, including with respect to alleged unfair or deceptive business practices, mis-selling of certain products, violations of contract or intellectual property rights, and other compliance or operational failures. Certain of the actual or threatened legal actions include claims for substantial compensatory and/or punitive damages or claims for indeterminate amounts of damages. In some cases, the entities that would otherwise be the primary defendants in such cases are bankrupt or in financial distress. Moreover, a number of recent judicial decisions have upheld the right of borrowers to sue lending institutions on the basis of various evolving legal theories, collectively termed “lender liability.” Generally, lender liability is founded on the premise that a lender has either violated a duty, whether implied or contractual, of good faith and fair dealing owed to the borrower or has assumed a degree of control over the borrower resulting in the creation of a fiduciary duty owed to the borrower or its other creditors or stockholders. This could increase the amount of private litigation to which we are subject. For more information regarding ongoing significant legal proceedings in which we may be involved, see Note 19 in Item 8.