CITIZENS FINANCIAL GROUP INC/RI

Previous wording

We are subject to a number of risks potentially impacting our business, financial condition, results of operations and cash flows. As a financial services organization, certain elements of risk are inherent in what we do and the decisions we make. Therefore, we encounter risk as part of the normal course of our business and design risk management processes to help manage these risks. See the “Risk Governance” section in Item 7 for a discussion of our risk management framework and the primary risks we face.

Current wording

We are subject to a number of risks potentially impacting our business, financial condition, results of operations, and cash flows. As a financial services organization, certain elements of risk are inherent in what we do and the decisions we make. Therefore, we encounter risk as part of the normal course of our business and design risk management processes to help manage these risks. See the “Risk Management” section in Item 7 for a discussion of our risk management framework and the primary risks we face.

Previous wording

Our business strategy is designed to maximize the full potential of our business, drive sustainable growth and enhance profitability, with our success resting on our ability to distinguish ourselves. Our future success and the value of our stock depends, in part, on our ability to effectively implement our business strategy and achieve our financial performance goals across our Consumer and Commercial businesses, including our Private Bank. There are risks and uncertainties, many of which are not within our control, associated with each element of our strategy. If we are not able to successfully execute our business strategy, we may not achieve our financial performance goals and any shortfall may be material. See the “Business Strategy” section in Item 1 for further information.

Current wording

Our future success and the value of our stock depends, in part, on our ability to effectively implement our business strategy and achieve our financial performance goals across our Consumer and Commercial businesses, including our Private Bank. Risks and uncertainties associated with each element of our strategy exist, many of which are not within our control. If we are not able to successfully execute our business strategy, we may not achieve our financial performance goals and any shortfall may be material. See the “Business Strategy” section in Item 1 for further information.

Previous wording

Our operations are subject to extensive regulation, supervision and examination by the federal banking regulators, as well as the CFPB. As part of the supervisory and examination process, if we are unsuccessful in meeting the regulatory requirements and supervisory expectations that apply to us, regulatory agencies may from time to time take supervisory actions against us, including actions that may not be publicly disclosed. Such actions may include restrictions on our activities or the activities of our subsidiaries, informal (nonpublic) or formal (public) supervisory actions or public enforcement actions, including the payment of civil money penalties, which could increase our costs and limit our ability to implement our strategic plans and expand our business, and as a result could have a material adverse effect on our business, financial condition or results of operations. See the “Regulation and Supervision” section in Item 1 for further information.

Current wording

Our operations are subject to regulation, supervision, and examination by the federal banking regulators, as well as the CFPB. As part of the supervisory and examination process, if we are unsuccessful in meeting the regulatory requirements and supervisory expectations that apply to us, regulatory agencies may from time to time take supervisory actions against us, including actions that may not be publicly disclosed. Such actions may include restrictions on our activities or the activities of our subsidiaries, informal (nonpublic) or formal (public) supervisory actions, or public enforcement actions, including the payment of civil money penalties, which could increase our costs and limit our ability to implement our strategic plans and expand our business and, as a result, could have a material adverse effect on our business, financial condition, or results of operations. See the “Regulation and Supervision” section in Item 1 for further information.

Previous wording

Volatility and uncertainty related to inflation and the effects of inflation may enhance or contribute to some of the risks of our business by negatively impacting our costs and expenses, including increasing funding costs and expenses related to talent acquisition and retention, and negatively impacting consumer demand and client purchasing power for our products and services, as well as the ability of borrowers to repay their obligations. These inflationary pressures would likely have an adverse impact on our business, financial position and results of operations.

Current wording

Volatility and uncertainty related to inflation and its associated effects may enhance or contribute to certain risks that we face by negatively impacting our funding costs and expenses, including increasing funding costs and expenses related to talent acquisition and retention. Inflation may also negatively impact consumer demand and client purchasing power for our products and services, as well as the ability of our borrowers to repay their obligations. These inflationary pressures would likely have an adverse impact on our business, financial position, and results of operations.

Previous wording

We rely on customer deposits to be our primary stable and low-cost source of funding. Our funding sources also include our ability to securitize loans in secondary markets, raise funds in the debt and equity capital markets, pledge loans and/or securities for borrowing from the FHLB, pledge securities as collateral for borrowing under repurchase agreements, and sell AFS securities.

Current wording

We rely on customer deposits to be our primary stable and low-cost source of funding. Our other funding sources are dependent on our ability to securitize loans in secondary markets, raise funds in the debt and equity capital markets, pledge loans and/or securities for borrowing from the FHLB, pledge securities as collateral for borrowing under repurchase agreements, and sell AFS securities.

Previous wording

Our ability to meet our obligations and support our operations could be materially affected by a variety of conditions, including market-wide illiquidity or disruption, a loss of market or customer confidence in the financial services industry generally or in the Company specifically, or reductions in one or more of our credit ratings. This could limit our ability to retain our deposits, securitize or sell assets, access the debt or equity capital markets, or otherwise borrow money at a reasonable cost. Additionally, these conditions, among others, if severe enough, could create unanticipated material outflows of cash due to, among other factors, draws on unfunded commitments or deposit attrition, which could have significant adverse impact on our liquidity. Further, changes to the FHLB’s or the FRB’s underwriting guidelines for wholesale borrowings or lending policies may limit or restrict our ability to borrow, and therefore could have a significant adverse impact on our liquidity.

