Capital One Financial Corporation, a Delaware corporation established in 1994 and headquartered in McLean, Virginia, is a diversified financial services holding company with banking and non-banking subsidiaries. Capital One Financial Corporation and its subsidiaries (the “Company” or “Capital One”) offer a broad array of financial products and services to consumers, small businesses and commercial clients through branches, the internetdigital channels, branch locations, Cafés and other distribution channels.

As of December 31, 2017,2021, our principal subsidiaries included:

The Company is hereafter collectively referred to as “we,” “us” or “our.” COBNA and CONA are collectively referred to as the “Banks.” References to “this Report” or our “2017“2021 Form 10-K” or “2017“2021 Annual Report” are to our Annual Report on Form 10-K for the fiscal year ended December 31, 2017.2021. All references to 2017, 2016, 2015, 20142021, 2020 and 2013,2019, refer to our fiscal years ended, or the dates, as the context requires, December 31, 2017,2021, December 31, 2016, December 31, 2015, December 31, 20142020 and December 31, 2013,2019, respectively. Certain business terms used in this document are defined in the “MD&A—Glossary and Acronyms” and should be read in conjunction with the Consolidated Financial Statements included in this Report.

We also offer products and services outside of the U.S. principally through Capital One (Europe) plc (“COEP”), an indirect subsidiary of COBNA organized and located in the United Kingdom (“U.K.”), and through a branch of COBNA in Canada. Both COEP and our Canadian branch of COBNA in Canada have the authority to provide credit card loans.

We regularly explore and evaluate opportunities to acquire financial products and services andas well as financial assets, including credit card and other loan portfolios, and enter into strategic partnerships as part of our growth strategy. We also explore opportunities to acquire digitaltechnology companies and related assets to improve our information technology infrastructure and to deliver on our digital strategy. We may issue equity or debt to fund our acquisitions. In addition, we regularly consider the potential disposition of certain of our assets, branches, partnership agreements or lines of business. We may issue equity or debt, including public offerings, to fund our acquisitions.

On December 1, 2015,The COVID-19 pandemic resulted in a global public-health crisis, disrupting economies and introducing significant volatility into financial markets. We transformed how we completedwork in order to protect the acquisitionwell-being of our associates and our customers, and were able to continue to serve our customers, successfully manage critical functions, and keep our lines of business operating.

Since the start of the HealthcareCOVID-19 pandemic, a significant majority of our associates across our workforce have transitioned to working remotely, relying on our technology infrastructure and systems that have been designed for resilience and security. The majority of our associates continue to work remotely. In the future, we plan to adopt a hybrid work methodology that allows for in-office collaboration while still enabling associates to work remotely. We continue to monitor local conditions to ensure the safety of our associates.

Our common stock trades on the New York Stock Exchange (“NYSE”) under the symbol “COF” and is included in the Standard & Poor’s (“S&P”) 100 Index. We maintain a website at www.capitalone.com. Documents available under Corporate Governance“Governance & Leadership” in the Investor Relations section of our website include:

These documents also are available in print to any stockholder who requests a copy. We intend to disclose future amendments to certain provisions of our Code of Business Conduct and Ethics, andon the website following the date of the amendment. If applicable, we would publicly disclose any waivers of our Code of Business Conduct and Ethics granted to executive officers and directors, on the website within four business days following the date of the amendment or waiver.directors.

In addition, we make available free of charge through our website all of our U.S. Securities and Exchange Commission (“SEC”) filings, including our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports, as soon as reasonably practicable after electronically filing or furnishing such material to the U.S. Securities and Exchange Commission (“SEC”).

Our consolidated total net revenues are derived primarily from lending to consumer and commercial customers net of funding costs associated with our deposits, short-term borrowingslong-term debt and long-term debt.other borrowings. We also earn non-interest income which primarily consists of interchange income, net of reward expenses, and service charges and other customer-related fees. Our expenses primarily consist of the provision for credit losses, operating expenses, marketing expenses and income taxes.

Our principal operations are organized for management reporting purposes into three primarymajor business segments, which are defined primarily based on the products and services provided or the typetypes of customercustomers served: Credit Card, Consumer Banking and Commercial Banking. The operations of acquired businesses have been integrated into or managed as a part of our existing business segments. Certain activities that are not part of a segment, such as management of our corporate investment portfolio and asset/liability management by our centralized Corporate Treasury group, andare included in the Other category. Other category also includes unallocated corporate expenses that do not directly support the operations of the business segments or for which the business segments are not considered financially accountable in evaluating their performance, such as certain restructuring charges, as well as residual tax expense or benefit to arrive at the consolidated effective tax rate that is not assessed to our primary business segments, are included in the Other category.segments.

Customer usage and payment patterns, estimates of future expected credit quality,losses, levels of marketing expense and operating efficiency all affect our profitability. In our Credit Card business, we experience fluctuations in purchase volume and the level of outstanding loan receivables due to seasonal variances in consumer spending and payment patterns which, for example, arehave historically been the highest around the winter holiday season. No individual quarter in 2017, 2016 or 2015 accounted for more than 30% of our total revenues in any of these fiscal years. Net charge-off rates infor our Credit Card and Consumer Banking businessescredit card loan portfolio also have historically exhibited seasonal patterns as well and generally tend to be the highest in the first and fourth quartersquarter of the year.

Each of our business segments operates in a highly competitive environment, and we face competition in all aspects of our business from numerous bank and non-bank providers of financial services.

Our Consumer Banking and Commercial Banking businesses compete with national, state and direct banks for deposits, commercial and auto loans, as well as with savings and loan associations and credit unions for loans and deposits. Our competitors also include automotive finance companies, commercial mortgage banking companies and other financial services providers that provide loans, deposits, and other similar services and products. In addition, we compete against non-depository institutions that are able to offer these products and services. Securities firms

We also consider new and insuranceemerging companies that elect to become financial holding companies may acquire banksin digital and mobile payments and other financial institutions. Combinationstechnology providers among our competitors. We compete with many forms of this type could significantly change the competitive environment in which we conduct business. The financial services industry is also likely to become more competitive as further technological advances enable more companies to provide financial services. These technological advances may diminish the importance of depository institutionspayment mechanisms, systems and other financial intermediaries in the transfer of funds between parties. In addition, competition among direct banks is intense because online banking provides customers the ability to rapidly deposit and withdraw funds and open and close accounts in favor of products, and services offered by competitors.both bank and non-bank providers.

Capital One Financial Corporation is a bank holding company (“BHC”) and a financial holding company (“FHC”) under the Bank Holding Company Act of 1956, as amended (“BHC Act”), and is subject to the requirements of the BHC Act, including approval requirements for investments in or acquisitions of banking organizations, capital adequacy standards and limitations

on nonbankingnon-banking activities. As a BHC and FHC, we are subject to supervision, examination and regulation by the Board of Governors of the Federal Reserve System (“Federal Reserve”). Permissible activities for a BHC include those activities that are so closely related to banking as to be a proper incident thereto. In addition, ana FHC is permitted to engage in activities considered to be financial in nature (including, for example, securities underwriting and dealing and merchant banking activities), incidental to financial activities or, if the Federal Reserve determines that they pose no risk to the safety or soundness of depository institutions or the financial system in general, activities complementary to financial activities.

To become and remain eligible for financial holding companyFHC status, a BHC and its subsidiary depository institutions must meet certain criteria, including capital, management and Community Reinvestment Act (“CRA”) requirements. Failure to meet such criteria could result, depending on which requirements were not met, in the Company facing restrictions on new financial activities or acquisitions or being required to discontinue existing activities that are not generally permissible for BHCs.

We also are also registered as a financial institution holding company under the lawlaws of the Commonwealth of Virginia and, as such, we are subject to periodic examination by the Virginia Bureau of Financial Institutions. We also face regulation in the international jurisdictions in which we conduct business (see below underbusiness. See “Regulation of Businesses by Authorities Outside the United States”). below for additional details.

The business activities of the Company and the Banks are also subject to regulation and supervision under various laws and regulations.

The activities of the Banks as consumer lenders are subject to regulation under various federal laws, including, for example, the Truth in Lending Act (“TILA”), the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the CRA, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank Act”), the Servicemembers Civil Relief Act and the Military Lending Act, as well as under various state laws. We are also subject to the Credit Card Accountability Responsibility and Disclosure Act, whichTILA, as amended, the TILA, and which imposes a number of restrictions on credit card practices impacting rates and fees, requires that a consumer’s ability to pay be taken into account before issuing credit or increasing credit limits, and imposes revised disclosures required for open-end credit.

