Customer usage and payment patterns, credit quality, levels of marketing expense and operating efficiency all affect our profitability. In our Credit Card business, we experience fluctuations in purchase volume and the level of outstanding loan receivables due to seasonal variances in consumer spending and payment patterns which, for example, are highest around the winter holiday season. Net charge-off rates for our credit card loan portfolio also have historically exhibited seasonal patterns as well and generally tend to be the highest in the first quarter of the year. No individual quarter in 2017, 20162019, 2018 or 20152017 accounted for more than 30% of our total revenues in any of these fiscal years. Net charge-off rates in

Each of our business segments operates in a highly competitive environment, and we face competition in all aspects of our business from numerous bank and non-bank providers of financial services.

Our Consumer Banking and Commercial Banking businesses compete with national, state and direct banks for deposits, commercial and auto loans, as well as with savings and loan associations and credit unions for loans and deposits. Our competitors also include automotive finance companies, commercial mortgage banking companies and other financial services providers that provide loans, deposits, and other similar services and products. In addition, we compete against non-depository institutions that are able to offer these products and services. Securities firms and insurance companies that elect to become financial holding companies may acquire banks and other financial institutions. Combinations of this type could significantly change the competitive environment in which we conduct business. The financial services industry is also likely to become more competitive as further technological advances enable more companies to provide financial services. These technological advances may diminish the importance of depository institutions and other financial intermediaries in the transfer of funds between parties. In addition, competition among direct banks is intense because online banking provides customers the ability to rapidly deposit and withdraw funds and open and close accounts in favor of products and services offered by competitors.

Capital One Financial Corporation is a bank holding company (“BHC”) and a financial holding company (“FHC”) under the Bank Holding Company Act of 1956, as amended (“BHC Act”), and is subject to the requirements of the BHC Act, including approval requirements for investments in or acquisitions of banking organizations, capital adequacy standards and limitations on nonbanking activities. As a BHC and FHC, we are subject to supervision, examination and regulation by the Board of Governors of the Federal Reserve System (“Federal Reserve”). Permissible activities for a BHC include those activities that are so closely related to banking as to be a proper incident thereto. In addition, an FHC is permitted to engage in activities considered to be financial in nature (including, for example, securities underwriting and dealing and merchant banking activities), incidental to financial activities or, if the Federal Reserve determines that they pose no risk to the safety or soundness of depository institutions or the financial system in general, activities complementary to financial activities.

To become and remain eligible for financial holding companyFHC status, a BHC and its subsidiary depository institutions must meet certain criteria, including capital, management and Community Reinvestment Act (“CRA”) requirements. Failure to meet such criteria could result, depending on which requirements were not met, in the Company facing restrictions on new financial activities or acquisitions or being required to discontinue existing activities that are not generally permissible for BHCs.

We are also registered as a financial institution holding company under the lawlaws of the Commonwealth of Virginia and, as such, we are subject to periodic examination by the Virginia Bureau of Financial Institutions. We also face regulation in the international

jurisdictions in which we conduct business (see below underbusiness. See “Regulation of Businesses by Authorities Outside the United States”). below for additional details.

The business activities of the Company and the Banks are also subject to regulation and supervision under various laws and regulations.

The activities of the Banks as consumer lenders are subject to regulation under various federal laws, including, for example, the Truth in Lending Act (“TILA”), the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the CRA, the Servicemembers Civil Relief Act and the Military Lending Act, as well as under various state laws. We are also subject to the Credit Card Accountability Responsibility and Disclosure Act, whichTILA, as amended, the TILA, and which imposes a number of restrictions on credit card practices impacting rates and fees, requires that a consumer’s ability to pay be taken into account before issuing credit or increasing credit limits, and imposes revised disclosures required for open-end credit.

Depending on the underlying issue and applicable law, regulators may be authorized to impose penalties for violations of these statutes and, in certain cases, to order banks to compensate customers. Borrowers may also have a private right of action for certain violations. Federal bankruptcy and state debtor relief and collection laws may also affect the ability of a bank, including the Banks, to collect outstanding balances owed by borrowers.

The CFPB has issued several rules pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) that provide additional disclosure requirements and substantive limitations on our mortgage lending activities. Although we announced our decision to cease new originations of residential mortgage and home equity loan products within our Consumer Banking business, these rules could still impact pending mortgage loan applications and our servicing activities.

The Bank Secrecy Act and the USA PATRIOT Act of 2001 (“Patriot Act”) require financial institutions, among other things, to implement a risk-based program reasonably designed to prevent money laundering and to combat the financing of terrorism, including through suspicious activity and currency transaction reporting, compliance, record-keeping and customer due diligence.

FDIC is authorized to terminate a bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance would likely have a material adverse effect on a bank’s liquidity and earnings.

Certain of our nonbank subsidiaries are subject to supervision and regulation by various other federal and state authorities. United Income, Inc. is an investment adviser registered with the SEC and regulated under the Investment Advisers Act of 1940. Capital One Securities, Inc. and Capital One Investing, LLCKippsDeSanto & Company are registered broker-dealers regulated by the SEC and the Financial Industry Regulatory Authority. Our broker-dealer subsidiaries are subject, among other things, to net capital rules designed to measure the general financial condition and liquidity of a broker-dealer. Under these rules, broker-dealers are required to maintain the minimum net capital deemed necessary to meet their continuing commitments to customers and others, and to keep a substantial portion of their assets in relatively liquid form. These rules also limit the ability of a broker-dealer to transfer capital to its parent companies and other affiliates. Broker-dealers are also subject to regulations covering their business operations, including sales and trading practices, public offerings, publication of research reports, use and safekeeping of client funds and securities, capital structure, record-keeping and the conduct of directors, officers and employees.

The Commodity Futures Trading Commission (“CFTC”) and the SEC have jointly issued final rules further defining the Dodd-Frank Act’s “swap dealer” definitions. Based on these rules, no Capital One entity is currently required to register with the CFTC or SEC as a swap dealer. The Dodd-Frank Act also requires all swap market participants to keep certain swap transaction records and report pertinent information to swap data repositories on a real-time and on-going basis. Further, each swap, group, category, type or class of swap that the CFTC or SEC determines must be cleared through a derivatives clearinghouse (unless the swap is eligible for a clearing exemption) must also be executed on a designated contract market (“DCM”), exchange or swap execution facility (“SEF”), unless no DCM, exchange or SEF has made the swap available for trading.