Current wording

Our ability to meet our obligations and support our operations could be materially affected by a variety of conditions, including market-wide illiquidity or disruption, a general loss of market or customer confidence in the financial services industry or in the Company specifically, or reductions in one or more of our credit ratings. These conditions could limit our ability to retain deposits, securitize or sell assets, access debt and equity capital markets, or otherwise borrow money at a reasonable cost. If these conditions, among others, are severe enough they could also create unanticipated material outflows of cash due to, among other factors, draws on unfunded commitments or deposit attrition, which could have a significant adverse impact on our liquidity. In addition, changes to the FHLB’s or the FRB’s underwriting guidelines for wholesale borrowings or lending policies may limit or restrict our ability to borrow and could have a significant adverse impact on our liquidity as a result.

Previous wording

Changes in interest rates can have a material impact on the value of our securities portfolio, the primary objective of which is to provide a readily available source of liquidity. An increase in rates could lower the collateral value of these securities, reducing the amount we could borrow, and lead to losses in the event of their sale.

Current wording

Changes in interest rates can have a material impact on the value of our securities portfolio, the primary objective of which is to provide a readily available source of liquidity. An increase in rates could lower the collateral value of these securities, reducing the amount we could borrow and leading to losses in the event of their sale.

Previous wording

An increase in interest rates could cause lower demand for loans by customers, reducing our net interest income due to lower loan balances and origination-related fee income due to lower production volume, and could also have an adverse impact on our credit costs, as borrowers may have difficulty in making higher interest payments. Additionally, an increase in rates could cause the recognition of losses on our AFS securities portfolio if the securities needed to be sold.

Current wording

An increase in interest rates could weaken demand for loans by customers, reducing our net interest income due to lower loan balances and origination-related fee income due to lower production volume. An increase in rates could also have an adverse impact on our credit costs, as borrowers may have difficulty in making higher interest payments, as well as on our AFS securities portfolio, which could trigger the recognition of losses in the event the securities need to be sold.

Previous wording

Similarly, a decrease in interest rates could reduce our net interest income, net interest margin and fee income. A prolonged period of low interest rates may result in us holding lower yielding loans and securities should rates rise rapidly after the period of low interest rates.

Current wording

Similarly, a decrease in interest rates could reduce our net interest income, net interest margin, and fee income. A prolonged period of low interest rates may result in us holding lower yielding loans and securities should rates rise rapidly after such a period.

Previous wording

Changes in the spread between short-term and long-term interest rates (i.e., the yield curve) can also have a material impact on our net interest income and net interest margin. If the yield curve, typically upward sloping with short-term rates lower than long-term rates, were to flatten or invert, our net interest income and net interest margin may decrease if the cost of our short-term funding increases relative to the yield we can earn on our long-term assets.

Current wording

Changes in the spread between short-term and long-term interest rates (i.e., the yield curve) can also have a material impact on our net interest income and net interest margin. The yield curve, typically upward sloping with short-term rates lower than long-term rates, could cause our net interest income and net interest margin to decline if it were to flatten or invert, as the cost of our short-term funding is likely to increase relative to the yield we can earn on our long-term assets.

Previous wording

Interest rates and the yield curve are highly sensitive to many factors that are beyond our control, including general economic conditions and the policies of various governmental and regulatory agencies and, in particular, the Federal Open Market Committee. Although we have policies and procedures designed to manage our interest rate risk, as further discussed in the “Risk Governance” section in Item 7, there can be no assurance that these policies and procedures will be effective in avoiding material adverse effects on our profitability.

Current wording

Interest rates and the yield curve are highly sensitive to many factors that are beyond our control, including general economic conditions and the policies of various governmental and regulatory agencies, most notably the Federal Open Market Committee. Although we have policies and procedures designed to manage our interest rate risk as discussed in the “Risk Management” section in Item 7, there can be no assurance that these policies and procedures will be effective in preventing material adverse effects on our profitability.

Previous wording

Our ability to implement our strategic plan and our future success depends on our ability to attract, retain and motivate highly-skilled and qualified personnel, including our senior management and other key employees and directors. The marketplace for skilled personnel continues to be competitive, which means the cost of hiring, incentivizing and retaining skilled personnel may continue to rise. The failure to attract and retain highly-skilled and qualified personnel could place us at a significant competitive disadvantage and impair our ability to implement our strategic plan successfully and achieve our performance targets, which could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Our ability to implement our strategic plan and our future success depends on our ability to attract, retain, and motivate highly-skilled and qualified personnel, including senior management, other key employees, and directors. The marketplace for skilled personnel continues to be competitive, which means the cost of hiring, incentivizing, and retaining skilled personnel may continue to rise. The failure to attract and retain highly-skilled and qualified personnel could place us at a significant competitive disadvantage and impair our ability to implement our strategic plan successfully and achieve our performance targets, which could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

Limitations on the manner in which regulated financial institutions, such as us, can compensate their officers and employees, including those contained in pending rule proposals implementing the requirements of Section 956 of the Dodd-Frank Act, may make it more difficult for such institutions to compete for talent with financial institutions and other companies not subject to these or similar limitations. If we are unable to compete effectively, our business, financial condition and results of operations could be adversely affected, perhaps materially.

