We areAlly is a Delaware corporation and areis registered as a BHC under the BHC Act and an FHC under the GLB Act. Our primary business lines are Dealer Financial Services, which is composed of our Automotive Finance and Insurance operations, Mortgage Finance, and Corporate Finance. Corporate and Other primarily consists of centralized corporate treasury activities, the management of our legacy mortgage portfolio, the activity related to Ally Invest, Ally Lending, and Ally Credit Card, and reclassifications and eliminations between the reportable operating segments. Additionally, beginning in December 2021 with the acquisition of Fair Square, which we rebranded Ally Credit Card, financial information related to our credit card business is included within Corporate and Other. Ally Bank’s assets and operating results are included within our Automotive Finance, Mortgage Finance, and Corporate Finance segments, as well as Corporate and Other, based on its underlying business activities. As of December 31, 2021,2023, Ally Bank had total assets of $172.8$186.1 billion and total nonaffiliate deposits of $141.6$154.7 billion.

Our long-term strategic objectives are centered around (1) differentiating our company as a relentless ally for the financial well-being of our consumer and commercial and corporate customers, by (1)(2) leveraging our “Do it Right” purpose-driven culture as weto drive enhanced value for our customers, communities, employees, and stockholders, (2)(3) growing and diversifying our leading automotive, insurance, and digital-bank platforms through increased scale and expanded product solutions (3)to meet customer needs, (4) driving ongoing customer growth and relationship deepening (4)relationships, (5) operating under efficient, disciplined risk management and capital allocation approaches, (5)(6) out-executing our competition and creating differentiated advantages through continuous investment and evolution among our leading experiences, products and brand, and (6)(7) delivering long-term value evident through sustainable financial results and stockholder returns. We seek to extend our leading position in automotive finance in the United States by continuing to provide automotive dealers and their retail customers with premium service, a comprehensive product suite, consistent funding, and competitive pricing—reflecting our commitment to the automotive industry. Within our Automotive Finance and Insurance operations, we are also focused on strengthening our network of dealer relationships and pursuing digital distribution channels for our products and services, including through our operation of a direct-lending platform and our work with dealers innovating in digital transactions—all while maintaining an appropriate level of risk appetite. Within our other banking operations—operations, including Mortgage Finance and Corporate Finance—Finance, we seek to expand our consumer and commercial banking products and services while providing a high level of customer service. Ally Lending currently serves medical, retail, and home improvement service providers by enabling promotional and fixed rate installment-loan products through a digital application process at point-of-sale. We continue to focus on delivering significant and sustainable growth and retention in deposit customers and balances while optimizing our cost of funds. At Ally Invest, we seek to augment our securities-brokerage and investment-advisory services to more comprehensively assist our customers in managing their savings and growing their wealth. Additionally, we acquired Fair Square in December 2021, which provides us with aAlly Credit Card is our scalable, digital-first credit card platform and advances our evolution as a leading digital consumer bank. Ally Credit Card (formerly Fair Square)that features leading-edge technology, and a proprietary, analytics-based underwriting model. We believe the addition of credit card to our suite of productsAlly Credit Card enhances our ability to grow and deepen both new and existing customer relationships.

Unless the context otherwise requires, the following definitions apply. The term “loans” means the following consumer and commercial products associated with our direct and indirect financing activities: loans, retail installment sales contracts, lines of credit, and other financing products excluding operating leases. The term “operating leases” means consumer- and commercial-vehicle lease agreements where Ally is the lessor and the lessee is generally not obligated to acquire ownership of the vehicle at lease-end or compensate Ally for the vehicle’s residual value. The terms “lend,” “finance,” and “originate” mean our direct extension or origination of loans, our purchase or acquisition of loans, or our purchase of operating leases, as applicable. The term “consumer” means all consumer products associated with our loan and operating-lease activities and all commercial retail installment sales contracts. The term “commercial” means all commercial products associated with our loan activities, other than commercial retail installment sales contracts. The term “partnerships” means business arrangements rather than partnerships as defined by law.

For further details and information related to our business segments and the products and services they provide, refer to the MD&A in Part II, Item 7 of this report, and Note 26 to the Consolidated Financial Statements.

Many of our competitors have substantial positions nationally or in the markets in which they operate. Some also have significantly greater scale, financial and operational resources, investment capacity, and brand recognition. Our competitors may be subject to different and, in some cases, less stringent legislative, regulatory, and supervisory regimes than Ally. A range of competitors differ from us in their strategic and tactical priorities and, for example, may be willing to suffer meaningful financial losses in the pursuit of disruptive innovation and customer growth or to accept more aggressive business, compliance, and other risks in the pursuit of higher returns and market valuations. Competition affects every aspect of our business, including product and service offerings and features, rates, pricing and fees, credit limits, and customer service. Successfully competing in our markets also depends on our ability to innovate, to invest in technology and infrastructure, to execute transactions reliably and efficiently, to maintain and enhance our reputation, and to attract, retain, and motivate talented employees, all while effectively managing risks and expenses. We expect that competition will only intensify in the future.

We are also subject to direct supervision and periodic examinations by various governmental agencies and industry SROs that are charged with overseeing the kinds of business activities in which we engage, including the FRB, the UDFI, the FDIC, the CFPB, the SEC, FINRA, and a number of state regulatory and licensing authorities such as the NYDFS. These agencies and organizations generally have broad authority and discretion in restricting and otherwise affecting our businesses and operations and may take formal or informal supervisory, enforcement, and other actions against us when, in the applicable agency’s or organization’s judgment, our businesses or operations fail to comply with applicable law, comport with safe and sound practices, or meet its supervisory expectations. We strive to maintain constructive relationships with supervisory authorities.

This system of regulation, supervision, and examination is intended primarily for the protection and benefit of our depositors and other customers, the FDIC’s DIF, the banking and financial systems as a whole, and the broader economy—and not for the protection or benefit of our stockholders (except in the case of securities laws) or non-deposit creditors. The scope, intensity, and focus of this system can vary from time to time for reasons that range from the state of the economic and political environments to the performance of our businesses and operations, but for the foreseeable future, we expect to remain subject to extensive regulation, supervision, and examinations.

This section summarizes some relevant provisions of the principal statutes, regulations, and other laws that apply to us. The descriptions, however, are not complete and are qualified in their entirety by the full text and judicial or administrative interpretations of those laws and other laws that affect us.

The risk-based capital ratios are based on a banking organization’s RWAs, which are generally determined under the standardized approach applicable to Ally and Ally Bank by (1) assigning on-balance-sheet exposures to broad risk-weight categories according to the counterparty or, if relevant, the guarantor or collateral (with higher risk weights assigned to categories of exposures perceived as representing greater risk), and (2) multiplying off-balance-sheet exposures by specified credit conversion factors to calculate credit equivalent amounts and assigning those credit equivalent amounts to the relevant risk-weight categories. The leverage ratio, in contrast, is based on an institution’s average unweighted on-balance-sheet exposures.

Under U.S. Basel III, Ally and Ally Bank must maintain a minimum Common Equity Tier 1 risk-based capital ratio of 4.5%, a minimum Tier 1 risk-based capital ratio of 6%, and a minimum total risk-based capital ratio of 8%. In addition to theseOn top of the minimum risk-based capital ratios, Ally and Ally Bank are subject to a capital conservation buffer requirement, which for Ally was 3.5% and for Ally Bank was 2.5%must be satisfied entirely with capital that qualifies as of December 31, 2021.Common Equity Tier 1 capital. Failure to maintain more than the full amount of the capital conservation buffer requirement would result in automatic restrictions on the ability of Ally and Ally Bank to make capital distributions, including dividend payments and stock repurchases and redemptions, and to pay discretionary bonuses to executive officers. U.S. Basel III also subjects Ally and Ally Bank to a minimum Tier 1 leverage ratio of 4%.

Ally and Ally Bank are currently subject to the U.S. Basel III standardized approach for counterparty credit risk but not to the U.S. Basel III advanced approaches for credit risk or operational risk. Ally is also not currently subject to the U.S. market-risk capital rule, which applies only to banking organizations with significant trading assets and liabilities. Since Ally and Ally Bank are currently not subject to the advanced approaches risk-based capital rules, we elected to apply a one-time option to exclude most components of accumulated other comprehensive income and loss from regulatory capital. As of December 31, 2023, and December 31, 2022, Ally had $3.8 billion and

The risk-based capital ratios and the Tier 1 leverage ratio play a central role in PCA, which is an enforcement framework used by the U.S. banking agencies to constrain the activities of depository institutions based on their levels of regulatory capital. Five categories have been established using thresholds for the Common Equity Tier 1 risk-based capital ratio, the Tier 1 risk-based capital ratio, the total risk-based capital ratio, and the Tier 1 leverage ratio: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. FDICIA generally prohibits a depository institution from making any capital distribution, including any payment of a cash dividend or a management fee to its BHC, if the depository institution would become undercapitalized after the distribution. An undercapitalized institution is also subject to growth limitations and must submit and fulfill a capital restoration plan. WhileAlthough BHCs are not subject to the PCA framework, the FRB is empowered to compel a BHC to take measures—such as the execution of financial or performance

At December 31, 2021,2023, Ally and Ally Bank were in compliance with their regulatory capital requirements. For an additional discussion of capital adequacy requirements, refer to Note 20 to the Consolidated Financial Statements.

On January 1, 2020, we adopted CECL, which is further described inCECL. Refer to Note 1 to the Consolidated Financial Statements. In December 2018,Statements for additional information about our allowance for loan losses accounting policy. Under a rule finalized by the FRB and other U.S. banking agencies approved a final rule to address the impact of CECL on regulatory capital by allowing BHCs and banks, including Ally, the option to phase in the day-one impact of CECL over a three-year period. In March 2020, the FRB and other U.S. banking agencies issued an interim final rule that became effective for the first quarter of 2020 and that provided BHCs and banks with an alternative option to temporarily delay an estimate of the impact of CECL, relative to the incurred loss methodology for estimating the allowance for loan losses, on regulatory capital. The interim final rule was clarified and adjusted in a final rule that became effective in September 2020. We elected this alternative option instead of the one described in the December 2018 rule. As a result, under the final rule, we delayed recognizing the estimated impact of CECL on regulatory capital until after a two-year deferral period, which for us extended through December 31, 2021. Beginning on January 1, 2022, we arewere required to phase in 25% of the previously deferred estimated capital impact of CECL, with an additional 25% to be phased in at the beginning of each subsequent year until fully phased in by the first quarter of 2025. The estimated impact of CECL on regulatory capital that we deferred and began phasing in on January 1, 2022, is generally calculated as the entire day-one impact at adoption plus 25% of the subsequent change in allowance during the two-year deferral period. As of December 31, 2021,2023, the total deferred impact on Common Equity Tier 1 capital related to our adoption of CECL was $1.2 billion.$591 million.