We and each of our subsidiaries, including the Banks, are subject to the “Volcker Rule,” a provision of the Dodd-Frank Act that contains prohibitions on proprietary trading and certain investments in, and relationships with, covered funds (hedge funds, private equity funds and similar funds), subject to certain exemptions, in each case as the applicable terms are defined in the Volcker Rule and the implementing regulations. The implementing regulations also require that we as a banking entity with $50 billion or more in total assets, establish and maintain an enhanceda compliance program designed to ensure that we complyadherence with the requirements of the regulations.

In December 2010, the Basel Committee on Banking Supervision (“Basel Committee”) published a framework for additional capital and liquidity requirements (“Basel III”), which included detailed capital ratios and buffers, subject to transition periods. The Federal Reserve, OCC and FDIC (collectively, the “Federal Banking Agencies”) have issued a final rule that implemented regulations (“Basel III Capital Rule”) that implement certain capital and liquidity requirements published by the Basel Committee on Banking Supervision (“Basel Committee”), along with certain Dodd-Frank Act and other capital provisions and updated the prompt corrective action (“PCA”) framework to reflect the new regulatory capital minimums (“Basel III Capital Rule”). The Basel III Capital Rule increased the minimum capital that we and other institutions are required to hold.provisions. The Basel III Capital Rule includes the “Basel III Standardized Approach” and the “Basel III Advanced Approaches.”

In October 2019, the minimum risk-based and leverage capital requirements for Advanced Approaches banking organizations included a common equity Tier 1 capital ratio of at least 4.0%, a Tier 1 risk-based capital ratio of at least 5.5%, a total risk-based capital ratio of at least 8.0% and a Tier 1 leverage capital ratio of at least 4.0%. On January 1, 2015, the minimum risk-based capital ratio requirements increased to 4.5% for the common equity Tier 1 capital ratio and to 6.0% for the Tier 1 risk-based capital ratio, and the minimum requirements for the total risk-based capital ratio and Tier 1 leverage capital ratio remained the same. Both the capital conservation buffer and the countercyclical capital buffer are being phased-in over a transition period of four years that commenced on January 1, 2016. On January 1, 2014, we began to useFederal Banking Agencies amended the Basel III Capital Rule with transition provisions, to calculate our regulatoryprovide for tailored application of certain capital including for purposesrequirements across different categories of calculating our regulatory capital ratios. On January 1, 2015, we began to use the Basel III Standardized Approach for calculating our risk-weighted assets in our regulatory capital ratios.

The “Market Risk Rule” supplements both the Basel III Standardized Approach and the Basel III Advanced ApproachesCapital Rule by requiring institutions subject to the Market Risk Rule to adjust their risk-based capital ratios to reflect the market risk in their trading portfolios. The Market Risk Rule generally applies to institutions with aggregate trading assets and liabilities equal to the lesser of:

The Basel Committee has published a liquidity framework whichthat includes two standards for liquidity risk supervision, each subject to observation periods and transitional arrangements.supervision. One standard, the liquidity coverage ratio (“LCR”), seeks to promote short-term resilience by requiring organizations to hold sufficient high-quality liquid assets to survive a stress scenario lasting for 30 days. The other standard, the net stable funding ratio (“NSFR”), seeks to promote longer-term resilience by requiring sufficient stable funding over a one-year period based on the liquidity characteristics of its assets and activities.

As implemented in the United States, the LCR Rule applies to institutions with total consolidated assets of $250 billion or more or total consolidated on-balance sheet foreign exposure of $10 billion or more, and their respective consolidated subsidiary depository institutions with $10 billion or more in total consolidated assets. As a result, theThe Company and the Banks are subject to the LCR Rule.as implemented by the Federal Reserve and OCC (“LCR Rule”). The ruleLCR Rule requires the Company and each of the Banks to hold an amount of eligible high-quality liquid assets (“HQLA”) that equals or exceeds 100% of their respective projected adjusted net cash outflows over a 30-day period, each as calculated in accordance with the LCR Rule. The LCR Rule requires us to calculate the LCR daily as of July 1, 2016. Each company subject todaily. In addition, the LCR RuleCompany is required to make quarterly public disclosures of its LCR and certain related quantitative liquidity metrics, along with a qualitative discussion of its LCR.

Under the Tailoring Rules, as a Category III institution with less than $75 billion in weighted average short-term wholesale funding, the Company’s and the Banks’ total net cash outflows are multiplied by an outflow adjustment percentage of 85%. We expect this outflow adjustment to materially increase the LCR for the Banks but not for the Company. The Company is requiredLCR Rule restricts the amount of HQLA held at the Banks in excess of the Banks’ total net cash outflow amount that can be included in the Company’s HQLA amount (referred to comply with these disclosure requirements beginning April 1, 2018.as “Trapped Liquidity”). Therefore, although we typically manage Bank-level LCRs at a level well above the regulatory minimum of 100%, the amount of Trapped Liquidity will also increase as the Banks’ total net cash outflows are reduced

In April 2016, the Federal Banking Agencies issued an interagency notice of proposed rulemaking regarding the U.S. implementation of the Basel III NSFR (the “Proposed(“Proposed NSFR”), which would apply to the same institutions subject to the LCR Rule. The Proposed NSFR would require us to maintain a sufficient amount of stable funding in relation to our assets, derivatives exposures and commitments over a one-year horizon period. WhileAlthough the Proposed NSFR is generally consistent with the Basel NSFR standard, it is more stringent in certain areas. The financial and operational impact on us of a final NSFR rule remains uncertain until a final rule is published. There is uncertainty regarding the timing and form of any such final rule implementing the NSFR in the United States.rule.

The FDICIA requires the Federal Banking Agencies to take “prompt corrective action” for banks that do not meet minimum capital requirements. The FDICIA establishes five capital ratio levels: well capitalized; adequately capitalized; undercapitalized; significantly undercapitalized; and critically undercapitalized. The three undercapitalized categories are based upon the amount by which a bank falls below the ratios applicable to an adequately capitalized institution. The capital categories are determined solely for purposes of applying the FDICIA’s PCAprompt corrective action (“PCA”) provisions, and such capital categories may not constitute an accurate representation of the Banks’ overall financial condition or prospects.

As an additional means to identify problems in the financial management of depository institutions, the FDICIA required the Federal Banking Agencies to establish certain non-capital safety and soundness standards. The standards adopted by the Federal Banking Agencies relate generally to operations and management, asset quality, interest rate exposure and executive compensation. The Federal Banking Agencies are authorized to take action against institutions that fail to meet such standards.