Current wording

Limitations on the manner in which regulated financial institutions, such as us, can compensate their officers and employees may make it more difficult for such institutions to compete for talent with financial institutions and other companies not subject to these or similar limitations. If we are unable to compete effectively, our business, financial condition, and results of operations could be adversely affected, perhaps materially.

Previous wording

Credit ratings affect the cost and associated terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, with their ratings based on a number of factors, including our financial strength and conditions affecting the financial services industry generally. Any downgrade in our ratings would likely increase our borrowing costs and could limit our access to capital markets, which would adversely affect our business. For example, a ratings downgrade could adversely affect our ability to sell or market our securities, including long-term debt, engage in certain longer-term derivative transactions and retain customers, who may require a minimum credit rating in order to place funds with us. In addition, under the terms of our derivatives contracts, we may be required to maintain a minimum credit rating, post additional collateral or terminate such contracts. Any of these impacts of a ratings downgrade could increase our cost of funding, reduce our liquidity and have adverse effects on our business, financial condition and results of operations. For more information regarding our credit ratings, see the “Liquidity” section in Item 7.

Current wording

Credit ratings affect the cost and associated terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, with their ratings based on a number of factors, including our financial strength and conditions affecting the financial services industry generally. Any downgrade in our ratings would likely increase our borrowing costs and could limit our access to capital markets, which would adversely affect our business. For example, a ratings downgrade could adversely affect our ability to sell or market our securities, including long-term debt, engage in certain longer-term derivative transactions, and retain customers, who may require a minimum credit rating in order to place funds with us. In addition, under the terms of our derivatives contracts, we may be required to post additional collateral or terminate such contracts if we don’t maintain a minimum credit rating. Any of these impacts of a ratings downgrade could increase our cost of funding, reduce our liquidity, and have adverse effects on our business, financial condition, and results of operations. For more information regarding our credit ratings, see the “Liquidity Risk” section in Item 7.

Previous wording

Risks arising from actual or perceived changes in credit quality and uncertainty over the recoverability of amounts due from borrowers is inherent in our businesses. If the economic environment were to deteriorate, more of our borrowers may have difficulty in repaying their loans which could result in higher credit losses and increased loan loss provision expense. Further, our credit risk and credit losses may increase to the extent our loans are concentrated by loan type, industry segment, collateral type, borrower type, or location of the collateral or borrower.

Current wording

Risks arising from actual or perceived changes in credit quality and uncertainty over the recoverability of amounts due from borrowers is inherent in our businesses. If the economic environment were to deteriorate, our borrowers may have difficulty in repaying their loans which could result in higher credit losses and increased loan loss provision expense. Further, our credit risk and credit losses may increase to the extent our loans are concentrated by loan type, industry segment, collateral type, borrower type, or location of the collateral or borrower.

Previous wording

A significant portion of our earnings assets are in the form of loans to borrowers across the U.S., primarily for residential, commercial and industrial, commercial real estate, education, and other retail purposes. A deterioration in economic conditions or changes in consumer or business behavior that negatively impacts home or commercial property values could, in event of the borrower’s default, result in materially higher credit losses. Similarly, elevated unemployment levels and higher interest rates can adversely affect our customers’ ability to repay their loans, which can negatively impact our credit performance.

Current wording

A significant portion of our earning assets are in the form of loans to borrowers across the U.S., primarily for residential, commercial and industrial, commercial real estate, education, and other retail purposes. A deterioration in economic conditions or changes in consumer or business behavior that negatively impact home or commercial property values could, in event of the borrower’s default, result in materially higher credit losses. Similarly, elevated unemployment levels and higher interest rates can adversely affect our customers’ ability to repay their loans, which can negatively impact our credit performance.

Previous wording

Our risk management framework is made up of various processes and strategies to manage our risk exposure. The framework to manage risk, including the framework’s underlying assumptions, may not be effective under all conditions and circumstances. If the risk management framework proves ineffective, we could suffer unexpected losses and could be materially adversely affected.

Current wording

Our risk management framework is made up of various processes and strategies to manage our risk exposure and may not be effective under all conditions and circumstances. If our risk management framework proves ineffective, we could suffer unexpected losses and could be materially adversely affected.