Depending on the underlying issue and applicable law, regulators may be authorized to impose penalties for violations of these statutes and, in certain cases, to order banks to compensate customers. Borrowers may also have a private right of action for certain violations. Federal bankruptcy and state debtor relief and collection laws may also affect the ability of a bank, including the Banks, to collect outstanding balances owed by borrowers.

The Dodd-Frank Act requires that the amount of any interchange fee received by a debit card issuer with respect to debit card transactions be reasonable and proportional to the cost incurred by the issuer with respect to the transaction. Final rulesRules adopted by the Federal Reserve to implement these requirements limit interchange fees per debit card transaction to $0.21 plus five basis points of the transaction amount and provide for an additional $0.01 fraud prevention adjustment to the interchange fee for issuers that meet certain fraud prevention requirements.

In addition, significant uncertainty exists as privacy, data protection and data security laws may be interpreted and applied differently from country to country or state to state and may create inconsistent or conflicting requirements. For example, in the United States we are subject to the Gramm-Leach Bliley Act (“GLBA”), among other laws and USA PATRIOTregulations, at the federal level, and in Canada we are subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”). In addition, the European Union (“EU”) General Data Protection Regulation (“GDPR”) applies EU data protection laws to companies that process data of 2001EU residents, and we also are subject to the U.K. General Data Protection Regulation (“U.K. GDPR”). At the U.S. state level, we are subject to a number of laws and regulations, such as the California Consumer Privacy Act (“CCPA”), which became effective on January 1, 2020. The CCPA and its implementing regulations, as amended by the California Privacy Rights Act (“CPRA”) (which will take effect in most material respects on January 1, 2023), create obligations on covered companies to, among other things, share certain information they have collected about individuals who are California residents with those individuals, subject to some exceptions. Many other states have also enacted or are considering enactment of state-level privacy, data protection and/or data security laws and regulations, with which we may be required to comply.

The Bank Secrecy Act and the USA PATRIOT Act of 2001 (“Patriot Act”) require financial institutions, among other things, to implement a risk-based program reasonably designed to prevent money laundering and to combat the financing of terrorism, including through suspicious activity and currency transaction reporting, compliance, record-keeping and customer due diligence.

Under the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), as discussed in “MD&A—Liquidity Risk Profile,” only well-capitalizedwell capitalized and adequately capitalized institutions may accept brokered deposits. Adequately capitalized institutions, however, must obtain a waiver from the FDIC before accepting brokered deposits, and such institutions may not pay rates that significantly exceed the rates paid on deposits of similar maturity obtained from the institution’s normal market area or, for deposits obtained from outside the institution’s normal market area, the national rate on deposits of comparable maturity. In December 2020, the FDIC finalized amendments to the brokered deposit regulation that, among other things, generally clarify and narrow the scope of the “deposit broker” definition. The amendments became effective April 1, 2021, with compliance required by January 1, 2022.

The FDIC is authorized to terminate a bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance would likely have a material adverse effect on a bank’s liquidity

Certain of our nonbanknon-bank subsidiaries are subject to supervisionregulation and regulationsupervision by various other federal and state authorities. Capital One Securities,Investing, Inc. and (formerly known as United Income, Inc.) (“Capital One Investing,Investing”) is an investment adviser registered with the SEC and primarily regulated under the Investment Advisers Act of 1940.

Capital One Securities, Inc., KippsDeSanto & Company and TripleTree, LLC are registered broker-dealers regulated by the SEC and the Financial Industry Regulatory Authority. OurThese broker-dealer subsidiaries are subject, among other things, to net capital rules designed to measure the general financial condition and liquidity of a broker-dealer. Under these rules, broker-dealers are required to maintain the minimum net capital deemed necessary to meet their continuing commitments to customers and others, and to keep a substantial portion of their assets in relatively liquid form. These rules also limit the ability of a broker-dealer to transfer capital to its parent companies and other affiliates. Broker-dealers are also subject to regulations covering their business operations, including sales and trading practices, public offerings, publication of research reports, use and safekeeping of client funds and securities, capital structure, record-keeping and the conduct of directors, officers and employees.

TheTitle VII of the Dodd-Frank Act establishes a regulatory framework for the governance of the over-the-counter (“OTC”) derivatives market, including swaps and security-based swaps and the registration of certain market participants as a swap dealer. CONA provisionally registered with the Commodity Futures Trading Commission (“CFTC”(the “CFTC”) as a swap dealer in the third quarter of 2020. Registration as a swap dealer subjects CONA to additional regulatory requirements with respect to its swaps and other derivatives activities. As a result of CONA’s swap dealer registration, it is subject to the SEC have jointly issued final rules further definingof the Dodd-Frank Act’s “swap dealer” definitions. Based on theseOCC concerning capital and margin requirements for swap dealers, including the mandatory exchange of variation margin and initial margin with certain counterparties. Additionally, as a provisionally registered swap dealer, CONA is subject to requirements under the CFTC’s regulatory regime, including rules no Capital One entity is currently requiredregarding business conduct standards, recordkeeping obligations, regulatory reporting and procedures relating to swaps trading. CONA’s swaps and other derivatives activities do not require it to register with the CFTC or SEC as a security-based swap dealer. The Dodd-Frank

There are various legal restrictions on the extent to which we and our non-bank subsidiaries may borrow or otherwise engage in certain types of transactions with the Banks. Under the Federal Reserve Act also requires all swap market participantsand Federal Reserve regulations, the Banks and their subsidiaries are subject to keepquantitative and qualitative limits on extensions of credit, purchases of assets, and certain swap transaction recordsother transactions involving its non-bank affiliates. In addition, transactions between the Banks and report pertinent informationtheir non-bank affiliates are required to swap data repositoriesbe on a real-timearm’s length terms and on-going basis. Further, each swap, group, category, type or class of swap that the CFTC or SEC determines must be cleared through a derivatives clearinghouse (unless the swap is eligible for a clearing exemption) must also be executed on a designated contract market (“DCM”), exchange or swap execution facility (“SEF”), unless no DCM, exchange or SEF has made the swap available for trading.consistent with standards of safety and soundness.

We and each of our subsidiaries, including the Banks, are subject to the “Volcker Rule,” a provision of the Dodd-Frank Act that contains prohibitions on proprietary trading and certain investments in, and relationships with, covered funds (hedge funds, private equity funds and similar funds), subject to certain exemptions, in each case as the applicable terms are defined in the

Volcker Rule and the implementing regulations. The implementing regulations also require that we as a banking entity with $50 billion or more in total assets, establish and maintain an enhanceda compliance program designed to ensure that we complyadherence with the requirements of the regulations.

In December 2010,The Company and the Banks are subject to the regulatory capital requirements established by the Federal Reserve and the OCC respectively (the “Basel III Capital Rules”). The Basel III Capital Rules implement certain capital requirements published by the Basel Committee on Banking Supervision (“Basel Committee”) published a framework for additional capital and liquidity requirements (“Basel III”), which included detailed capital ratios and buffers, subject to transition periods. The Federal Reserve, OCC and FDIC (collectively,along with certain provisions of the “Federal Banking Agencies”) issued a final rule that implemented Basel III and certain Dodd-Frank Act and other capital provisionsprovisions.

Under the Basel III Capital Rules, we must maintain a minimum common equity Tier 1 (“CET1”) capital ratio of 4.5%, a Tier 1 capital ratio of 6.0%, and updateda total capital ratio of 8.0%, in each case in relation to risk-weighted assets. In addition, we must maintain a minimum leverage ratio of 4.0% and a minimum supplementary leverage ratio of 3.0%. We are also subject to the capital conservation buffer and countercyclical capital buffer requirements, as described below.

The Banks, as subsidiaries of a Category III institution, are Category III banks. Moreover, the Banks, as insured depository institutions, are subject to prompt corrective action (“PCA”) framework to reflect the new regulatory capital minimums (“Baselregulations, as further described below.

As a Category III Capital Rule”). The Basel III Capital Rule increased the minimum capital that we and other institutions are required to hold. The Basel III Capital Rule includes the “Basel III Standardized Approach” and the “Basel III Advanced Approaches.”

The Basel III Capital Rules require banking institutions to maintain a capital conservation buffer, composed of CET1 capital, above the regulatory minimum ratios. In October 2017,March 2020, the Federal Reserve issued a final rule to implement the stress capital buffer requirement (the “Stress Capital Buffer Rule”). The stress capital buffer requirement is institution-specific and replaces the fixed 2.5% capital conservation buffer previously in place for BHCs.

