Santander Holdings USA, Inc.

Previous wording

•Pandemics such as the COVID-19 pandemic can affect our business. Pandemics such as the COVID-19 pandemic can affect our business. Closures, disruptions to businesses and other actions that could restrict economic activity in the U.S. due to pandemics or other public health emergencies may result in adverse effects on our customers and our business.

Current wording

•Pandemics and public health emergencies can affect our business. Pandemics and public health emergencies can affect our business. Closures, disruptions to businesses and other actions that could restrict economic activity in the U.S. due to pandemics or other public health emergencies may result in adverse effects on our customers and our business.

Previous wording

Despite the long-term expansion of the U.S. economy, some uncertainty remains regarding U.S. monetary policy and the future economic environment. There can be no assurance that economic conditions will continue to improve. Such economic uncertainty could have an adverse effect on our business and results of operations. A downturn of the economic expansion or failure to sustain the economic recovery would likely aggravate the adverse effects of these difficult economic and market conditions on us and on others in the financial services industry. In addition, dislocations in international trade such as interruptions in international supply chains or implementation of tariffs may impact prices and demand for goods and services and lead to lower levels of business and possible declining creditworthiness of customers.

Current wording

Despite the long-term expansion of the U.S. economy, some uncertainty remains regarding U.S. monetary policy and the future economic environment. There can be no assurance that economic conditions will continue to improve. Such economic uncertainty could have an adverse effect on our business and results of operations. A downturn of the economic expansion or failure to sustain the economic recovery would likely aggravate the adverse effects of these difficult economic and market conditions on us and on others in the financial services industry. In addition, dislocations in international trade such as interruptions in international supply chains or implementation of tariffs may impact prices and demand for goods and services and lead to lower levels of business and possible declining creditworthiness of customers. Growing protectionism and trade tensions could have a negative impact on the U.S. and global economies, and impact our operating results, financial condition and prospects.

Previous wording

In addition, these concerns continue even as the global economy recovers. If countries with significant economies default on their debt or experience a significant widening of credit spreads, it may delay or weaken economic recovery, adversely affect financial institutions and bank systems related to that region, result in the exit of member states from organizations such as the Eurozone or contribute to other more severe economic and financial conditions. Ifrealized, these risk scenarios could contribute to severe stress and adverse consequences for global financial markets, likely affecting the economy and capital markets in the United States as well.

Current wording

These concerns continue even as the global economy recovers. If countries with significant economies default on their debt or experience a significant widening of credit spreads, it may delay or weaken economic recovery, adversely affect financial institutions and bank systems related to that region, result in the exit of member states from organizations such as the Eurozone or contribute to other more severe economic and financial conditions. Ifrealized, these risk scenarios could contribute to severe stress andadverse consequences for global financial markets, likely affecting the economy and capital markets in the United States as well. In addition, public concern related to the ability of the U.S. government to agree on federal budgetary matters, or that the government may have a total or partial shutdown, may adversely affect the U.S. economy and increase the risk of economic instability or market volatility.

Previous wording

In addition, our revenues are subject to risk of loss from unfavorable political and diplomatic developments, social instability, and changes in governmental policies, international ownership legislation, interest rate caps and tax policies. Growth, asset quality and profitability may be affected by volatile macroeconomic and political conditions.

Current wording

In addition, our revenues are subject to risk of loss from unfavorable political and diplomatic developments, social instability, and changes in governmental policies, international ownership legislation, interest rate caps and tax policies. For example, in 2025 a new U.S. presidential administration took office. In recent months, commentary by certain people associated with the new administration suggests that it may seek to reduce or eliminate incentives for manufacturers and consumers of electric vehicles and the building of new wind farms for the production of wind energy. Our businesses include financing the sale of electric vehicles and financing the creation of renewable energy developments such as wind farms. Governmental policies that disincentivize these industries and projects could therefore lead to reductions in our revenue. In general, growth, asset quality and profitability may be affected by volatile macroeconomic and political conditions.

Previous wording

In addition, the volume, granularity, frequency and scale of regulatory and other reporting requirements necessitate a clear data strategy to enable consistent data aggregation, reporting and management. Inadequate management information systems or processes, including those relating to risk data aggregation and risk reporting, could lead to a failure to meet regulatory reporting requirements or other internal or external information demands that may result in supervisory measures.

Current wording

Moreover, the volume, granularity, frequency and scale of regulatory and other reporting requirements necessitate a clear data strategy to enable consistent data aggregation, reporting and management. Inadequate management information systems or processes, including those relating to risk data aggregation and risk reporting, could lead to a failure to meet regulatory reporting requirements or other internal or external information demands that may result in supervisory measures.