AsWe are a BHC with total consolidated assets of $50 billion or more (a “covered company”), we are subject under the Dodd-Frank Act to certain enhanced prudential standards, including requirements that may be recommended by the Financial Stability Oversight Council (“FSOC”) and implemented by the Federal Reserve and other regulators. We remain a covered company under the amendments to the Dodd-Frank Act made by the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”), which provided reduced enhanced prudential standards for institutions with less than $250 billion in assets. As a result, we are subject to more stringent standards and requirements than those applicable to smaller institutions.institutions that are not covered companies. The FSOC may also issue recommendations to the Federal Reserve or other primary financial regulatory agencies to apply new or enhanced standards to certain financial activities or practices.

The Federal Reserve and FDIC have issued rules requiring covered companiesthe Company to implement resolution planning for orderly resolution in the event the Companycovered company faces material financial distress or failure. The FDIC issued similar rules regarding resolution planning applicable to the Banks. In addition, the OCC has issued final guidelines in September 2016 that require the Banksrules requiring banks with assets of $250 billion or more to develop recovery plans detailing the actions they would take to remain a going concern when they experience considerable financial or operational stress, but have not deteriorated to the point that resolution is imminent.

The Federal Reserve established a rule that implements the requirement in the Dodd-Frank Act that the Federal Reserve conduct annual stress tests on the capacity of our capital to absorb losses as a result of adverse economic conditions. The stress testThis rule also implementsrequires the requirement that weCompany to conduct ourits own semiannual stress tests and requires us to publish the results of the stress tests on our website or other public forum. As a Category III institution under the Tailoring Rules, the Company must disclose the results of its company-run stress test in 2020 and every two years thereafter. The OCC has adopted a similar stress test rule requiring banks with at least $250 billion in assets, including CONA, to implement the requirement that each of the Banks conduct annualtheir own company-run stress tests. Under that OCC rule, CONA must disclose the results of this stress test in 2020 and every two years thereafter.

The Federal Reserve has finalized otheralso established rules implementing certain other aspects of the enhanced prudential standards under the Dodd-Frank Act which were applicable to us beginning on January 1, 2015 (“Enhanced Standards Rule”). Under the Enhanced Standards Rule, wethe Company must meet liquidity risk management standards, conduct internal liquidity stress tests, and maintain a 30-day buffer of highly liquid assets, in each case, consistent with the requirements of the rule.Enhanced Standards Rule. These requirements are in addition to the LCR, discussed above in “Basel III and United States Liquidity Rules.” The Enhanced Standards Rule also requires that wethe Company comply with, and hold capital commensurate with, the requirements of, any regulations adopted by the Federal Reserve relating to capital planning and stress tests. Stress testing and capital planning regulations are discussed further below under “Dividends, Stock Repurchases and Transfers of Funds.” The Enhanced Standards Rule also requires that wethe Company establish and maintain an enterprise-wide risk management framework that includes a risk committee and a chief risk officer.

Although not a requirement of the Dodd-Frank Act, the OCC established regulatory guidelines (“Heightened Standards Guidelines”) that apply heightened standards for risk management to large institutions subject to its supervision, including the Banks. The Heightened Standards Guidelines establish standards for the development and implementation by the Banks of a risk governance framework.

Certain acquisitions of our capital stock may be subject to regulatory approval or notice under federal or state law. Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of our capital stock in excess of the amount that can be acquired without regulatory approval, including under the BHC Act and the Change in Bank Control Act (“CIBC Act”).

Federal law and regulations prohibit any person or company from acquiring control of the Company or the Banks without, in most cases, prior written approval of the Federal Reserve or the OCC, as applicable. Control exists if, among other things, a person or company acquires more than 25% of any class of our voting stock or otherwise has a controlling influence over us. For a publicly traded BHC like us,such as ourselves, a rebuttable presumption of control arises under the CIBC Act if a person or company acquires more than 10% of any class of our voting stock.

Additionally, COBNA and CONA are “banks” within the meaning of Chapter 13 of Title 6.1 of the Code of Virginia governing the acquisition of interests in Virginia financial institutions (“Financial Institution Holding Company Act”). The Financial Institution Holding Company Act prohibits any person or entity from acquiring, or making any public offer to acquire, control of a Virginia financial institution or its holding company without making application to, and receiving prior approval from, the Virginia Bureau of Financial Institutions.

Under the Federal Reserve’s capital planning rules applicable to large BHCs including us (commonly referred to as Comprehensive Capital Analysis and Review or “CCAR”), a BHC with total consolidated assets of $50 billion or more“covered BHCs,” including ourselves, must submit a capital plan to the Federal Reserve on an annual basis that contains a description of all planned capital actions, including dividends or stock repurchases, over a nine-quarter planning horizon beginning with the fourthfirst quarter of the calendar year prior to the submission of the capital plan is submitted (“CCAR cycle”). A covered BHC may take the proposed capital actions if the Federal Reserve does not object to the plan.

Dodd-Frank Act stress testing, described above in “Enhanced Prudential Standards and Other Requirements under the Dodd-Frank Act,” is a complementary exercise to CCAR. It is a forward-looking exercise conducted by the Federal Reserve and covered financial companies to help assess whether a company has sufficient capital to absorb losses and support operations during adverse economic conditions. The supervisory stress test, after incorporating a firm’s planned capital actions, is used for quantitative assessment in CCAR.

As part of its evaluation of a large BHC’s capital plan, the Federal Reserve will consider how comprehensive the plan is, the reasonableness of the assumptions, analysis and methodologies used therein to assess capital adequacy and the ability of the BHC to maintain capital above each minimum regulatory capital ratio on a pro forma basis under expected and stressful conditions throughout a planning horizon of at least nine quarters. The annual CCAR cycle measures our capital levels under the Basel III Standardized Approach, with appropriate phase-in provisions applicable to Capital One. The Federal Reserve has indefinitely delayed incorporation of the Basel III Advanced Approaches into the capital planning and stress testing process. The Company must file its capital plan and stress testing results with the Federal Reserve by April 5 2018,of each year (unless the Federal Reserve designates a later date), using data as of the end of the prior calendar year. The Federal Reserve is expected to provide its objection or non-objection to that capital plan the following June.in June of that year. The Federal Reserve’s objection or non-objection applies to planned capital actions from the third quarter of the year the capital plan is submitted through the end of the second quarter of the following year. The Company, along with other BHCs subject to the supplementary leverage ratio, must incorporate an estimate of its supplementary leverage ratio into its capital plan and stress tests.

projected in its capital plan, as measured on an aggregate basis beginning in the third quarter of the planning horizon, the BHC must reduce its capital distributions.