Under the Stress Capital Buffer Rule framework, the Company’s “standardized approach capital conservation buffer” includes its stress capital buffer requirement (which will be recalibrated every year based on the Company’s supervisory stress test results), any G-SIB Surcharge (which is not applicable to us) and the countercyclical capital buffer requirement (which is currently set at 0%). Any determination to increase the countercyclical capital buffer generally would be effective twelve months after the announcement of such an increase, unless the Federal Banking Agencies proposed certain limited changes to the Basel III Capital Rule. There is uncertainty regarding how any of the proposed changes may impact the Basel III Standardized Approach and the Basel III Advanced Approaches.

The “Market Risk Rule” supplements both the Basel III Standardized Approach and the Basel III Advanced ApproachesCapital Rules by requiring institutions subject to the Market Risk Rulerule to adjust their risk-based capital ratios to reflect the market risk in their trading portfolios.book. The Market Risk Rule generally applies to institutions with aggregate trading assets and liabilities equal to the lesser of:

The FDICIA requires the Federal Banking Agencies to take “prompt corrective action” for banks that do not meet minimum capital requirements. The FDICIA establishes five capital ratio levels: well capitalized; adequately capitalized; undercapitalized; significantly undercapitalized; and critically undercapitalized. The three undercapitalized categories are based upon the amount by which a bank falls below the ratios applicable to an adequately capitalized institution. The capital categories are determined solely for purposes of applyingrelate to the FDICIA’s PCA provisions, and such capital categories may not constitute an accurate representation of the Banks’ overall financial condition or prospects.

As an additional means to identify problems in the financial management of depository institutions, the FDICIA required the Federal Banking Agencies to establish certain non-capital safety and soundness standards. The standards adopted by the Federal Banking Agencies relate generally to operations and management, asset quality, interest rate exposure and executive compensation. The Federal Banking Agencies are authorized to take action against institutions that fail to meet such standards.

As a BHC with total consolidated assets of $50 billion or more (a “covered company”), weWe are subject under the Dodd-Frank Act to certain enhanced prudential standards including requirements that may be recommendedunder the Dodd-Frank Act, as amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) and implemented by various regulations issued by the Federal Banking Agencies. The Financial Stability Oversight Council (“FSOC”) and implemented by the Federal Reserve and other regulators. As a result, we are subject to more stringent standards and requirements than those applicable to smaller institutions. The FSOC may also issue recommendations to the Federal Reserve or other primary financial regulatory agencies to apply new or enhanced standards to certain financial activities or practices.

The Federal Reserve and FDIC have issued rules requiring covered companiesAs part of the enhanced prudential standards, the Company is required to implement resolution planning for orderly resolution in the event the Companyit faces material financial distress or failure. The FDIC issued similar rules regarding resolution planning applicable to the Banks. In addition, the OCC has issued final guidelines in September 2016 that require the Banksrules requiring banks with assets of $250 billion or more to develop recovery

plans detailing the actions they would take to remain a going concern when they experience considerable financial or operational stress, but have not deteriorated to the point that resolution is imminent.

The Federal Reserve established a rule that implementsenhanced prudential standards also include supervisory and company-run stress testing requirements (also known as the requirement in the Dodd-Frank Act that“DFAST stress testing requirements”). In particular, the Federal Reserve is required to conduct annual stress tests on certain covered companies, including us, to ensure that the capacity of ourcovered companies have sufficient capital to absorb losses as a result ofand continue operations during adverse economic conditions. Theconditions, as well as to determine the Company’s stress test rulecapital buffer requirement as described above. As a covered company that is a Category III institution under the Tailoring Rules, we are also implements the requirement that werequired to conduct our own semiannual stress tests and requires us to publish the results of the stresssuch tests on our website or other public forum. The Company must disclose the results of its company-run stress test on a biennial basis. The OCC has adopted a similar stress test rule requiring banks with at least $250 billion in assets, including CONA, to implement the requirement that each of the Banks conduct annualtheir own company-run stress tests. Under that OCC rule, CONA must also disclose the results of its stress test on a biennial basis.

The Federal Reserve has finalized other rules implementing certain other aspects ofIn addition, the enhanced prudential standards under the Dodd-Frank Act, which were applicableCompany is required to us beginning on January 1, 2015 (“Enhanced Standards Rule”). Under the Enhanced Standards Rule, we must meet liquidity risk management standards, conduct internal liquidity stress tests, and maintain a 30-day buffer of highly liquid assets, in each case, consistent with the requirements of the rule.enhanced prudential standards. These requirements are in addition to the LCR and NSFR Rules, discussed above in “Basel III and United States Liquidity Rules.” The Enhanced Standards Ruleenhanced prudential standards also requiresrequire that wethe Company comply with, and hold capital commensurate with, the requirements of, any regulations adopted by the Federal Reserve relating to capital planning and stress tests. Stress testing and capital planning regulations are discussed further below under “Dividends, Stock Repurchases and Transfers of Funds.” The Enhanced Standards RuleFinally, the Company is also requires that werequired to establish and maintain an enterprise-wide risk management framework that includes a risk committee and a chief risk officer.

Although not a requirement of the Dodd-Frank Act, the OCC established regulatory guidelines (“Heightened Standards Guidelines”) that apply heightened standards forto the governance and risk management topractices of large institutions subject to its supervision, including the Banks. The Heightened Standards Guidelines establish standards for the development and implementation by the Banks of a risk governance framework.

Under the Federal Reserve’s capital planning rules applicable to large BHCs including usand related supervisory process (commonly referred to as Comprehensive Capital Analysis and Review or “CCAR”) requirements), a “covered BHC, with total consolidated assets of $50 billion or more” such as the Company, must submit a capital plan to the Federal Reserve on an annual basis that contains a description of all planned capital actions, including dividends or stock repurchases, over a nine-quarter planning horizon beginning with the fourthfirst quarter of the calendar year prior to the submission of the capital plan is submitted (“CCAR cycle”). A covered BHC may take the proposed capital actions if the Federal Reserve does not object to the plan.

Dodd-Frank ActThe DFAST stress testing requirements, described above in “Enhanced Prudential Standards and Other Related Requirements, under the Dodd-Frank Act,” is a complementary exercise to CCAR. It is a forward-looking exercise conducted by the Federal Reserve and each covered financial companiescompany to help assess whether a company has sufficient capital to absorb losses and supportcontinue operations during adverse economic conditions. The supervisory stress test, after incorporating a firm’s planned capital actions, is used for quantitative assessment in CCAR.

As part of its evaluation of a large BHC’s capital plan, the Federal Reserve will consider how comprehensive the plan is, the reasonableness of the assumptions, analysis and methodologies used thereinPursuant to assess capital adequacy and the ability of the BHC to maintain capital above each minimum regulatory capital ratio on a pro forma basis under expected and stressful conditions throughout a planning horizon of at least nine quarters. The annual CCAR cycle measures our capital levels under the Basel III Standardized Approach, with appropriate phase-in provisions applicable to Capital One. The Federal Reserve has indefinitely delayed incorporation of the Basel III Advanced Approaches into the capital planning and stress testing process. Therules, the Company must file its capital plan and stress testing results with the Federal Reserve by April 5 2018,of each year (unless the Federal Reserve designates a later date), using data as of the end of the prior calendar year. The Federal Reserve is expectedwill release the results of the supervisory stress test and notify the Company of its stress capital buffer requirement by June 30 of that year. The Company will have two business days from receipt of its stress capital buffer requirement to providemake any necessary adjustments to its objection or non-objection to thatplanned capital plan the following June.distributions. The Federal Reserve’s objection or non-objection applies toReserve will then finalize the stress capital buffer requirement for the Company and confirm the Company’s planned capital actionsdistributions by August 31 of that year. The Company’s final stress capital buffer requirement will be effective from the thirdfourth quarter of the year the capital plan is submitted through the end of the secondthird quarter of the following year. The Company along with other BHCs subject tomay make the supplementary leverage ratio, must incorporate an estimate of its supplementary leverage ratio into itsplanned capital plan and stress tests.

The Federal Reserve has announced that it would maintain its pre-CECL framework for calculating allowances on loans in the third quartersupervisory stress test through the 2023 cycle until the impact of the planning horizon, the BHC must reduce its capital distributions.CECL is better known and understood.

limitations on the extent to which the Banks can finance or otherwise supply funds to usthe Company through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, provisions of Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. In general, federal and applicable state banking laws prohibit insured depository institutions, such as the Banks, from making dividend distributions without first obtaining regulatory approval if such distributions are not paid out of available earnings or would cause the institution to fail to meet applicable capital adequacy standards.