Previous wording

The Company is subjectto stress testing and capital planning requirements under regulations implementing the DFA and other banking laws and policies. Under such rules, the Federal Reserve expects BHCs such as the Company to have sufficient capital to withstand a highly adverse operating environment and to be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and serve as credit intermediaries. In addition, the Federal Reserve evaluates the planned capital actions of BHCs, including capital distributions such as dividend payments or stock repurchases. Effe ctive January 2017, the Federal Reserve finalized a rule adjusting its capital plan and stress testing rules, exempting from the qualitative portion of the CCAR certain BHCs and U.S. IHCs of FBOs with total consolidated assets between $50 billion and $250 billion and total nonbank assets of less than $75 billion, and that are not identified as GSIBs. Such firms, including the Company, are still required to meet CCAR’s quantitative requirements, are subject to regular supervisory assessments that examine their capital planning processes and are subject to the limitations and requirements set forth in the Federal Reserve's SCB rules.

Current wording

The Company is subjectto stress testing and capital planning requirements under regulations implementing the DFA and other banking laws and policies. Under such rules, the Federal Reserve expects BHCs such as the Company to have sufficient capital to withstand a highly adverse operating environment and to be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and serve as credit intermediaries. In addition, the Federal Reserve evaluates the planned capital actions of BHCs, including capital distributions such as dividend payments or stock repurchases. As a Category IV IHC under Federal Reserve regulations, we are required to submit a capital plan to the Federal Reserve on an annual basis. We are also subject to supervisory stress testing on a two-year cycle. Our categorization as a Category IV IHC could change depending on the scope and composition of our activities. If this categorization changes, we would be subject to enhance prudential standards tailored to our risk profile.

Previous wording

In addition, the FASB’s Topic 326 Financial Instruments - Credit Losses, establishes a single allowance framework for financial assets carried at amortized cost. As a result of the adoption of this standard, companies must recognize credit losses on these assets equal to management’s estimate of credit losses over the assets’ remaining expected lives. It is possible that our ongoing reported earnings and lending activity will be impacted negatively as a result of the application of this ASU. See “Changes in accounting standards could impact reported earnings” below.

Current wording

In addition, the FASB’s Topic 326 Financial Instruments - Credit Losses, establishes a single allowance framework for financial assets carried at amortized cost. Under this standard, companies must recognize credit losses on these assets equal to management’s estimate of credit losses over the assets’ remaining expected lives. It is possible that our ongoing reported earnings and lending activity will be impacted negatively as a result of the application of this accounting standard. See “Changes in accounting standards could impact reported earnings” below.

Previous wording

We rely, and will continue to rely, primarily on deposits to fund lending activities. The ongoing availability of this type of funding is sensitive to a variety of factors outside our control, such as general economic conditions and the confidence of depositors in the economy in general, and the financial services industry in particular, as well as competition among banks for deposits. Any of these factors could significantly increase the amount of deposit withdrawals in a short period of time, thereby reducing our ability to access deposit funding in the future on appropriate terms, or at all. If these circumstances were to arise, they could have a material adverse effect on our operating results, financial condition and prospects.

Current wording

We rely, and will continue to rely, primarily on deposits to fund lending activities. The ongoing availability of this type of funding is directly related to our solvency and the success of our policies. It is also sensitive to a variety of factors outside our control, such as general economic conditions and the confidence of depositors in the economy in general, and the financial services industry in particular, as well as competition among banks and non-banks for deposits. Online and mobile banking services may allow customers to withdraw their deposits or send funds to other accounts with short notice. Additionally, account owners with uninsured deposits may be more likely to withdraw their deposits. Any of these factors could significantly increase the amount of significant deposit withdrawals in a short period of time, thereby reducing our ability to access deposit funding in the future on appropriate terms, or at all. If these circumstances were to arise, they could have a material adverse effect on our operating results, liquidity, financial condition and prospects.

Previous wording

We anticipate that our customers will continue to make deposits (particularly demand deposits and short-term time deposits) in the near future, and we intend to maintain our emphasis on the use of banking deposits as a source of funds. The short-term nature of some deposits could cause liquidity problems for us in the future if deposits are not made in the volumes we expect or are not renewed. If a substantial number of our depositors withdraw their demand deposits, or do not roll over their time deposits upon maturity, we may be materially and adversely affected.