In January 2017,April 2018, the Federal Reserve issued revisions to itsa proposed rule (“Stress Capital Buffer Proposed Rule”) that would implement a firm-specific “stress capital planningbuffer” requirement and stress testing rules for the 2017 cycle. Among the provisions applicable to the Company, the revisions decrease the amount of capital a company subject to the quantitative requirements of CCAR can distribute to shareholders outside of an approved capital plan without seeking prior approval from the“stress leverage buffer” requirement. The Federal Reserve (knowndescribed the Stress Capital Buffer Proposed Rule as designed to simplify the “de minimis exception”). Beginning April 1, 2017, ifagency’s regulatory regime by integrating the supervisory stress tests with its non-stress capital rules. Under the Stress Capital Buffer Proposed Rule, a company does not receive an objection to itsfirm’s stress capital plan, it may distribute up to 0.25%buffer would have a floor of its2.5% of total risk-weighted assets, replacing the existing 2.5% capital conservation buffer, and would equal, as a percentage of total risk-weighted assets, the sum of (i) the difference between a firm’s starting common equity Tier 1 capital aboveratio and the distributions inlow point under the severely adverse scenario of the Federal Reserve’s supervisory stress test plus (ii) the ratio of the firm’s projected four quarters of common stock dividends to risk-weighted assets as projected under CCAR (for the fourth to seventh quarters of the planning horizon). A firm’s new “Standardized Approach capital conservation buffer” would include its stress capital plan, a reduction frombuffer, any G-SIB surcharge (not applicable to us), and any applicable countercyclical capital buffer (currently set at zero). The consequences of breaching the 1% of Tier 1stress capital permitted previously. The revisions also impose a “blackout period,” startingbuffer requirement would be consistent with the 2017current capital conservation buffer framework and would result in increasingly strict limitations on capital distributions and discretionary bonus payments. The Stress Capital Buffer Proposed Rule would replace the current CCAR exercise, duringpost-stress leverage ratio requirement with a stress leverage buffer requirement. Additionally, the second calendar quarter on the abilityproposal would modify certain CCAR assumptions relating to balance sheet growth, prefunding of a firm subject to CCAR to submit prior notice of its intention to rely on the aforementioned de minimis exception or to submit a request for prior approval for adividends, and capital distribution thatdistributions. It is not reflected in the firm’s capital plan forclear which it has received a non-objection from the Federal Reserve.of these changes, if any, will be finalized and when they would go into effect.

Historically, dividends from the Company’s direct and indirect subsidiaries have represented a major source of the funds we have used to pay dividends on our stock, make payments on corporate debt securities and meet our other obligations. There are various federal law limitations on the extent to which the Banks can finance or otherwise supply funds to us through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, provisions of Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. In general, federal and applicable state banking laws prohibit insured depository institutions, such as the Banks, from making dividend distributions without first obtaining regulatory approval if such distributions are not paid out of available earnings or would cause the institution to fail to meet applicable capital adequacy standards.

Each of CONA and COBNA, as an insured depository institution, is a member of the DIF maintained by the FDIC. Through the DIF, the FDIC insures the deposits of insured depository institutions up to prescribed limits for each depositor. The FDIC sets a Designated Reserve Ratio (“DRR”) for the DIF. To maintain the DIF, member institutions may be assessed an insurance premium, and the FDIC may take action to increase insurance premiums if the DRR falls below its required level.

Under regulations issued by the Federal Reserve, a BHC must serve as a source of financial and managerial strength to its subsidiary banks (the so-called “source of strength doctrine”). The Dodd-Frank Act codified this doctrine.

Under the “cross-guarantee” provision of the Financial Institutions Reform, Recovery and Enforcement Act of 1989 (“FIRREA”), insured depository institutions such as the Banks may be liable to the FDIC with respect to any loss incurred, or reasonably anticipated to be incurred, by the FDIC in connection with the default of, or FDIC assistance to, any commonly controlled insured depository institution. The Banks are commonly controlled within the meaning of the FIRREA cross-guarantee provision.

The Dodd-Frank Act provides the FDIC with liquidation authority that may be used to liquidate nonbank financial companies and BHCs if the Treasury Secretary, in consultation with the President and based on the recommendation of the Federal Reserve and another federal agency,other appropriate Federal Banking Agencies, determines that doing so is necessary, among other criteria, to mitigate serious adverse

effects on United StatesU.S. financial stability. Upon such a determination, the FDIC would be appointed receiver and must liquidate the company in a way that mitigates significant risks to financial stability and minimizes moral hazard. The costs of a liquidation of a financialthe company would be borne by shareholders and unsecured creditors and then, if necessary, by risk-based assessments on large financial companies. The FDIC has issued rules implementing certain provisions of its liquidation authority and may issue additional rules in the future.

COBNA is subject to regulation in foreign jurisdictions where it operates, currently in the United Kingdom and Canada.

In the United Kingdom, COBNA operates through COEP, which was established in 2000 and is an authorized payment institution regulated by the Financial Conduct Authority (“FCA”) under the Payment Services Regulations 20092017 and the Financial Services and Markets Act 2000. COEP’s indirect parent, Capital One Global Corporation, is wholly-owned by COBNA and is subject to regulation by the Federal Reserve as an “agreement corporation” under the Federal Reserve’s Regulation K.

In Canada, COBNA operates as an authorized foreign bank pursuant to the Bank Act (Canada) (“Bank Act”) and is permitted to conduct its credit card business in Canada through its Canadian branch, Capital One Bank (Canada Branch) (“Capital One Canada”). The primary regulator of Capital One Canada is the Office of the Superintendent of Financial Institutions Canada.Institutions. Other regulators include the Financial Consumer Agency of Canada (“FCAC”), the Office of the Privacy Commissioner of Canada, and the Financial Transactions and Reports Analysis Centre of Canada. Capital One Canada is subject to regulation under various Canadian federal laws, including the Bank Act and its regulations, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and the Personal Information Protection and Electronic Documents Act.

As part of our continuous efforts to review and improve our technologies, we may either develop such capabilities internally or rely on third-party outsourcers who have the ability to deliver technology that is of higher quality, lower cost, or both. We continue to rely on third-party outsourcers to help us deliver systems and operational infrastructure. These relationships include (but are not limited to): Amazon Web Services, Inc. (“AWS”) for our cloud infrastructure, Total System Services Inc.LLC (“TSYS”) for consumer and commercial credit card processing services for our North American and U.K. portfolios, of consumer, commercial and small business credit card accounts, Fidelity Information Services (“FIS”) for certain of our banking systems and International Business Machines Corporation (“IBM”) for mainframe managed services.