Previous wording

The processes we use to estimate loan losses, measure the fair value of financial instruments and estimate the effects of changing interest rates and other market measures on our financial condition and results of operations are reliant upon the use of analytical and forecasting models. Some of our tools and metrics for managing risk are based on observed historical market behavior, and we rely on quantitative models to measure risks and to estimate certain financial values. Models may be used in processes such as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting losses, assessing capital adequacy and calculating regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items, including goodwill. Poorly designed or implemented models could adversely affect our business decisions if the information is inadequate. In addition, our models may fail to predict future risk exposures if the information used is inaccurate, obsolete or not sufficiently comparable to actual events as they occur. We seek to incorporate appropriate historical data in our models, but the range of market values and behaviors reflected in any period of historical data is not always predictive of future developments in any particular period and the period of data we incorporate into our models may turn out to be inappropriate for the future period being modeled. In these instances, our ability to manage risk would be limited and our risk exposure and losses could be significantly greater than our models indicated, which could harm our reputation and adversely affect our revenues and profits. Finally, information provided to our regulators based on poorly designed or implemented models could be inaccurate or insufficient, which could adversely affect some of the decisions that our regulators make, including those related to capital distributions to our stockholders, and subject us to supervisory criticism and costs relating to remediation.

Current wording

The processes we use to estimate loan losses, measure the fair value of financial instruments, and estimate the effects of changing interest rates and other market measures on our financial condition and results of operations are reliant upon the use of analytical and forecasting models. Some of our tools and metrics for managing risk are based on observed historical market behavior, and we rely on quantitative models to measure risks and to estimate certain financial values. Models may be used in processes such as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting losses, assessing capital adequacy, and calculating regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items, including goodwill. Poorly designed or implemented models could adversely affect our business decisions if the information is inadequate. In addition, our models may fail to predict future risk exposures if the information used is inaccurate, obsolete, or not sufficiently comparable to actual events as they occur. We seek to incorporate appropriate historical data in our models, but the range of market values and behaviors reflected in any period of historical data is not always predictive of future developments in any particular period and the period of data we incorporate into our models may turn out to be inappropriate for the future period being modeled. In these instances, our ability to manage risk would be limited and our risk exposure and losses could be significantly greater than our models indicated, which could harm our reputation and adversely affect our revenues and profits. Finally, information provided to our regulators based on poorly designed or implemented models could be inaccurate or insufficient, which could adversely affect some of the decisions that our regulators make, including those related to capital distributions to our stockholders, and subject us to supervisory criticism and costs related to remediation.

Previous wording

In addition, changes in the legal and regulatory framework under which we operate require us to update our information systems to ensure compliance. Our need to review and evaluate the impact of ongoing rule proposals, final rules and implementation guidance from regulators further complicates the development and implementation of new information systems for our business. Regulatory guidance continues to be focused on the need for financial institutions to perform appropriate due diligence and ongoing monitoring of third-party vendor relationships, thus increasing the scope of management involvement and decreasing the efficiency otherwise resulting from our relationships with third-party technology providers. Given the significant number of ongoing regulatory reform initiatives, it is possible that we incur higher than expected information technology costs in order to comply with current and impending regulations. Also, see “Supervisory requirements and expectations on us as a financial holding company and a bank holding company and any regulator-imposed limits on our activities could adversely affect our ability to implement our strategic plan, expand our business, continue to improve our financial performance and make capital distributions to our stockholders.”

Current wording

In addition, changes in the legal and regulatory framework under which we operate require us to update our information systems to ensure compliance. Our need to review and evaluate the impact of ongoing rule proposals, final rules, and implementation guidance from regulators further complicates the development and implementation of new information systems for our business. Regulatory guidance continues to be focused on the need for financial institutions to perform appropriate due diligence and ongoing monitoring of third-party vendor relationships, thus increasing the scope of management involvement and decreasing the efficiency otherwise resulting from our relationships with third-party technology providers. Given the significant number of ongoing regulatory reform initiatives, it is possible that we may incur higher than expected information technology costs in order to comply with current and impending regulations. Also, see “Supervisory requirements and expectations on us as a financial holding company and a bank holding company and any regulator-imposed limits on our activities could adversely affect our ability to implement our strategic plan, expand our business, continue to improve our financial performance, and make capital distributions to our stockholders.”

Previous wording

Evolving technologies, including the introduction of Generative Artificial Intelligence and Large Language Models, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties present a significant information security risk to large financial institutions such as us. Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. Risks related to cyber-attacks on our vendors and other third parties, including supply chain attacks affecting our software and information technology service providers, are on the rise as such attacks become more frequent and severe. Employee error, failure to follow security procedures, or malfeasance also present these risks. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks as well as in the third-party computer systems and networks used to provide products and services on our behalf. Although we believe that we have appropriate information security procedures and controls based on our adherence to applicable laws and regulations and industry standards, our technologies, systems, and networks may be the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, theft, sale or loss or destruction of the confidential and/or proprietary information of CFG, and our customers, vendors, counterparties, or employees. We and our third-party vendors are under continuous threat of loss or network degradation due to cyber-attacks, such as computer viruses, malicious or destructive code, phishing attacks, ransomware, and Distributed Denial of Service (“DDoS”) attacks (collectively, “fraudulent schemes”). Also, our customers are routinely the target of fraudulent schemes. This is especially true as we continue to expand customer capabilities to utilize the Internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face as a result of these fraudulent schemes are potential loss of funds resulting from customers falling victim to cybercriminal communications directed to them or unauthorized access to sensitive customer data. Cybercriminals can use fraudulent schemes directly targeting our customers or our own systems to compromise and directly extract funds from a customer’s account or access sensitive customer data. Certain technology protections such as Customer Profiling and Step-Up Authentications have been implemented, but there can be no assurance that these protections will be effective.