Current wording

We anticipate that our customers will continue to make deposits (particularly demand deposits and short-term time deposits) in the near future, and we intend to maintain our emphasis on the use of banking deposits as a source of funds. While we expect the implementation of SBNA’s new online banking platform Openbank will facilitate our acquisition of additional deposits, there can be no assurance that we will be able to implement and integrate this system with our other banking systems seamlessly and efficiently. Moreover, the short-term nature of some deposits could cause liquidity problems for us in the future if deposits are not made in the volumes we expect or are not renewed. If a substantial number of our depositors withdraw their demand deposits, or do not roll over their time deposits upon maturity, we may be materially and adversely affected.

Previous wording

Credit ratings affect the cost and other terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, and their ratings of our debt are based on a number of factors, including our financial strength and conditions affecting the financial services industry generally.

Current wording

Credit ratings affect the cost and other terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, and their ratings of our debt are based on internal methodologies dependent on a number of factors, including our financial strength and conditions affecting the financial services industry generally.

Previous wording

Interest rates are highly sensitive to many factors beyond our control, including increased regulation of the financial sector, monetary policies, domestic and international economic and political conditions, and other factors. Variations in interest rates could affect our net interest income, which comprises the majority of our revenue, reducing our growth rate and potentially resulting in losses. This is a result of the different effect a change in interest rates may have on the interest earned on our assets and the interest paid on our borrowings. In addition, we may incur costs (which, in turn, will impact our results) as we implement strategies to reduce future interest rate exposure.

Current wording

Interest rate risk arises from movements in interest rates that reduce the value of a financial instrument or portfolio. It can affect loans, deposits, debt securities, most assets and liabilities held for trading, and derivatives. Interest rates are highly sensitive to many factors beyond our control, including increased regulation of the financial sector, monetary policies, domestic and international economic and political conditions, and other factors. Variations in interest rates could affect our net interest income, which comprises the majority of our revenue, reducing our growth rate and potentially resulting in losses. This is a result of the different effect a change in interest rates may have on the interest earned on our assets and the interest paid on our borrowings. In addition, we may incur costs (which, in turn, will impact our results) as we implement strategies to reduce future interest rate exposure.

Previous wording

Governmental and regulatory authorities throughout the world implemented fiscal and monetary policies and initiatives to mitigate the effects of the pandemic on the economy and individual businesses and households. These fiscal and monetary policy measures accelerated the economic recovery in 2021, but in turn significantly increased public debt and introduced risks of economic overheating in certain countries. In 2022, inflationary pressures intensified due to a number of factors, including the revitalization of demand for consumer goods, labor shortages, supply chain issues, and the rise in the prices of energy, oil, gas and other commodities exacerbated by the war in Ukraine. In an effort to contain inflation, central banks increased interest rates during 2022 and 2023, contributing to a slowdown of the global economy. Many countries experienced persistent high inflation, and even though inflation has begun to fall in most markets, central banks are expected to sustain high interest rates to address persistent underlying inflation pressures through mid-2024. Prolonged periods of high inflation are likely to result in higher operating costs, a decrease in the purchasing power of families with a consequent increase in delinquencies in our credit portfolios, and lower economic growth derived from the tightening of monetary and fiscal policies aimed at containing inflation, among other risks, any of which could have a material adverse effect on our operations, financial condition and prospects.

Current wording

Governmental and regulatory authorities throughout the world implemented fiscal and monetary policies and initiatives to mitigate the effects of the pandemic on the economy and individual businesses and households. These fiscal and monetary policy measures accelerated the economic recovery in 2021, but in turn significantly increased public debt and introduced risks of economic overheating in certain countries. In 2022, inflationary pressures intensified due to a number of factors, including the revitalization of demand for consumer goods, labor shortages, supply chain issues, and the rise in the prices of energy, oil, gas and other commodities exacerbated by the war in Ukraine. In an effort to contain inflation, central banks increased interest rates during 2022 and 2023, contributing to a slowdown of the global economy. During 2023 and 2024, inflation slowly converged towards central banks' objectives, allowing central banks to reduce rates beginning in mid-2024. Prolonged periods of high inflation could result in higher operating costs, a decrease in the purchasing power of families with a consequent increase in delinquencies in our credit portfolios, and lower economic growth derived from the tightening of monetary and fiscal policies aimed at containing inflation, among other risks, any of which could have a material adverse effect on our operations, financial condition and prospects.