Each of CONA and COBNA, as an insured depository institution, is a member of the DIF maintained by the FDIC. Through the DIF, the FDIC insures the deposits of insured depository institutions up to prescribed limits for each depositor. The FDIC sets a Designated Reserve Ratio (“DRR”) for the DIF. To maintain the DIF, member institutions may be assessed an insurance premium, and the FDIC may take action to increase insurance premiums if the DRR falls below its required level.

The Dodd-Frank Act reformed the managementAs of June 30, 2020, the DIF reserve ratio fell to 1.30 percent. The FDIC, as required under the Federal Deposit Insurance Act, established a plan in several ways. It raisedSeptember 2020, to restore the minimum DRRDIF reserve ratio to 1.35% (from the former minimum of 1.15%); removed the upper limit on the DRR; required thatmeet or exceed 1.35 percent within eight years. The FDIC’s restoration plan projects the reserve ratio reach 1.35% by September 30, 2020; required the FDIC, when setting deposit insurance assessments, to offset the effect on small insured depository institutions of meeting the increased reserve ratio; and eliminated the requirement that the FDIC pay dividends from the DIF when the reserve ratio reached certain levels. The FDIC has set the DRR at 2% and, in lieu of dividends, has established progressively lower assessment rate schedules as the reserve ratio meets certain trigger levels. The Dodd-Frank Act also required the FDIC to changeexceed 1.35 percent without increasing the deposit insurance assessment base from deposits to average total consolidated assets minus average tangible equity.

Under regulations issued by the Federal Reserve, a BHC must serve as a source of financial and managerial strength to its subsidiary banks (the so-called “source of strength doctrine”). The Dodd-Frank Act codified this doctrine.

Under the “cross-guarantee” provision of the Financial Institutions Reform, Recovery and Enforcement Act of 1989 (“FIRREA”), insured depository institutions such as the Banks may be liable to the FDIC with respect to any loss incurred, or reasonably anticipated to be incurred, by the FDIC in connection with the default of, or FDIC assistance to, any commonly controlled insured depository institution. The Banks are commonly controlled within the meaning of the FIRREA cross-guarantee provision.

The Dodd-Frank Act provides the FDIC with liquidation authority that may be used to liquidate nonbanknon-bank financial companies and BHCs if the Treasury Secretary, in consultation with the President and based on the recommendation of the Federal Reserve and another federal agency,other appropriate Federal Banking Agencies, determines that doing so is necessary, among other criteria, to mitigate serious adverse effects on United StatesU.S. financial stability. Upon such a determination, the FDIC would be appointed receiver and must liquidate the company in a way that mitigates significant risks to financial stability and minimizes moral hazard. The costs of a liquidation of a financialthe company would be borne by shareholders and unsecured creditors and then, if necessary, by risk-basedrisk-

based assessments on large financial companies. The FDIC has issued rules implementing certain provisions of its liquidation authority and may issue additional rules in the future.

Our culture is rooted in putting people first with a focus on building and maintaining a workforce which fosters an inclusive environment based on diversity of our philosophypeople, ideas and the merit of our work. Our workforce is to attractour largest and retain highly capable staff.one of our most valuable assets. We prioritize the recruitment, development, recognition and retention of the 50,767 employees worldwide that we had approximately 49,300 employees,as of December 31, 2021, whom we refer to as “associates,“associates.” The following disclosures provide information on our human capital resources, including certain human capital objectives and measures that we focus on in managing our business.

Our full Board of Directors oversees our human capital management, including strategies, policies and practices, and diversity, inclusion and belonging (“DIB”), and is assisted by our Board’s Compensation Committee and Governance and Nominating Committee. Our Executive Committee, a committee of senior management which includes our Chief Human Resources Officer, advises, assists and makes recommendations to our Chief Executive Officer and Board of Directors on human capital matters such as human resource practices and programs, including general employee benefits and compensation programs. Our Chief Diversity, Inclusion and Belonging Officer (“Chief DIB Officer”) provides an update, at least annually, on the progress, success and challenges on workforce representation, trends and programs to the Board of Directors and Executive Committee.

Growing the diversity of our workforce at all levels, with an emphasis on leader and executive roles, is an important component of our comprehensive DIB strategy. As of December 31, 2017. None2021, key measures of our workforce representation include:

We leverage information and technology to achieve our business objectives and to develop and deliver products and services that satisfy our customers’ needs. A key part of our strategic focus is the development and use of efficient, flexible computer and operational systems, such as cloud technology, to support complex marketing and account management strategies, the servicing of our customers, and the development of new and diversified products. We believe that the continued development and integration of these systems is an important part of our efforts to reduce costs, improve quality and security and provide faster, more flexible technology services. Consequently, we continuously review capabilities and develop or acquire systems, processes and competencies to meet our unique business requirements.

As part of our continuous efforts to review and improve our technologies, we may either develop such capabilities internally or rely on third-party outsourcers who have the ability to deliver technology that is of higher quality, lower cost, or both. We continue to rely on third-party outsourcers to help us deliver systems and operational infrastructure. These relationships include (but are not limited to): Amazon Web Services, Inc. (“AWS”) for our cloud infrastructure, Total System Services Inc.LLC (“TSYS”) for consumer and commercial credit card processing services for our North American and U.K. portfolios of consumer, commercial and small business credit card accounts, Fidelity Information Services (“FIS”) for certain of our banking systemssystems.

From time to time, we have made and will make forward-looking statements, including those that discuss, among other things,things: strategies, goals, outlook or other non-historical matters; projections, revenues, income, returns, expenses, capital measures, capital allocation plans, accruals for claims in litigation and for other claims against us; earnings per share, efficiency ratio, operating efficiency ratio or other financial measures for us; future financial and operating results; our plans, objectives, expectations and intentions; and the assumptions that underlie these matters.

To the extent that any such information is forward-looking, it is intended to fit within the safe harbor for forward-looking information provided by the Private Securities Litigation Reform Act of 1995.

This section highlights specificsignificant factors, events, and uncertainties that make an investment in our securities risky. The events and consequences discussed in these risk factors could, in circumstances we may not be able to accurately predict, recognize, or control, have a material adverse effect on our business, growth, reputation, prospects, financial condition, operating results, cash flows, liquidity, and stock price. These risk factors do not identify all risks that we face; our operations could also be affected by factors, events, or uncertainties that are not presently known to us or that we currently do not consider to present significant risks to our operations. In addition, the global economic and political climate may amplify many of these risks.

We offer a broad array of financial products and services to consumers, small businesses and commercial clients. We market our credit card products on a national basis throughout the United States, Canada and the United Kingdom and offer banking and other services in many regions within the United States. A prolonged period of economic volatility, slow growth, or a significant deterioration in economic conditions, in the United StatesU.S., Canada or one of these countriesthe U.K., could have a material adverse effect on our financial condition and results of operations as customers default on their loans, or maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity.

Some of the risks we may face in connection with adverse changes and instability in the macroeconomic environment, include the following:

Our ability to borrow from other financial institutions or to engage in funding transactions on favorable terms or at all could be adversely affected by disruptions in the capital markets or other events, including actions by rating agencies and deteriorating investor expectations, which could limit our access to funding.

Like other lenders, we face the risk that our customers will not repay their loans. A customer’s ability and willingness to repay us can be negatively impactedadversely affected by decreases in the income of the borrower or increases in their payment obligations to other lenders, whether as a result of higher debt levels or rising interest rates, by rising levels of inflation, or by restricted availability of credit generally. We may fail to quickly identify and reduce our exposure to customers that are likely to default on their payment obligations, and reduce our exposurewhether by closing credit lines andor restricting authorizations, which could adversely impact our financial condition and results of operations.authorizations. Our ability to manage credit risk also may be adverselyis affected by legal or regulatory changes (such as restrictions on collections, bankruptcy laws, minimum payment regulations and re-age guidance), competitors'competitors’ actions and consumer behavior, as well as inadequateand depends on the effectiveness of our collections staffing,staff, techniques and models.