In December 2017,April 2023, in a statement accompanying the Basel Committee approvedreview of the FRB’s supervision and regulation of SVB, FRB Vice Chair for Supervision Barr highlighted a plan to revisit the Tailoring Rules and develop stronger capital, liquidity, stress-testing, and other standards for Category IV firms like Ally. In July 2023, the U.S. banking agencies issued a proposed rule to customize and implement revisions to the global Basel III capital framework that were approved by the Basel Committee in December 2017 (commonly known as the Basel III endgame or as Basel IV), many. For regulatory capital, the proposed rule would eliminate the effect of which—the Tailoring Rules by requiring the recognition of most elements of accumulated other comprehensive income and loss and the application of deductions, limitations, and criteria for specified capital investments, minority interests, and TLAC holdings. For each of the risk-based capital ratios, a large banking organization, like Ally, would calculate and be bound by the lower of two alternatives: one version of the ratio based on an expanded risk-based approach prescribed in the proposed rule and one version of the ratio based on the standardized approach as modified by the proposed rule. All capital buffer requirements, including the stress capital buffer requirement, would apply regardless of whether the expanded risk-based approach or the standardized approach produces the lower ratio. Under the expanded risk-based approach, total RWAs would equal the sum of the RWAs for credit risk, equity risk, operational risk, market risk, and CVA risk as set forth in the proposed rule minus any amount of the banking organization’s adjusted allowance for credit losses that is not included in Tier 2 capital and any amount of allocated transfer risk reserves. Under the standardized approach, total RWAs would be calculated using the existing rules with a revised methodology for determining RWAs for market risk, and a required application of the standardized approach for counterparty credit risk for derivative exposures. Category IV firms would be further required under the proposed rule to project their risk-based capital ratios under baseline conditions in their capital plans and related reports using the RWA-calculation approach that results in their binding risk-based capital ratios as of the start of the projection horizon. The proposed rule also would roll back additional elements of the Tailoring Rules by applying to Category IV firms the supplementary leverage ratio, the countercyclical capital buffer, and enhanced public disclosure and reporting requirements. Under the proposed rule, a three-year transition period from July 1, 2025, to June 30, 2028, would apply to the recognition of accumulated other comprehensive income and loss in regulatory capital and the use of the expanded risk-based approach. The phase-in of accumulated other comprehensive income and loss is expected to significantly affect our levels of regulatory capital. While we believe that this would be manageable, we also anticipate that our levels of regulatory capital would need to be gradually increased in advance of and during the proposed transition period. As for the proposed changes to RWAs, while we continue to evaluate the effects of individual provisions and the interplay among them as well as potential management actions in response, the impact is not currently expected to be significant in the aggregate if the proposed rule were adopted in its existing form. Since the United States—could heighten regulatory capital standards. In March 2020,proposed rule was issued, we have been engaged with research and advocacy groups to inform the rulemaking process and better allowunderstand the impacts of the proposed rule on banking organizations of various sizes and complexities—as well as the competitive environment more broadly—and likewise encourage the U.S. banking agencies to focusclosely study these impacts and their resourceswider implications.

Whether and when final rules related to these proposals may be adopted and take effect, as well as what changes to the revisions willproposed rules may be harmonizedreflected in any final rules after the comment periods, remain unclear. Also, beyond these proposed rules, more stringent and finalized inless tailored liquidity, stress-testing, and other standards for Category IV firms, like Ally, may be forthcoming, including those that may reinstate the United States is not clear or predictable.LCR, require more rigorous liquidity stress testing, and return Ally to supervisory stress testing on an annual cycle.

Ally Bank’s deposits are insured by the FDIC in the standard insurance amounts per depositor for each account ownership category as prescribed by the FDI Act. Insured depository institutions with two million or more deposit accounts, including Ally Bank, are required by the FDIC to establish and maintain systems and processes designed to facilitate prompt payment of FDIC-insured deposits in the event of a failure. Deposit insurance is funded through assessments on Ally Bank and other insured depository institutions, and under the Dodd-Frank Act, theinstitutions. The FDIC assesses premiums from each institution based on its average consolidated total assets minus its average tangible equity, while utilizing a scorecard method to determine each institution’s risk to the DIF. The FDIC may take action to increase insurance premiums if the DIF is not funded to its regulatory-mandated Designated Reserve Ratio (DRR).DRR. Currently, the FDIC is required to maintain a DRR of 1.35% under the FDI Act. In 2020, due to extraordinary growth in insured deposits after the start of the COVID-19 pandemic, the DIF reserve ratio fell below the 1.35% statutory minimum. The FDI Act requires thatOctober 2022, the FDIC adoptfinalized a restoration plan whenrule that increased the DIF reserve ratio falls below 1.35% or is expected to do so within six months. The plan must restore the DIF reserve ratio to at least 1.35% within eight years, absent extraordinary circumstances. On September 15, 2020, the FDIC announced its restoration plan, projecting the DIF reserve ratio to return to a level above 1.35% without any increase to theinitial base deposit insurance assessment rate schedule while committingschedules for all insured depository institutions by two basis points, beginning with the first quarterly assessment period of 2023. The increased assessment rate is intended to closely monitor economic conditions,improve the healthlikelihood that the DRR will reach the required minimum of 1.35% by the statutory deadline of September 30, 2028. On November 16, 2023, the FDIC finalized a rule that imposes a special assessment to recover the costs to the DIF resulting from the FDIC’s use, in March 2023, of the banking sector,systemic risk exception to the least-cost resolution test under the FDI Act in connection with the receiverships of SVB and deposit-growth trends.Signature. The FDIC estimated in approving the rule that those assessed losses total approximately $16.3 billion. The rule provides that this loss estimate will be periodically adjusted, which will affect the amount of the special assessment. Under the rule, the assessment base is the estimated uninsured deposits that an IDI reported in its Consolidated Reports of Condition and Income (“Call Report”) at December 31, 2022, excluding the first $5 billion in estimated uninsured deposits. The special assessments will be collected at an annual rate of approximately 13.4 basis points per year (3.36 basis points per quarter) over eight quarters in 2024 and 2025, with the first assessment period beginning January 1, 2024. Because the estimated loss pursuant to the systemic risk determination will be periodically adjusted, the FDIC retains the ability to cease collection early, extend the special assessment collection period, and impose a final shortfall special assessment on a one-time basis. Ally expects the special assessments to be tax deductible. The total of the assessments for Ally, based on Ally Bank’s uninsured deposits as of December 31, 2022, is estimated at $38 million, and such amount was recorded as an expense in the quarter of adoption (the quarter ending December 31, 2023).

If an insured depository institution, like Ally Bank, were to become insolvent or if other specified events were to occur relating to its financial condition or the propriety of its actions, the FDIC may be appointed as conservator or receiver for the institution. In that capacity, the FDIC would have the power to (1) transfer assets and liabilities of the institution to another person or entity without the approval of the institution’s creditors; (2) require that its claims process be followed and to enforce statutory or other limits on damages claimed by the institution’s creditors; (3) enforce the institution’s contracts or leases according to their terms; (4) repudiate or disaffirm the institution’s contracts or leases; (5) seek to reclaim, recover, or recharacterize transfers of the institution’s assets or to exercise control over assets in which the institution may claim an interest; (6) enforce statutory or other injunctions; and (7) exercise a wide range of other rights, powers, and authorities, including those that could impair the rights and interests of all or some of the institution’s creditors. In addition, the administrative expenses of the conservator or receiver could be afforded priority over all or some of the claims of the institution’s creditors, and under the FDI Act, the claims of depositors (including the FDIC as subrogee of depositors) would enjoy priority over the claims of the institution’s unsecured creditors.

Ally Invest Forex LLC (Ally Invest Forex) is registered with the CFTC as an introducing broker and is a member of the NFA, which is the primary SRO for the U.S. futures industry. The firm is subject to similarly expansive requirements under the Commodity Exchange Act, CFTC and NFA rules governing introducing brokers and their personnel, and CFTC retail forex rules.

Regulators conduct periodic examinations of Ally Invest Securities Ally Invest Forex, and Ally Invest Advisors and regularly review reports that the firms are required to submit on an ongoing basis. Violations of relevant regulatory requirements could result in adverse consequences for the firms and their personnel, including censure, penalties and fines, the issuance of cease-and-desist orders, and restriction, suspension or expulsion from the securities or commodity-futures industries.

Our people-first human capital approach is guided by a philosophy that emphasizes care for our employees through professional and personal support, and offerings that drive them to better care for our customers and positively impact our communities. These components combine to propel better operational and financial results. We emphasize a working environment and company culture that embrace diverse talents, backgrounds, and perspectives and where colleagues feel valued as both individuals and members of the team. We had approximately 10,500measure human capital success through regular enterprise-wide engagement surveys and 9,500 employees as of December 31, 2021, and 2020, respectively, which consisted primarily of full-time employeesexternal workplace recognition. In 2023, we placed in the United States. OurTop 10% of global workplaces for employee growthengagement for the 4th consecutive year, ended December 31, 2021, was primarily attributableas measured by a third-party provider. We also were named to expansion in the overall business and our information technology organization.

For 20212023 and 2020,2022, our employee engagement scores have beenwere within the top 10% of all global companies that participated in the survey and at least teneight points higher than the financial services industry benchmark. ActiveWe believe that high levels of employee engagement helpsreflect a productive and engaged workforce that takes care of our customers and communities, and contributes to strengthen our stable employee retention rate, which was approximately 86%84% and 90%85% for the years ended December 31, 2021,2023, and December 31, 2020,2022, respectively.

Our performance management process is designed to promote a culture of meaningful work, ongoing feedback and coaching, and employee-owned careers. Annually, employees partner with managers to create and align performance measurements considering company-wide objectives. We encourage quarterly performance review discussions between employees and managers and require year endyear-end performance evaluations summarizing the ongoing performance, development, and career interest conversations that occurred throughout the year. Additionally, we provide a multi-rater feedback tool to solicit additional perspectives on employee contributions and a more holistic picture of employee performance and leadership.

