What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-14 compared with 2024-02-20 · 365 added, 309 removed, 504 unchanged (57% of the section changed)

6 unchanged sentences

Risks related to our macroeconomic, global, strategic, business and competitive environment include:

• Market conditions, inflation, interest rates, unemployment levels and the increased probability of a recession or prolonged economic slowdown, and the related impact on consumer spending behavior, payments, debt levels, savings rates and other behavior, could have a material adverse effect on our business.

• Market conditions, inflation, interest rates, labor market conditions, recessionary pressures or concerns over a prolonged economic slowdown, and the related impact on consumer spending behavior, payments, debt levels, savings rates and other behavior, could have a material adverse effect on our business.

• Global political, public health and social events or conditions, including ongoing wars and military conflicts, may harm our business.

10 unchanged sentences

• We rely extensively on models in managing many aspects of our business, and if they are not accurate or are misinterpreted, such factors could have a material adverse effect on our business and results of operations.

• Fraudulent activity associated with our products and services could negatively impact our operating results, brand and reputation, decreasing the use of our products and services and increasing our fraud losses.

Risks related to our liquidity, market and credit risk include:

8 unchanged sentences

• We face various risks related to the extensive government regulation and supervision of our business, including by the FDIC, CFPB and other federal and state authorities.

These risks include pending and future laws and regulations that may adversely impact our business, such as the CFPB’s proposed rulemaking with respect to late fees, as well as supervisory and other actions that may be taken against us by our regulators.

These risks include pending and future laws and regulations that may adversely impact our business, such as the CFPB’s final rule with respect to late fees, as well as supervisory and other actions that may be taken against us by our regulators.

• Pending and future litigation could subject us to significant fines, penalties, judgments and/or requirements.

2 unchanged sentences

Risks related to cybersecurity, technology and third-party vendors include:

• We rely on third-party vendors, and we could be adversely impacted if such vendors fail to fulfill their obligations.

• We rely on third-party vendors, and could be adversely impacted if such vendors fail to fulfill their obligations.

• Impacts arising from or relating to the transition of our credit card processing services to strategic outsourcing providers that we completed in 2022 have, and may continue to adversely affect our business.

1 unchanged sentence

• Our industry is subject to rapid and significant technological changes, and we may be unable to successfully develop and commercialize new or enhanced products and services.

• The development and use of AI presents risks and challenges to our business, including compliance with new AI laws and regulations, risks associated with AI models, and the malicious use of AI technology by bad actors.

Risks related to the spinoff of our former LoyaltyOne segment include potential tax and other liabilities, existing or future litigation or other disputes, or other adverse impacts.

8 unchanged sentences

• Limitations on our ability to replace maturing liabilities and to access the capital and deposit markets to meet liquidity needs.

While we closely monitor economic conditions and indicators, including inflation, interest rates, changes in monetary policy, housing values, the state of the commercial real estate industry, energy prices, consumer wages, consumer saving rates and debt levels, including student loan debt, consumer and business spending, unemployment, and concerns about the level of U.S.

government debt, as well as economic and political conditions in the U.S.

1 unchanged sentence

During 2024, the economic scenario weightings in our credit reserve modeling continued to reflect an increased probability of a recession, high interest rates, persistent inflation, and the increased cost of overall consumer debt.

A recession or prolonged period of economic weakness would likely, among other things, adversely affect consumer discretionary spending levels and the ability and willingness of customers to pay amounts owed to us and could have a material adverse effect on our business, key credit trends, results of operations and financial condition.

Moreover, the current macroeconomic environment may have a disproportionately adverse impact

A recession or prolonged period of economic weakness would likely, among other things, adversely affect consumer discretionary spending levels

Tabl e of Contents

on us, as compared to our peers, due to our relatively higher proportion of private label credit card accounts and our deeper underwriting.

and the ability and willingness of customers to pay amounts owed to us and could have a material adverse effect on our business, key credit trends, results of operations and financial condition.

Moreover, the current macroeconomic environment may have a disproportionately adverse impact on us, as compared to our peers, due to our relatively higher proportion of private label credit card accounts and our deeper underwriting.

In the current macroeconomic landscape, the wage growth of many moderate and lower-income households has been challenged by the compounding effect of persistent inflation, even while unemployment rates remain low.

Given the higher proportion of moderate and lower-income households within our partners’ customer bases relative to many of our peers, a continuation of this trend could impact us more negatively than others in our industry.

Moreover, the current Presidential Administration’s policies on trade, immigration and taxes could create inflationary pressures, which in turn could disproportionately impact our customer base.

For context, during the Great Recession, our Delinquency and Net loss rates peaked in 2009 at 6.2% and 10.0%, respectively.

As of December 31, 2023, our Delinquency rate of 6.5% actually exceeded our peak Delinquency rate during the Great Recession;

although, our 2023 full-year Net loss rate of 7.5% was below the peak Net loss rate experienced in 2009.

While we expect our Delinquency rate to move lower during 2024, we are expecting our Net loss rate to be in the low 8% range for 2024, peaking in the first half of the year with each of the first two quarters of the year in the mid-to-high 8% range.

Even if these rates moderate in the latter part of 2024, the current and near-term anticipated Delinquency and Net loss rates are high, relative to our historical experience, and a prolonged continuation or worsening of these rates could have a material adverse impact on us.

In addition, outbreaks of illnesses, pandemics like COVID-19, or other local or global health issues, political uncertainties (including those resulting from a presidential election year), international hostilities, armed conflict, war (such as the ongoing wars between Ukraine and Russia, and between Israel and Hamas), civil unrest, climate-related events, impacts to the power grid, and natural disasters have, to varying degrees, negatively impacted our operations, brand partners, service providers and consumer spending, and such events and conditions may negatively impact us going forward.

As of December 31, 2024, our Delinquency rate was 5.9% and our 2024 full-year Net loss rate was 8.2%.

While these 2024 rates were lower than those experienced in 2009 during the Great Recession, the current and near-term anticipated Delinquency and Net loss rates are high, relative to our historical experience, and a prolonged continuation or worsening of these rates could have a material adverse impact on us.

In addition, outbreaks of illnesses, pandemics, endemic diseases, or other local or global health issues, political uncertainties (including those arising from significant shifts in policy that impact consumers, such as tariffs and other trade-related measures, taxes and immigration, among others), international hostilities, armed conflict, war (such as the ongoing wars between Ukraine and Russia, and between Israel and Hamas), civil unrest, climate-related events, impacts to the power grid, and natural disasters have, to varying degrees, negatively impacted our operations, brand partners, service providers and consumer spending, and such events and conditions may negatively impact us going forward.

The loans we make are unsecured, and we may not be able to ultimately collect from customers that default on their loans.

3 unchanged sentences

We may not be able to successfully identify and evaluate the creditworthiness of borrowers to minimize delinquencies and losses.

The models and approaches we use to manage our credit risk, including our automated proprietary scoring technology and verification procedures for new account holders, establishing or adjusting their credit limits and applying our risk-based pricing, may not accurately predict future write-offs for various reasons discussed elsewhere in these Risk Factors, including “ Our risk management policies and procedures may not be effective, and the models we rely on may not be accurate or may be misinterpreted.

While we monitor credit quality on a regular and consistent basis, utilizing internal algorithms and external credit bureau risk scores and other data, these algorithms and data sources may be inaccurate or incomplete, including as a result of certain customers’ credit profiles not fully reflecting their credit risk due to, among other things, the less-regulated reporting requirements for many fintechs.

As a result, the data and models upon which we rely may not fully reflect the extent of our customers’ BNPL debt or other financial obligations.

General economic conditions, including a recession or prolonged economic slowdown, persistent inflation, high interest rates, high unemployment or volatility in energy prices, may result in greater delinquencies that lead to greater credit losses.

In addition to being affected by general economic conditions and the success of our collection and recovery efforts, the stability of our Delinquency and Net loss rates are affected by the credit risk inherent in our Credit card and other loans portfolio, as well as the vintage of the accounts in our various credit card portfolios.

We are also closely monitoring the effects of the lifting of the moratorium on federal student loan payments in October 2023, which moratorium had been originally implemented as part of the federal government’s COVID-19 response under the CARES Act in March 2020.

We believe that approximately 23% of our active customers have one or more outstanding student loans (with approximately 17% of our active customers having a student loan balance in excess of $10,000), and it is unclear the extent to which the lifting of this moratorium will ultimately impact these customers’ abilities to repay their loan balances to us.

Under the applicable rules, there is a grace period for federal student loan borrowers until late 2024 before any adverse credit bureau reporting will be made in the event they fail to resume payments on such loans, and we expect that consumer payment trends may further evolve after the grace period expires.

As part of our efforts to manage our credit risk, we use our automated proprietary scoring technology and verification procedures to make risk-based origination decisions when approving new account holders, establishing or adjusting their credit limits and applying our risk-based pricing.