Current wording

Evolving technologies, including the introduction of Generative Artificial Intelligence and Large Language Models, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists, and other external parties present a significant information security risk to large financial institutions such as us. Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. Risks related to cyberattacks on our vendors and other third parties, including supply chain attacks affecting our software and information technology service providers, are on the rise as such attacks become more frequent and severe. Employee error, failure to follow security procedures, or malfeasance also present these risks. Our operations rely on the secure processing, transmission, and storage of confidential information in our computer systems and networks as well as in the third-party computer systems and networks used to provide products and services on our behalf. Although we believe that we have appropriate information security procedures and controls based on our adherence to applicable laws and regulations and industry standards, our technologies, systems, and networks may be the target of cyberattacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, theft, sale, or loss or destruction of the confidential and/or proprietary information of CFG, and our customers, vendors, counterparties, or employees. We and our third-party vendors are under continuous threat of loss or network degradation due to cyberattacks, such as computer viruses, malicious or destructive code, phishing attacks, ransomware, and Distributed Denial of Service attacks (collectively, “fraudulent schemes”). Also, our customers are routinely the target of fraudulent schemes as we continue to expand customer capabilities to utilize the Internet and other remote channels to transact business. Two of the most significant cyberattack risks that we face as a result of these fraudulent schemes are potential loss of funds resulting from customers falling victim to cybercriminal communications directed to them or unauthorized access to sensitive customer data. Cybercriminals can use fraudulent schemes directly targeting our customers or our own systems to compromise and directly extract funds from a customer’s account or access sensitive customer data. Certain technology protections such as Customer Profiling and Step-Up Authentications have been implemented, but there can be no assurance that these protections will be effective.

Previous wording

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense, to investigate and remediate any information security vulnerabilities internally, to assess and mitigate issues associated with customers that have fallen victim to fraudulent schemes, and perform additional due diligence with respect to our third-party vendors. System enhancements and updates may also create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our layers of defense can itself create a risk of system disruptions and security issues. In addition, addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. Cyber-attacks against the patches themselves have also proven to be a significant risk that companies will have to address going forward.

Current wording

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense, to investigate and remediate any information security vulnerabilities internally, to assess and mitigate issues associated with customers that have fallen victim to fraudulent schemes, and perform additional due diligence with respect to our third-party vendors. System enhancements and updates may also create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our layers of defense can itself create a risk of system disruptions and security issues. In addition, addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. Cyberattacks against the patches themselves have also proven to be a significant risk that companies will have to address going forward.

Previous wording

Despite our efforts to prevent a cyber-attack, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, could take considerable time for us to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised. During the course of an investigation, we may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Moreover, existing regulations may require us to disclose information about a cybersecurity event before it has been resolved or fully investigated.

Current wording

Despite our efforts to prevent a cyberattack, a successful one could persist for an extended period of time before being detected, and, following detection, could take considerable time for us to obtain full and reliable information about the cybersecurity incident and the extent, amount, and type of information compromised. During the course of an investigation, we may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Moreover, existing regulations may require us to disclose information about a cybersecurity event before it has been resolved or fully investigated.

Previous wording

The techniques used by cyber criminals change frequently, may not be recognized until launched and can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments. These actors may attempt to fraudulently induce employees, customers or other third-party users of our systems to disclose sensitive information in order to gain access to data or our systems. In the event that a cyber-attack is successful, our business, financial condition or results of operations may be adversely affected.

Current wording

The techniques used by cyber criminals change frequently, may not be recognized until launched, and can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments. These actors may attempt to fraudulently induce employees, customers, or other third-party users of our systems to disclose sensitive information in order to gain access to data or our systems. In the event that a cyberattack is successful, our business, financial condition, or results of operations may be adversely affected.

Previous wording

Any failure, interruption or breach in the security of our communication and information systems, including due to cyber-attacks or our failure to adequately maintain and manage our systems or implement system changes and upgrades, could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan and other systems. Although our policies and procedures are designed to prevent or limit the effect of the possible failure, interruption or security breach of our information systems, there can be no assurance that these policies and procedures will be successful and that any such failure, interruption or security breach will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failure, interruption or security breach of our information systems could require us to devote substantial resources to recovery and response efforts, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny or expose us to civil litigation and possible financial liability. Although we maintain insurance coverage for information security events, we may incur losses as a result of such events that are not insured against or not fully covered by our insurance.

Current wording

Any failure, interruption, or breach in the security of our communication and information system due to, among other things, cyberattacks or our failure to adequately maintain and manage our systems or implement system changes and upgrades, could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan, and other systems. Although our policies and procedures are designed to prevent or limit the effect of the possible failure, interruption, or security breach of our information systems, there can be no assurance that these policies and procedures will be successful and that any such failure, interruption, or security breach will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failure, interruption, or security breach of our information systems could require us to devote substantial resources to recovery and response efforts, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability. Although we maintain insurance coverage for information security events, we may incur losses as a result of such events that are not insured against or not fully covered by our insurance.