We empower our employees and encourage internal mobility, among our employees, contributing to 26%16% and 22% of our existing eligible workforce that has been with Ally for at least one year receiving promotions or taking on new roles during the yearyears ended December 31, 2021.2023, and December 31, 2022, respectively. Our internal hiring rate was 40% and 28% in 2023 and 2022, respectively, further advancing employee career development and mobility. Our deliberate focus on mobility supports our ongoing retention efforts for top talent across the organization. The retention rate for employees that we determine to be high performers through talent planning wasyear-end evaluation ratings were 96% and 94% for the yearyears ended December 31, 2021.2023, and December 31, 2022. On a routine basis, we perform talent and succession planning to develop and retain our top talent. We also provide support for continuing education through a tuition reimbursement program, as well as student loan repayment assistance and contributions to employee’s 529 education savings plans.talent, including critical roles throughout the organization.

We empower our employees to act as founders with an owner’s mindset across all levels of the organization and all parts of the business which is encouraged through our shared equity program. In August 2021, we announced that all eligible employees may be awarded Ally stock annually through our discretionary #OwnIt Annual Grant Program dependent upon our financial performance and Board approval. In January 2022,2024, for the thirdfifth consecutive year, we awarded all active, regular Ally employees with 100 restricted stock units, up to a maximum grant date value of $5,000, and subject to a 3-year cliff vesting schedule, in recognition of our notable accomplishments and to support a founder’s mentality. This benefit provides shared equity to our employees and to further encourage the mindset of an owner, we also maintain an employee stock purchase plan that provides employees with the opportunity to purchase Ally stock at a discount.

Supporting and valuing all our employees is central to our culture. We offer flexible health insurance options including dental and vision for our employees, as well as a pre-tax health savings account with employer contributions. We expanded eligibility to employees with an annual base salary of less than $70,000 to receive additional employer contributions offsetting the cost of health insurance. Additionally, we provide access to virtual care options for certain healthcare needs and reimburse for certain eligible transportation and lodging expenses when in-network covered care is not available within 100 miles of a member’s home address. We provide life and disability benefits and manage a wellness program encouraging healthy living with financial rewards.

These four pillars are championed by our employees, since its launchwhich empowers us to advance DE&I efforts in May 2020.meaningful ways beyond Ally. Additionally, these efforts are further supported by our Chief Diversity Officer, and 16 full-time employees designated to advance DE&I within Ally. While our Financial and Social Inclusion Framework is focused on addressing the wealth gap, specifically in Black, Hispanic, and Latino communities, the four pillars are reflective of our DE&I efforts more broadly as further discussed below.

One of our largest and most powerful initiatives is Moguls in the Making, an annual competition that fosters opportunities for students from historically black colleges and universities. The annual program was launched in 2019 in collaboration with the Thurgood Marshall College Fund and the Sean Anderson Foundation. In 2023, we instituted a remotesponsored the fifth Moguls in the Making competition, with 60 students, who brought innovative and impactful solutions to economic mobility challenges. Since the program’s inception, we have offered internships to 45 students, which have often led to permanent job placements within Ally or the broader financial-services industry.

Our work protocol beginning in mid-March 2020.the communities is woven throughout our culture. We originated, as defined in our CRA strategic plan approved by the FRB, approximately $1.3 billion and $1.1 billion in loans and investments that primarily benefit low- and moderate-income individuals and communities as part of our CRA program during the years ended December 31, 2023, and 2022, respectively. In 2021,2023, we launched a voluntary office reentry pilot programfurther executed on our ongoing commitment of expanding access to test processescapital for Black, Hispanic, and procedures designedLatino communities by deploying $71 million in loans and investments specifically to minority- and women-led organizations. These loans and investments are instrumental in providing the financial foundation required to help develop and create a safe in-office environment.more opportunities for the next generation of successful Black, Hispanic, and Latino entrepreneurs, investors, affordable housing developers, and community leaders. We required daily health attestations and reconfiguredalso provided over $1.6 million in grants to 65 non-profit organizations, including $391,000 to 18 organizations that are either minority-led or supported initiatives targeting primarily Black, Hispanic, or Latino individuals. Additionally, Ally Bank received consecutive “Outstanding” CRA ratings in our working environment to allow for social distancing. last three reviews.

Since the program’s inception, we have created operational processes to include diverse suppliers in our decision-making,bidding and our phased reopeningcontracting opportunities. This has resulted in an increase in both first-tier and second-tier diverse supplier expenditures. In 2023, we directed approximately $176 million of first-tier diversity expenditures to certified Minority and Women-Owned Business Enterprises and Small Businesses, surpassing first-tier diverse expenditures in 2022 by $41 million. Approximately 50% of our facilities islargest suppliers, in terms of dollars spent, participated in second-tier expenditure reporting during the year ended December 31, 2023. As a result, these suppliers have allowed us to capture our second-tier diverse supplier expenditures, which provides a more holistic view of our economic impact within our communities. In all instances, regardless of diversity status, we seek to award procurement contracts to the suppliers who demonstrate they are the optimum partner for such business opportunities based on viral trends, medical advisor guidance, governmental regulations,a combination of decision factors including but not limited to total cost of ownership, compliance with applicable third-party risk, legal and local ordinances. While we began 2021regulatory requirements, ability to meet or exceed our operational and functional requirements and robustness of service quality commitments.

Our dedicated Supplier Diversity team assists our business lines and procurement teams in identifying a mix of certified diverse suppliers with nearly 99%the proper credentials and capabilities to adhere to our third-party risk, operational, commercial, legal and performance standards. As part of our initial supplier due diligence process, our Supplier Diversity and procurement teams partner to research qualified diverse suppliers capable of meeting our standards in Request for Proposal events. This allows us to integrate consideration of diverse business enterprises in third-party purchasing opportunities. Our comprehensive sourcing network pairs our needs with the business strengths of a diverse mix of large and small suppliers, who then may participate in our bidding and selection processes.

In February 2023, we hosted more than 50 diverse-owned businesses at our Ally Charlotte Center office for the 3rd annual Supplier Diversity Symposium. The day featured interactive sessions and a fireside chat with our CEO to increase access, create connections, and explore opportunities to expand relationships with diverse suppliers. In addition to our annual Supplier Symposium, we also hosted quarterly diverse supplier spotlight events as part of our ongoing commitment to supplier diversity. These events engaged diverse suppliers through interactive mock sales pitches and provided immediate coaching and feedback. As a result of this access, many of the participating diverse suppliers went on to connect with our supply chain department and business line executives to explore potential opportunities to work with us. Additionally, in July 2023 we celebrated Ally’s Supplier Diversity Month. Established in July 2022, the month-long celebration features events for diverse businesses and highlights the accomplishments of employees, working remotely, we ended the year preparedcompanies and industry professionals who have contributed to reopenadvancing inclusion for all suppliers.

In 2023, we made the Forbes’ lists as a Nation’s Bestbest place to work for diversity, new grads, women and Brightest in Wellness award in 2021,veterans. We also were named to Diversity Inc.’s Top 50 companies for diversity list for a third consecutive year, and as a best place to work for disability inclusion by the following organizations: American Association of People with Disabilities, and Disability:IN. Finally, Newsweek named us one of America’s Greatest Workplaces 2023 for Diversity.

In 2023, Ally’s Supplier Diversity Program was recognized as a “Top Corporation” by the Greater Women’s Business Council for the fifthsecond consecutive year.year and received Disability:IN’s Top Corporation for Disability-Owned Business Award. Our Senior Director for Supplier Diversity & Sustainability was also honored as the 2023 Advocate of the Year by the Greater Women’s Business Council.

While the scope, intensity, and focus of governmental oversight can vary from time to time, we expect a highly demanding environment for the foreseeable future. In recent years, regulatory and other governmental agencies have taken a host of actions that create more challenging and volatile financial and operating conditions for financial-services companies, including through formal rulemakings that change the law or interpretations of the law, supervisory expectations and public statements that are designed to informally compel changes in industry practices, and more aggressive approaches to enforcement that are accompanied by increasingly severe penalties. These actions are comprehensive in their coverage, such as rulemakings on climate-related disclosures, cybersecurity risk governance (including incident disclosure), CRA reform, credit-card fees (such as the CFPB’s proposed rule to cap late fees), and personal-financial-data rights as well as guidance and statements on mergers and acquisitions, regulatory capital, resolution planning, automotive financing and insurance, fees for financial services, and UDAAP. Further, following the failures of three large banks in 2023, banking regulators have proposed changes, or indicated the potential for changes, regarding the regulation and supervision of banking organizations, in particular those, such as Ally, with $100 billion or more in assets. The introduction of new or more stringent regulatory requirements, as well as heightened supervisory expectations, could require Ally to maintain additional capital or liquidity or incur significant expenses. Governmental oversight of this kind may increase our operating costs or reduce our revenues, limit the types of financial services and products we may offer, alter the investments we may make, affect the manner in which we conduct our business and operations, increase our litigation and regulatory costs, and enhance the ability of others to offer more competitive financial services and products. We continue devotingto devote substantial time and resources to risk management, compliance, regulatory-change management, and cybersecurity and other technology initiatives, each of whichwhich—whether successful or not—also may adversely affect our ability to operate profitably or to pursue advantageous business opportunities.

Ally has elected to be treated as an FHC, which permits us to engage in a number of financial and related activities—including securities, advisory, insurance, and merchant-banking activities—beyond the business of banking. Ally and Ally Bank are subject to ongoing requirements for Ally to qualify as an FHC. If Allya BHC or Ally Bankany of its insured depository institutions is found not to be well capitalized or well managed, as defined under applicable law, wethe BHC can be restricted from engaging in the broader range of financial and related activities permitted for FHCs, including the ability to acquire companies engaged in those activities, and can be required to discontinue these activities or even divest Ally Bank.any of its insured depository institutions. In addition, if we failan insured-depository-institution subsidiary of a BHC fails to achieve a satisfactory or better rating under the CRA, ourthe ability of the BHC to expand theseits financial and related activities or make acquisitions could be restricted.