These models may not accurately predict future write-offs for various reasons discussed elsewhere in these Risk Factors, including “ Our risk management policies and procedures may not be effective, and the models we rely on may not be accurate or may be misinterpreted.

While we monitor credit quality on a regular and consistent basis, utilizing internal algorithms and external credit bureau risk scores and other data, these algorithms and data sources may be inaccurate or incomplete, including as a result of certain customers’ credit profiles not fully reflecting their credit risk due to any number of factors, including, for example, the less-regulated reporting requirements for many fintechs offering buy now, pay later products or other lending options and existing or future limitations on the reporting of medical debt.

Mandated changes to credit bureau reporting, or the information that may be included in a credit bureau report, can change the accuracy of scoring models that leverage tradelines and performance in determining credit risk.

As a result, the data and models upon which we rely may not fully reflect the extent of our customers’ actual financial obligations.

General economic conditions, including a recession or prolonged economic slowdown, persistent inflation, interest rates, high unemployment or volatility in energy prices, may result in greater delinquencies that lead to greater credit losses.

In addition to being affected by general economic conditions and the success of our collection and recovery efforts, the stability of our Delinquency and Net loss rates are affected by the credit risk inherent in our Credit card and other loan portfolios, as well as the vintage of the accounts in our various credit card portfolios.

We are also closely monitoring the effects on our business of the lifting of the moratorium on federal student loan payments in October 2023, which moratorium had been originally implemented as part of the federal government’s COVID-19 response under the CARES Act in March 2020.

Under the applicable rules, there was a grace period for federal student loan borrowers until late 2024 before any adverse credit bureau reporting was to be made in the event they fail to resume payments on their loans.

This grace period has ended, and we are closely monitoring the segment of our portfolio with student loans to observe payment

Tabl e of Contents

In addition, targeted government efforts to forgive or discharge portions of student loan debt or provide additional relief may further influence these trends.

Further, our pricing strategy may not offset the negative impact on profitability caused by increases in delinquencies and losses, thus any material increases in delinquencies and losses beyond our current estimates could have a material adverse impact on us.

Our Delinquency rates were 5.9% of Credit card and other loans as of December 31, 2024, compared with 6.5% and 5.5% as of December 31, 2023 and 2022, respectively.

For 2023, our Net principal loss rate was 7.5%, compared

Tabl e of Contents

with 5.4% and 4.6% for 2022 and 2021, respectively.

For 2024, our Net principal loss rate was 8.2%, compared with 7.5% and 5.4% for 2023 and 2022, respectively.

As referenced above, the current and near-term anticipated Delinquency and Net loss rates remain high, relative to our historical experience, and a prolonged continuation or worsening of these rates could have a material adverse impact on our business and results of operations.

2 unchanged sentences

We depend on a limited number of large partner relationships for a significant portion of our revenue.

As of and for the year ended December 31, 2023, our five largest credit card programs accounted for approximately 47% of our Total net interest and non-interest income excluding the gain on sale and 37% of our End-of-period credit card and other loans.

As of and for the year ended December 31, 2024, our five largest credit card programs (based on Total net interest and non-interest income) accounted for approximately 48% of our Total net interest and non-interest income excluding the gain on sale and 38% of our End-of-period credit card and other loans.

In particular, our programs with (alphabetically) Signet Jewelers, Ulta Beauty and Victoria’s Secret & Co.

and its retail affiliates each accounted for more than 10% of our Total net interest and non-interest income for the year ended December 31, 2023.

and its retail affiliates, each accounted for 10% or more of our Total net interest and non-interest income for the year ended December 31, 2024.

A decrease in business from, or the loss of, any of our significant partners for any reason, could have a material adverse effect on our business.

10 unchanged sentences

economy, consumer spending and consumer credit.

We are also more susceptible to the risks of increased regulations and legal and other regulatory actions that are targeted at consumer credit or the specific consumer credit products that we offer, such as regulations relating to credit card late fees, finance charges and promotional financing.

We are also more susceptible to the risks of increased regulations and legal and other regulatory actions that are targeted at consumer credit or the specific consumer credit products that we offer, such as legislation and regulations relating to credit card late fees, finance charges and promotional financing.

Our business concentration could have an adverse effect on our results of operations.

4 unchanged sentences

See “ Our risk management policies and procedures may not be effective, and the models we rely on may not be accurate or may be misinterpreted.

Moreover, under the CECL accounting rules, the acquisition of an existing credit card or BNPL portfolio typically has a negative impact on certain key financial metrics in the near-term, including Net income and Earnings per share, because we are required to include a reserve build in our Provision for credit losses for the estimated credit losses to be experienced over the life of the acquired portfolio.

The amount of this reserve build (which is included in the reporting period in which the portfolio is obtained) is often large relative to the amount of revenue generated through such date by the newly-acquired portfolio.

Moreover, under the CECL accounting rules, the acquisition of an existing credit card or other loan portfolio typically has a negative impact on certain key financial metrics in the near-term, including Net income and Earnings per share, because we are required to include a reserve build in our Provision for credit losses for the estimated credit losses to be experienced over the life of the acquired portfolio.

The amount of this reserve build (included in the reporting period in which the portfolio is obtained) is often large relative to the amount of revenue generated through such date by the newly-acquired portfolio.

See also “ –The amount of our Allowance for credit losses could adversely affect our business and may prove to be insufficient to cover actual losses on our loans.

Tabl e of Contents

Our risk management policies and procedures may not be effective, and the models we rely on may not be accurate or may be misinterpreted.

2 unchanged sentences

If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and could be materially adversely affected.

We rely extensively on models in managing many aspects of our business, including liquidity and capital planning (including stress testing), customer selection, credit and other risk management, pricing, reserving and collections

Tabl e of Contents

We rely extensively on models in managing many aspects of our business, including liquidity and capital planning (including stress testing), customer selection, underwriting and line management, credit and other risk management, pricing, reserving and collections management.

The models may prove in practice to be less predictive than we expect for a variety of reasons, including as a result of errors in constructing, interpreting or using the models or the use of inaccurate assumptions (including models being calibrated on historical cycles and correlations which may not be predictive of the future, or failures to update assumptions appropriately or in a timely manner).

Our assumptions may be inaccurate for many reasons including that they often involve matters that are inherently difficult to predict and beyond our control (e.g., macroeconomic conditions, including continued elevated inflation, low unemployment, increasing consumer debt levels and weakening in macroeconomic indicators, and their impact on partner and customer behaviors) and they often involve complex interactions between a number of dependent and independent variables, factors and other assumptions.

In particular, in recent years, we have observed rates and correlations among several key macroeconomic variables, such as unemployment and interest rates, perform outside of observed historical norms, which could impact the reliability of certain models in the current economic environment.

The errors or inaccuracie s in our models may be material, and could lead us to make poor or sub-optimal decisions in managing our business, and this could have a material adverse effect on our business, results of operations and financial condition.

Fraudulent activity associated with our products and services could negatively impact our operating results, brand and reputation and cause the use of our products and services to decrease and our fraud losses to increase.

We are subject to the risk of fraudulent activity associated with retailers, partners, other merchant parties or third-party service providers handling consumer information.

Our fraud-related operational losses were $127 million, $73 million and $71 million for the years ended December 31, 2023, 2022 and 2021, respectively.

We are subject to the risk of fraudulent activity associated with our products and services, as well as retailers, partners, other merchant parties or third-party service providers handling consumer information.

Our products are susceptible to application fraud bec ause, among other things, we provide immediate access to credit at the time of approval.

In addition, digital sales on the internet and through mobile channels continue to be a larger part of our business, and fraudulent activity is higher as a percentage of sales in those channels than in brick-and-mortar store locations.

The different financial products we offer, including deposit products, are susceptible to different types of fraud, and, depending on our product mix and channel mix, we may continue to experience variations in, or levels of, fraud-related expense that are different from or higher than those experienced by some of our competitors or the industry generally.

The different financial products we offer, including deposit products, are susceptible to different types of fraud, and, depending on our product mix and channel mix, we may continue to experience variations in, or levels of, fraud-related expenses that are different from or higher than those experienced by some of our competitors or the industry generally.

The risk of fraud continues to increase for the financial services industry, and credit card and deposit fraud, identity theft and related crimes are likely to continue to be prevalent, with increasingly sophisticated perpetrators.

More recently, emerging generative AI capabilities, such as synthetic voice and conversation generation, introduced new fraud risks, especially in the form of identity fraud.

Our resources, technologies and fraud prevention tools may be insufficient to accurately detect and prevent fraud.

Our fraud-related operational losses were $65 million, $127 million and $73 million for the years ended December 31, 2024, 2023 and 2022, respectively.

During 2023, we believe the financial services industry generally experienced an uptick in both the volume and sophistication of fraud attacks, and we also experienced that trend in our business, with fraud-related operational losses increasing significantly from 2022 levels.

High profile fraudulent activity could also negatively impact our brand and reputation, which could negatively impact the use of our services, leading to a material adverse effect on our results of operations.