From time to time, we have made and will make forward-looking statements, including those that discuss, among other things, strategies, goals, outlook or other non-historical matters; projections, revenues, income, returns, expenses, capital measures, capital allocation plans, accruals for claims in litigation and for other claims against us; earnings per share, efficiency ratio, operating efficiency ratio, or other financial measures for us; future financial and operating results; our plans, objectives, expectations and intentions; and the assumptions that underlie these matters.

To the extent that any such information is forward-looking, it is intended to fit within the safe harbor for forward-looking information provided by the Private Securities Litigation Reform Act of 1995.

Numerous factors could cause our actual results to differ materially from those described in such forward-looking statements, including, among other things:

This section highlights specificsignificant factors, events, and uncertainties that make an investment in our securities risky. The events and consequences discussed in these risk factors could, in circumstances we may not be able to accurately predict, recognize, or control, have a material adverse effect on our business, growth, reputation, prospects, financial condition, operating results, cash flows, liquidity, and stock price. These risk factors do not identify all risks that we face; our operations could affect our business. Although we have tried to discuss all material risks of which we are aware at the time this Report has been filed, other risks may prove toalso be important in the future, including thoseaffected by factors, events, or uncertainties that are not presently known to us or that we currently ascertainable.do not consider to present significant risks to our operations. In addition, to the factors discussed elsewhere in this Report, other factors that could cause actual results to differ materially from our forward-looking statements include:global economic and political climate amplifies many of these risks.

We offer a broad array of financial products and services to consumers, small businesses and commercial clients. We market our credit card products on a national basis throughout the United States, Canada and the United Kingdom and offer banking and other services in many regions within the United States. A prolonged period of economic volatility, slow growth, or a significant deterioration in economic conditions, in the United States, Canada or one of these countriesthe United Kingdom, could have a material adverse effect on our financial condition and results of operations as customers default on their loans, or maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity.

Some of the risks we may face in connection with adverse changes and instability in the macroeconomic environment, include the following:

In the United Kingdom, changes in consumer behavior or an economic slowdown arising from the U.K.’s exit from the European Union (“Brexit”) could adversely affect our U.K. operations. The impact of Brexit and its full effects on us are uncertain and will depend on the post-Brexit relationships that the U.K. implements with the European Union (“EU”) and countries that are not a part of the EU. While Capital One does not have operations in any other EU jurisdictions, increased market volatility and global economic deterioration resulting from an uncontrolled Brexit could have a negative impact on our results of operations.

Our ability to borrow from other financial institutions or to engage in funding transactions on favorable terms or at all could be adversely affected by disruptions in the capital markets or other events, including actions by rating agencies and deteriorating investor expectations, which could limit our access to funding.

We are subject to heightenedextensive regulatory oversight by the federal banking regulators to ensure that we build systems and processes that are commensurate with the nature of our business and that meet the heightened risk management and enhanced prudential standards issued by our regulators. A wide array of banking and consumer lending laws apply to almost every aspect of our business. Failure to comply

with these laws and regulations could result in financial, structural and operational penalties, including significant fines and criminal sanctions, and/or damage to our reputation with regulators, our customers or the public. Hiring, training and retaining qualified compliance and legal personnel, and establishing and maintaining compliance-related systems, infrastructure and processes, is difficult and these efforts could limit our ability to invest in other business opportunities. Furthermore, applicable rules and regulations may affect us in an unforeseen manner, or may have a disproportionate impact on us as compared to our competitors. For example, over the last several years, state and federal regulators have focused on compliance with the Bank Secrecy Act and anti-money laundering laws, data integrity and security, use of service providers, fair lending and other consumer protection issues. In July 2015, Capital One entered into a consent order with the OCC to address concerns about our anti-money laundering (“AML”) program (“AML Program”). Although we are making substantial progressand in taking the steps and making the improvements requiredOctober 2018, Capital One paid a civil monetary penalty assessed by the OCC relating to our AML program. The OCC lifted the AML consent order we expect heightened oversight of our AML Program will continue for the foreseeable future.

We have a large number of customer accounts in our credit card and auto lending businesses and we have made the strategic choice to originate and service subprime credit cardscard and auto loans, which typically have higher delinquencies and charge-offs than prime customers. Accordingly,As a result, we have significant involvement with credit bureau reporting and the collection and recovery of delinquent and charged-off debt, primarily through customer communications, the filing of litigation against customers in default, the periodic sale of charged-off debt and vehicle repossession. The banking industry isThese activities are subject to enhanced legal and regulatory scrutiny regarding credit bureau reporting and debt collection practices from regulators, courts and legislators. Any future changes to our business practices in these areas, including our debt collection practices, whether mandated by regulators, courts, legislators or otherwise, or any legal liabilities resulting from our business practices, including our debt collection practices, could have a material adverse impact on our financial condition.

The legislative and regulatory environment is beyond our control, may change rapidly and unpredictably and may negatively influence our revenue, costs, earnings, growth, liquidity and capital levels. In addition, some rules and regulations may be subject to litigation or other challenges that delay or modify their implementation and impact on us. For example, the Tax Act has resultedAdoption of new technologies, such as distributed ledger technologies, artificial intelligence and machine learning technologies, can present unforeseen challenges in material impacts to our results of operations due to changes to the valuation of our deferred tax assets, the valuation of other tax assets,applying and tax expense, and may affect customer behavior and our ability to forecast our effective tax rate. Many aspects of the Tax Act are unclear and may not be clarified for some time. As a result, we have not yet been able to determine the full impact of the new lawsrelying on our business, operating results and financial condition. For example, in the United Kingdom and Europe, continued regulatory uncertainty or changes arising from Brexit negotiations could adversely affect our U.K. operations.existing compliance systems.

Like other lenders, we face the risk that our customers will not repay their loans. A customer’s ability and willingness to repay us can be negatively impactedadversely affected by increases in their payment obligations to other lenders, whether as a result of higher debt levels or rising interest rates, or by restricted availability of credit generally.generally, or by the revenue and income of the borrower. We may fail to quickly identify and reduce our exposure to customers that are likely to default on their payment obligations, and reduce our exposurewhether by closing credit lines andor restricting authorizations, which could adversely impact our financial condition and results of operations.authorizations. Our ability to manage credit risk also may be adverselyis affected by legal or regulatory changes (such as restrictions on collections, bankruptcy laws, minimum payment regulations and re-age guidance), competitors'competitors’ actions and consumer behavior, as well as inadequateand depends on the effectiveness of our collections staffing,staff, techniques and models.