Rising losses or leading indicators of rising losses (such as higher delinquencies, higher rates of non-performingnonperforming loans, higher bankruptcy rates, lower collateral values, or elevated unemployment rates)rates or changing market terms) may require us to increase our allowance for loan and leasecredit losses, which may degradewould decrease our profitability if we are unable to raise revenue or reduce costs to compensate for higher losses. In particular, we face the following risks in this area:

Financial institutions are subject to extensive and complex capital and liquidity requirements, which are subject to change. These requirements affect our ability to lend, grow deposit balances, or make acquisitions and limitdistribute capital. Failure to maintain adequate capital or liquidity levels, whether due to adverse developments in our business or the economy or to changes in the applicable requirements, could subject us to a variety of remedies available to our regulators. These include limitations on the ability to make most capital distributions. Higher capital levels also lower our return on equity.

We consider various factors in the management of capital, including the impact of both internal and supervisory stress scenarios on our capital levels as determined by both our internal modeling and the Federal Reserve’s modeling of our capital position in supervisory stress tests and CCAR.tests. There can be significant differences between our modeling and the Federal Reserve’s estimatesprojections for a given supervisory stress scenario and between the capital needs suggested by our internal bank holding companystress scenarios relative to the supervisory scenarios. Therefore, although our estimated capital levels under stress disclosed as part of the CCAR or DFASTstress testing processes may suggest that we have substantiala particular capacity to return capital to shareholdersstockholders and remain well capitalized under stress, the Federal Reserve’s modeling, our owninternal modeling of another scenario and/or other factors related to our capital management process may result inreflect a materially lower capacity to return capital to shareholdersstockholders than that indicated by the projections released in the CCAR or DFASTstress testing processes. This in turn, could lead to restrictions on our ability to pay dividends and engage in share repurchase transactions.repurchases. See “Part I—Item 1. Business—Supervision and Regulation” for additional information.

Our ability to retain and attract new customers depends on our ability to build or acquire necessary operational, technologicaldevelop, operate, and adapt our technology and organizational infrastructure or adapt to technological advances involving such infrastructure, which can bein a challenge due to the fast pacerapidly changing environment. In addition, we must accurately process, record and monitor an increasingly large number of digital transformation and advances. We are embeddingcomplex transactions. Digital technology, data and software development are deeply embedded into our business model and how we work.

Similar to other large corporations, we are exposed to operational risk that can manifest itself in many ways, such as errors related to failed orin execution, inadequate processes, inaccurate models, faulty or disabled computer systems, technological infrastructure, malicious disruption and

fraud by employees or persons outside of our company, and exposure to external events.whether through attacks on Capital One directly or on our customers. In addition, we are heavily dependent on the security, capability and continuous availability of the technology systems that we use to manage our internal financial and other systems, interfacemonitor risk and compliance with regulatory requirements, provide services to our customers, and develop and implement effective marketing campaigns.offer new products and communicate with stakeholders. We also face risk of adverse customer impacts and business disruption arising from the execution of strategic initiatives we may pursue across our operations.

In addition,If we do not maintain the necessary operational, technological and organizational infrastructure to operate our businesses are dependent on our abilitybusiness, including to process, recordmaintain the resiliency and monitor a large numbersecurity of complex transactions. If any of our financial, accounting or other data processing systems fail or have other significant shortcomings,that infrastructure, our business and reputation could be materially adversely affected. We may also beare subject to disruptions ofto our operating systems arising from events that are wholly or partially beyond our control, which may include for example, computer viruses, or electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks includingand other security incidents (including Distributed Denial of Service (“DDOS”) and other attacks on our infrastructure as discussed below,below), natural disasters, other damage to property or physical assets, or events arising from local or larger scale politics, including terrorist acts. Any failure to maintain our infrastructure or disruption of these occurrencesour systems and applications could diminish our ability to operate our businesses, service customer accounts and protect customers’ information, or result in potential liability to customers, reputational damage, regulatory intervention and customers’ loss of confidence in our businesses, any of which could result in a material adverse effect.

We also rely on the business infrastructure and systems of third parties with which we do business and to whom we outsource the operation, maintenance and development of operationalour information technology and technological functionality. For example, wecommunications systems. We have migrated a number of, and intend to migrate substantially all aspects of our core information technology systems and customer-facing applications to third-party cloud infrastructure platforms, such as Amazon Web Services, Inc.principally AWS. If we do not execute the transition orfail to administer these new environments in a well-managed, secure and effective manner, or if such platforms become unavailable or do not meet their service level agreements for any reason, we may experience unplanned service disruption or unforeseen costs which maycould result in material harm to our business and operating results.results of operations. We must successfully develop and maintain information, financial reporting, disclosure, privacy, data-protection, data security and other

Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones and to run our business in compliance with applicable laws and regulations depends on the functionality and reliability of our operational and technology systems. Any disruptions, failures or inaccuracies of our operational andprocesses, technology systems and models, including those associated with improvements or modifications to such technology systems and models, could cause us to be unable to market and manage our products and services, manage our risk, meet our regulatory obligations or report our financial results in a timely and accurate manner, all of which could have a negative impact on our results of operations. In addition, our ongoing investments in infrastructure, which are necessary to maintain a competitive business, integrate acquisitions and establish scalable operations, may increase our expenses. As our business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business strategies, management of outsourced services, asset purchases or other acquisitions, structural reorganization, compliance with new laws or regulations, or the integration of newly acquired businesses.businesses, or the prevention or occurrence of cyber-attacks and other security incidents. If we are unable to successfully manage our expenses, our financial results will be negatively affected. Changes to our business, including those resulting from our strategic objectives, also requires robust governance to ensure that our objectives are executed as intended without adversely impacting our customers, associates, operations or financial performance. Ineffective change management oversight and governance over the execution of our strategic objectives could expose us to operational, strategic and reputational risk and could negatively impact customers or our financial performance.

Our ability to provide our products and services, many of which are web-based, and communicate with our customers, depends upon the management and safeguarding of information systems and infrastructure, networks, software, data engineering, technology, methodologies and business secrets, including those of our service providers. Our products and services involve the gathering,collection, authentication, management, processing,usage, storage, transmission and transmissioneventual destruction of sensitive and confidential information, including personal information, regarding our customers and their accounts, our employees, our partners and other

third parties with which we do business. Our ability to provide such products and services, many of which are web-based, depends upon the management and safeguarding of information, software, methodologies and business secrets. To provide these products and services to, as well as communicate with, our customers, we rely on information systems and infrastructure, including digital technologies, computer and email systems, software, networks and other web-based technologies, that we and third-party service providers operate. We also have arrangements in place with third parties through which we share and receive information about their customers who are or may become our customers.

Like other financial services firms, technologies,Technologies, systems, networks, and other devices of Capital One, oras well as those of our customers, employees, service providers, orpartners and other third parties with whom we interact, have been and may continue to be the subject of attempted unauthorized access, mishandling or misuse of information, denial-of-servicecyber-attacks and other security incidents, including DDOS attacks, computer viruses, website defacement, hacking, malware, ransomware, credential stuffing, or phishing or other forms of social engineering,engineering. Such cyber-attacks and other forms of cyber-attackssecurity incidents are designed to obtainlead to various harmful outcomes, such as unauthorized transactions in Capital One accounts, unauthorized or unintended access to or release, gathering, monitoring, disclosure, loss, destruction, corruption, disablement, encryption, misuse, modification or other processing of confidential or sensitive information destroy data, disrupt(including personal information), intellectual property, software, methodologies or degradebusiness secrets, disruption, sabotage or degradation of service, sabotage systems or causenetworks, or other damage, and other events.damage. These threats may derive from, humanamong other things, error, fraud or malice on the part of our employees, insiders, or third parties or may result from accidental technological failure. Any of these parties may also attempt to fraudulently induce employees, service providers, customers, partners or other third-party users of our systems or networks to disclose confidential or sensitive information (including personal information) in order to gain access to our systems, networks or data or that of our customers, partners, or third parties with whom we interact. Further, cyberinteract, or to unlawfully obtain monetary benefit through misdirected or otherwise improper payment. For example, any party that obtains our confidential or sensitive information (including personal information) through a cyber-attack or other security incident may use this information for ransom, to be paid by us or a third party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes.

For example, on July 29, 2019, we announced that on March 22 and 23, 2019 an outside individual gained unauthorized access to our systems (the “Cybersecurity Incident”). This individual obtained certain types of personal information relating to people who had applied for our credit card products and to our credit card customers. While the Cybersecurity Incident has been remediated, it has resulted in fines, litigation, government investigations and other regulatory enforcement inquiries, as well as consent orders with certain regulatory agencies. Cyber and information security risks for large financial institutions like us have generally increased in recent years in part because ofcontinue to increase due to the proliferation of new technologies, the use ofindustry-wide shift to reliance upon the Internet and telecommunications technologiesinternet to conduct financial transactions, and the increased sophistication and activities of malicious actors, organized crime, perpetrators of fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other external parties. In addition, toour customers access our products and services our customers may use computers, smartphones, tablet PCs and other mobileusing personal devices that are beyondnecessarily external to our security control systems.