While we were successful in decreasing fraud-related losses in 2024, the perpetrators of fraud attacks remain persistent and we cannot provide assurance that fraud-related losses will remain at these lower levels going forward.

In addition to direct financial impacts, high profile fraudulent activity could also negatively affect our brand and reputation, which could negatively impact the use of our services, leading to a material adverse effect on our results of operations.

In addition, significant increases in fraudulent activity could lead to regulatory intervention, including, but not limited to, additional consumer notification requirements, increasing our costs and negatively impacting our operating results, net income and profitability.

Regulators and consumer activists have also sought to expand financial institutions’ responsibility to hold customers harmless for fraudulent transactions on their accounts, which increases our exposure to fraud-related losses.

The amount of our Allowance for credit losses could adversely affect our business and may prove to be insufficient to cover actual losses on our loans.

The Financial Accounting Standards Board’s CECL accounting standard became effective for us on January 1, 2020 and requires us to determine periodic estimates of the lifetime expected credit losses on loans, and reserve for those expected credit losses through an allowance for credit losses against the loans.

Tabl e of Contents

credit losses through an allowance for credit losses against the loans.

In addition, as referenced above, for loan portfolios we acquire, we are required to establish at the time of acquisition such an allowance for credit losses.

7 unchanged sentences

Moreover, we may underestimate our expected credit losses, and we cannot assure that our Allowance for credit losses will be sufficient to cover actual losses.

Tabl e of Contents

We may not be successful in realizing the benefits associated with our acquisitions, dispositions and strategic investments, and our business and reputation could be materially adversely affected.

3 unchanged sentences

Similarly, we may evaluate the potential disposition of, or elect to divest, assets or portfolios that no longer complement our long-term strategic objectives, as we did in November 2021, when we completed the spinoff of our LoyaltyOne segment.

When a determination is made to divest assets or portfolios, we may encounter difficulty attaining buyers or effecting desired exit strategies in a timely manner or on acceptable terms and may be subject to market forces leading to a divestiture on less than optimal price or other terms.

See also “ Risks Related to the LoyaltyOne Spinoff.

In addition, there are numerous risks associated with acquisitions, dispositions and the implementation of new business opportunities, including, but not limited to:

• the difficulty and expense that we incur in connection with the acquisition, disposition or new business opportunity;

• the inability to satisfy pre-closing conditions preventing consummation of the acquisition, disposition or new business opportunity;

• the potential for adverse consequences when conforming the acquired company’s accounting policies to ours;

the diversion of management’s attention from other business concerns;

• the potential loss of customers or key employees of the acquired company;

• the impact on our financial condition due to the timing of the acquisition, disposition or new business implementation or the failure of the acquired or new business to meet operating expectations;

continued financial responsibility with respect to a divested business, including required equity ownership, guarantees, indemnities or other financial obligations;

3 unchanged sentences

unforeseen legal, regulatory or other challenges that we may not be able to manage effectively;

• the reduction of cash available for operations, payment of dividends, stock repurchase programs or other uses and potentially dilutive issuances of equity securities or incurrence of additional debt;

• the requirement to provide transition services in connection with a disposition resulting in the diversion of resources and focus;

• the difficulty retaining and motivating key personnel from acquisitions or in connection with dispositions.

For example, upon the disposition of Epsilon in July 2019, we agreed to indemnify Publicis Groupe S.A.

for the matter included in Note 15, “Commitments and Contingencies” to the audited Consolidated Financial Statements, which has resulted in a $150 million charge associated with Epsilon’s deferred prosecution agreement with the United States Department of Justice requiring two $75 million payments in January 2021 and January 2022, respectively.

See also “ Risks Related to the LoyaltyOne Spinoff.

and the reduction of cash available for operations, payment of dividends, stock repurchase programs or other uses and potentially dilutive issuances of equity securities or incurrence of additional debt.

Furthermore, if the operations of an acquired or new business do not meet expectations, our profitability may decline and we may seek to restructure the acquired business or to impair the value of some or all of the assets of the acquired or new business.

3 unchanged sentences

We compete with a wide range of businesses, and some of our current competitors have longer operating histories, stronger brand names and greater financial, technical, marketing and other resources than we do.

Moreover, the consumer credit and payments

Tabl e of Contents

industry is highly competitive and we face an increasingly dynamic industry as emerging technologies enter the marketplace.

For a more detailed discussion regarding the manner in which we compete with respect to each of our product categories, see “Item 1.

Moreover, the consumer credit and payments industry is highly competitive and we face an increasingly dynamic industry as emerging technologies enter the marketplace.

For a more detailed discussion regarding how we compete with respect to each of our product categories, see “Item 1.

Business—Competition” of this Form 10-K above.

Additionally, downturns in the economy or the performance of our retail or other partners, including as a result of macroeconomic conditions, geopolitical events or global health events such as COVID-19 or other pandemic or endemic diseases, may result in a decrease in the demand for our products and services.

Our ability to generate significant revenue from partners and customers will depend on our ability to differentiate ourselves through the products and services we provide and the attractiveness of our programs to consumers.

Additionally, downturns in the economy or the performance of our retail or other partners, including as a result of macroeconomic conditions, geopolitical events or global health events or other pandemic or endemic diseases, may result in a decrease in the demand for our products and services.

Our ability to

Tabl e of Contents

generate significant revenue from partners and customers will depend on our ability to differentiate ourselves through the products and services we provide and the attractiveness of our programs to consumers.

If we are not able to differentiate our products and services from those of our competitors, drive value for our partners and their customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively in the market.

20 unchanged sentences

Our partners’ sales may decrease or may not increase as we anticipate for various reasons, some of which are in the partners’ control and some of which are not.

For example, partner sales have been, and in the future may be adversely affected by pandemic or endemic diseases like COVID-19 or other macroeconomic conditions having a national, regional or more local effect on consumer spending, business conditions affecting the general retail environment, such as supply chain distributions or the ability to maintain sufficient staffing levels or a particular partner or industry, or natural disasters or other catastrophes affecting broad or more discrete geographic areas.

If our partners’ sales decline for any reason, it generally results in lower credit sales, and therefore lower

Tabl e of Contents

loan volumes and associated interest and fees and other income for us from our customers.

For example, partner sales have been, and in the future may be adversely affected by pandemic or endemic diseases or other macroeconomic conditions having a national, regional or more local effect on consumer spending, business conditions affecting the general retail environment, such as supply chain distributions or the ability to maintain sufficient staffing levels or a particular partner or industry, or natural disasters or other catastrophes affecting broad or more discrete geographic areas.

If our partners’ sales decline for any reason, it generally results in lower credit sales, and therefore lower loan volumes and associated interest and fees and other income for us from our customers.

In addition, if a partner closes some or all of its stores or becomes subject to a voluntary or involuntary bankruptcy proceeding (or if there is a perception that such an event may occur), its customers who have used our financing products may have less incentive to pay their outstanding balances to us, which could result in higher charge-off rates than anticipated and our costs for servicing its customers’ accounts may increase.

This risk is particularly acute with respect to our largest partners that account for a significant amount of our Total net interest and non-interest income.

This risk is particularly acute with respect to our largest partners that account for a significant amount of our Total net

Tabl e of Contents

interest and non-interest income.

See “ A significant percentage of our Total net interest and non-interest income, or revenue, is generated through our relationships with a limited number of partners, and a decrease in business from, or the loss of, any of these partners could cause a significant drop in our revenue.

2 unchanged sentences

We may not be successful in our efforts to promote usage of our DTC credit cards, or to effectively control the costs associated with such promotion, both of which may materially impact our profitability.

We have been investing in promoting the use of our DTC credit cards, including our Bread Cashback TM credit card that we launched in 2022 and our recently-launched Bread Rewards TM credit card, but there can be no assurance that our investments to acquire cardholders, provide differentiated features and services and increase the use of our DTC credit cards will be effective, particularly with increasing competition from other card issuers and fintechs, as well as changing consumer and business behaviors.

We have been investing in promoting the use of our DTC credit cards, including our Bread Cashback American Express Credit Card and our Bread Rewards American Express Credit Card, but there can be no assurance that our investments to acquire cardholders, provide differentiated features and services and increase the use of our DTC credit cards will be effective, particularly with increasing competition from other card issuers and fintechs, as well as changing consumer and business behaviors.

In addition, if we develop new products or offers that attract customers looking for short-term incentives rather than incentivizing long-term loyalty, cardholder attrition and costs could increase.

Moreover, we may not be able to cost-effectively manage and expand cardholder benefits, including controlling the growth of marketing, promotion, rewards and cardholder services expenses in the future.

Reductions in interchange fees may reduce the competitive advantages our private label credit card products currently have by virtue of not charging interchange fees and would reduce our income earned from those fees on co-brand and general purpose credit card transactions.