In connection with their continuous supervision and examinations of us, the FRB, the UDFI, the CFPB, the SEC, FINRA, the NYDFS, or other regulatory agencies may explicitly or implicitly require changes in our business or operations. Such a requirement may be judicially enforceable or impractical for us to contest, and if we are unable to comply with the requirement in a timely and effective manner, we could become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives. The financial-services industry continues to face scrutiny from supervisory authorities in the examination process, including through an increasing use of horizontal reviews from a broader industry perspective as well as strict enforcement of laws at federal, state, and local levels, levels—particularly in connection with business and other practices that may harm or appear to harm consumers and compliance with anti-money-laundering, sanctions, and related laws. Because of the regulatory and supervisory framework, financial institutions often are less inclined to litigate with governmental authorities. In general, the amounts paid by financial institutions in settling proceedings or investigations and the severity of other terms of regulatory settlements are likely to remain elevated. In some cases, governmental authorities have required criminal pleas or other extraordinary terms, including admissions of wrongdoing and the imposition of monitors, as part of settlements. Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business or make acquisitions, our flexibility in conducting operations, and our ability to pay dividends or utilize capital. Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence.confidence, and a prior enforcement action may also increase the risk that regulators and governmental authorities pursue formal enforcement actions in connection

Our regulatory and supervisory environments—whether at federal, state, or local levels—are not static. No assurance can be given that applicable statutes, regulations, and other laws will not be amended or construed differently, that new laws will not be adopted, or that any of these laws will not be enforced more aggressively. For example, while Congress nullifiedaggressively, or that applicable laws, or the CFPB’s guidance about compliance with fair-lending laws in the context of indirect automotive financing, the NYDFS later adopted arguably more far-reaching guidance on the subject.interpretation or enforcement thereof, may overlap, diverge or conflict across jurisdictions. Changes in the regulatory and supervisory environments could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, and restricting our ability to make acquisitions or pursue other profitable opportunities, and negatively impacting our financial condition and results of operations.opportunities. Further, our noncompliance with applicable laws—whether as a result of changes in interpretation or enforcement, system or human errors, or otherwise—otherwise and, in some cases, regardless of whether noncompliance was inadvertent—could result in the suspension or revocation of licenses or registrations that we need to operate and in the initiation of enforcement and other supervisory actions or private litigation.

A primary componentMuch of our business strategyand operations is the continued growth ofconducted by Ally Bank, which is a direct bank with no branch network.network, and a primary component of our business strategy is its continued growth. This growth includes expanding our consumer and commercial lending and increasing our deposit customers and balances while optimizing our cost of funds. If regulatory agencies raise concerns about any aspect of our business strategy for Ally Bank or the way in which we implement it, we may be obliged to limit or even reverse the growth of Ally Bank or otherwise alter our strategy, which could have an adverse effect on our business, financial condition, results of operations, or prospects. In addition, if we are compelled to retain or shift any of our business activities in or to nonbank affiliates, our funding costs for those activities—such as unsecured funding in the capital markets—could be more expensive than our cost of funds at Ally Bank.

The FRB may require us to revise and resubmit our capital plan in specified circumstances, including if the FRB determines that our capital plan is incomplete, our capital plan or internal capital adequacy process contains material weaknesses, or there has been, or will likely be, a material change in our risk profile (including a material change in our business strategy or any risk exposure), financial condition, or corporate structure. While a resubmission is pending, without prior approval of the FRB, we would generally be prohibited from paying dividends, repurchasing our common stock, or making other capital distributions. In addition,

Depending on the circumstances, to satisfy the FRB in its review of our capital plan, we may be required to further cease or limit these capital distributions or to issue capital instruments that could be dilutive to stockholders. The FRB also may prevent us from maintaining or expanding lending or other business activities. Any of these developments, including the mere fact of being required by the FRB to revise or resubmit our capital plan and especially if unique to us or a group of firms like us, may damage our reputation and result in a loss of customer or investor confidence.

Further, we may be required to raise capital if we are at risk of failing to satisfy our minimum regulatory capital ratios or related supervisory requirements, whether due to inadequate operating results that erode capital, future growth that outpaces the accumulation of capital through earnings, changes in regulatory capital standards, changes in accounting standards that affect capital (such as CECL), or otherwise. In addition, we may elect to raise capital for strategic reasons even when we are not required to do so. Our ability to raise capital on favorable terms or at all will depend on general economic and market conditions, which are outside of our control, and on our operating and financial performance. Accordingly, we cannot be assured of being able to raise capital when needed or on favorable terms. An inability to raise capital when needed and on favorable terms could damage the performance and value of our business, prompt supervisory actions and private litigation, harm our reputation, and cause a loss of customer or investor confidence, and if the condition were to persist for any appreciable period of time, our viability as a going concern could be threatened. Even if we are able to raise capital but do so by issuing common stock or convertible securities, the ownership interest of our existing stockholders could be diluted, and the market price of our common stock could decline.

The enhanced prudential standards also require Ally, as a Category IV firm, to conduct quarterly liquidity stress tests, to maintain a buffer of unencumbered highly liquid assets to meet projected net stressed cash outflows over a 30-day planning horizon, to adopt a contingency funding plan that would address liquidity needs during various stress events, and to implement specified liquidity risk management and corporate governance measures. These enhanced liquidity standards could constrain our ability to originate or invest in longer-term or less liquid assets or to take advantage of other profitable opportunities and, therefore, may adversely affect our business, results of operations, and prospects.

Ally Bank is a key part of our funding strategy, and we place great reliance on deposits at Ally Bank as a source of funding. Competition for deposits and deposit customers, however, is fierceintense. Further, recent increases in short-term interest rates have resulted in, and has only intensifiedare expected to continue to result in, more intense competition in deposit pricing and with the implementation of enhanced capital and liquidity requirements since the economic crisis that began in 2007–2008.respect to non-deposit financial products. Ally Bank does not have a branch network but, instead, obtains its deposits through online and other digital channels, from other business lines including customers of Ally Invest, and through deposit brokers. Brokered deposits may be more price sensitive than other types of deposits and may become less available if alternative investments offer higher returns. BrokeredOur brokered deposits totaled $4.7$11.0 billion at December 31, 2021,2023, which represented 3.3%7.1% of Ally Bank’s total deposits.deposit liabilities. In addition, our ability to maintain, grow, or growfavorably price deposits may be constrained by our lack of in-personfocus on online and mobile banking, services, gaps in our product and service offerings, changes in consumer trends, our smaller scale relative to other financial institutions, competition from fintech companies and emerging financial-services providers, any failures or deterioration in our customer service, or any loss of confidence in our brand or our business. Our level and cost of deposits also could be adversely affected by regulatory or supervisory restrictions, including any applicable prior approval requirements or limits on our offered rates or brokered deposit growth, and by changes in monetary or fiscal policies that influence deposit or other interest rates. Perceptions of our existing and future financial strength or the financial strength of the financial-services industry generally, rates or returns offered by other financial institutions or third parties, and other competitive factors beyond our control, including returns on alternative investments, will also impact the size and cost of our deposit base. For example, Ally Bank could be subject to sudden withdrawals of deposits, including as a result of negative media coverage, which may be spread through social media, regarding us or the financial services industry generally. Online and mobile banking have made it easier for customers to withdraw their deposits or transfer funds to other accounts with short notice. This may make retaining deposits during periods of stress more difficult. In addition, depositors of certain types of deposits, such as uninsured or uncollateralized deposits, may be more likely to withdraw their deposits or do so more quickly. Any such withdrawals could result in higher funding costs for us as we lose a lower cost source of funding, and significant unanticipated withdrawals could materially and adversely affect our liquidity, financial condition, and results of operations. Approximately 93% of total deposits at Ally Bank, excluding affiliate and intercompany deposits, were FDIC-insured as of December 31, 2023.

If Ally or Ally Bank were to fail to satisfy its regulatory capital requirements, significant regulatory sanctions could result, such as a bar on capital distributions, limitations on acquisitions and new activities, restrictions on our acceptance of brokered deposits, a loss of our status as an FHC, or informal or formal enforcement and other supervisory actions. Such a failure also could irrevocably damage our reputation, prompt a loss of customer and investor confidence, generateprompt private litigation, and even lead to our resolution or receivership. Any of these consequences could have an adverse effect on our business, results of operations, financial condition, or prospects.

In December 2017, the Basel Committee approved revisions to the global Basel III capital framework (commonly known as the Basel III endgame or as Basel IV), manyand on July 27, 2023, the FRB and FDIC issued a proposed rule to implement the Basel Committee’s 2017 standards and make other changes to regulatory capital rules for banking organizations with total consolidated assets of which—$100 billion or more. Further, on August 29, 2023, the FRB and the FDIC issued a proposed rule that would require Category II through Category IV BHCs and IDIs with $100 billion or more in consolidated assets (as well as their IDI affiliates) to maintain minimum amounts of eligible long-term debt (generally, debt that is unsecured, has a maturity greater than one year from issuance and satisfies additional criteria). The long-term debt proposal, if adopted, in the United States—could heighten regulatory capital standards. How these revisions will be finalized in the United Stateswould require Ally to maintain more long-term debt than it does currently, which would adversely affect interest expense, net interest income, and harmonized with other regulatory proposals and rules (such as the stress capital buffer) is not clear or predictable, and no assurance can be provided that they would not further impact our business, results of operations, financial condition, or prospects in an adverse way.net interest margin.

A fractious or volatile political environment in the United States, including any related social unrest, could negatively impact business and market conditions, economic growth, financial stability, and business, consumer, investor, and regulatory sentiments, any one or more of which in turn could cause our business and financial results to suffer. In addition, disruptions in the foreign relations of the United States could adversely affect the automotive and other industries on which our business depends and our tax positions and other dealings in foreign countries. We also could be negatively impacted by political scrutiny of the financial-services industry in general or our business or operations in particular, whether or not warranted, and by an environment where criticizing financial-services providers or their activities is politically advantageous.

Additionally, changes to tax policies could have a materialsignificant impact toon our results of operations and financial condition. For example, in August 2022, the U.S. Congress has recently engagedInflation Reduction Act was signed into law in significant debatethe United States and, in part, imposes a 15% corporate alternative minimum tax on potential tax reforms, including proposals to increase the federal statutory rate, to imposecertain large corporations, such as Ally, and a surcharge on stock repurchases, and to modify foreign tax credits. In November 2021, the House of Representatives passed the Build Back Better Act, which could adversely affect us if enacted into law. Any increase in the federal statutory rate could result in a significant day-one tax expense related to the revaluation of our deferred tax assets and liabilities and a significant increase in tax expense for future years.repurchases. Tax and other fiscal policies, moreover, impact not only general economic and market conditions but also give rise to incentives or disincentives that affect how we and our customers prioritize objectives, deploy resources, and run households or operate businesses. Both the timing and the nature of any changes in monetary or fiscal policies, as well as their consequences for the economy and the markets in which we operate, are beyond our control and difficult to predict but could adversely affect us.