Previous wording

Our success and results depend on our reputation and the strength of our brands. We are vulnerable to adverse market perception as we operate in an industry where integrity, customer trust and confidence are paramount. We are exposed to the risk that litigation, employee misconduct, operational failures, the outcome of regulatory or other investigations or actions, press speculation and negative publicity, and perception of our environmental, social and governance practices and disclosures, among other factors, could damage our brands or reputation. Our brands and reputation could also be harmed if we sell products or services that do not perform as expected or customers’ expectations for the product are not satisfied.

Current wording

Our success and results depend on our reputation and the strength of our brands. We are vulnerable to adverse market perception as we operate in an industry where integrity, customer trust, and confidence are paramount. We are exposed to the risk that litigation, employee misconduct, operational failures, the outcome of regulatory or other investigations or actions, press speculation and negative publicity, and perception of our sustainability and governance practices and disclosures, among other factors, could damage our brands or reputation. Our brands and reputation could also be harmed if we sell products or services that do not perform as expected or customers’ expectations for the product are not satisfied.

Previous wording

Any deterioration in national economic conditions could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Any deterioration in national economic and political conditions could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

Our business is affected by national economic conditions, as well as perceptions of those conditions and future economic prospects. Changes in such economic conditions are not predictable and cannot be controlled. Adverse economic conditions, such as recent inflationary pressures, could require us to charge off a higher percentage of loans and increase the provision for credit losses, which would reduce our net income and otherwise have a material adverse effect on our business, financial condition and results of operations.

Current wording

Our business is affected by national economic and political conditions, as well as perceptions of those conditions and future economic prospects, with changes in such conditions neither predictable or controllable. Adverse economic and political conditions, such as global trade policies, inflationary pressures, and government shutdowns could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

We are also exposed to risks associated with the transition to a lower-carbon economy in response to concerns around climate change. Such risks may result from changes in policies, laws and regulations, technologies, or market preferences that are intended to address climate change. These changes could adversely impact our or our customers’ business, results of operations, financial condition and reputation. This could occur as a result of our or our customers’ involvement in, or decision not to participate in, certain industries or projects associated with exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations related to climate change. For example, a number of states in which we operate have enacted or proposed statutes and regulations addressing climate change and sustainability issues, while certain other states have enacted, or have proposed to enact, divergent or sometimes conflicting statutes, regulations or policies. Ongoing legislative or regulatory uncertainties and changes regarding climate risk management and practices may result in higher regulatory, compliance, credit and reputational risks and costs.

Current wording

We are also exposed to risks associated with the transition to a lower-carbon economy in response to concerns around climate change. Such risks may result from changes in policies, laws and regulations, technologies, or market preferences that are intended to address climate change. These changes could adversely impact our or our customers’ business, results of operations, financial condition, and reputation. This could occur as a result of our or our customers’ involvement in, or decision not to participate in, certain industries or projects associated with exacerbating climate change, as well as any decisions we make to continue to conduct or change our activities in response to considerations related to climate change. For example, a number of states in which we operate have enacted or proposed statutes and regulations addressing climate change and sustainability issues, while certain other states have enacted, or have proposed to enact, divergent or sometimes conflicting statutes, regulations, or policies. Uncertainties and changes in legislation, regulations, and/or global standards related to climate risk management and practices may result in higher regulatory, compliance, credit, and/or reputational risks and costs.

Previous wording

With respect to non-banking financial institutions, technology and other changes have lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks. For example, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds and can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in automation, artificial intelligence and robotics, could significantly affect the competition for financial services. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. Some of our non-bank competitors are not subject to the same extensive regulations we are and, therefore, may have greater flexibility in competing for business. As a result of these and other sources of competition, we could lose business to competitors or be forced to price products and services on less advantageous terms to retain or attract clients, either of which would adversely affect our profitability.

Current wording

With respect to non-banking financial institutions, technology and other changes have lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks. For example, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds and can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. In addition, the emergence, adoption, and evolution of new technologies that do not require intermediation, including distributed ledgers such as digital assets and blockchain, as well as advances in automation, artificial intelligence, and robotics, could significantly affect the competition for financial services. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. Some of our non-bank competitors are not subject to the same regulations that we are and, therefore, may have greater flexibility in competing for business. As a result of these and other sources of competition, we could lose business to competitors or be forced to price products and services on less advantageous terms to retain or attract clients, either of which would adversely affect our profitability.

Previous wording

Financial services institutions are typically interconnected as a result of trading, investment, liquidity, clearing, counterparty and other relationships. Within the financial services industry, the default by any one institution could lead to defaults by other institutions. Concerns about, or a default by, one institution could lead to significant market and customer perception of the risk of similar problems at other institutions. This perception of risk could, in and of itself, lead to adverse impacts on liquidity, as the financial soundness of financial institutions is closely related as a result of these credit, trading, clearing and other relationships. Even the perceived lack of creditworthiness of, or questions about, a counterparty may lead to market-wide liquidity problems and losses or defaults by various institutions. This systemic risk may adversely affect financial intermediaries, such as clearing agencies, banks and exchanges with which we interact on a daily basis, or key funding providers such as the FHLBs, any of which could have a material adverse effect on our access to liquidity or otherwise have a material adverse effect on our business, financial condition and results of operations.