Interchange is a fee merchants pay to the interchange network in exchange for the use of the network’s infrastructure and payment facilitation, and which are paid to credit card issuers to compensate them for the risk they bear in lending money to customers.

Reductions in interchange fees, or changes in the laws and regulations governing such fees, could have various adverse impacts on our business and results of operations.

Interchange is a fee merchants pay to the payment networks in exchange for using the network’s infrastructure and payment facilitation, some of which is paid to credit card issuers.

We earn interchange fees on co-brand and general purpose credit card transactions, but we typically do not charge or earn interchange fees from our partners or customers on our private label credit card products.

Merchants, trying to decrease their operating expenses, have sought to, and have had some success at, lowering interchange rates.

Several recent events and actions indicate a continuing increase in focus on interchange by both regulators and merchants.

Certain merchants, in an effort to decrease their operating expenses, have with some success sought to lower interchange fees, including through promoting alternative payment platforms with lower processing costs and lobbying for legislative or regulatory changes.

Several recent events and actions indicate a continuing focus on interchange by legislators, regulators and merchants.

In 2023, for example, legislation was reintroduced in the U.S.

House of Representatives and Senate, which, among other things, would require large issuing banks to offer a choice of at least two unaffiliated networks over which electronic transactions may be processed.

Furthermore, beyond pursuing litigation, legislation and regulation, merchants are also pursuing alternate payment platforms as a means to lower payment processing costs.

To the extent interchange fees are reduced, one of our current competitive advantages with our partners—that we typically do not charge interchange fees when our private label credit card products are used to purchase our partners’ goods and services—may be reduced.

Moreover, to the extent interchange fees are reduced, our income from those fees will be lower on co-brand and general purpose credit card transactions.

As a result, a reduction in interchange fees could have a material adverse effect on our business and results of operations.

In addition, for our co-brand and general purpose credit cards, we are subject to the operating regulations and procedures set forth by the interchange network, and our failure to comply with these operating regulations, which may change from time to time, could subject us to various penalties or fees, or the termination of our license to use the interchange network, all of which could have a material adverse effect on our business and results of operations.

House of Representatives and Senate, which, among other things, would require large issuing banks (over $100 billion) to offer a choice of at least two unaffiliated networks over which electronic transactions may be processed.

At the state level, the Illinois legislature passed a bill that would, beginning in July 2025, prohibit the charging of interchange fees on sales tax and gratuities and restrict use of electronic payment transaction data except to facilitate or process the transaction or as required by law.

This Illinois legislation is being challenged in federal court.

Similar legislation has been introduced in other states and, absent a successful legal challenge, these bills would have a number of adverse impacts on us, including negatively impacting our interchange revenue and creating operational challenges.

Furthermore, to the extent interchange fees are reduced, one of our current competitive advantages with our partners—that we typically do not charge interchange fees when our private label credit card products are used to purchase our partners’ goods and services—may be reduced.

In addition, for our co-brand and general purpose credit cards, we are subject to the operating regulations and procedures set forth by the payment networks.

Our failure to comply with these operating regulations, which may change from time to time, could subject us to various penalties or fees, or the termination of our license to use the applicable payment network, all of which could have a material adverse effect on our business and results of operations.

We may not be able to retain and/or attract and hire a highly qualified and diverse workforce or maintain our corporate culture, and having a large segment of our workforce working from home may exacerbate these risks and cause new risks.

2 unchanged sentences

The market for key personnel is highly competitive, particularly in technology and other skill areas significant to our business.

Failure to attract, hire, develop, motivate and retain highly qualified and diverse employee talent, or to maintain a corporate culture that fosters innovation,

Failure to attract, hire, develop, motivate and retain highly qualified and diverse employee talent, or to maintain a corporate culture that fosters innovation, creativity and teamwork could harm our overall business and results of operations.

We rely on key personnel to lead with

Tabl e of Contents

creativity and teamwork could harm our overall business and results of operations.

We rely on key personnel to lead with integrity and decency.

integrity and decency.

To the extent our leaders behave in a manner that is not consistent with our values, we could experience significant impacts to our brand and reputation, as well as to our corporate culture.

1 unchanged sentence

Remote work by a majority of our employee population may impact our culture and employee engagement with our company, which could affect productivity and our ability to retain employees who are critical to our operations and may increase our costs and impact our results of operations.

In addition, work from home policies by other companies may create more job opportunities for employees and make it more difficult for us to attract and retain key talent, especially in light of changing worker expectations and talent marketplace variability regarding flexible work models.

Moreover, work from home policies by other companies may create more job opportunities for employees and make it more difficult for us to attract and retain key talent, especially in light of changing worker expectations and talent marketplace variability regarding flexible work models.

In addition, employees who work from home rely on residential communication networks and internet providers that may not be as resilient as commercial networks and providers, and therefore may be more susceptible to service interruptions and cyberattacks than commercial systems.

Our business continuity and disaster recovery plans, which have been historically developed and tested with a focus on centralized delivery locations, may not work as effectively in a distributed work from home model, where weather impacts, network and power grid downtime may be difficult to manage.

In addition, we may not be effective in timely updating our existing operating and administrative controls nor implementing new controls tailored to the work from home environment.

If we are unable to manage the work from home environment effectively to address these and other risks, our reputation and results of operations may be impacted.

1 unchanged sentence

Severe weather events and natural disasters could have a material adverse effect on our financial position and results of operations, and the timing and effects of any such event cannot accurately be predicted.

The frequency and severity of some types of weather events and natural disasters, including wildfires, tornadoes, severe storms and hurricanes, have increased as a result of climate change, which further reduces our ability to predict their effects accurately.

These such events could affect us directly (for example, by interrupting our systems, impacting the power grid, damaging our facilities or otherwise preventing us from conducting our business in the ordinary course) or indirectly (for example, by damaging or destroying brand partner businesses, impacting our service providers or otherwise impairing customers’ ability to repay their loans).

In addition, as governments, investors and other stakeholders face additional pressures to accelerate actions to address climate change and other environmental, social and governance topics, governments are implementing regulations and investors and other stakeholders, whether by stockholder proposals, public campaigns, proxy solicitations or otherwise, are imposing new expectations on, or focusing investments in ways that may cause significant shifts in, disclosure, commerce and consumption behaviors.

Any of these developments may increase our operating costs and otherwise negatively impact our business.

In March 2022, the SEC proposed new rules relating to the disclosure of a range of climate-related risks and other information.

To the extent these rules are finalized as proposed, we and/or our partners could incur increased costs related to the assessment and disclosure of climate-related information.

The frequency and severity of some types of weather events and natural disasters, including wildfires, tornadoes, severe storms and hurricanes, have increased in recent years, which further reduces our ability to predict their effects accurately.

These such events could affect us directly (for example, by interrupting our systems, impacting the power grid, damaging our facilities or otherwise preventing us from conducting our business in the ordinary course) or indirectly (for example, by damaging or destroying brand partner businesses or customers’ homes, impacting our service providers or otherwise impairing customers’ ability to repay their loans).

Many of our customers were affected by the particularly intense 2024 hurricane season in the U.S.

As a result of these hurricanes, we froze delinquency progression for cardholders in Federal Emergency Management Agency (FEMA) identified impact zones for one billing cycle, which resulted in modestly lower Net principal losses and Net loss rate in the fourth quarter of 2024, and consequently these actions will negatively impact Net principal losses and the Net loss rate in the second quarter of 2025.

In addition, many governments, investors and other stakeholders are under pressure to accelerate actions to address climate change and other environmental, social and governance topics.

This has led to new regulations and expectations, which may be conveyed to us in the form of stockholder proposals, public campaigns, proxy solicitations or otherwise, that may cause significant shifts in disclosure, commerce and consumption behaviors.

Any of these developments may impact our operating costs and our business.

For example, in March 2024, the SEC issued final rules relating to the disclosure of a range of climate-related risks and other information.

Multiple lawsuits were filed against the SEC, and the SEC issued a voluntary stay of the rules, pending review by the U.S.

Court of Appeals for the Eighth Circuit, where the litigation had been consolidated.

To the extent these rules become effective as issued, we and/or our partners could incur increased costs related to the assessment and disclosure of climate-related information.

Our failure to comply with these requirements, if adopted, or any future regulatory requirements or disclosure standards, may expose us to government enforcement actions or private litigation and otherwise damage our reputation, any of which could adversely impact our business.

Our Board approved an enhanced and modernized ESG strategy intended to drive additional progress on initiatives that promote sustainability, diversity, equity and inclusion, and increased transparency in our disclosures as we continue to advance the integration of ESG into our overall governance and risk management practices.

Statements in this and other filings we make with the SEC and other public statements, including in our annual ESG reports, related to these initiatives reflect our current plans and expectations and are not a guarantee that these initiatives will be achieved or achieved on the currently anticipated timeline.

Our ability to execute on our ESG strategy or achieve ESG initiatives is subject to numerous factors and conditions, some of which are outside of our control.