Rising losses or leading indicators of rising losses (such as higher delinquencies, higher rates of non-performingnonperforming loans, higher bankruptcy rates, lower collateral values, or elevated unemployment rates)rates or changing market terms) may require us to increase our allowance for loan and lease losses, which may degrade our profitability if we are unable to raise revenue or reduce costs to compensate for higher losses. In particular, we face the following risks in this area:

Financial institutions are subject to extensive and complex capital and liquidity requirements. These requirements affect our ability to lend, grow deposit balances, or make acquisitions and limit our ability to make most capital distributions. HigherFailure to maintain adequate capital or liquidity levels, also lowerwhether due to adverse developments in our return on equity.

Our ability to retain and attract new customers depends on our ability to build or acquire necessary operational, technologicaldevelop, operate, and adapt our technology and organizational infrastructure or adapt to technological advances involving such infrastructure, which can bein a challenge due to the fast pacerapidly changing environment. In addition, we must accurately process, record and monitor an increasingly large number of digital transformation and advances. We are embeddingcomplex transactions. Digital technology, data and software development are deeply embedded into our business model and how we work.

Similar to other large corporations, we are exposed to operational risk that can manifest itself in many ways, such as errors related to failed orin execution, inadequate processes, inaccurate models, faulty or disabled computer systems,technological infrastructure, and fraud by employees or persons outside of our company and exposure to external events.company. In addition, we are heavily dependent on the security, capability and continuous availability of the technology systems that we use to manage our internal financial and other systems, interfacemonitor risk and compliance with regulatory requirements, provide services to our customers, and develop and implement effective marketing campaigns.offer new products and communicate with stakeholders.

In addition,If we do not maintain the necessary operational, technological and organizational infrastructure to operate our businesses are dependent on our abilitybusiness, including to process, record and monitor a large numbermaintain the security of complex transactions. If any of our financial, accounting or other data processing systems fail or have other significant shortcomings,that infrastructure, our business and reputation could be materially adversely affected. We may also beare subject to disruptions ofto our operating systems arising from events that are wholly or partially beyond our control, which may include for example, computer viruses, or electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks including(including Distributed Denial of Service (“DDOS”) and other attacks on our infrastructure as discussed below,below), natural disasters, other damage to property or physical assets, or events arising from local or larger scale politics, including terrorist acts. Any failure to maintain our infrastructure or disruption of these occurrencesour operating systems and applications could diminish our ability to operate our businesses, service customer accounts and protect customers’ information, or result in potential liability to customers, reputational damage, regulatory intervention and customers’ loss of confidence in our businesses, any of which could result in a material adverse effect.

We also rely on the business infrastructure and systems of third parties with which we do business and to whom we outsource the operation, maintenance and development of operationalour information technology and technological functionality. For example, wecommunications systems. We have migrated a number of,substantially all, and intend to migrate substantially all, of our core information technology systems and customer-facing applications to third-party cloud infrastructure platforms, such as Amazon Web Services, Inc.principally AWS. If we do not executecomplete the transition or fail to administer these new environments in a well-managed, secure and effective manner, or if AWS platforms become unavailable or do not meet their service level agreements for any reason, we may experience unplanned service disruption or unforeseen costs which maycould result in material harm to our business and operating results.results of operations. We must successfully develop and maintain information, financial reporting, disclosure, data-protection and other

Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones and to run our business in compliance with applicable laws and regulations depends on the functionality and reliability of our operational and technology systems. Any disruptions, failures or inaccuracies of our operational and technology systems and models, including those associated with improvements or modifications to such systems and models, could cause us to be unable to market and manage our products and services, manage our risk, meet our regulatory obligations or report our financial results in a timely and accurate manner, all of which could have a negative impact on our results of operations. In addition, our ongoing investments in infrastructure, which are necessary to maintain a competitive business, integrate acquisitions and establish scalable operations, may increase our expenses. As our business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business strategies, management of outsourced services, asset purchases or other acquisitions, structural reorganization, compliance with new laws or regulations, or the integration of newly acquired businesses.businesses, or the occurrence of incidents such as the Cybersecurity Incident. If we are unable to successfully manage our expenses, our financial results will be negatively affected.

Our products and services involve the gathering, management,authenticating, managing, processing, and the storage and transmission of sensitive and confidential information regarding our customers and their accounts, our employees and other third parties with which we do business. Our ability to provide such products and services, many of which are web-based, depends upon the management and safeguarding of information, software, methodologies and business secrets. To provide these products and services to, as well as communicate with, our customers, we rely on information systems and infrastructure, including software and data engineering, and information security personnel, digital technologies, computer and email systems, software, networks and other web-based technologies, that we and third-party service providers operate.technologies. We also have arrangements in place with third parties through which we share and receive information about their customers who are or may become our customers.

Like other financial services firms, technologies,Technologies, systems, networks and devices of Capital One or our customers, employees, service providers or other third parties with whom we interact continue to be the subject of attempted unauthorized access, mishandling or misuse of information, denial-of-service attacks, computer viruses, website defacement, hacking, malware, ransomware, phishing or other forms of social engineering, and other forms of cyber-attacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and other events. These threats, such as the Cybersecurity Incident, may derive from human error, fraud or malice on the part of our employees, insiders or third parties or may result from accidental technological failure. Any of these parties may also attempt to fraudulently induce employees, customers, or other third-party users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or third parties with whom we interact.interact, or to unlawfully obtain monetary benefit through misdirected or otherwise improper payment. Further, cyber and information security risks for large financial institutions like us have generally increased in recent years in part because ofcontinue to increase due to the proliferation of new technologies, the use of the Internet and telecommunications technologiesinternet to conduct financial transactions, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other external parties. In addition, toour customers access our products and services our customers may useusing computers, smartphones, tablet PCstablets, and other mobile devices that are beyond our security control systems.

As a financial institution, we are subject to and examined for compliance with an array of data protection laws, regulations and guidance, as well as to our own internal privacy and information security policies and programs. However, because theThe methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and persist for an extended period of time before being detected,detected. For example, although we immediately fixed the configuration vulnerability that was exploited in the Cybersecurity Incident once we discovered the unauthorized access, a period of time elapsed between the occurrence of the unauthorized access and the time when we discovered it. In other circumstances, we and our third-party service providers and partners may be unable to anticipate or identify certain attack methods in order to implement effective preventative measures or mitigate or remediate the damages caused in a

timely manner. We may also be unable to hire and develop talent capable of detecting, mitigating or remediating these risks. Although we believe we haveseek to maintain a robust suite of authentication and layered information security controls, including our cyber threat analytics, data encryption and tokenization technologies, anti-malware defenses and vulnerability management program, any one or combination of these controls could fail to detect, mitigate or remediate these risks in a timely manner. We maywill likely face an increasing number of attempted cyber-attacks as we expand our

A disruption or breach, including as a result of a cyber-attack such as the Cybersecurity Incident, or media reports of perceived security vulnerabilities at Capital One or at third-party service providers, could result in significant legal and financial exposure, regulatory intervention, litigation and remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business. We and other U.S. financial services providers continue to be targeted with evolving and adaptive cybersecurity threats from sophisticated third parties. Although we have not experienced any material losses relatingWe are continuing to cyber incidents,assess the impact of the Cybersecurity Incident and there can be no assurance that additional unauthorized access or cyber incidents will not occur or that we will not suffer suchmaterial losses in the future. Unauthorized access or cybercybersecurity incidents could occur more frequently and on a more significant scale. If future attacks like these are successful or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services. In addition, a breach or attack affecting one of our third-party service providers or partners could harm our business even if we do not control the service that is attacked.