Previous wording

Some of our tools and metrics for managing risk are based on our use of observed historical market behavior. We apply statistical and other tools to these observations to arrive at quantifications of our risk exposures. These tools and metrics may fail to predict future risk exposures. These risk exposures could, for example, arise from factors we did not anticipate or correctly evaluate in our statistical models. This would limit our ability to manage our risks. Our losses therefore could be significantly greater than the historical measures indicate. In addition, our statistical models do not take all risks into account. Our approach to managing risks could prove insufficient, exposing us to material unanticipated losses. We could face adverse consequences as a result of decisions based on models that are poorly developed, implemented, or used, or as a result of a modeled outcome being misunderstood or used of for purposes for which it was not designed. In addition, if existing or potential customers believe our risk management is inadequate, they could take their business elsewhere or seek to limit transactions with us. This could have a material adverse effect on our reputation, operating results, financial condition, and prospects.

Current wording

Some of our tools and metrics for managing risk are based on our use of observed historical market behavior. We apply statistical and other tools to these observations to arrive at quantifications of our risk exposures. These tools and metrics may fail to predict future risk exposures. These risk exposures could, for example, arise from factors we did not anticipate or correctly evaluate in our statistical models. This would limit our ability to manage our risks. Our losses therefore could be significantly greater than the historical measures indicate. In addition, our statistical models do not take all risks into account. Our approach to managing risks could prove insufficient, exposing us to material unanticipated losses. We could face adverse consequences as a result of decisions based on models that are poorly developed, implemented, or used, or as a result of a modeled outcome being misunderstood or used of for purposes for which it was not designed, or if the data or inputs of the models were incorrect or insufficient. In addition, if existing or potential customers believe our risk management is inadequate, they could take their business elsewhere or seek to limit transactions with us. This could have a material adverse effect on our reputation, operating results, financial condition, and prospects.

Previous wording

•apply our risk management policies effectively to an enlarged group; and

Current wording

•apply our risk management policies effectively to an enlarged group;

Previous wording

•manage a growing number of entities without over-committing management or losing key personnel.

Current wording

•manage a growing number of entities without over-committing management or losing key personnel; and

Previous wording

We have made business acquisitions for which it is possible that the goodwill which has been attributed to those businesses may have to be written down if our valuation assumptions are required to be reassessed as a result of any deterioration in the business’ underlying profitability, asset quality, interest rate environment, or other relevant matters. Impairment testing with respect to goodwill is performed annually, more frequently if impairment indicators are present, and includes a comparison of the carrying amount of the reporting unit with its fair value. If the carrying value of the reporting unit is higher than the fair value, the impairment is measured as this excess of carrying value over fair value. We did not recognize any impairments of goodwill in 2023, 2022, or 2021, however based on future market conditions and the Company's financial performance, it is possible we may be required to record additional impairment of goodwill of up to $2.8 billion attributable to one or more of the Company's reporting units in the future. There can be no assurance that we will not have to write down the value attributed to goodwill further in the future, which would not impact risk-based capital ratios adversely but would adversely affect our results of operations and stockholder's equity. See Note 6 to our Consolidated Financial Statements, “Goodwill and Other Intangibles,” for a discussion of the risk of potential future impairment of our CRE reporting unit.

Current wording

We have made business acquisitions for which it is possible that the goodwill which has been attributed to those businesses may have to be written down if our valuation assumptions are required to be reassessed as a result of any deterioration in the business’ underlying profitability, asset quality, interest rate environment, or other relevant matters. Impairment testing with respect togoodwill is performed annually, more frequently if impairment indicators are present, and includes a comparison of the carrying amount of the reporting unit with its fair value. If the carrying value of the reporting unit is higher than the fair value, the impairment is measured as this excess of carrying value over fair value. We did not recognize any impairments of goodwill in 2024, 2023, or 2022; however, based on future market conditions and the Company's financial performance, it is possible we may be required to record additional impairment of goodwill of up to $2.8 billion attributable to one or more of the Company's reporting units in the future. There can be no assurance that we will not have to write down the value attributed to goodwill further in the future, which would not impact risk-based capital ratios adversely but would adversely affect our results of operations and stockholder's equity.

Previous wording

Our continued success depends in part on the continued service of key members of our management team. The ability to continue to attract, train, motivate and retain highly qualified professionals is a key element of our strategy. The successful implementation of our growth strategy depends on the availability of skilled management and employees, both at our head office and at each of our business units. Changes to the labor market as a result of the COVID-19 pandemic such as increased employee attrition, labor availability, and increased wages may make it more challenging to attract and retain talented personnel. If we or one of our business units or other functions fails to staff its operations appropriately or loses one or more of its key senior executives and fails to replace them in a satisfactory and timely manner, our business, financial condition and results of operations, including control and operational risks, may be adversely affected.