Investor and regulatory focus on ESG matters continues to increase.

If our ESG initiatives do not meet our investors’ or other stakeholders’ evolving expectations and standards, investment in our stock may be viewed as less attractive and our contractual, employment and other business relationships may be adversely impacted.

Conversely, other stakeholders hold differing views on sustainability-related goals and initiatives.

Certain state governments and activist groups, and most recently the new Presidential Administration through a series of executive orders and other actions, have pursued measures that appear designed to discourage companies from engaging in ESG practices or adhering to certain ESG principles.

These circumstances, among others, may result in pressure from investors, unfavorable reputational impacts, including inaccurate perceptions or misrepresentation of our actual business practices, diversion of management’s attention and resources, and potential proxy fights, among other adverse impacts.

Any failure, or perceived failure, by us to adhere to our public statements, comply fully with developing interpretations of sustainability-related laws and regulations, or meet evolving and varied stakeholder expectations and standards could negatively impact our business, reputation, financial condition and operating results.

Tabl e of Contents

Our Board-approved sustainability strategy, which focuses on opportunities to create value for all our stakeholders, while advancing our long-term financial and reputational goals, is intended to drive additional progress on initiatives that promote sustainability, responsible business practices and increased transparency in our disclosures.

We continue to advance the integration of sustainability into our overall governance and risk management practices.

Statements in this and other filings we make with the SEC and other public statements, including in our annual sustainability reports, related to these initiatives reflect our current plans and expectations and are not a guarantee that these initiatives will be achieved or achieved on the currently anticipated timeline.

Our ability to execute on our sustainability strategy or achieve sustainability initiatives is subject to numerous factors and conditions, some of which are outside of our control.

Damage to our reputation could damage our business.

23 unchanged sentences

We will need additional financing in the future to repay or refinance our existing debt at maturity, or otherwise, and to fund our growth.

As of the date of this Annual Report on Form 10-K, we had outstanding $100 million of 7.000% senior notes due in January 2026, $316 million of 4.25% convertible senior notes due in June 2028 and $900 million of 9.750% senior notes due in March 2029.

As of the date of this Annual Report on Form 10-K, we had outstanding $10 million of 4.25% convertible senior notes due in June 2028 and $900 million of 9.750% senior notes due in March 2029.

The availability of additional financing will depend on a variety of factors such as financial market conditions generally, including the availability of credit to the financial services industry and our lender counterparties’ willingness to lend to us, consumers’ willingness to place money on deposit with us, our performance and credit ratings and the performance of our securitized portfolios.

4 unchanged sentences

As a result, we may be forced to delay obtaining funding or be forced to issue or raise funding on undesirable terms, which could significantly reduce our financial flexibility and cause us to contract or not grow our business, all of which could have a material adverse effect on our results of operations and financial condition.

Given the current high interest rate environment and other recessionary pressures, the debt markets are volatile, and there can be no assurance that significant disruptions, uncertainties and volatility will not occur in the future.

Specifically, availability of capital from the non-investment grade debt markets is currently subject to significant volatility, and there can be no assurance that we will be able to access those markets at attractive rates, or at all.

It is possible that we will be required to repay or refinance some or all of our maturing debt in volatile and/or unfavorable markets.

If we are unable to continue to fund our business operations, access capital markets for debt refinancings and otherwise, and attract deposits on

Tabl e of Contents

favorable terms and in a timely manner, or if we experience an increase in our borrowing costs or otherwise fail to manage our liquidity effectively, our results of operations and financial condition may be materially adversely affected.

Given potential changes in the interest rate environment and other recessionary pressures, the debt markets may be volatile, and there can be no assurance that significant disruptions, uncertainties and volatility will not occur in the future.

Specifically, availability of capital from the non-investment grade debt markets may be subject to significant volatility, and there can be no assurance that we will be able to access those markets at attractive rates, or at all.

It is possible that we will be required to repay or refinance some or all of our maturing debt in volatile and/or unfavorable markets.

If we are unable to continue to fund our business operations, access capital markets for debt refinancings and otherwise, and attract deposits on favorable terms and in a timely manner, or if we experience an increase in our borrowing costs or otherwise fail to manage our liquidity effectively, our results of operations and financial condition may be materially adversely affected.

If we are unable to securitize our credit card loans due to changes in the market or other circumstances or events, we may not be able to fund new credit card loans, which would have a material adverse effect on our operations and profitability.

5 unchanged sentences

• costs of securitizing our credit card loans;

• ability to fund required over-collateralization or credit enhancements, which are routinely utilized in order to achieve better credit ratings to lower borrowing cost;

• ability to fund required over-collateralization or credit enhancements, which are routinely used to achieve better credit ratings to lower borrowing cost;

• the legal, regulatory, accounting or tax rules affecting securitization transactions and asset-backed securities, generally.

3 unchanged sentences

Although funding may be requested from other lenders who have not delayed their funding, access to financing could be disrupted if all of the lenders implement such delays or if the lending capacities of those who did not do so were insufficient to make up the shortfall.

In addition, excess spread may be affected if the trust’s borrowing costs increase as a result of Basel III.

Such cost increases may result, for example, because the investors are entitled to indemnification for increased costs resulting from such regulatory changes.

Furthermore, if adopted in its current form, the B3E rules would generally require large U.S.

banking organizations to maintain higher levels of capital than under the current Basel III requirements.

These higher capital requirements could cause our institutional lenders to reduce their lending activities and increase our securitization trusts’ borrowing costs.

For example, excess spread may be affected if a securitization trust’s borrowing costs increase as a result of the proposed B3E changes to existing capital requirements.

Such cost increases may result, for example, because the investors are entitled to indemnification for increased costs resulting from such regulatory changes, such as increased capital requirements.

The inability to securitize credit card loans due to changes in the market, regulatory proposals, the unavailability of credit enhancements, or any other circumstance or event would have a material adverse effect on our operations, cost of funds and overall financial condition.

4 unchanged sentences

Deteriorating economic conditions and increased competition in the retail industry, among other factors, may lead to an increase in bankruptcies among retailers who have entered into credit card programs with us.

The bankruptcy of one or more retailers or other partners could lead to a decline in the amount of new loans and could lead to increased delinquencies and defaults on the associated loans.

The bankruptcy of one

Tabl e of Contents

or more retailers or other partners could lead to a decline in the amount of new loans and could lead to increased delinquencies and defaults on the associated loans.

Any of these effects of a partner bankruptcy could result in the commencement of an early amortization for one or more series of such funding securities, particularly if such an event were to occur with respect to a retailer or other partner relating to a large percentage of such securitization trust’s assets.

The occurrence of an early amortization event may significantly limit our ability to securitize additional loans and materially adversely affect our liquidity.

Tabl e of Contents

Lower payment rates on our securitized credit card loans could materially adversely affect our liquidity and financial condition .

7 unchanged sentences

We obtain deposits directly from retail and commercial customers or through brokerage firms that offer our deposit products to their customers.

In recent years, deposits have become an increasingly important source of funds for us, with, for example, our retail deposits growing 18% from $5.5 billion as of December 31, 2022 to $6.5 billion as of December 31, 2023, accounting for 34% of our funding base.

In recent years, deposits have become an increasingly important source of funds for us, with, for example, our DTC deposits growing 19% from $6.5 billion as of December 31, 2023 to $7.7 billion as of December 31, 2024, and average DTC deposits representing 43% of our total funding sources.

Our funding strategy includes continued growth of our liquidity through deposits.

13 unchanged sentences

The FDIA also prohibits an insured bank from accepting brokered deposits, unless it is “well capitalized” or it is “adequately capitalized” and receives a waiver from the FDIC.

Limitations on our Banks’ ability to accept brokered deposits for any reason (including regulatory limitations on the amount of brokered deposits in total or as a percentage of total assets) in the future could materially adversely impact our liquidity, funding costs and profitability.

Limitations on our Banks’ ability to accept brokered deposits for any reason (including regulatory limitations on the volume of brokered deposits in total or as a percentage of

Tabl e of Contents

total assets) in the future could materially adversely impact our liquidity, funding costs and profitability.

In December 2020, the FDIC updated its regulations that implement Section 29 of the FDIA to establish a new framework for analyzing whether certain deposit arrangements qualify as brokered deposits.

This brokered deposit rule establishes bright-line standards for determining whether an entity meets the statutory definition of “deposit broker” and a consistent process for application of the primary purpose exception.

All deposits on the Consolidated Balance Sheets of our Banks categorized as non-brokered in accordance with the updated regulations mentioned above comply with all application requirements of those regulations.

Any limitation on the ability of our Banks to participate in the gathering of brokered deposits may competitively disadvantage us in meeting our funding goals and result in a material adverse effect on our business.

Tabl e of Contents

All deposits on the Consolidated Balance Sheets of our Banks categorized as non-brokered in accordance with the current regulations mentioned above comply with all application requirements of those regulations.