In addition, the increasing prevalence and the evolution of cyber-attacks and other efforts to breach or disrupt our systems or those of our partners, retailers or other market participants has led, and will likely continue to lead, to increased costs to us with respect to preventing, mitigating and remediating these risks, as well as any related attempted fraud. We may be requiredIn order to address ongoing and future risks, including from the Cybersecurity Incident, we must expend significant additional resources to continue to modify or strengthen oursupport protective security measures, investigate and remediate any vulnerabilities of our information systems and infrastructure orand invest in new technology designed to mitigate security risks. For example, various retailers have continued to be victims of cyber-attacks in which customer data, including debit and credit card information, was obtained. In these situations, we incur a variety of costs, including those associated with replacing the compromised cards and remediating fraudulent transaction activity. Further,The Cybersecurity Incident, or successful cyber-attacks at other large financial institutions or other market participants whether(whether or not we are impacted,impacted), could lead to a general loss of customer confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the financial system in general which could result in reduced use of our financial products. Though weWe have insurance against some cyber-risks and attacks, itincluding insurance that is expected to cover certain costs associated with the Cybersecurity Incident; nonetheless, our insurance coverage may not be sufficient to offset the impact of a material loss event.event, and such insurance may increase in cost or cease to be available on commercial terms in the future.

IfA breach, failure or other disruption of our information systems or infrastructure or data management processes, or those of our customers, partners, service providers or other market participants, experience a significant disruption or breach, it could lead, depending on the nature of the disruption or breach,incident, to the unauthorized or unintended access to and release, gathering, monitoring, misuse, loss or destruction of personal or confidential data about our customers, employees or other third parties in our possession. Any party that obtains this personal or confidential data through a breach or disruption may use this information for ransom, to be paid by us or a third-party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes. Further, such disruption or breach could also result in unauthorized access to our proprietary information, intellectual property, software, methodologies and business secrets and in unauthorized transactions in Capital One accounts or unauthorized access to personal or confidential information maintained by those entities. For example, thereThere has been a significant proliferation of consumer information available on the Internetinternet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. While Capital One waswe were not directly involved in these third-party breach events, the stolen information can create a vulnerability for our customers if their Capital One log-in credentials are the same as or similar to the credentials that have been compromised on other sites. This vulnerability could include the risk of unauthorized account access, data loss and fraud. The use of artificial intelligence, “bots” or other automation software, or “bots,” can increase the velocity and efficacy of these types of attacks. A

We are continuing to assess the impact of the Cybersecurity Incident. The Cybersecurity Incident, other data protection incident,security incidents we may experience in the future, or media reports of perceived security vulnerabilities at Capital One or at third-party service providers, could result in significant legal and financial exposure, regulatory intervention, remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business.

We regularly move data across national borders to conduct our operations, and consequently are subject to a variety of continuously evolving and developing laws and regulations in the United States and abroad regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer and security of personal data. Significant uncertainty exists as privacy and data protection laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements. For example, in Canada we are subject to the GDPR, which becomes effective in May 2018, extendsPersonal Information Protection and Electronic Documents Act (“PIPEDA”). In addition, the scope of theGeneral Data Protection Regulation (“GDPR”) applies EU data protection law to all companies processing data of EU residents, regardless of the company’s location. The law requiresMore recently, on January 1, 2020, the CCPA went into effect for companies to meet newdoing business in California. These laws impose strict requirements regarding the collection, storage, handling, use, disclosure, transfer and security of personal data, which may have adverse consequences, including new rights such as the “portability” of personal data.severe monetary penalties. Our efforts to comply with PIPEDA, GDPR, CCPA and other privacy and data protection laws may entail substantial expenses,

Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry and the structure of the credit card industry and business practices in the mortgage business.industry. Given the inherent uncertainties involved in litigation, government investigations and regulatory enforcement decisions, and the very large or indeterminate damages sought in some matters asserted against us, there can be significant uncertainty as to the ultimate liability we may incur from these kinds of matters. The finding, or even the assertion, of substantial legal liability against us could have a material adverse effect on our business and financial condition and could cause significant reputational harm to us, which could seriously harm our business. The Cybersecurity Incident has resulted in litigation, government investigations and other regulatory enforcement inquiries.

In addition, financial institutions, including us, have facedsuch as ourselves, face significant regulatory scrutiny, over the past several years, which has increasingly ledcan lead to public enforcement actions. We and our subsidiaries are subject to comprehensive regulation and periodic examination by the Federal Reserve, the SEC, OCC, FDIC and CFPB. We have been subject to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including governmental inquiries, investigations and enforcement proceedings, including by the OCC, Department of Justice, Financial Crimes Enforcement Network (“FinCEN”) and state Attorneys General.

We operate in a highly competitive environment, whether in making loans, attracting deposits or in the global payments industry, and we expect competitive conditions to continue to intensify with respect to most of our products. We compete on the basis of the rates we pay on deposits and the rates and other terms we charge on the loans we originate or purchase, as well as the quality and range of our customer service, products, innovation and experience. This increasingly competitive environment is primarily a result of changes in technology, product delivery systems and regulation, as well as the emergence of new or significantly larger financial serviceservices providers, all of which may affect our customers’ expectations and demands. In addition to offering competitive products and services, we invest in and conduct marketing campaigns to attract and inform customers.

Some of our competitors, including new and emerging competitors in the digital and mobile payments space and other financial technology providers, are not subject to the same regulatory requirements or legislative scrutiny to which we are subject, which also could place us at a competitive disadvantage, in particular in the development of new technology platforms or the ability to rapidly innovate. We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital or “crypto” currencies, prepaid systems and payment services targeting users of social networks, communications platforms and online gaming (including, for example, those offering payment through mobile phone accounts).gaming. If we are unable to continue to keep pace with innovation, do not effectively market our products and services or are prohibited from or unwilling to enter emerging areas of competition, our business and results of operations could be adversely affected.