A data protection incident,disruption or breach, including as a result of a cyber-attack such as the Cybersecurity Incident, or media reports of perceived security vulnerabilities at Capital One or at third-partyour service providers, could result in significant legal and financial exposure, regulatory intervention, litigation, remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business. There can be no assurance that unauthorized access or cyber incidents similar to the Cybersecurity Incident will not occur or that we will not

We regularly move data across national borders to conduct our operations, and consequently are subject to a variety of continuously evolving and developing laws and regulations in the United States at the federal, state and abroadlocal level regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer, security and securityother processing of personal data.information. For example, at the federal level, we are subject to the GLBA, among other laws and regulations. In addition, in November 2021, the Federal Reserve, OCC, and FDIC issued a final rule that, among other things, requires all banking organizations in the United States to notify their primary federal regulators of certain material computer-security incidents as soon as possible and no later than 36 hours after determining that the incident has occurred. At the state level, the CCPA went into effect on January 1, 2020 and covers certain companies that process personal information of California residents. The CCPA was recently amended by the CPRA, which will become effective in most material respects on January 1, 2023. Numerous other states have also enacted or are in the process of enacting state-level privacy, data protection and/or data security laws and regulations.

We also are, or may become, subject to continuously evolving and developing laws and regulations in other jurisdictions regarding privacy, data protection and data security. For example, in Canada we are subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”). In addition, the EU GDPR applies EU data protection law to all companies processing data of EU residents, regardless of the company’s location. We also are subject to the U.K. GDPR (which is how GDPR has been implemented into U.K. law). These laws and regulations, and similar laws and regulations in other jurisdictions, impose strict requirements regarding the collection, storage, handling, use, disclosure, transfer, security and other processing of personal information, which may have adverse consequences, including significant compliance costs and severe monetary penalties for non-compliance. Significant uncertainty exists as privacy, data protection, and data protectionsecurity laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements. For example, the GDPR, which becomes effective in May 2018, extends the scope of the EU data protection law to all companies

Further, we make public statements about our use, collection, disclosure and other processing data of EU residents, regardless of the company’s location. The law requires companies to meet new requirements regarding the handling of personal data, including new rights such as the “portability” of personal data. Our effortsinformation through our privacy policies, information provided on our website and press statements. Although we endeavor to comply with GDPRour public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about privacy, data protection and data protection laws may entail substantial expenses,

Certain laws and regulations, and any interpretations and applications with respect thereto, are generally intended to protect consumers, borrowers, depositors, the DIF, the U.S. banking and financial system, and financial markets as a whole, but not stockholders. Our Businesses Are Subject To The Risk Of Increased Litigation, Government Investigations And Regulatory Enforcement.success depends on our ability to maintain compliance with both existing and new laws and regulations. For a description of the material laws and regulations to which we are subject, see “Part I—Item 1. Business—Supervision and Regulation.”

Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry and the structure of the credit card industry and business practices in the mortgage business. industry.

Given the inherent uncertainties involved in litigation, government investigations and regulatory enforcement decisions, and the very large or indeterminate damages sought in some matters asserted against us, there can be significant uncertainty as to the ultimate liability we may incur from these kinds of matters. The finding, or even the assertion, of substantial legal liability against us could have a material adverse effect on our business and financial condition and could cause significant reputational harm to us, which could seriously harm our business. The Cybersecurity Incident has resulted in litigation, government investigations and other regulatory enforcement inquiries.

In addition, financial institutions, including us, have facedsuch as ourselves, face significant regulatory scrutiny, over the past several years, which has increasingly ledcan lead to public enforcement actions or nonpublic supervisory actions. We and our subsidiaries are subject to comprehensive regulation and periodic examination by, among other regulatory bodies, the Federal Reserve, theBanking Agencies, SEC, OCC, FDICCFTC and CFPB. We have been subject to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including governmental inquiries, investigations and enforcement proceedings, including by the OCC, Department of Justice, Financial Crimes Enforcement Network (“FinCEN”) and state Attorneys General.

We expect that regulators and governmental enforcement bodies will continue taking formal enforcement actions against financial institutions in addition to addressing supervisory concerns through non-publicnonpublic supervisory and enforcement actions or findings, which could involve restrictions on our activities, or our ability to make acquisitions or otherwise expand our business, among other limitations that could adversely affect our business. In addition, a violation of law or regulation by another financial institution is likely to give rise to an investigation by regulators and other governmental agencies of the same or similar practices by us. For example, various regulatory and governmental agencies initiated an industry-wide supervisory initiative regarding sales practices and sales incentive compensation structures following a public enforcement action at another financial institution. In addition,Furthermore, a single event may give rise to numerous and overlapping investigations and proceedings. These and other initiatives from governmental authorities and officials may subject us to further judgments, settlements, fines or penalties, or cause us to restructure our operations and activities or to cease offering certain products or services, all of which could harm our reputation or lead to higher operational costs. Litigation, government investigations and other regulatory actions could involve restrictions on our activities, generally subject us to significant fines, increased expenses, restrictions on our activities and damage to our reputation and our brand, and could adversely affect our business, financial condition and results of operations. For additional information regarding legal and regulatory proceedings to which we are subject, see “Note 18—Commitments, Contingencies, Guarantees and Others.”

We operate in a highly competitive environment across all of our lines of business, whether in making loans, attracting deposits or in the global payments industry, and we expect competitive conditions to continue to intensify with respect to most of our products.products particularly in our credit card and consumer banking business. We compete on the basis of the rates we pay on deposits and the rates and other terms we charge on the loans we originate or purchase, as well as the quality and range of our customer service, products, innovation and experience. This increasingly competitive environment is primarily a result of changes in technology, product delivery systems and regulation, as well as the emergence of new or significantly larger financial serviceservices providers, all of which may affect our customers’ expectations and demands. In addition to offering competitive products and services, we invest in and conduct marketing campaigns to attract and inform customers.

Some of our competitors, including new and emerging competitors in the digital and mobile payments space and other financial technology providers, are not subject to the same regulatory requirements or legislative scrutiny to which we are subject, which also could place us at a competitive disadvantage, in particular in the development of new technology platforms or the ability to rapidly innovate. We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital currencies,or cryptocurrencies, prepaid systems and payment services targeting users of social networks, communications platforms and online gaming (including, for example, those offering payment through mobile phone accounts).gaming. If we are unable to continue to keep pace with innovation, do not effectively market our products and services or are prohibited from or unwilling to enter emerging areas of competition, our business and results of operations could be adversely affected.

Some of our competitors are substantially larger than we are, which may give those competitors advantages, including a more diversified product and customer base, the ability to reach out to more customers and potential customers, operational efficiencies,

As of December 31, 2017, weWe operate the largestas an online direct bank in the U.S. by deposits.United States. While direct banking representsprovides a significant opportunity to attract new customers that value greater and more flexible access to banking services at reduced costs, we face strong and increasing competition in the direct banking market. Aggressive pricing throughout the industry may adversely affect the retention of existing balances and the cost-efficient acquisition of new deposit funds and may affect our growth and profitability. In addition, the effects of a competitive environment may be exacerbated by the flexibility of direct banking and the increasing financial and technological sophistication of our customer base. Customers could also close their online accounts or reduce balances or deposits in favor of products and services offered by competitors for other reasons. These shifts, which could be rapid, could result from general dissatisfaction with our products or services, including concerns over pricing, online security or our reputation. The potential consequences of this competitive environment are exacerbated by the flexibility of direct banking and the financial and technological sophistication of our online customer base.

In our credit card business, competition for rewards customers may result in higher rewards expenses, or we may fail to attract new customers or retain existing rewards customers due to increasing competition for these consumers. WeAs of December 31, 2021, we have expandeda number of large partnerships in our credit card partnership business over the past several years with the additions of a number of credit card partnerships.loan portfolio. The market for key business partners, especially in the credit card business, is very competitive, and we may not be able to grow or maintain these partner relationships. Additionally, partners themselves may face changes in their business, including market factors and ownership changes, that could impact the partnership. We face the risk that we could lose partner relationships, even after we have invested significant resources time and expense into acquiring and developing the relationships. The loss of any of our key business partners could have a negative impact on our results of operations, including lower returns, excess operating expense and excess funding capacity.