However, in the third quarter of 2024, the FDIC issued a proposed rule that, if finalized as proposed, would expand the scope of deposits that constitute “brokered deposits” and therefore could potentially cause certain of our present or prospective deposits to be treated as brokered.

While we cannot speculate on whether this proposed rule will be implemented or on what terms, limitations on the ability of our Banks to participate in the gathering of deposits may competitively disadvantage us, impede our ability to meet our funding goals and result in a material adverse effect on our business.

As of December 31, 2024, we had $13.1 billion in deposits, with approximately $6.8 billion in non-maturity savings deposits and approximately $6.2 billion in certificates of deposit.

2 unchanged sentences

Our level of indebtedness requires a high level of interest and principal payments.

Subject to the limits contained in our credit agreement, the indentures governing our senior notes and our other debt instruments, we may be able to incur substantial additional indebtedness from time to time to finance working capital, capital expenditures, investments or acquisitions, or for other purposes.

Subject to the limits contained in our credit agreement, the indenture governing our senior notes and our other debt instruments, we may be able to incur substantial additional indebtedness from time to time to finance working capital, capital expenditures, investments or acquisitions, or for other purposes.

If we do so, the risks related to our level of indebtedness could intensify.

1 unchanged sentence

Our level of indebtedness, combined with our other financial obligations and contractual commitments, could:

• make it more difficult for us to satisfy our obligations with respect to our indebtedness, and any failure to comply with the obligations under any of our debt instruments, including restrictive covenants, could result in an event of default under our credit agreement, the indentures governing our senior notes and the agreements governing our other indebtedness;

• make it more difficult for us to satisfy our obligations with respect to our indebtedness, and any failure to comply with the obligations under any of our debt instruments, including restrictive covenants, could result in an event of default under our credit agreement, the indenture governing our senior notes and the agreements governing our other indebtedness;

• require us to dedicate a substantial portion of our cash flow from operations to payments on our indebtedness, thereby reducing funds available for working capital, capital expenditures, acquisitions or other new business and other corporate purposes;

5 unchanged sentences

• prevent us from raising the funds necessary to repurchase all senior notes tendered to us upon the occurrence of certain changes of control.

Restrictions imposed by the indentures governing our senior notes, our credit agreement and our other outstanding or future indebtedness may limit our ability to operate our business and to finance our future operations or capital needs or to engage in other business activities.

The terms of the indentures governing our senior notes, our credit agreement and agreements governing our other debt instruments limit us and our subsidiaries from engaging in specified types of transactions.

Tabl e of Contents

Restrictions imposed by the indenture governing our senior notes, our credit agreement and our other outstanding or future indebtedness may limit our ability to operate our business and to finance our future operations or capital needs or to engage in other business activities.

The terms of the indenture governing our senior notes, our credit agreement and agreements governing our other debt instruments limit us and our subsidiaries from engaging in specified types of transactions.

These covenants limit our and our subsidiaries’ ability, among other things, to:

9 unchanged sentences

The terms of any future indebtedness we may incur could include more restrictive covenants.

We cannot assure that we will be able to

Tabl e of Contents

maintain compliance with these covenants in the future.

We cannot assure that we will be able to maintain compliance with these covenants in the future.

If we fail to comply with such covenants, we may not be able to obtain waivers of non-compliance from the lenders and/or amend the covenants so that we are in compliance therewith.

5 unchanged sentences

Changes in market interest rates could negatively affect our profitability.

Changes in market interest rates cause our finance charges and our interest expense to increase or decrease, as certain of our assets and liabilities carry interest rates that fluctuate with market benchmarks.

We fund Credit card and other loans with a combination of fixed rate and floating rate funding sources that include deposits and securitized financings.

We also have unsecured term debt that is subject to variable interest rates, and we may in the future incur additional debt or issue preferred equity that rely on variable interest rates.

Beginning in March 2022, the Federal Reserve Board began raising the federal funds rate in an effort to curb inflation, and the Federal Reserve Board continued raising interest rates throughout 2023.

We also have unsecured debt that is subject to variable interest rates, and we may in the future incur additional debt or issue preferred equity that may rely on variable interest rates.

The interest rate benchmark for most of our floating rate assets is the Prime rate, and the interest rate benchmark for our floating rate liabilities is generally either the Secured Overnight Financing Rate (SOFR) or the Federal funds rate.

1 unchanged sentence

Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions, the competitive environment within our markets, consumer preferences for specific loan and deposit products, and policies of various governmental and regulatory agencies, in particular the Federal Reserve.

Changes in monetary policy, including changes in interest rate controls being applied by the Federal Reserve, could influence the amount of interest we receive on our Credit card and other loans and the amount of interest we pay on deposits and borrowings.

In 2022, we began indexing our variable rate debt to SOFR as a result of the discontinuation of the London Interbank Offered Rate (LIBOR) beginning in 2021.

Accordingly, SOFR is a relatively new reference rate, has a limited history and is based on short-term repurchase agreements, backed by Treasury securities.

Changes in SOFR can be volatile and difficult to predict, and there can be no assurance that SOFR will perform similarly to the way LIBOR would have performed at any time.

As a result, the amount of interest we may pay on our credit facilities is difficult to predict.

Changes in monetary policy, including changes in interest rates being applied by the Federal Reserve, could influence the amount of interest we receive on our Credit card and other loans and the amount of interest we pay on deposits and borrowings.

As a result, the amount of interest we pay on our credit facilities may be difficult to predict.

If the interest we pay on deposits and other borrowings increases at a faster rate than the interest we receive on our Credit card and other loans, our profitability would be adversely affected.

Conversely, our profitability could also be adversely affected if the interest we receive on our Credit card and other loans falls more quickly than the interest we pay on deposits and other borrowings.

While the interest rate increases to date have resulted in a nominal benefit on our results, there can be no assurance that future rate increases will not impact us negatively.

We recognize that a customers’ ability and willingness to repay us can be negatively impacted by factors such as inflation, which may result in greater delinquencies that lead to greater credit losses, as reflected in our increased Allowance for credit losses.

If the efforts to control inflation in the U.S.

and globally are not successful and inflationary pressures persist, they could magnify the slowdown in the domestic and global economies and increase the risk of a recession or prolonged economic slowdown, which may adversely impact our business, results of operations and financial condition.

Tabl e of Contents

Future sales of our common stock, or the perception that future sales could occur, may adversely affect our common stock price.

2 unchanged sentences

We have reserved 9,348,807 shares of our common stock for issuance under our employee stock purchase plan and our long-term incentive plans, of which 921,166 shares have been issued and 2,762,717 shares are issuable upon vesting of restricted stock awards and restricted stock units.

Under the terms of the applicable indenture, we also reserved

Tabl e of Contents

10,287,897 shares in connection with the issuance of our 4.25% convertible senior notes due in June 2028.

Under the terms of the applicable indenture, we also reserved 337,216 shares in connection with the issuance of our 4.25% convertible senior notes due in June 2028.

We have reserved for issuance 1,500,000 shares of our common stock, 143,633 of which remain issuable, under our 401(k) Plan as of December 31, 2024.

12 unchanged sentences

Based on an evaluation of these factors, the Board of Directors may determine in the future not to declare dividends at all, to declare dividends at a reduced amount, not to repurchase shares or to repurchase shares at reduced levels compared to historical levels, any or all of which could reduce returns to our stockholders.

Additionally, we may be unable to obtain

regulatory approvals, if required, to repurchase shares.

We are a holding company and depend on payments from our subsidiaries.

Although not a bank holding company as defined, Bread Financial Holdings, Inc.

Although not a bank holding company as defined under the Bank Holding Company Act, Bread Financial Holdings, Inc.

is our parent holding company and, as such, depends on dividends, distributions and other payments from subsidiaries, particularly our Banks, to fund dividend payments, any potential share repurchases, payment obligations, including debt obligations, and to provide funding and capital, as needed, to our other operating subsidiaries.

4 unchanged sentences

We make assumptions, judgments and estimates in determining the Allowance for credit losses, accruals for employee-related liabilities, accruals for uncertain tax positions, valuation allowances on deferred tax assets and legal contingencies.

We also make assumptions, judgments and estimates for items such as the fair value of financial instruments, any impairment of goodwill, long-lived assets and other prepaid or intangible assets, the fair value of stock awards, as well as the recognition of revenue.

We also make assumptions, judgments and estimates for items such as the fair value of financial instruments, any

Tabl e of Contents

impairment of goodwill, long-lived assets and other prepaid or intangible assets, the fair value of stock awards, as well as the recognition of revenue.

These assumptions, judgments and estimates are drawn from historical experience and various other factors that we believe are reasonable under the circumstances as of the date of the audited Consolidated Financial Statements.

Actual results could differ materially from our estimates as a result of adverse impacts from various factors, including regulatory or legislative changes, or if future macroeconomic conditions or future operating results differ significantly from our current assumptions, and such differences could significantly impact our financial results.