Current wording

Our continued success depends in part on the continued service of key members of our management team. The ability to continue to attract, train, motivate and retain highly qualified professionals is a key element of our strategy. The successful implementation of our growth strategy depends on the availability of skilled management and employees, both at our head office and at each of our business units. If we or one of our business units or other functions fails to staff its operations appropriately or loses one or more of its key senior executives and fails to replace them in a satisfactory and timely manner, our business, financial condition and results of operations, including control and operational risks, may be adversely affected.

Previous wording

While negative public opinion once was primarily a response to adverse coverage in traditional news media, increased use of social media platforms has resulted in rapid dissemination of information and misinformation, which can magnify potential harm to the Company’s reputation. We may be the subject of misinformation and misrepresentations propagated deliberately to harm our reputation or for other deceitful purposes, including by others seeking to gain an illegal market advantage by spreading false information about us. There can be no assurance that we will be able to neutralize or contain false information that may be propagated regarding the Company, which could have an adverse effect on our operating results, financial condition and prospects.

Current wording

While negative public opinion once was primarily a response to adverse coverage in traditional news media, increased use of social media platforms has resulted in rapid dissemination of information and misinformation, which can magnify potential harm to the Company’s reputation. We may be the subject of misinformation and misrepresentations deliberately propagated in media or social media to harm our reputation or for other deceitful purposes, including by others seeking to gain an illegal market advantage by spreading false information about us. There can be no assurance that we will be able to neutralize or contain false information that may be propagated regarding the Company, which could have an adverse effect on our operating results, financial condition and prospects.

Previous wording

SBNA engages in transactions with its subsidiaries or affiliates that others may not consider to be on an arm’s-length basis.

Current wording

SBNA engages in transactions with its affiliates that may not be on favorable terms to the affiliate.

Previous wording

SBNA and its subsidiaries have entered into a number of services agreements pursuant to which we render services, such as administrative, accounting, finance, treasury, legal services and others.

Current wording

SBNA enters into many transactions with its affiliates in the ordinary course of business, including agreements pursuant to which SHUSA may render services, such as administrative, accounting, finance, treasury, legal services and others.

Previous wording

SBNA and its affiliates are likely to continue to engage in transactions with their respective affiliates. Future conflicts of interests among our affiliates may arise, which conflicts are not required to be and may not be resolved in SHUSA's favor.

Current wording

SBNA is likely to continue to engage in transactions with affiliates and such transactions are not required to be and may not be considered favorable to SHUSA.

Previous wording

Although the World Health Organization has since declared an end to COVID-19 as a public health emergency, certain adverse consequences of the pandemic continued to impact the macroeconomic environment in 2023 and may persist for some time. If new COVID-19 waves, the emergence of variants resistant to existing vaccines, or any other highly contagious disease or public health emergencies force countries to re-adopt measures that restrict economic activity, the macroeconomic environment could deteriorate and adversely impact our business and results of operations, which could include, but are not limited to, (i) a continued decreased demand for our products and services; (ii) material impairment of our loans and other assets including goodwill; (iii) decline in the value of collateral; (iv) constraints on our liquidity due to market conditions, exchange rates and customer withdrawal of deposits and continued draws on lines of credit; and (v) downgrades to our credit ratings. Moreover, our operations could still be impacted by risks from remote work or bans on non-essential activities. If, as a result of any future public health emergency, we become unable to operate our business from remote locations successfully including, for example, due to failures of our technology infrastructure, increased cybersecurity risks, or governmental restrictions that affect our operations, this could result in business disruptions that could have a material and adverse effect on our business.

Current wording

If a new pandemic or public health emergency occurs that forces countries to re-adopt measures that restrict economic activity, such as requiring certain businesses or locations to close temporarily or indefinitely, the macroeconomic environment could deteriorate and adversely impact our business and results of operations, the effects of which could include, but are not limited to, (i) decreased demand for our products and services; (ii) material impairment of our loans and other assets including goodwill; (iii) decline in the value of collateral; (iv) constraints on our liquidity due to market conditions, exchange rates and customer withdrawal of deposits and continued draws on lines of credit; and (v) downgrades to our credit ratings. Moreover, our operations could still be impacted by risks from remote work or bans on non-essential activities. If, as a result of any future public health emergency, we become unable to operate our business from remote locations successfully including, for example, due to failures of our technology infrastructure, increased cybersecurity risks, or governmental restrictions that affect our operations, this could result in business disruptions that could have a material and adverse effect on our business.

Previous wording

The resurgence of COVID-19 or other variants, or any future outbreak of any other highly contagious disease or other public health emergency may have adverse effects on our business, financial condition, liquidity and results of operations or increase the likelihood of experiencing other risks described in these Risk Factors.