Cybersecurity and data privacydata-privacy risks have received heightened legislative and regulatory attention. For example, in 2021 the U.S. banking agencies adopted a final rule requiring us to notify the FRB within 36 hours of any significant computer security incident and have proposed enhanced cyber risk management standards that would applyapplicable to us and our service providers and that would address cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. In addition, rulemakings by the U.S. banking agencies recently adopted a rule requiring usSEC and the CFPB have commenced to notify the FRB within 36 hours of any significant computer security incident.further regulate cybersecurity risk governance (including incident disclosure) and personal-financial-data rights, respectively. Several states and their governmental agencies, such as the NYDFS, also have adopted or proposed

Legislation and regulations on cybersecurity and data privacy may compel us to enhance or modify our systems and infrastructure, invest in new systems and infrastructure, change our service providers, augment our scenario and vulnerability testing, or alter our business practices or our policies on security, data governance, and privacy. If any of these outcomes were to occur, the complexity and costs of our operational costsoperations could increase significantly. In addition, if governmental authorities were to conclude that we or our service providers had not adequately implemented laws on cybersecurity and data privacy or had not otherwise met related supervisory expectations, we could be subject to enforcement and other supervisory actions, related litigation by private plaintiffs, reputational damage, or a loss of customer or investor confidence.

Governments and policymakers at the federal, state and international levels are intenselyincreasingly focused on the effects of climate change and related environmental, issues. For example, since December 2020,social and governance issues, and the FRB has become a member of the Network of Central Banks and Supervisorspotential for Greening the Financial System, created a Supervision Climate Committee to identify and assess financial risks from climate change and to develop a program to ensure the resilience of supervised firms to those risks, and created a Financial Stability Climate Committee to identify, assess, and address climate-related risks to impact the safety and soundness of large financial stability. In addition,institutions. For example, in 2021, President Biden has issued an Executive Order on Climate-Related Financial Risks, which in part directsdirected the U.S. Treasury Secretary to work with other members of the Financial Stability Oversight Council to consider a number of actions. Included among them areMore recently, in 2023, the Financial Stability Oversight Council’s assessmentFRB conducted a pilot climate scenario analysis exercise involving six of the nation’s largest banks designed to enhance the ability of supervisors and firms to measure and manage climate-related financial riskrisks. The results of this exercise may result in future changes to the stabilityFRB’s supervisory activities and expectations with respect to Ally. Further, several states in which Ally operates, such as California, have enacted or proposed statutes or regulations addressing climate change and other ESG issues. As a result of these and similar future developments at the federal, governmentstate and the U.S. financial system, facilitation of the sharing of climate-related financial risk datainternational levels, we may become subject to different and information among its memberspotentially conflicting requirements and other executive departments and agencies, and issuance of a report on any efforts by its members to integrate consideration of climate-related financial risk in their policies and programs. Further, the SEC has created a Climate and ESG Task Forceexpectations in the Division of Enforcement, whosevarious jurisdictions in which we operate. Further, it is possible that government responses to actual or perceived changes in climate and related environmental risks, including expectations regarding the purpose includes proactively identifying ESG-related misconduct such as material gaps or misstatements in the disclosure of climate risks.scenario analysis, may occur more rapidly than we (or third parties on whom we rely for certain climate- or other sustainability-related information or services) are able to adapt. Our ability to comply with these requirements and expectations, including responses to any inquiry or investigation from a regulatory agency, could have a material adverse effect on our operations, reputation and our financial results.

How governments act to mitigateaddress climate and related environmental risks, as well as associated changes in the behavior and preferences of businesses and consumers, could have an adverse effect on our business and financial results. The FRB has announced its developmentFor example, physical and transition risks associated with climate change could affect households, communities, businesses, and governments, which could impede business activity, affect household incomes, and alter the value of a program of scenario analysis to evaluate the potential economicassets and financialliabilities. These risks posed by different climate outcomes, and especially because of our concentration in automotive finance and insurance, this could have the effect of directly or indirectly compelling us to alter our businesses or operations in ways that would be detrimental to our results of operations and prospects. Such a program, moreover, could be followed by an incorporation of climate and related environmental risks into the FRB’s supervisory stress tests, which may negatively impact us and our future capital plans. Further, we may be compelledpropagated through the economy and financial

Our business is centered around lending and banking with an emphasis on our digital platform, and a significant percentage of our assets are composed of loans, operating leases, and securities. As a result, in the ordinary course of business, credit risk is one of our most significant risks.

We continue to have exposure to nonprime consumer automotive financing and used vehicle financing. We define nonprime consumer automotive loans primarily as those loans with a FICO® Score (or an equivalent score) at origination of less than 620. Customers that finance used vehicles tend to have lower FICO® Scores as compared to new vehicle customers, and defaults resulting from vehicle breakdowns are more likely to occur with used vehicles as compared to new vehicles that are financed. The carrying value of our nonprime consumer automotive loans before allowance for loan losses was $8.8$8.7 billion, or approximately 11.3%10.3% of our total consumer automotive loans at December 31, 2021,2023, as compared to $8.6$8.8 billion, or approximately 11.7%10.6% of our total consumer automotive loans at December 31, 2020.2022. At December 31, 2021,2023, and 2020, $2942022, $258 million and $337$302 million, respectively, of nonprime consumer automotive loans were considered

As part of the underwriting process, we rely heavily upon information supplied by applicants and other third parties, such as credit reporting agencies, automotive dealers and retailers (in the case of automotive consumer and commercial loans), and service providers (in the case of unsecured personal loans). If any of this information is intentionally or negligently misrepresented and the misrepresentation is not detected before completing the transaction, we may experience increased credit risk.

Regulatory agencies periodically review our allowance for loan losses, as well as our methodology and models used for calculating our allowance for loan losses, and from time to time may insist on an increase in the allowance for loan losses or the recognition of additional

A number of trends are affecting the automotive industry and the role of dealers within it. These include challenges to the dealer’s role as intermediary between manufacturers and purchasers, shifting financial and other pressures exerted by manufacturers on dealers, the rise of vehicle sharing and ride hailing, the development of autonomous and alternative-energy vehicles, the impact of demographic shifts on attitudes and behaviors toward vehicle ownership and use, changing consumer and regulatory expectations around the vehicle buying experience, adjustments in the geographic distribution of new and used vehicle sales, and advancements in communications technology. While it is not currently clear how and how quickly these trends may develop, any one or more of them could adversely affect the key role of dealers and their business models, profitability, and viability, and if this were to occur, our dealer-centric automotive finance and insurance businesses could suffer as well.

Our share of commercial wholesale financing remains at risk of decreasing in the future as a result of intense competition and other factors. The number of dealers with whom we have wholesale relationships decreased approximately 14%5% as of December 31, 2023, compared to December 31, 2020.2022. If we are not able to maintain existing relationships with significant automotive dealers or if we are not able to develop new relationships for any reason—including if we are not able to provide services on a timely basis, offer products and services that meet the needs of the dealers, compete successfully with the products and services of our competitors, or effectively counter the influence that captive automotive finance companies have in the marketplace or the exclusivity privileges that some competitors have with automotive manufacturers—our wholesale funding volumes, and the number of dealers with whom we have retail funding relationships, could decline in the future. If this were to occur, our business, results of operations, financial condition, or prospects could be adversely affected.

While we continue to diversify our automotive finance and insurance businesses and to expand into other financial services, GM and Stellantis dealers and their retail customers still constitute a significant portion of our customer base. In 2021, 31%2023, 28% of our new vehicle dealer inventory financing and 21%23% of our consumer automotive financing volume were transacted for GM dealers and customers, and 48%53% of our new vehicle dealer inventory financing and 26%20% of our consumer automotive financing volume were transacted for Stellantis dealers and customers. In 2020, 40%2022, 31% of our new vehicle dealer inventory financing and 22% of our consumer automotive financing volume were transacted for GM-franchised dealers and customers, and 40%55% of our new vehicle dealer inventory financing and 28%22% of our consumer automotive financing volume were transacted for Stellantis dealers and customers. GM and its captive finance company compete vigorously with us and could take further actions that negatively impact the amount of business that we do with GM dealers and their customers. Additionally, through a recent acquisition, Stellantis has indicated its intention to develop a captive finance company in the United States that could impact the business that we do with Stellantis dealers and their customers. A significant adverse change in GM’s or Stellantis’ business—including, for example, in the production or sale of GM or Stellantis vehicles, the quality or resale value of GM or Stellantis vehicles, GM’s or Stellantis’ relationships with its key suppliers, or the rate or volume of recalls of GM or Stellantis vehicles—could negatively impact our GM and Stellantis dealer and retail customer bases and the value of collateral securing our extensions of credit to them. Any future reductions in GM and Stellantis business that we are not able to offset could adversely affect our business and financial results. Refer to Note 29 to the Consolidated Financial Statements for additional information.

Our automotive finance and insurance businesses can be impacted by the sales volume for new and used vehicles. Vehicle sales are impacted, in turn, by several economic and market conditions, including employment levels, household income and savings, interest rates, credit availability, inventory levels, customer preferences, and fuel costs. For example, new vehicle sales decreased dramatically during the economic crisis that began in 2007–2008 and did not rebound significantly until 2012 and 2013. More recently, automotive manufacturers have continuedA meaningful rise in inflation during 2021

During the year ended December 31, 2021,2023, approximately 56%58% of our average earning assets were composed of vehicle loans or operating leases and related residual securitization interests. If we experience higher losses on the sale of repossessed vehicles or lower or more volatile residual values for off-lease vehicles, our business or financial results could be adversely affected.

General economic conditions, the supply of off-lease and other vehicles to be sold, the levels of demand for vehicle ownership and use, relative market prices for new and used vehicles, perceived vehicle quality, the shift from gasoline to electric vehicles, overall vehicle prices, the vehicle disposition channel, volatility in gasoline or diesel fuel prices, levels of household income and savings, interest rates, and other factors outside of our control heavily influence used vehicle prices. Consumer confidence levels and the strength of automotive manufacturers, dealers, and dealersretailers can also influence the used vehicle market. For example, during the economic crisis that began in 2007–2008, sharp declines in used vehicle demand and sale prices adversely affected our remarketing proceeds and financial results.