Some of our competitors are substantially larger than we are, which may give those competitors advantages, including a more diversified product and customer base, the ability to reach out to more customers and potential customers, operational efficiencies,

As of December 31, 2017,2019, we operate as one of the largest online direct bankbanks in the U.S.United States by deposits. While direct banking representsprovides a significant opportunity to attract new customers that value greater and more flexible access to banking services at reduced costs, we face strong and increasing competition in the direct banking market. Aggressive pricing throughout the industry may adversely affect the retention of existing balances and the cost-efficient acquisition of new deposit funds and may affect our growth and profitability. In addition, the effects of a competitive environment may be exacerbated by the flexibility of direct banking and the increasing financial and technological sophistication of our customer base. Customers could also close their online accounts or reduce balances or deposits in favor of products and services offered by competitors for other reasons. These shifts, which could be rapid, could result from general dissatisfaction with our products or services, including concerns over pricing, online security or our reputation. The potential consequences of this competitive environment are exacerbated by the flexibility of direct banking and the financial and technological sophistication of our online customer base.

In our credit card business, competition for rewards customers may result in higher rewards expenses, or we may fail to attract new customers or retain existing rewards customers due to increasing competition for these consumers. We have expanded the loan portfolio in our credit card partnership business over the past several years with the additions of a number of credit cardlarge partnerships. The market for key business partners, especially in the credit card business, is very competitive, and we may not be able to grow or maintain these partner relationships.

We face the risk that we could lose partner relationships, even after we have invested significant resources, time and expense into acquiring and developing the relationships. The loss of any of our key business partners could have a negative impact on our results of operations, including lower returns, excess operating expense and excess funding capacity.

Some of our competitors have developed, or may develop, substantially greater financial and other resources than we have, may offer richer value propositions or a wider range of programs and services than we offer or may use more effective advertising, marketing or cross-selling strategies to acquire and retain more customers, capture a greater share of spending and borrowings, attain and develop more attractive cobrand card programs and maintain greater merchant acceptance than we have. We may not be able to compete effectively against these threats or respond or adapt to changes in consumer spending habits as effectively as our competitors.

In such a competitive environment, we may lose entire accounts or may lose account balances to competing firms, or we may find it more costly to maintain our existing customer base. Customer attrition from any or all of our lending products, together with any lowering of interest rates or fees that we might implement to retain customers, could reduce our revenues and therefore our earnings. Similarly, unexpected customer attrition from our deposit products, in addition to an increase in rates or services that we may offer to retain deposits, may increase our expenses and therefore reduce our earnings.

Credit card interchange fees are generally one of the largest components of the costs that merchants pay in connection with the acceptance of credit cards and are a meaningful source of revenue for our credit card businesses. Interchange fees are the subject of significant and intense global legal, regulatory and legislative focus, and the resulting decisions, regulations and legislation may have a material adverse impact on our overall business, financial condition and results of operations.

Regulators and legislative bodies in a number of countries are seeking to reduce credit card interchange fees through legislation, competition-related regulatory proceedings, central bank regulation and or litigation. Interchange reimbursement rates in the United States are set by credit card networks such as MasterCard and Visa. In some jurisdictions, such as Canada and certain countries in the European Union,EU, interchange fees and related practices are subject to regulatory activity that havehas limited the ability of certain networks to establish default rates, including in some cases imposing caps on permissible interchange fees. We have already experienced these impacts in our international credit card portfolio.businesses. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the payments industry. Consequently, a development in one country, state or region may influence regulatory approaches in another, such as our primary market, the United States.

Some major retailers may have sufficient bargaining power to independently negotiate lower interchange fees with MasterCard and Visa, which could, in turn, result in lower interchange fees for us when our cardholders undertake purchase transactions with these retailers. In 2016, some of the largest merchants individually negotiated lower interchange rates with MasterCard and/or Visa. These and other merchants also continue to lobby aggressively for caps and restrictions on interchange fees and there can be no assurance that their efforts will notmay be successful or that they will notmay in the future bring legal proceedings against us or other credit card and debit card issuers and networks.

Beyond pursuing litigation, legislation and regulation, merchants may also promote forms of payment with lower fees, such as ACH-based payments, or seek to impose surcharges at the point of sale for use of credit or debit cards. New payment systems, particularly mobile-based payment technologies, could also gain widespread adoption and lead to issuer transaction fees or the displacement of credit card accounts as a payment method.

The heightened focus by merchants and regulatory and legislative bodies on the fees charged by credit and debit card networks, and the ability of certain merchants to successfully negotiate discounts to interchange fees with MasterCard and Visa or develop alternative payment systems, could result in a reduction of interchange fees. Any resulting loss in income to us could have a material adverse effect on our business, financial condition and results of operations.

Our industry is subject to rapid and significant technological changes and our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings. We expect digital technologies to have a significant impact on banking over time. Consumers increasingly expect robust digital experiences from their financial services providers. The ability for customers to access their accounts and conduct financial transactions using digital technology, including mobile applications, is an increasingly important aspect of the financial services industry and it impacts our ability to deliver products and services to our customers. To that end, financial institutions are rapidly introducing new digital and other technology-driven products and services whichthat aim to offer a better customer experience and to reduce costs. We continue to invest in digital technology designed to attract new customers, facilitate the ability of existing customers to conduct financial transactions and enhance the customer experience related to our products and services.

We have engaged in merger and acquisition activity and entered into strategic partnerships over the past several years and may continue to engage in such activity in the future.years. We continue to evaluate and anticipate engaging in, among other merger and acquisition activity, additional strategic partnerships and selected acquisitions of financial institutions and other financial assets,

Any merger, acquisition or strategic partnership we undertake entails certain risks, which may materially and adversely affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our existing operations, or are not able to achieve the anticipated benefits of any merger, acquisition or strategic partnership, including cost savings and other synergies, our business could be negatively affected. In addition, it is possible that the ongoing integration processes could result in the loss of key employees, errors or delays in systems implementation, exposure to cybersecurity risks associated with acquired businesses, exposure to additional regulatory oversight, the disruption of our ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect our ability to maintain relationships with partners, clients, customers, depositors and employees or to achieve the anticipated benefits of any merger, acquisition or strategic partnership.

Integration efforts also may divert management attention and resources. These integration matters may have an adverse effect on us during any transition period.

In addition, we may face the following risks in connection with any merger, acquisition or strategic partnership:

We did not have any sales of unregistered equity securities in 2017.2019.