Tabl e of Contents

Legal, Regulatory and Compliance Risks

Our business is subject to extensive government regulation and supervision, which could materially adversely affect our results of operations and financial condition.

We, primarily through our Banks and certain non-bank subsidiaries, are subject to extensive federal and state regulation and supervision.

Banking and consumer financial protection regulations are intended to protect consumers, depositors’ funds, the DIF, and the safety and soundness of the banking system as a whole, not stockholders.

These regulations affect our lending practices, capital structure, investment practices, dividend policy and growth, among other things.

Our business is subject to extensive and evolving government regulation and supervision, which could materially adversely affect our results of operations and financial condition.

We, primarily through our Banks and certain non-bank subsidiaries, are subject to extensive federal and state regulation, supervision and examination by regulators, including the FDIC, the Delaware Office of the State Bank Commissioner,

the Utah Department of Financial Institutions, and the CFPB.

Banking and consumer financial protection laws and regulations are intended to protect consumers, depositors’ funds, the DIF, and the safety and soundness of the banking system as a whole, not stockholders and non-deposit creditors.

These laws and regulations affect our lending practices, capital structure, investment practices, dividend policy and growth, among other things.

Federal and state legislative bodies and regulatory agencies continually review banking laws, regulations and policies for possible changes.

Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in supervision, often impose additional compliance costs.

The scope of the laws and regulations and the intensity of the supervision to which we are subject have increased in recent years, initially in response to the 2008-2010 financial crisis, and more recently in light of other factors such as technological and market changes.

We believe that regulatory enforcement and fines have also increased across the banking and financial services sector.

Further, the scope of regulation and the intensity of supervision will likely remain high in the current regulatory environment, including with respect to late fees, interchange fees and other matters.

Further, while the new Presidential Administration and the congressional majorities in the U.S.

Senate and House of Representatives support reducing the regulatory burden, the scope of legislation, executive action and regulation and the intensity of supervision will likely remain uncertain in the current regulatory and political environments at both the federal and state levels, including with respect to late fees, finance charges, interchange fees, credit card reward programs and other matters.

Such changes could subject us to additional costs, limit the types of financial services and products we may offer, and/or limit what we may charge for certain banking services, among other things.

For example, in February 2023, the CFPB published a proposed rule that would significantly reduce the amount of late fees that we are authorized to charge under the CARD Act safe harbor.

The CFPB’s proposed late fee rule and its potential impact on our business are discussed in more detail in the subsequent risk factor below.

Other examples of state and federal legislation we are tracking include legislation intended to place caps on the interest rates that we and other financial institutions are permitted to charge.

We expect that we, like the rest of the banking sector, will remain subject to increased regulation and supervision of our industry by bank regulatory agencies and that there may be additional and changing requirements and conditions imposed on us, any of which could increase our costs, require increased management attention, and adversely impact our results of operations.

In connection with their continuous supervision and examinations of us, the FDIC, CFPB and/or other regulatory agencies may require changes in our business or operations, and any such changes may be judicially enforceable or impractical for us to contest.

For example, in March 2024, the CFPB published a final rule that would significantly reduce the amount of late fees that we are authorized to charge under the CARD Act safe harbor.

The CFPB’s late fee rule, which is currently subject to a preliminary injunction, is discussed in more detail in the subsequent risk factor below.

Other examples of federal and state legislation we are tracking include legislation intended to place caps on the interest rates that we and other financial institutions are permitted to charge.

For example, in 2023, Colorado passed a law (initially effective July 2024) to opt out of the Depository Institutions Deregulation and Monetary Control Act (DIDMCA), a federal law addressing interstate loans by state-chartered banks.

Colorado contends that, by opting out of DIDMCA, Colorado would have the ability to impose its interest rate limits (generally capped at 21%) and fee terms (e.g., $15 late fee and 10-day grace period) on any loan made by a state-chartered bank to a resident of Colorado located in Colorado at the time of the loan.

This Colorado law is currently subject to a preliminary injunction, but we cannot provide any assurance as to the outcome of this or other similar pending or future legislation in other states, any of which would have an adverse effect on our business and results of operations.

President Trump and various federal legislators have also recently made public statements regarding potential efforts to place caps on credit card interest rates, and a bill was introduced in the U.S.

Senate in February 2025 proposing to cap credit card interest rates at 10% for a period of five years.

In connection with their continuous supervision and examinations of us, the FDIC, CFPB and/or other regulatory agencies may require changes in our business or operations.

Any such changes may be judicially enforceable and in some cases, regardless of fault, it may be less time-consuming or costly to settle these matters, which may require us to implement certain changes to our business practices, provide remediation to certain individuals or make a settlement payment to a given party or regulatory body.

We may also become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives.

For additional information regarding this consent order, see “Item 1.

Business – Supervision and Regulation” above.

For example, in late November 2023, the FDIC issued a consent order to one of our subsidiaries, arising out of the June 2022 transition of our credit card processing services to strategic outsourcing partners, and in August 2024 each of our Banks entered into an agreement with the FDIC to pay civil money penalties (CMPs) of $1 million per Bank, also related to the June 2022 transition.

For additional information regarding these matters, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations (MD&A) — Legislative and

Tabl e of Contents

Regulatory Matters” below.

Regulatory authorities have extensive discretion in their supervisory and enforcement actions.

Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business, our flexibility in conducting operations, and our ability to pay dividends or utilize capital.

Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence.

We could be required, as well, to dispose of specified assets and liabilities within a prescribed period of time.

We could be required, as well, to dispose of specified assets and liabilities within a prescribed time-frame.

As a result, any enforcement or other supervisory action could have an adverse effect on our business, results of operations, financial condition and prospects.

1 unchanged sentence

Changes in the prevailing interpretations of federal or state laws and related regulations could also invalidate or call into question the legality of certain of our services and business practices.

Our failure to comply with the laws, regulations, and supervisory actions to which we are subject, even if the failure is inadvertent or reflects a difference in interpretation, could subject us to fines, other penalties, and restrictions on our business activities, any of which could adversely affect our business, results of operations, financial condition, cash flows, capital base, and the price of our securities.

Our failure to comply with the laws, executive actions, regulations, and supervisory actions to which we are subject, even if the failure is inadvertent or reflects a difference in interpretation, could subject us to fines, other penalties, and restrictions on our business activities, any of which could adversely affect our business, results of operations, financial condition, cash flows, capital base, and the price of our securities.

Business — Supervision and Regulation” for more information about certain laws and regulations to which we are subject and their impacts on us.

Tabl e of Contents

We continue to await a final rule from the CFPB regarding credit card late fees, which could represent a significant departure from the rules that are currently in effect.

In the event the terms of any such final rule are substantially similar to those set forth in the proposed rule, we expect the rule would have a significant adverse impact on our business, results of operations and financial condition for at least the short term and, depending on the effectiveness of our actions taken in response to the rule, potentially over the long term.

As discussed in “Business – Supervision and Regulation” above, in February 2023 the CFPB published a proposed rule with request for public comment that would significantly reduce the safe harbor amount for late fees that credit card issuers are authorized to charge.

During the comment period, we joined in a comment letter submitted by the American Bankers Association (ABA), as well as submitting our own comment letter expressing our views that the proposed rule would harm consumers, that the CFPB’s assumptions were untested, unvalidated and incorrect, and that the CFPB failed to consider the proposed rule’s impact on smaller financial entities and mid-sized private label credit card issuers.

Under the proposed rulemaking , the rule would:

The CFPB has issued a final rule regarding credit card late fees, which represents a significant departure from the rules that are currently in effect.

Absent a successful legal challenge or other invalidation of the rule, we expect the rule will have a significant adverse impact on our business, results of operations and financial condition for at least the short term and, depending on the effectiveness of our actions taken in response to the rule, potentially over the long term.

In March 2024 the CFPB published a final rule that would significantly reduce the safe harbor amount for late fees that credit card issuers are authorized to charge.

Absent a successful legal challenge or other invalidation of the rule, the rule will:

(i) decrease the safe harbor amount for credit card late fees to $8 and eliminate a higher safe harbor dollar amount for subsequent late payments;

(ii) eliminate the annual inflation adjustments that currently exist for the late fee safe harbor dollar amounts;

and (iii) require that late fees not exceed 25% of the consumer’s required minimum payment.

The “safe harbor” dollar amounts referenced in the CFPB’s rulemaking refer to the amounts that credit card issuers may charge as late fees under the Credit Card Accountability Responsibility and Disclosure Act of 2009 without reference to the issuer’s cost to collect.

and (ii) eliminate the annual inflation adjustments that currently exist for the late fee safe harbor dollar amounts.

The “safe harbor” dollar amounts referenced in the CFPB’s rulemaking refer to the amounts that credit card issuers may charge as late fees under the Credit Card Accountability Responsibility and Disclosure Act of 2009 (CARD Act) without reference to the issuer’s cost to collect.