Current wording

Financial services institutions are typically interconnected as a result of trading, investment, liquidity, clearing, counterparty, and other relationships. Within the financial services industry, the default by any one institution could lead to defaults by other institutions. Concerns about, or a default by, one institution could lead to significant market and customer perception of the risk of similar problems at other institutions. This perception of risk could, in and of itself, lead to adverse impacts on liquidity, as the financial soundness of financial institutions is closely related as a result of the aforementioned relationships. Even the perceived lack of creditworthiness of, or questions about, a counterparty may lead to market-wide liquidity problems and losses or defaults by various institutions. This systemic risk may adversely affect financial intermediaries, such as clearing agencies, banks, and exchanges with which we interact on a daily basis, or key funding providers such as the FHLBs, any of which could have a material adverse effect on our access to liquidity or otherwise have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

As a financial holding company and a bank holding company, we are subject to comprehensive regulation that could have a material adverse effect on our business and results of operations.

Current wording

As a financial holding company and a bank holding company, we are subject to regulation that could have a material adverse effect on our business and results of operations.

Previous wording

As a FHC and a BHC, we are subject to comprehensive regulation, supervision and examination by the FRB. In addition, CBNA is subject to comprehensive regulation, supervision and examination by the OCC. Our regulators supervise us through regular examinations and other means that allow them to gauge management’s ability to identify, assess and control risk in all areas of operations in a safe and sound manner and to ensure compliance with laws and regulations. In the course of their supervision and examinations, our regulators may require improvements in various areas. We may be required to devote substantial resources to meet supervisory expectations or remediate supervisory findings. In addition, the failure to meet supervisory expectations can result in practical limitations on the ability of a bank, BHC or FHC to engage in new activities, pursue growth opportunities, engage in acquisitions, return capital to shareholders through repurchases or dividends, or continue to conduct existing activities. If we are unable to implement and maintain any required actions in a timely and effective manner, we could become subject to informal (nonpublic) or formal (public) supervisory actions and public enforcement orders that could lead to significant restrictions on our existing business or on our ability to engage in any new business. Such forms of supervisory action could include, without limitation, written agreements, cease and desist orders, and consent orders and may, among other things, result in restrictions on our ability to pay dividends, requirements to increase capital, restrictions on our activities, the imposition of civil monetary penalties, and enforcement of such actions through injunctions or restraining orders. We could also be required to dispose of certain assets and liabilities within a prescribed period. The terms of any such supervisory or enforcement action could have a material adverse effect on our business, financial condition and results of operations.

Current wording

As a FHC and a BHC, we are subject to regulation, supervision, and examination by the FRB. In addition, CBNA is subject to regulation, supervision, and examination by the OCC. Our regulators supervise us through examinations and other means that allow them to gauge management’s ability to identify, assess, and control risk in all areas of operations in a safe and sound manner and to ensure compliance with laws and regulations. In the course of their supervision and examinations, our regulators may require improvements in various areas. We may be required to devote substantial resources to meet supervisory expectations or remediate supervisory findings. In addition, the failure to meet supervisory expectations can result in practical limitations on the ability of a bank, BHC, or FHC to engage in new activities, pursue growth opportunities, engage in acquisitions, return capital to shareholders through repurchases or dividends, or continue to conduct existing activities. If we are unable to implement and maintain any required actions in a timely and effective manner, we could become subject to informal (nonpublic) or formal (public) supervisory actions and public enforcement orders that could lead to significant restrictions on our existing business or on our ability to engage in any new business. Such forms of supervisory action could include, without limitation, written agreements, cease and desist orders, and consent orders and may, among other things, result in restrictions on our ability to pay dividends, requirements to increase capital, restrictions on our activities, the imposition of civil monetary penalties, and enforcement of such actions through injunctions or restraining orders. We could also be required to dispose of certain assets and liabilities within a prescribed period. The terms of any such supervisory or enforcement action could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

From time to time, bank regulatory agencies take supervisory actions that restrict or limit a financial institution’s activities and lead it to raise capital or subject it to other requirements. In addition, as part of our regular examination process, our regulators may advise us to conduct significant remediation activities or operate under various restrictions as a prudential matter. Any such actions or restrictions, if and in whatever manner imposed, could adversely affect our costs and revenues. Moreover, efforts to comply with any such nonpublic supervisory actions or restrictions may require material investments in additional resources and systems, as well as a significant commitment of managerial time and attention. As a result, such supervisory actions or restrictions, if and in whatever manner imposed, could have a material adverse effect on our business and results of operations.