Our expectation of the residual value of a vehicle subject to an automotive operating lease contract is a critical element used to determine the amount of the operating lease payments under the contract at the time the customer enters into it. As a result, to the extent that the actual residual value of the vehicle—as reflected in the sale proceeds received upon remarketing at lease termination—is less than the expected residual value for the vehicle at lease inception, we will incur additional depreciation expense and lower profit on the operating lease transaction than our priced expectations. Our expectation of used vehicle values is also a factor in determining our pricing of new loan and operating lease originations. In stressed economic environments, residual-value risk may be even more volatile than credit risk. To the extent that used vehicle prices are significantly lower than our expectations, our profit on vehicle loans and operating leases could be substantially less than our expectations, even more so if our estimate of loss frequency is underestimated as well. In addition, we could be adversely affected if we fail to efficiently process and effectively market off-lease vehicles and repossessed vehicles and, as a consequence, incur higher-than-expected disposal costs or lower-than-expected proceeds from the vehicle sales.

We are highly dependent on net interest income, which is the difference between interest income on earning assets (such as loans and investments) and interest expense on deposits and borrowings. Net interest income is significantly affected by market rates of interest, which in turn are influenced by monetary and fiscal policies, general economic and market conditions (including high or increasing levels of inflation), the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future (including future changes in interest rates). We may be adversely affected by policies, laws, and events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), depressing the interest rates associated with our earning assets to levels near the rates associated with our interest expense, increasing the volatility of market rates of interest (including the rate of change), or changing the spreads among different interest rate indices.

The levels of or changes in interest rates could adversely affect us beyond our net interest income, including by increasing the cost or decreasing the availability of deposits or other variable-rate funding instruments, reducing the return on or demand for loans or increasing the prepayment speed of loans, increasing customer or counterparty delinquencies or defaults, negatively impacting our ability to remarket off-lease and repossessed vehicles, and reducing the value of our loans, retained interests in securitizations, and fixed-income securities in our investment portfolio and the efficacy of our hedging strategies. For example, recent increases in interest rates have resulted in, and could in the future further result in, unrealized losses in our investment securities portfolio, which are recognized in accumulated other comprehensive loss within the Consolidated Balance Sheet. We recognize the accumulated change in estimated fair value of these fixed-income securities in net income when we realize a gain or loss upon the sale of the security.

We seek to distinguish ourselves as a customer-centric company that delivers passionate customer service and innovative financial solutions and that is relentlessly focused on “Doing it Right.” Third-party service providers, however, are key to much of our business and operations, including online and mobile banking, mortgage finance, personal lending, credit cards, brokerage, customer service, and operating systems and infrastructure. While we have implemented a supplier-risk-management program and can exert varying degrees of influence over our service providers, we do not control them, their actions, or their businesses. Our contracts with service providers, moreover, may not require or sufficiently incent them to perform at levels and in ways that we would choose to act on our own. Despite our supplier-risk-management program, service providers have not always met our requirements and expectations, and no assurance can be provided that our service providersin the future they will perform to our standards, adequately represent our brand, comply with applicable law, appropriately manage their own risks (including cybersecurity), remain financially or operationally viable, abide by their contractual obligations, or continue to provide us with the services that we require. In such a circumstance, our ability to deliver products and services to customers, to satisfy customer expectations, and to otherwise successfully conduct our business and operations have been and, in the future, could be adversely affected. In addition, we may need to incur substantial expenses to address issues of concern with a service provider, and if the issues cannot be acceptably resolved, we may not be able to timely or effectively replace the service provider due to contractual restrictions, the unavailability of acceptable alternative providers, or other reasons. Further, regardless of how much we can influence our service providers, issues of concern with them could result in supervisory actions and private litigation against us and could harm our reputation, business, and financial results.

As a financial-services company, we are regularly involved in pending or threatened legal proceedings and other matters and are or may be subject to potential liability in connection with them. These legal matters may be formal or informal and include litigation and arbitration with one or more identified claimants, certified or purported class actions with yet-to-be-identified claimants, and regulatory or other governmental information-gathering requests, examinations, investigations, and enforcement proceedings. Our legal matters exist in varying stages of adjudication, arbitration, negotiation, or investigation and span our business lines and operations. Claims may be based in law or equity—such as those arising under contracts or in tort and those involving banking, consumer-protection, securities, tax, employment, and other laws—and some can present novel legal theories and allege substantial or indeterminate damages. In addition, our income tax positions have been and could continue to be challenged by taxing authorities, and any adverse results could materially impact our business, results of operations, and financial condition.

The course and outcome of legal matters are inherently unpredictable. This is especially so when a matter is still in its early stages, the damages sought are indeterminate or unsupported, significant facts are unclear or disputed, novel questions of law or other meaningful legal uncertainties exist, a request to certify a proceeding as a class action is outstanding or granted, multiple parties are named, or regulatory or other governmental entities are involved. Other contingent exposures and their ultimate resolution are similarly unpredictable for reasons that can vary based on the circumstances. As a result, we often are unable to determine how or when threatened or pending legal matters and other contingent exposures will be resolved and what losses may be incrementally and ultimately incurred. Actual losses may be higher or lower than any amounts accrued or estimated for those matters and other exposures, possibly to a significant degree. Refer to Note 29 to the Consolidated Financial Statements. In addition, while we maintain insurance policies to mitigate the cost of litigation and other proceedings, these policies have deductibles, limits, and exclusions that may diminish their value or efficacy. Substantial legal claims, even if not meritorious, could have a detrimental impact on our business, results of operations, and financial condition and could cause us reputational harm.

Skilled employees are our most important resource, and competition for talented people is intense. Even though compensation and benefits expense is among our highest expenses,costs, we may not be able to locate and hire the best people, keep them with us, or properly motivate them to perform at a high level. This risk may be exacerbated due to some of our competitors having significantly greater scale, financial and operational resources, and brand recognition. While we engage in robust succession planning,strive to mitigate human-capital risks, our senior executives and other key leaders have deep and broad industry experience and would be difficult to replace without some degree of disruption. For example, in October 2023 our former CEO provided notice of his intent to retire, and the search for a permanent replacement remains ongoing. In addition, our former General Counsel provided his notice of resignation and left the company in December 2023 and our current President of Consumer and Commercial Banking has provided notice of her intent to retire effective July 1, 2024. As a result of these departures, we may face disruption in our business as we seek to identify and transition permanent successors into these roles. In addition, we may experience competition in retaining employees based on remote or other flexible work arrangements, and our ability to attract or retain qualified employees may be adversely affected if our work arrangements are perceived as less favorable than those of our competitors. Continued scrutiny of compensation practices, especially in the financial services industry, has made this competition for talent only more difficult. In addition, many parts of our business are particularly dependent on key personnel, and retaining talented people in certain areas, such as technology, has been challenging. Further, growth in our businesses, through acquisitions or otherwise, will further increase our need for skilled employees. If we were to lose

Acquisitions involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower-than-expected performance, higher-than-expected costs, difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with customers or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes. An acquisition also could be dilutive to our existing stockholders if we were to issue common stock to fully or partially pay or fund the purchase price. We, moreover, may not be successful in identifying appropriate acquisition candidates, integrating acquired companies or businesses, or realizing expected value from acquisitions. There is significant competition for valuable acquisition targets, and we may not be able to acquire other companies or businesses on attractive terms. No assurance can be given that we will pursue future acquisitions, and our ability to grow and successfully compete may be impaired if we choose not to pursue or are unable to successfully make acquisitions.

Liquidity is the ability to fund increases in assets and meet obligations as they come due, all without incurring unacceptable losses. Banks are especially vulnerable to liquidity risk because of their role in the maturity transformation of demand or short-term deposits into longer-term loans or other extensions of credit. We, like other financial services companies, rely to a significant extent on external sources of funding (such as deposits and borrowings) for the liquidity needed to conduct our business and operations. A number of factors beyond our control, however, could have a detrimental impact on the availability or cost of that funding and thus on our liquidity. These include market disruptions, changes in our credit ratings or the sentiment of our investors, the state of the regulatory environment and monetary and fiscal policies, competitive dynamics, reputational damage, the confidence of depositors in us or the financial-services industry generally, financial or systemic shocks, and significant counterparty failures. For example, in August 2023, the U.S. banking agencies issued a proposed rule that would require Category II, III, and IV firms, their large consolidated banks, and other institutions to issue and maintain minimum amounts of long-term debt that is most readily able to absorb losses in a resolution proceeding. Due to the current structure and amount of debt instruments issued by Ally and Ally Bank, this proposal would significantly affect us. Refer to Note 20 to the Consolidated Financial Statements for further discussion. Weak business or operational performance, unexpected declines or limits on dividends or other distributions from our subsidiaries, and other failures to execute our strategic plan also could adversely affect Ally’s liquidity position.

We have significant maturities of unsecured debt each year. While we have reduced our reliance on unsecured funding as our deposits have grown to 88% of our total funding profile as of December 31, 2023, it remains an important component of our capital structure and financing plans. At December 31, 2021,2023, approximately $1.1$1.5 billion in principal amount of total outstanding consolidated unsecured debt is scheduled to mature in 2022,2024, and approximately $2.1$2.5 billion and $1.5 billion$149 million is scheduled to mature in 20232025 and 2024,2026, respectively. We also utilize secured funding. At December 31, 2021,2023, approximately $4.8$2.9 billion in principal amount of total outstanding consolidated secured long-term debt is scheduled to mature in 2022,2024, approximately $1.5$1.9 billion is scheduled to mature in 2023,2025, and approximately $1.3$1.7 billion is scheduled to mature in 2024.2026. Furthermore, at December 31, 2021,2023, approximately $32.0$43.5 billion in certificates of deposit at Ally Bank are scheduled to mature in 2022,2024, which is not included in the amounts provided above. Additional funding, whether through deposits or borrowings, will be required to fund a substantial portion of the debt maturities over these periods.periods, and we may not be able to obtain such additional funding at interest rates or on other terms as favorable as the interest rates and other terms on the maturing debt.

At times we may rely on our ability to borrow from other financial institutions, and bank facilities are generally up for renewal on a yearly basis. Any weakness in market conditions, tightening of credit availability, or other events referenced earlier in this risk factor could have a negative effect on our ability to refinance any existing facilities and could increase the costs of bank funding. Ally and Ally Bank also continue to access the securitization markets. While those markets have stabilized following the liquidity crisis that commenced in 2007–2008, there can be no assurances that these sources of liquidity will remain available to us.