Some of our competitors have developed, or may develop, substantially greater financial and other resources than we have, may offer richer value propositions or a wider range of programs and services than we offer, or may use more effective advertising, marketing or cross-selling strategies to acquire and retain more customers, capture a greater share of spending and borrowings, attain and develop more attractive cobrandco-brand card programs and maintain greater merchant acceptance than we have. We may not be able to compete effectively against these threats or respond or adapt to changes in consumer spending habits as effectively as our competitors.

In such a competitive environment, we may lose entire accounts or may lose account balances to competing firms, or we may find it more costly to maintain our existing customer base. Customer attrition from any or all of our lending products, together with any lowering of interest rates or fees that we might implement to retain customers, could reduce our revenues and therefore our earnings. Similarly, unexpected customer attrition from our deposit products, in addition to an increase in rates or services that we may offer to retain deposits, may increase our expenses and therefore reduce our earnings.

Credit card interchangeInterchange fees are generally one of the largest components of the costs that merchants pay in connection with the acceptance of credit and debit cards and are a meaningful source of revenue for our credit and debit card businesses. Interchange fees are the subject of significant and intense global legal, regulatorylegislative and legislativeregulatory focus, and the resulting decisions, regulationslegislation and legislationregulation may have a material adverse impact on our overall business, financial condition and results of operations.

RegulatorsLegislative and legislativeregulatory bodies in a number of countries are seeking to reduce credit card interchange fees through legislation, competition-related regulatory proceedings, voluntary agreements, central bank regulation and and/or litigation. InterchangeFor credit transactions, interchange reimbursement rates in the United States are set by credit card networks such as MasterCard and Visa. For debit transactions, Federal Reserve rules place limits on the interchange fees we may charge. For more information on these rules, including the Federal Reserve’s proposed amendments, please see “Part I—Item 1. Business—Supervision and Regulation.” In some jurisdictions, such as Canada and certain countries in Europe, including the European Union,U.K., interchange fees and related practices are subject to regulatory activity, that have limited the ability of certain networks to establish default rates, including in some cases, imposing caps on permissible interchange fees. WeOur international card businesses have already experiencedbeen impacted by these impactsrestrictions. For example, in ourthe U.K., interchange fees are capped for both credit and debit card transactions. In addition, in Canada, Visa and Mastercard payment networks have, since 2014, entered into voluntary agreements with the Department of Finance Canada to maintain an agreed upon average interchange rate. Lowering interchange fees remains an area of domestic and international credit card portfolio.governmental focus. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the payments industry. Consequently, a development in one country, state or region may influence regulatory approaches in another, such as our primary market, the United States.

In addition to this regulatory activity, merchants are also seeking avenues to reduce interchange fees. During the past few years, merchants and their trade groups have filed numerous lawsuits against Visa, MasterCard, American Express and their card-issuing banks, claiming that their practices toward merchants, including interchange and similar fees, violate federal antitrust laws. In 2005, a number of entities filed antitrust lawsuits against MasterCard and Visa and several member banks, including our subsidiaries and us, alleging among other things, that the defendants conspired to fix the level of interchange fees. In December 2013, the U.S.

Some major retailers may have sufficient bargaining power to independently negotiate lower interchange fees with MasterCard and Visa, which could, in turn, result in lower interchange fees for us when our cardholders undertake purchase transactions with these retailers. In 2016, some of the largest merchants individually negotiated lower interchange rates with MasterCard and/or Visa. These and other merchants also continue to lobby aggressively for caps and restrictions on interchange fees and there can be no assurance that their efforts will notmay be successful or that they will notmay in the future bring legal proceedings against us or other credit card and debit card issuers and networks.

Beyond pursuing litigation, legislation and regulation, merchants may also promote forms of payment with lower fees, such as ACH-based payments, or seek to impose surcharges at the point of sale for use of credit or debit cards. New payment systems, particularly mobile-based payment technologies, could also gain widespread adoption and lead to issuer transaction fees or the displacement of credit card accounts as a payment method.

The heightened focus by merchants and regulatorylegislative and legislativeregulatory bodies on the fees charged by credit and debit card networks, and the ability of certain merchants to successfully negotiate discounts to interchange fees with MasterCard and Visa or develop alternative payment systems, could result in a reduction of interchange fees. Any resulting loss in income to us could have a material adverse effect on our business, financial condition and results of operations.

Our industry is subject to rapid and significant technological changes and our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings. We expect digital technologies to have a significant impact on banking over time. Consumers increasingly expect robust digital experiences from their financial services providers. The ability for customers to access their accounts and conduct financial transactions using digital technology, including mobile applications, is an increasingly important aspect of the financial services industry and it impacts our ability to deliver products and services to our customers. To that end, financial institutions are rapidly introducing new digital and other technology-driven products and services whichthat aim to offer a better customer experience and to reduce costs. We continue to invest in digital technology designed to attract new customers, facilitate the ability of existing customers to conduct financial transactions and enhance the customer experience related to our products and services.

We have engaged in merger and acquisition activity and entered into strategic partnerships over the past several years and may continue to engage in such activity in the future.years. We continue to evaluate and anticipate engaging in, among other merger and acquisition activity, additional strategic partnerships and selected acquisitions of financial institutions and other financialbusinesses or assets,

Any merger, acquisition or strategic partnership we undertake entails certain risks, which may materially and adversely affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our existing operations, or are not able to achieve the anticipated benefits of any merger, acquisition or strategic partnership, including cost savings and other synergies, our business could be negatively affected. In addition, it is possible that the ongoing integration processes could result in the loss of key employees, errors or delays in systems implementation, exposure to cybersecurity risks associated with acquired businesses, exposure to additional regulatory oversight, the disruption of our ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect our ability to maintain relationships with partners, clients, customers, depositors and employees or to achieve the anticipated benefits of any merger, acquisition or strategic partnership. Integration efforts also may divert management attention and resources. These integration matters may have an adverse effect on us during any transition period.

In addition, we may face the following risks in connection with any merger, acquisition or strategic partnership:

Our ability to originateattract and maintain accountsretain customers is highly dependent upon the perceptions of consumer and commercial borrowers and deposit holders and other external perceptions of our products, services, trustworthiness, business andpractices, workplace culture, compliance practices or our financial health. In addition, our brand has historically been, and we expect it to continue to be,is very important to us. Maintaining and enhancing our brand will dependdepends largely on our ability to continue to provide high-quality products and services. Adverse perceptions regarding our reputation in the consumer, commercial and funding markets could lead to difficulties in generating and maintaining accounts as well as in financing them. In particular, negative public perceptions regarding our reputation, including negative perceptions regarding our ability to maintain the security of our technology systems and protect customer data, could lead to decreases in the levels of deposits that consumer and commercial customers and potential customers choose to maintain with us or significantly increase

Negative public opinion or damage to our brand could also result from actual or alleged conduct in any number of activities or circumstances, including lending practices, regulatory compliance, security breaches (including the use and protection of customer information)data, such as resulting from the Cybersecurity Incident), corporate governance and sales and marketing, and from actions taken by regulators or other persons in response to such conduct. Such conduct could fall short of our customers’ and the public’s heightened expectations of companies of our size with rigorous privacy, data privacyprotection, data security and compliance practices, and could further harm our reputation. In addition, our co-brand and private label partners or other third parties with whom we have important relationships may take actions over which we have limited control that could negatively impact perceptions about us or the financial services industry. The proliferation of social media may increase the likelihood that negative public opinion from any of the events discussed above will impact our reputation and business.

In addition, a variety of social factors may cause changes in borrowing activity, including credit card use, payment patterns and the rate of defaults by accountholdersaccount holders and borrowers domestically and internationally. These social factors include changes in consumer confidence levels, the public’s perception regarding the banking industry and consumer debt, including credit card use, and changing attitudes about the stigma of bankruptcy. If consumers develop or maintain negative attitudes about incurring debt, or if consumption trends decline or if we fail to maintain and enhance our brand, or we incur significant expenses in this effort,to do so, our business and financial results could be materially and negatively affected.

We rely on a variety of measures to protect and enhance our intellectual property, including copyrights, trademarks, trade secrets, patents and certain restrictions on disclosure, solicitation and competition. We also undertake other measures to control access to and distribution of our other proprietary information. These measures may not prevent misappropriation of our proprietary information or infringement of our intellectual property rights and a resulting loss of competitive advantage. In addition, our competitors or other third parties may file patent applicationsobtain patents for innovations that are used in our industry or allege that our systems, processes or technologies infringe on their intellectual property rights. If our competitors or other third parties are successful in obtaining such patents or prevail in intellectual property-related litigation against us, we could lose significant revenues, incur significant license, royalty or technology development expenses, or pay significant damages.