Current wording

A future pandemic or public health emergency may have adverse effects on our business, financial condition, liquidity and results of operations or increase the likelihood of experiencing other risks described in these Risk Factors.

Previous wording

Like other financial institutions with a large customer base, we have been subject to and are likely to continue to be the subject of attempted cyberattacks in light of the fact that we receive, manage, process, hold and transmit proprietary and sensitive or confidential information, including that of our customers and employees, in the conduct of our banking operations, as well as a large number of assets. Our business depends on the ability to process a large number of transactions efficiently and accurately, and on our ability to rely on our digital technologies, computer and e-mail services, spreadsheets, software and networks, as well as on the secure processing, storage and transmission of confidential and other information in our computer systems and networks and those of our third-party service providers. The proper and secure functioning of financial controls, accounting and other data collection and processing systems is critical to our businesses and our ability to compete effectively. Cybersecurity incidents and data losses can result from inadequate personnel, inadequate or failed internal control processes and systems, or external events or actors that interrupt normal business operations. We also face the risk that the design of our cybersecurity controls and procedures proves to be inadequate or is circumvented. Although we work with our clients, third-party service providers, counterparties and other external parties to develop secure transmission capabilities and prevent information security risk, we routinely exchange personal, confidential and proprietary information by electronic means, which may be a target for attempted cyberattacks. This is especially applicable in the current environment, in which there has been a shift in recent years to work-from-home policies for a significant portion of the workforce, as they access our secure networks remotely. If we cannot maintain effective and secure electronic data and information, management and processing systems or if we fail to maintain complete physical and electronic records, the result could be disruptions to our operations, claims from customers, regulators, employees and other parties, violations of applicable privacy and other laws, regulatory sanctions and serious reputational and financial harm to us.

Current wording

Like other financial institutions with a large customer base, we have been subject to and are likely to continue to be the subject of attempted cyberattacks in light of the fact that we receive, manage, process, hold and transmit proprietary and sensitive or confidential information, including that of our customers and employees, in the conduct of our banking operations, as well as a large number of assets. Our business depends on the ability to process a large number of transactions efficiently and accurately, and on our ability to rely on our digital technologies, computer and e-mail services, spreadsheets, software and networks, as well as on the secure processing, storage and transmission of confidential and other information in our computer systems and networks and those of our third-party service providers. The proper and secure functioning of financial controls, accounting and other data collection and processing systems is critical to our businesses and our ability to compete effectively. Cybersecurity incidents and data losses can result from inadequate personnel, inadequate or failed internal control processes and systems, or external events or actors that interrupt normal business operations. We also face the risk that the design of our cybersecurity controls and procedures proves to be inadequate or is circumvented. Any material disruption or slowdown of our systems could cause information, including data related to customer requests, to be lost or delivered to our clients with delays or errors, which could reduce demand for our products and services, result in customer claims and materially and adversely affect us.

Previous wording

We take protective measures and continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. We have policies, practices and controls designed to prevent or limit disruptions to our systems and enhance the security of our infrastructure. These include performing risk management for information systems that store, transmit or process information assets identifying and managing risks to information assets managed by third-party service providers through on-going oversight and auditing of the service providers’ operations and controls. We develop controls regarding user access to software on the principle that access is forbidden to a system unless expressly permitted, limited to the minimum amount necessary for business purposes, and terminated promptly when access is no longer required. We seek to educate and make our employees aware of information security and privacy controls and their specific responsibilities on an ongoing basis.

Current wording

Controls and capabilities include performing risk management for information systems that store, transmit or process information assets identifying and managing risks to information assets managed by third-party service providers through on-going oversight and assessment of the service providers’ operations and controls. We develop controls regarding user access to software on the principle that access is forbidden to a system unless expressly permitted, limited to the minimum amount necessary for business purposes, and terminated promptly when access is no longer required. We seek to educate and make our employees aware of information security and privacy controls and their specific responsibilities on an ongoing basis.

Previous wording

As financial institutions are becoming increasingly interconnected with central agents, exchanges and clearinghouses, they may be increasingly susceptible to negative consequences of cyberattacks and security breaches affecting the systems of such third parties. It could take a significant amount of time for a cyberattack to be investigated, during which time we may not be in a position to fully understand and remediate the attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences associated with a particular cyberattack. The perception of a security breach affecting us or any part of the financial services industry, whether correct or not, could result in a loss of confidence in our cybersecurity measures or otherwise damage our reputation with customers and third parties with whom we do business. Should such adverse events occur, we may not have indemnification or other protection from the third party sufficient to compensate or protect us from the consequences.