We have a significant amount of indebtedness apart from deposit liabilities. At December 31, 2021,2023, we had approximately $17.9$18.3 billion in principal amount of indebtedness outstanding (including $7.6$7.1 billion in secured indebtedness). Interest expense on our indebtedness was equal to approximately 10%8% of our total financing revenue and other interest income for the year ended December 31, 2021.2023. We also have the ability to create additional indebtedness.

If our debt service obligations increase, whether due to the increased cost of existing indebtedness or the incurrence of additional indebtedness, more of our cash flow from operations would need to be allocated to the payment of principal of, and interest on, our indebtedness, which would reduce the funds available for other purposes. Our indebtedness also could limit our ability to execute our strategic plan and withstand competitive pressures and could reduce our flexibility in responding to changing business and economic conditions. In addition, if we are unable to satisfy our indebtedness and other obligations in full and on time, our business, reputation, and value as a going concern could be profoundly and perhaps inexorably damaged.

The cost and availability of our funding are meaningfully affected by our short- and long-term credit ratings. Each of Standard & Poor’s Rating Services, Moody’s Investors Service, Inc., Fitch, Inc., and Dominion Bond Rating Service rates some or all of our debt, and these ratings reflect the rating agency’s opinion of our financial strength, operating performance, strategic position, and ability to meet our obligations. Agency ratings are not a recommendation to buy, sell, or hold any security and may be revised or withdrawn at any time. Each agency’s rating should be evaluated independently of any other agency’s rating.

FutureIn August 2023, citing macroeconomic trends impacting the banking industry, such as increased costs of funding and rapid tightening in monetary policy, Moody’s downgraded the credit ratings of a number of banks. Additionally, Moody’s downgraded the outlook of a number of banks, including Ally, where the outlook was lowered from Stable to Negative. Any future downgrades to our credit ratings or their failure to meet investor expectations may result in higher non-deposit borrowing costs, reduced access to the banking and capital markets, more restrictive terms and conditions being added to any new or replacement financing arrangements.

Our businesses are driven by robust economic and market activity, monetary and fiscal stability, and positive investor, business, and consumer sentiment. A downturn in economic conditions, disruptions in the equity or debt markets, high unemployment or underemployment, depressed vehicle or housing prices, unsustainable debt levels, high inflation, high interest rates, unfavorable changes in interest rates, declines in household incomes or savings, deteriorating consumer or business sentiment, consumer or commercial bankruptcy filings, or declines in the strength of national or local economies could decrease demand for our products and services, increase the amount and rate of delinquencies and losses, raise our operating and other expenses, and negatively impact the returns on and the value of our loans, investment portfolio, and other assets. Further, if a significant and sustained increase in fuel prices or other adverse conditions were to lead to diminished new and used vehicle purchases or prices, our automotive finance and insurance businesses could suffer considerably. In addition, concerns about the pace of economic growth and uncertainty about fiscal and monetary policies can result in significant volatility in the financial markets and could impact our ability to obtain cost-effective funding. If any of these events were to occur or worsen, our business, results of operation, and financial condition could be adversely affected.

Market prices for investment securities, nonmarketable equity investments, and other financial assets are subject to considerable fluctuation. Fluctuations may result, for example, from perceived changes in the value of the asset, the relative price of alternative investments, the usual volume of trading in the asset, shifts in investor sentiment, geopolitical events, actual or expected changes in monetary or fiscal policies, and general market conditions, such as inflation. Due to these kinds of fluctuations, the amount that we realize in the subsequent sale of an investment may significantly differ from the last reported value and could negatively affect our financial results. For

Our financial statements are subject to the application of U.S. GAAP, which are periodically revised or expanded. The application of U.S. GAAP is also subject to varying interpretations over time. Accordingly, we are required to adopt new or revised accounting standards or comply with revised interpretations that are issued from time to time by various parties, including accounting standard setters and those who interpret the standards, such as the FASB, the SEC, banking agencies, and our independent registered public accounting firm. Those changes are beyond our control but could adversely affect our revenues, expenses, profitability, or financial condition. For example, the adoption of CECL effective January 1, 2020, resulted in a significant increase to our allowance for loan losses in 2020. Refer to Note 1 to the Consolidated Financial Statements for financial accounting standards issued by the FASB, but not yet adopted by the Company.

We are exposed to portfolio concentrations in some states, including California, Texas, and Florida. Factors adversely affecting the economies and applicable laws in these states, including public policies that have the effect of drawing financial-services companies into contentious political or social issues, could have an adverse effect on our business, results of operations, and financial condition.

The performance and value of our business could be negatively impacted by any reputational harm that we may suffer, especially as an intermediary within the financial system. This harm could arise from negative publicity outside of our control or our failure to adequately address issues arising from our conduct or in connection with the financial services industry generally. Risks to our reputation could arise in any number of contexts—for example, stricter regulatory or supervisory environments, cyber incidents and other security breaches, inabilities to meet customer expectations, political controversies and social trends involving financial-services, mergers and acquisitions, lending or banking practices, actual or perceived conflicts of interest, failures to prevent money laundering, inappropriate conduct by employees, inadequate corporate governance, and any similar issues affecting our service providers.

Governments, investors, customers, and the general public are increasingly focused on ESG practices, oversight, and disclosures. For us and others in the financial-services industry, this focus extends to the practices and disclosures of the customers, counterparties, and service providers with whom we choose to do business. For example, while we have a smaller carbon footprint as a digital financial services

Our operating systems and infrastructure, as well as those of our service providers or others on whom we rely, are subject to security risks that are rapidly evolving and increasing in scope, complexity, and frequency,frequency. This is due, in part, because ofto the introduction of new technologies, the expandedcontinued expansion of the use of the internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions, and the increased sophistication and activities of hostile state-sponsored actors, organized crime, perpetrators of fraud, hackers, terrorists, and others. We, along with other financial institutions, our service providers, and others on whom we rely, have been and are expected to continue to be the target of cyberattacks, which could include computer viruses, malware, malicious or destructive code, social engineering (including phishing or spear phishing attacks,attacks), denial-of-service or denial-of-information attacks, ransomware, identity theft, access violations by employees or vendors, attacks on the personal email of employees, and ransom demands accompanied by threats to expose security vulnerabilities. Risks relating to cyberattacks on our service providers and other third parties, including supply-chain attacks affecting our software and information-technology providers, have been rising as such attacks become increasingly frequent and severe. The development of new technologies, as well as the utilization of decentralized technology infrastructures (such as our increased utilization of cloud computing) and software-defined networks, could expose us to additional cybersecurity risks. Further, the use of artificial intelligence by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our service providers and others on whom we rely. We, our service providers, and others on whom we rely are also exposed to more traditional security threats to physical facilities and personnel.

These security risks could result in business, reputational, financial, regulatory, and other harm to us, which could be particularly pronounced due to our being a digital financial-services company with a meaningful dependence on service providers. For example, if sensitive, confidential, or proprietary data or other information about us or our customers, employees, or employeesthird parties were improperly disclosed, accessed, or destroyed because of a security breach, we could experience severe business or operational disruptions, reputational damage, contractual claims, supervisory actions, or litigation by private plaintiffs. As a digital financial-services company and a direct bank with no branch network, we may face heightened pressure to resolve security breaches more expeditiously to prevent or mitigate a loss of depositor or customer confidence, and if we were to fail to do so, our viability as a going concern could be threatened. As threats inevitably evolve, we expect to continue experiencing increased scrutiny of our security frameworks and protocols by supervisory authorities and others and to continue expending significant resources to enhance our defenses, to educate our employees, to monitor and support the defenses established by our service providers and others on whom we rely, and to investigate and remediate incidents and vulnerabilities as they arise or are identified. Even so, we may not be able to anticipate or implement effective preventive measures against all security breaches, especially because techniques change frequently, attacks can be launched with no warning from a wide variety of sources around the globe, and attackers often need few resources to extensively probe and exploit vulnerabilities over lengthy periods of time. A sophisticated breach, moreover, may not be identified until well after the attack has occurred and the damage has been caused.

We also could be adversely affected by security risks faced by others. For example, a cyberattack or other security breach affecting a service provider or another entity on whom we rely could negatively impact us and our ability to conduct business and operations just as much as a breach affecting us directly. Further, in such a circumstance, we may not receive timely notice of or sufficient information about the breach or be able to exert any meaningful control or influence over how and when the breach is addressed. In addition, a security threat affecting the business community, the markets, or parts of them may cycle or cascade through the financial system and harm us. The mere perception of a security breach involving us or any part of the financial services industry, whether or not true, also could damage our business, operations, or reputation.

We rely heavily upon communications, data management, and other operating systems and infrastructure—including cloud-based services—to conduct our business and operations, which creates meaningful operational risk for us. For example, during 2021, there were a number of widely publicized cases of outages in connection with access to cloud service providers. Any failure of or interruption in these systems or infrastructure or those of our service providers or others on whom we rely—including as a result of inadequate or failed technology or processes, unplanned or unsuccessful updates to technology, sudden increases in transaction volume, human errors, fraud or other misconduct, deficiencies in the integration of acquisitions or the commencement of new businesses, energy or similar infrastructure outages, disruptions in communications networks or systems, natural disasters, catastrophic events, pandemics, acts of terrorism, political or social unrest, external or internal security breaches, acts of vandalism, cyberattacks such as computer viruses and malware, misplaced or lost data, or breakdowns in business continuity plans—could cause failures or delays in receiving applications for loans and operating leases, underwriting or processing loan or operating-lease applications, servicing loans and operating leases, accessing online accounts, processing transactions, executing brokerage orders, communicating with our customers, managing our investment portfolio, or otherwise conducting our business and operations. These adverse effects could be exacerbated if systems or infrastructure need to be taken offline or meaningfully repaired, if backup systems or infrastructure are not adequately redundant and effective for the conduct of our business and operations, or if technological or other solutions do not exist or are slow to be developed. Further, to the extent that the systems or infrastructure of service providers or others are involved, we may have little or no knowledge, control, or influence over how and when failures or delays are addressed. As a digital financial-services company with a meaningful dependence on service providers, we are especially susceptible to business, reputational, financial, regulatory, and other harm as a result of these risks.

In the ordinary course of our business, we collect, store, process, and transmit sensitive, confidential, or proprietary data and other information, including business information, intellectual property, and the personally identifiable information of customers and employees. The secure collection, storage, processing, and transmission of this information are critical to our business and reputation, and if any of this information were mishandled, misused, improperly accessed, altered, lost, or stolen or if related operations were disabled or otherwise disrupted, we could suffer significant business, reputational, financial, regulatory, and other damage.