Management of risk, including market, credit, liquidity, operational and compliance and strategic risks,risk requires, among other things, policies and procedures to properly record and verify a large number of transactions and events. See “MD&A—Risk Management” for further details. We have devotedEven though we continue to devote significant resources to developing our risk management policies and procedures and expect to continue

Some of our methods of managing riskthese risks are based upon our use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than the historical measures indicate.indicate and market conditions, particularly during a period of financial market stress, can involve unprecedented dislocations. For example, market conditions during the financial crisis involved unprecedented dislocations and highlight the limitations inherent in using historical information to manage risk. In addition, credit risk is inherent in the financial services business and results from, among other things, extending credit to customers. Our ability to assess the creditworthiness of our customers may be impaired if the models and approaches we use to select, manage and underwrite our consumer and commercial customers become less predictive of future charge-offs (due,due, for example, to rapid changes in the economy, includingor degradation in the unemployment rate).predictive nature of credit bureau and other data used in underwriting.

While we employ a broad and diversified set of risk monitoring and risk mitigation techniques, those techniques and the judgments that accompany their application cannot anticipate every economic and financial outcome or the timing of such outcomes. For example, our ability to implement our risk management strategies may be hindered by adverse changes in the volatility or liquidity conditions in certain markets and as a result, may limit our ability to distribute such risks (for instance, when we seek to syndicate exposure in bridge financing transactions we have underwritten). We may, therefore, incur losses in the course of our risk management or investing activities.

Like other financial institutions, our business may beis sensitive to market interest rate movementmovements and the performance of the capital markets. Disruptions, uncertainty or volatility across the capital markets could negatively impact market liquidity, and limit our access to the funding and capital required to operate and grow our business.business and adversely affect our results of operations and financial condition. In addition, changes in interest rates or in valuations in the debt or equity markets could directly impact us. For example, we borrow money from other institutions and depositors, which we use to make loans to customers and invest in debt securities and other earninginterest-earning assets. We earn interest on these loans and assets and pay interest on the money we borrow from institutions and depositors. The interest rates that we pay on the securities we have issued are also influenced by, among other things, applicable credit ratings from recognized rating agencies. A downgrade to any of these credit ratings could affect our ability to access the capital markets, increase our borrowing costs and have a negative impact on our results of operations. Increased charge-offs, rising London Interbank Offering Rate (“LIBOR”)interest rates and other events may cause our securitization transactions to amortize earlier than scheduled, which could accelerate our need for additional funding from other sources. Fluctuations in interest rates,

including changes in the relationship between short-term rates and long-term rates and in the relationship between our funding basis rate and our lending basis rate, may have negative impacts on our net interest income and therefore our earnings.

We assess our interest rate risk by estimating the effect on our earnings, economic value and capital under various scenarios that differ based on assumptions about the direction and the magnitude of interest rate changes. We take risk mitigation actions based on those assessments. We face the risk that changes in interest rates could materially reduce our net interest income and our earnings, especially if actual conditions turn out to be materially different than those we assumed. See “MD&A—Market Risk Profile” for additional information.

readiness if they are not done on a timely basis or otherwise fail. Our Business Could Be Negatively Affected If We Are Unable To Attract, Retain And Motivate Skilled Senior Leaders.assessment of the ultimate impact of, and our planning for, the transition from LIBOR remains ongoing. Failure to adequately manage the transition could have a material adverse effect on our reputation, business, financial condition and results of operations. See “MD&A—Market Risk Profile” for additional information.

Our success depends, in large part, on our ability to retain key senior leaders and competitionto attract and retain skilled employees, particularly employees with advanced expertise in credit, risk, digital and technology skills. We depend on our senior leaders and skilled employees to oversee simultaneous, transformative initiatives across the enterprise and execute on our business plans in an efficient and effective manner. Competition for such senior leaders and employees, and the costs associated with attracting and retaining them, is intense. The executive compensation provisionshigh and made even more competitive as a result of the Dodd-Frank Actexternal environment, including increasing rates of job transition and low unemployment. Our ability to attract and retain qualified employees also is affected by perceptions of our culture and management, our profile in the regions where we have offices and the regulations issued thereunder, and any further legislation, regulationprofessional opportunities we offer. Regulation or regulatory guidance restricting executive compensation, as well as evolving investor expectations, may limit the types of compensation arrangements that we may enter into with our most senior leaders and could have a negative impact on our ability to attract, retain and motivate such leaders in support of our long-term strategy. These laws and regulations may not apply in the same manner to all financial institutions and wetechnology companies, which therefore may facesubject us to more restrictions than other institutions and companies with which we compete for talent. These lawstalent and regulations may also hinder our ability to compete for talent with other industries. We rely upon our senior leaders not only for business success, but also to lead with integrity. To the extent our senior leaders behave in a manner that does not comport with our values, the consequences to our brand and reputation could be severe and could adversely affect our financial condition and results of operations. If we are unable to attract, develop and retain talented senior leadership and employees, or to implement appropriate succession plans for our senior leadership, our business could be negatively affected.

Despite the business contingency plans we have in place, there can be no assurance that such plans willdo not fully mitigate all potential business continuity risks to us. The impact from naturalNatural disasters and other catastrophic events may have a negative effect oncould harm our employees, business and infrastructure, including our information technology systems and those of third-parties that we rely on.third-party platforms. Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our business and the communities where we are located, which are concentrated in the Northern Virginia and New York metropolitan areas, as well as Richmond, Virginia and Plano, Texas. This may include a disruption involving damage or loss of access to a physical site, access, cybercyber-attacks and other security incidents, terrorist activities, the occurrence or worsening of disease outbreaks or pandemics catastrophic events,(including the COVID-19 pandemic), natural disasters, extreme weather events (including as a result of climate change), electrical outage, environmental hazard, computer servers,hazards, disruption to technological infrastructure, communications or other services we use, our employees or third parties with whom we conduct business. Our business, financial condition and results of operations may be impacted by any such disruption and our ability to implement corresponding response measures quickly, including, for example, our ability to respond effectively to a remote work environment as a result of the ongoing COVID-19 pandemic and related response measures. In addition, if a natural disaster or other catastrophic event occurs in certain regions where our business and customers are concentrated, such as the mid-Atlantic, New York, California or Texas metropolitan areas, we could be disproportionately impacted as compared to our competitors. The impact of such events and other catastrophes on the overall economy may also adversely affect our financial condition and results of operations.

Our ability to engage in routine funding and other transactions could be adversely affected by the stability and actions of other financial services institutions. Financial services institutions are interrelated as a result of trading, clearing, servicing, counterparty and other relationships. We have exposure to an increasing number of financial institutions, intermediaries and counterparties. These counterparties include institutions that may beare exposed to various risks over which we have little or no control, including European or U.S. sovereign debt that is currently or may become in the future subject to significant price pressure, rating agency downgrade or default risk.control.

In addition, we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients, resulting in a significant credit concentration with respect to the financial services industry overall. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions.

Likewise, adverse developments affecting the overall strength and soundness of our competitors, the financial services industry as a whole and the general economic climate or sovereign debt could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. In addition, adverse developments with respect to third parties with whom we have important relationships also could negatively impact perceptions about us. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face.

None.

Our corporate and banking real estate portfolio consists of approximately 14.712.3 million square feet of owned or leased office and retail space, which is used to support our business. Of this overall portfolio, approximately 11.210.2 million square feet of space is dedicated for various corporate office uses and approximately 3.52.1 million square feet of space is for bank branches and related offices.Cafés.

Our 11.210.2 million square feet of corporate office space consists of approximately 6.44.1 million square feet of leased space and 4.86.1 million square feet of owned space. Our headquarters is located in McLean, Virginia, and is included in our corporate office space. We maintain corporate office space primarily in Virginia, Illinois, Texas and New York, Delaware, Louisiana and Maryland.including our headquarters located in McLean, Virginia.

The following graph shows the cumulative total stockholder return on our common stock compared to an overall stock market index, the S&P Composite 500 Stock Index (“S&P 500 Index”), and a published industry index, the S&P Financial Composite Index (“S&P Financial Index”), over the five-year period commencing December 31, 20122016 and endingended December 31, 2017.2021. The stock performance graph assumes that $100 was invested in our common stock and each index and that all dividends were reinvested. The stock price performance on the graph below is not necessarily indicative of future performance.