Current wording

As financial institutions continue to be interconnected with central agents, exchanges and clearinghouses, they may be increasingly susceptible to negative consequences of cyberattacks and security breaches affecting the systems of such third parties. It could take a significant amount of time for a cyberattack to be investigated, during which time we may not be in a position to fully understand and remediate the attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences associated with a particular cyberattack. The perception of a security breach affecting us or any part of the financial services industry, whether correct or not, could result in a loss of confidence in our cybersecurity measures or otherwise damage our reputation with customers and third parties with whom we do business. Should such adverse events occur, we may not have indemnification or other protection from the third party sufficient to compensate or protect us from the consequences.

Previous wording

U.S. banking agencies and other federal and state government agencies have increased their attention on cybersecurity and data privacy risks and have proposed enhanced risk management standards that would apply to us. For example, the California Consumer Privacy Act requires, among other things, notification to affected individuals when there has been a security breach of their personal data and imposes increased privacy and security obligations of entities handling certain personal information of indivi duals. Other states in which we do business or may in the future do business, or from which we collect personal information of residents, have adopted or are considering adopting similar laws. During 2022, federal banking regulators established a cybersecurity-related rule that would require banking organizations to notify their primary federal regulator as soon as possible and within 36 hours of incidents that, among other things, have materially disrupted or degraded, or are reasonable likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. This rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents. Additionally, in 2023, the SEC adopted new rules related to disclosures of cybersecurity risk management, strategy, governance, and incidents by public companies. These new rules have two main components for domestic public companies: (1) disclosure of material cybersecurity incidents on Form 8-K within four business days of determining that a cybersecurity incident is material; and (2) annual disclosure of a company’s risk management, strategy, and governance relating to cybersecurity matters on Form 10-K. Such legislation and regulations relating to cybersecurity and data privacy may require that we modify systems, change service providers, or alter business practices or policies regarding information security, handling of data and privacy. Changes such as these could subject us to heightened compliance complexity and operational costs. We may be required to report events related to data privacy or cybersecurity issues, events where customer information may be compromised, unauthorized access to our systems and other security breaches to affected individuals or the relevant regulatory authorities. To the extent we do not successfully meet supervisory standards pertaining to cybersecurity, we could be subject to supervisory actions, substantial fines, civil or criminal penalties, significant litigation and reputational damage or ordered to change our business practices, policies or systems in a manner that adversely impacts our operating results.

Current wording

U.S. banking agencies and other federal and state government agencies continue to focus their attention on cybersecurity and data privacy risks and have proposed enhanced risk management standards that would apply to us. For example, in 2023, the SEC adopted new rules related to disclosures of cybersecurity risk management, strategy, governance, and incidents by public companies. These new rules have two main components for domestic public companies: (1) disclosure of material cybersecurity incidents on Form 8-K within four business days of determining that a cybersecurity incident is material; and (2) annual disclosure of a company’s risk management, strategy, and governance relating to cybersecurity matters on Form 10-K. Such legislation and regulations relating to cybersecurity and data privacy may require that we modify systems, change service providers, or alter business practices or policies regarding information security, handling of data and privacy. Also in 2023, the NYDFS updated regulations to include enhanced requirements including independent audits, additional Board reporting and oversight, authentication, penetration testing, and incident response and continuity planning. These changes are in line with our existing information security program requirements. In addition, the NYDFS established a requirement for covered companies to notify the NYDFS within 72 hours after determining that a notifiable cybersecurity event has occurred. Changes such as these could subject us to heightened compliance complexity and operational costs. We may be required to report events related to data privacy or cybersecurity issues, events where customer information may be compromised, unauthorized access to our systems and other security breaches to affected individuals or the relevant regulatory authorities. To the extent we do not successfully meet supervisory standards pertaining to cybersecurity, we could be subject to supervisory actions, substantial fines, civil or criminal penalties, significant litigation and reputational damage or ordered to change our business practices, policies or systems in a manner that adversely impacts our operating results.

Previous wording

•Our relationship with Stellantis is a significant source of our loan and lease originations. Loss of our relationship with Stellantis, including as a result of termination of our agreement with Stellantis, could materially and adversely affect our business, financial condition and results of operations.

Current wording

•Our relationship with Stellantis has been a significant source of our loan and lease originations. Loss of our relationship with Stellantis, including as a result of termination of our agreement with Stellantis, could materially and adversely affect our business, financial condition and results of operations. Our MLPA with Stellantis is scheduled to expire in December 2025.