Even when a failure of or interruption in operating systems or infrastructure is timely resolved, we may need to expend substantial resources in doing so, may be required to take actions that could adversely affect customer satisfaction or behavior, and may be exposed to reputational damage. We also could be exposed to contractual claims, supervisory actions, or litigation by private plaintiffs.

Especially asAs a digital financial-services company and a direct bank with no branch network, we significantly depend on technology to deliver our products and services and to otherwise conduct our business and operations. To remain technologically competitive and operationally efficient, we invest in system upgrades, new solutions, cloud-based services, and other technology initiatives. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources.resources, and our utilization of artificial intelligence technologies could result in content or analyses that are inaccurate or deficient. Although we take steps to mitigate the risks and uncertainties associated with these initiatives, no assurance can be provided that they will beare not always implemented on time, within budget, or without negative financial, operational, or customer impact or that, once implemented, they willand do not always perform as we or our customers expect.expect, and no assurance can be provided that initiatives in the future will be or will do so. We also may not succeed in anticipating or keeping pace with future technology needs, the technology demands of customers, or the competitive landscape for technology. If we were to misstep in any of these areas, our business, financial results, or reputation could be negatively impacted. Our use of systems and other technologies also depends on rights or interests in the underlying intellectual property, which we or our service providers may own or license. If we or a service provider were alleged or found to be infringing on the intellectual-property rights of another person or entity, we could be liable for significant damages for past infringement, substantial fees for continued use, and deprivation of access for limited or extended periods of time without the practical availability of an alternative.

From time to time we have made, and in the future will make, forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These statements can be identified by the fact that they do not relate strictly to historical or current facts. Forward-looking statements often use words such as “believe,” “expect,” “anticipate,” “intend,” “pursue,” “seek,” “continue,” “estimate,” “project,” “outlook,” “forecast,” “potential,” “target,” “objective,” “trend,” “plan,” “goal,” “initiative,” “priorities,” or other words of comparable meaning or future-tense or conditional verbs such as “may,” “will,” “should,” “would,” or “could.” Forward-looking statements conveyOur long-term strategic objectives are centered around (1) differentiating our expectations, intentions, or forecasts about future events, circumstances, or results.

Unless the context otherwise requires, the following definitions apply. The term “loans” means the following consumer and commercial products associated with our direct and indirect financing activities: loans, retail installment sales contracts, lines of credit, and other financing products excluding operating leases. The term “operating leases” means consumer- and commercial-vehicle lease agreements where Ally is the lessor and the lessee is generally not obligated to acquire ownership of the vehicle at lease-end or compensate Ally for the vehicle’s residual value. The terms “lend,” “finance,” and “originate” mean our direct extension or origination of loans, our purchase or

Ally Invest Advisors Inc.(Ally Invest Advisors) is registered as an investment adviser with the SEC. As a result, the firm is subject to a host of requirements governing investment advisers and their personnel under the Investment Advisers Act of 1940, as amended, and related rules and regulations, including certain fiduciary and other obligations with respect to its relationships with its consolidated subsidiaries unlessinvestment advisory clients.

Regulators conduct periodic examinations of Ally Invest Securities and Ally Invest Advisors and regularly review reports that the context otherwisefirms are required to submit on an ongoing basis. Violations of relevant regulatory requirements could result in adverse consequences for the firms and their personnel, including censure, penalties and fines, the issuance of cease-and-desist orders, and restriction, suspension or expulsion from the securities or commodity-futures industries.

Depending on the circumstances, to satisfy the FRB in its review of our capital plan, we may be required to further cease or limit capital distributions or to issue capital instruments that could be dilutive to stockholders. The FRB also may prevent us from maintaining or expanding lending or other business activities. Any of these developments, including the mere fact of being required by the FRB to revise or resubmit our capital plan and especially if unique to us or our)a group of firms like us, may damage our reputation and result in a loss of customer or investor confidence.

Ally Bank is a key part of our funding strategy, and we place great reliance on deposits at Ally Bank as a source of funding. Competition for deposits and deposit customers, however, is intense. Further, recent increases in short-term interest rates have resulted in, and are expected to continue to result in, more intense competition in deposit pricing and with respect to non-deposit financial products. Ally Bank does not have a branch network but, instead, obtains its deposits through online and other digital channels, from other business lines including customers of Ally Invest, and through deposit brokers. Brokered deposits may be more price sensitive than other types of deposits and may become less available if alternative investments offer higher returns. Our brokered deposits totaled $11.0 billion at December 31, 2023, which represented 7.1% of total deposit liabilities. In addition, our ability to maintain, grow, or favorably price deposits may be constrained by our focus on online and mobile banking, gaps in our product and service offerings, changes in consumer trends, our smaller scale relative to other financial institutions, competition from fintech companies and emerging financial-services providers, any failures or deterioration in our customer service, or any loss of confidence in our brand or our business. Our level and cost of deposits also could be adversely affected by regulatory or supervisory restrictions, including any applicable prior approval requirements or limits on our offered rates or brokered deposit growth, and by changes in monetary or fiscal policies that influence deposit or other interest rates. Perceptions of our existing and future financial strength or the financial strength of the financial-services industry generally, rates or returns offered by other financial institutions or third parties, and other competitive factors beyond our control, including returns on alternative investments, will also impact the size and cost of our deposit base. For example, Ally Bank could be subject to sudden withdrawals of deposits, including as a result of negative media coverage, which may be spread through social media, regarding us or the financial services industry generally. Online and mobile banking have made it easier for customers to withdraw their deposits or transfer funds to other accounts with short notice. This may make retaining deposits during periods of stress more difficult. In addition, depositors of certain types of deposits, such as uninsured or uncollateralized deposits, may be more likely to withdraw their deposits or do so more quickly. Any such withdrawals could result in higher funding costs for us as we lose a lower cost source of funding, and significant unanticipated withdrawals could materially and adversely affect our liquidity, financial condition, and results of operations. Approximately 93% of total deposits at Ally Bank, excluding affiliate and intercompany deposits, were FDIC-insured as of December 31, 2023.

These security risks could result in business, reputational, financial, regulatory, and other harm to us, which could be particularly pronounced due to our being a digital financial-services company committedwith a meaningful dependence on service providers. For example, if sensitive, confidential, or proprietary data or other information about us or our customers, employees, or third parties were improperly disclosed, accessed, or destroyed because of a security breach, we could experience severe business or operational disruptions, reputational damage, contractual claims, supervisory actions, or litigation by private plaintiffs. As a digital financial-services company and a direct bank with no branch network, we may face heightened pressure to its promiseresolve security breaches more expeditiously to “Do It Right”prevent or mitigate a loss of depositor or customer confidence, and if we were to fail to do so, our viability as a going concern could be threatened. As threats inevitably evolve, we expect to continue experiencing increased scrutiny of our security frameworks and protocols by supervisory authorities and others and to continue expending significant resources to enhance our defenses, to educate our employees, to monitor and support the defenses established by our service providers and others on whom we rely, and to investigate and remediate incidents and vulnerabilities as they arise or are identified. Even so, we may not be able to anticipate or implement effective preventive measures against all security breaches, especially because techniques change frequently, attacks can be launched with no warning from a wide variety of sources around the globe, and attackers often need few resources to extensively probe and exploit vulnerabilities over lengthy periods of time. A sophisticated breach, moreover, may not be identified until well after the attack has occurred and the damage has been caused.

We rely heavily upon communications, data management, and other operating systems and infrastructure—including cloud-based services—to conduct our business and operations, which creates meaningful operational risk for its consumer, commercial,us. For example, during 2021, there were a number of widely publicized cases of outages in connection with access to cloud service providers. Any failure of or interruption in these systems or infrastructure or those of our service providers or others on whom we rely—including as a result of inadequate or failed technology or processes, unplanned or unsuccessful updates to technology, sudden increases in transaction volume, human errors, fraud or other misconduct, deficiencies in the integration of acquisitions or the commencement of new businesses, energy or similar infrastructure outages, disruptions in communications networks or systems, natural disasters, catastrophic events, pandemics, acts of terrorism, political or social unrest, external or internal security breaches, acts of vandalism, cyberattacks such as computer viruses and corporate customers. Allymalware, misplaced or lost data, or breakdowns in business continuity plans—could cause failures or delays in receiving applications for loans and operating leases, underwriting or processing loan or operating-lease applications, servicing loans and operating leases, accessing online accounts, processing transactions, executing brokerage orders, communicating with our customers, managing our investment portfolio, or otherwise conducting our business and operations. These adverse effects could be exacerbated if systems or infrastructure need to be taken offline or meaningfully repaired, if backup systems or infrastructure are not adequately redundant and effective for the conduct of our business and operations, or if technological or other solutions do not exist or are slow to be developed. Further, to the extent that the systems or infrastructure of service providers or others are involved, we may have little or no knowledge, control, or influence over how and when failures or delays are addressed. As a digital financial-services company with a meaningful dependence on service providers, we are susceptible to business, reputational, financial, regulatory, and other harm as a result of these risks.

Even when a failure of or interruption in operating systems or infrastructure is composedtimely resolved, we may need to expend substantial resources in doing so, may be required to take actions that could adversely affect customer satisfaction or behavior, and may be exposed to reputational damage. We also could be exposed to contractual claims, supervisory actions, or litigation by private plaintiffs.

As a digital financial-services company and a direct bank with no branch network, we significantly depend on technology to deliver our products and services and to otherwise conduct our business and operations. To remain technologically competitive and operationally efficient, we invest in system upgrades, new solutions, cloud-based services, and other technology initiatives. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources, and our utilization of artificial intelligence technologies could result in content or analyses that are inaccurate or deficient. Although we take steps to mitigate the risks and uncertainties associated with these initiatives, they are not always implemented on time, within budget, or without negative financial, operational, or customer impact and do not always perform as we or our customers expect, and no assurance can be provided that initiatives in the future will be or will do so. We also may not succeed in anticipating or keeping pace with future technology needs, the technology demands of customers, or the competitive landscape for technology. If we were to misstep in any of these areas, our business, financial results, or reputation could be negatively impacted. Our use of systems and other technologies also depends on rights or interests in the underlying intellectual property, which we or our service providers may own or license. If we or a service provider were alleged or found to be infringing on the intellectual-property rights of another person or entity, we could be liable for significant damages for past infringement, substantial fees for continued use, and deprivation of access for limited or extended periods of time without the practical availability of an industry-leadingalternative.