Current wording

From time to time, bank regulatory agencies take supervisory actions that restrict or limit a financial institution’s activities and lead it to raise capital or subject it to other requirements. In addition, as part of our examination process, our regulators may advise us to conduct significant remediation activities or operate under various restrictions as a prudential matter. Any such actions or restrictions, if and in whatever manner imposed, could adversely affect our costs and revenues. Moreover, efforts to comply with any such nonpublic supervisory actions or restrictions may require material investments in additional resources and systems, as well as a significant commitment of managerial time and attention. As a result, such supervisory actions or restrictions, if and in whatever manner imposed, could have a material adverse effect on our business and results of operations.

Previous wording

The regulatory environment in which we operate continues to be subject to significant and evolving regulatory requirements that could have a material adverse effect on our business and earnings.

Current wording

The regulatory environment in which we operate continues to be subject to evolving regulatory requirements that could have a material adverse effect on our business and earnings.

Previous wording

We are heavily regulated by multiple banking, consumer protection, securities and other regulatory authorities at the federal and state levels. This regulatory oversight is primarily established to protect depositors, the DIF, consumers of financial products, and the financial system as a whole, not for the protection of shareholders or other investors. Changes to statutes, regulations, rules or policies, including their interpretation, implementation or enforcement, could affect us in substantial and unpredictable ways, including by, for example, subjecting us to additional costs, limiting the types of financial services and other products we may offer, limiting our ability to pursue acquisitions and increasing the ability of third parties, including non-banks, to offer competing financial services and products. In recent years, we, together with the rest of the financial services industry, have faced particularly intense scrutiny, with many new regulatory initiatives and vigorous oversight and enforcement on the part of numerous regulatory and governmental authorities. Legislatures and regulators have pursued a broad array of initiatives intended to promote the safety and soundness of financial institutions, financial market stability, the transparency and liquidity of financial markets, and consumer and investor protection. Certain regulators and law enforcement authorities have also recently required admissions of wrongdoing and, in some cases, criminal pleas as part of the resolutions of matters brought by them against financial institutions. Any such resolution of a matter involving us could lead to increased exposure to civil litigation, could adversely affect our reputation, could result in penalties or limitations on our ability to do business or engage in certain activities and could have other negative effects. In addition, a single event or issue may give rise to numerous and overlapping investigations and proceedings, including by multiple federal and state regulators and other governmental authorities.

Current wording

We are regulated by multiple banking, consumer protection, securities, and other regulatory authorities at the federal and state levels. This regulatory oversight is primarily established to protect depositors, the DIF, consumers of financial products, and the financial system as a whole, not for the protection of shareholders or other investors. Changes to statutes, regulations, rules, or policies, including their interpretation, implementation, or enforcement, could affect us in substantial and unpredictable ways, including by, for example, subjecting us to additional costs, limiting the types of financial services and other products we may offer, limiting our ability to pursue acquisitions, and increasing the ability of third parties, including non-banks, to offer competing financial services and products. Certain regulators and law enforcement authorities have required admissions of wrongdoing and, in some cases, criminal pleas as part of the resolutions of matters brought by them against financial institutions. Any such resolution of a matter involving us could lead to increased exposure to civil litigation, could adversely affect our reputation, could result in penalties or limitations on our ability to do business or engage in certain activities, and could have other negative effects. In addition, a single event or issue may give rise to numerous and overlapping investigations and proceedings, including by multiple federal and state regulators and other governmental authorities.

Previous wording

While there have been significant revisions to the laws and regulations applicable to us that have been finalized in recent years, there are other rules to implement changes that have yet to be proposed or enacted by our regulators. The final timing, scope and impact of these changes to the regulatory framework applicable to financial institutions remains uncertain. Uncertainty exists with respect to new laws or regulations or changes in the interpretation or enforcement of existing laws or regulations, including potential deregulation in some areas. In addition, litigation challenging actions or regulations by federal or state authorities could, depending on the outcome, significantly affect the regulatory and supervisory framework affecting our operations. For more information on regulations to which we are subject and recent initiatives to reform financial institution regulation, see the “Regulation and Supervision” section in Item 1.

Current wording

Uncertainty exists with respect to the enactment of new laws and regulations, or changes in the interpretation or enforcement of existing laws and regulations, including potential deregulation in some areas. In addition, litigation challenging actions or regulations by federal or state authorities could, depending on the outcome, significantly affect the regulatory and supervisory framework affecting our operations. For more information on regulations to which we are subject, see the “Regulation and Supervision” section in Item 1.

Previous wording

FRB policy historically required BHCs to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. This support may be required by the FRB at times when we might otherwise determine not to provide it or when doing so is not otherwise in the interests of CFG or our stockholders or creditors, and may include one or more of the following:

Current wording

FRB policy historically required BHCs to act as a source of financial and managerial strength to their subsidiary banks. This support may be required by the FRB at times when we might otherwise determine not to provide it or when doing so is not otherwise in the interests of CFG or our stockholders or creditors, and may include one or more of the following:

Previous wording

•In the event of a BHC’s bankruptcy, any commitment that the BHC had been required to make by a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Current wording

•In the event of a BHC’s bankruptcy, any commitment that the BHC had been required to make by a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment; and