Previous wording

We are also subject to geopolitical risks, such as sanctions, state-sponsored cyberattacks, civil unrest, government or military conflicts and the U.S. or foreign governments’ reactions to such events. For example, disagreements between the U.S. and significant trading partners over economic or political matters such as international trade may result in new or continued sanctions, tariffs and other similar restrictions on trade and investment between the two countries, which may result in supply chain disruptions and increased costs that could negatively affect us, our customers and our counterparties. In addition, during 2022, Russia launched a large-scale military action against Ukraine. The war in Ukraine has caused an ongoing humanitarian crisis in Europe as well as volatility in financial markets globally, heightened inflation, shortages and increased commodities prices. In addition, the war has exacerbated supply chain problems, particularly to businesses most sensitive to rising energy prices. Several countries, including the US, have imposed severe sanctions on Russia and Belarus, including freezing/blocking assets, targeting major Russian banks, the Russian Central Bank, and certain Russian companies and individuals, imposing trade restrictions against Russia and Russian interests, as well as the disconnection of certain Russian banks from the SWIFT system. The scale of potential sanctions is complex and rapidly evolving and can pose operational risk to banking organizations. While we do not knowingly engage in direct or indirect dealings with sanctioned parties or in direct dealings with sanctioned countries/territories, companies within Santander may on occasion have indirect dealings within the sanctioned countries/territories, while aiming to operate in line with applicable U.S. and foreign sanctions regulations. Furthermore, the risk of cyberattacks on companies and institutions is expected to increase as a result of the war and in response to the sanctions imposed.

Current wording

We are also subject to geopolitical risks, such as sanctions, state-sponsored cyberattacks, civil unrest, government or military conflicts and the U.S. or foreign governments’ reactions to such events. For example, disagreements between the U.S. and significant trading partners over economic or political matters such as international trade may result in new or continued sanctions, tariffs and other similar restrictions on trade and investment between countries, which may result in supply chain disruptions and increased costs that could negatively affect us, our customers and our counterparties. In addition, during 2022, Russia launched a large-scale military action against Ukraine. The war in Ukraine has caused an ongoing humanitarian crisis in Europe as well as volatility in financial markets globally, heightened inflation, shortages and increased commodities prices. In addition, the war has exacerbated supply chain problems, particularly to businesses most sensitive to rising energy prices. Several countries, including the US, have imposed severe sanctions on Russia and Belarus, including freezing/blocking assets, targeting major Russian banks, the Russian Central Bank, and certain Russian companies and individuals, imposing trade restrictions against Russia and Russian interests, as well as the disconnection of certain Russian banks from the SWIFT system. The scale of potential sanctions is complex and rapidly evolving and can pose operational risk to banking organizations. While we do not knowingly engage in direct or indirect dealings with sanctioned parties or in direct dealings with sanctioned countries/territories, companies within Santander may on occasion have indirect dealings within the sanctioned countries/territories, while aiming to operate in line with applicable U.S. and foreign sanctions regulations. Furthermore, the risk of cyberattacks on companies and institutions is expected to increase as a result of the war and in response to the sanctions imposed.

Previous wording

The preparation of consolidated financial statements in conformity with GAAP requires management to make judgments, estimates and assumptions that affect our Consolidated Financial Statements and accompanying notes. Due to the inherent uncertainty in making estimates, actual results reported in future periods may be based upon amounts which differ from those estimates. Estimates, judgments and assumptions are continually evaluated and are based on historical experience and other factors, including expectations of future events that are believed to be reasonable under the circumstances. Revisions to accounting estimates are recognized in the period in which the estimate is revised and in any future periods affected. The accounting policies deemed critical to our results and financial position, based upon materiality and significant judgments and estimates, include impairment of loans and advances, goodwill impairment, valuation of financial instruments, impairment of available-for-sale financial assets, deferred tax assets and provisions for liabilities.

Current wording

The preparation of consolidated financial statements in conformity with GAAP requires management to make judgments, estimates and assumptions that affect our Consolidated Financial Statements and accompanying notes. Due to the inherent uncertainty in making estimates, actual results reported in future periods may be based upon amounts which differ from those estimates. Estimates, judgments and assumptions are continually evaluated and are based on historical experience and other factors, including expectations of future events that are believed to be reasonable under the circumstances. Revisions to accounting estimates are recognized in the period in which the estimate is revised and in any future periods affected. The accounting policies deemed critical to our results and financial position, based upon materiality and significant judgments and estimates, include impairment of loans, goodwill impairment, estimates of residual values of leased vehicles, valuation of financial instruments, impairment of available-for-sale financial assets, deferred tax assets and provisions for liabilities.