Under the CARD Act, these safe harbor amounts, since their initial implementation, have been subject to annual adjustment based on changes in the Consumer Price Index, and the safe harbor amounts are currently set at $30 for an initial late fee and $41 for subsequent late fees incurred in one of the next six billing cycles.

Accordingly, the proposed $8 safe harbor amount on late fees (and the elimination of the annual inflation-based adjustment thereto) would represent a significant decrease from the current safe harbor amounts.

In addition, while not a part of the proposed rule, the CFPB sought comment on whether late fees should be prohibited if the applicable payment is made within 15 days of the due date and whether, as a condition to utilizing the safe harbor, credit card issuers should be required to offer automatic payment options and/or provide certain notifications of upcoming payment due dates.

In the event the CFPB issues a final rule that is substantially similar to the proposed rule, we would expect the final rule to be challenged in one or more legal proceedings.

However, assuming these legal challenges are not successful and the CFPB’s final rule becomes effective on the terms substantially similar to those set forth in the proposed rule, this rule would represent an approximately 75% reduction in the amount of late fees that we are authorized to charge under the CARD Act safe harbor, which we expect would have a significant adverse impact on our revenue, results of operations and other financial metrics for at least the short term and, depending on the effectiveness of the mitigating actions that we may take in response to the rule , potentially over the long term.

We are evaluating a number of strategies designed to limit the impact of any such final rule on us and have started to execute certain of these strategies, but it may not be feasible for us to fully implement these strategies in the short term, and we cannot guarantee that these efforts will ultimately be successful even if and when fully implemented.

Moreover, any such final rule (and certain of our mitigating strategies) may present other risks and adverse impacts to our business, results of operations and financial condition, which could include, without limitation, the loss of customers due to tightened underwriting standards or negative customer response to higher rates and fees, impacts to customer payment behavior due to decreased incentives to pay, further regulatory action in response to mitigating strategies that may be employed by us or other credit card issuers, adverse impacts to or disputes with our brand partners, strategic non-renewals of certain brand partner relationships that cease to be profitable and balance sheet impairments, including of goodwill, long-lived assets and other prepaid or intangible assets.

Additional discussion regarding the CFPB’s rulemaking can be found in “Management’s Discussion & Analysis – Business Environment” below.

See also “Business — Supervision and Regulation” above for more information about certain laws and regulations to which we are subject and their impacts on us, including related risks and uncertainties.

Accordingly, the $8 safe harbor amount on late fees (and the elimination of the annual inflation-based adjustment thereto) would represent a significant decrease from the current safe harbor amounts.

Shortly after the final rule was published, a lawsuit was filed in U.S.

District Court for the Northern District of Texas (Ft.

Worth Division) by the U.S.

Chamber of Commerce, the American Bankers Association and various other parties, challenging the rule and seeking a preliminary injunction enjoining the rule from becoming effective during the pendency of the litigation.

The lawsuit asserts that the rule would ultimately harm those consumers the CFPB is charged with protecting and seeks to have the rule vacated on various grounds, including that the CFPB (i) violated the CARD Act by preventing issuers from collecting reasonable and proportional late fees when cardholders do not pay their bills on time, (ii) violated the Administrative Procedure Act by promulgating a final rule that is arbitrary and capricious, relying on inappropriate, incomplete and non-public data;

and (iii) issued the rulemaking with funds drawn in violation of the U.S.

Constitution’s Appropriations Clause.

While we are not a plaintiff in these actions, the presidents of our two subsidiary banks did each submit a declaration in connection with the plaintiffs’ motion for a preliminary injunction, and we support the positions taken by the plaintiffs in these matters.

The final rule had an original effective date of May 14, 2024; however, on May 10, 2024, the United States District Court for the Northern District of Texas granted an injunction and stay of the final rule, and the injunction granted remains in effect as of the date of this report.

The outcome of this legal challenge, including the impact on the final rule, remains uncertain.

Assuming these legal challenges are not successful and the CFPB’s final rule becomes effective, this rule will represent an approximately 75% reduction in the amount of late fees that may be charged under the CARD Act safe harbor, which we

Tabl e of Contents

expect will have a significant adverse impact on our revenue, results of operations and other financial metrics for at least the short term and, depending on the effectiveness of the mitigating actions that we take in response to the rule, potentially over the long term.

We have already executed on a number of strategies designed to limit the impact of the final rule on us and we continue to evaluate various other mitigating strategies, but it may not be feasible for us to fully implement these strategies in the short term, and we cannot guarantee that these efforts will ultimately be successful even if and when fully implemented.

Moreover, the final rule (and certain of our mitigating strategies) may present other risks and adverse impacts to our business, results of operations and financial condition, which could include, without limitation, the loss of customers due to tightened underwriting standards or negative customer response to higher rates and fees, impacts to customer payment behavior due to decreased incentives to pay, further regulatory action in response to mitigating strategies that may be employed by us or other credit card issuers, adverse impacts to or disputes with our brand partners, strategic non-renewals of certain brand partner relationships that cease to be profitable, and balance sheet impairments, including of goodwill, long-lived assets and other prepaid or intangible assets.

Additional discussion regarding the CFPB’s final rule can be found in “Management’s Discussion & Analysis – Business Environment” below.

See also “Business — Supervision and Regulation — Consumer Protection Regulation and Supervision” above for additional discussion regarding recent developments at the CFPB .

The extent to which these recent or other future developments will ultimately impact the CFPB’s regulation of our business, including the CFPB’s credit card late fee rule and the associated litigation, remains uncertain.

Litigation and other actions and disputes could subject us to significant fines, penalties, judgments and/or requirements resulting in significantly increased expenses, damage to our reputation and/or a material adverse effect on our business.

Businesses in the financial services and payments industry has historically been, and continues to be, subject to significant legal actions, including class action lawsuits.

Businesses in the financial services and payments industry have historically been, and continue to be, subject to significant legal actions, including class action lawsuits.

Many of these actions have included claims for substantial compensatory or punitive damages.

1 unchanged sentence

There may also be legislative, regulatory or other efforts to limit or eliminate the use of arbitration clauses or class action waivers, and if our arbitration provisions are found to be unenforceable or are otherwise limited or eliminated, our exposure to class action litigation could increase significantly.

Further, e ven if our arbitration clause remains enforceable, we may be subject to mass arbitrations in which large groups of

Tabl e of Contents

consumers bring arbitrations against us simultaneously.

Further, e ven if our arbitration clause remains enforceable, we may be subject to mass arbitrations in which large groups of consumers bring arbitrations against us simultaneously.

The continued focus of merchants on issues relating to the acceptance of various forms of payment may lead to additional litigation and other legal actions.

Given the inherent uncertainties involved in litigation, and the very large or indeterminate damages sought in some matters asserted against us, there is significant uncertainty as to the ultimate liability we may incur from litigation.

Claims and legal actions could involve significant defense costs and reputational damage, and the time-consuming nature of legal proceedings can divert senior management attention from the business.

In addition to litigation and regulatory matters, from time to time, through our operational and compliance controls, we identify compliance issues that require us to make operational changes and, depending on the nature of the issue, result in financial remediation to impacted cardholders.

8 unchanged sentences

Accordingly, neither CB nor CCB may be able to make any of their cash or other assets available to us, including to service our indebtedness.

If either of our Banks were to fail to meet any of the capital requirements to which it is subject, we may be required to provide them with additional capital, which could also impair our ability to service our indebtedness.

If either of our Banks were to fail to meet any of

Tabl e of Contents

the capital requirements to which it is subject, we may be required to provide them with additional capital, which could also impair our ability to service our indebtedness.

In addition, under the “Source of Strength” doctrine, we are required to serve as a source of financial strength to our Banks and may not conduct our operations in an unsafe or unsound manner.

7 unchanged sentences

If such legislation were enacted without any grandfathering of or accommodations for existing institutions, we could be required to become a BHC.

As a BHC, we and our non-bank subsidiaries would be subject to supervision, regulation and examination by the Federal Reserve Board.

If we were required to become a BHC, or if we voluntarily take such action that results in the Parent Company becoming a federally-regulated BHC, we and our non-bank subsidiaries would be subject to supervision, regulation and examination by the Federal Reserve Board.

We would be required to provide annual reports and such additional information as the Federal Reserve Board may require pursuant to the BHC Act, and applicable regulations.

In addition, we would be subject to consolidated regulatory capital requirements.

Pursuant to provisions of the BHC Act and regulations promulgated by the Federal Reserve Board thereunder, a BHC may only engage in, or own companies that engage in, activities deemed by the Federal Reserve Board to be permissible for BHCs or financial holding companies.

Activities permissible for BHCs are those that are so closely related to the business of banking or managing or controlling banks as to be a proper incident thereto.

Permissible activities for financial holding

Tabl e of Contents

companies include those “so closely related to banking as to be a proper incident thereto” as well as certain additional activities deemed “financial in nature or incidental to such financial activity” or complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of the depository institution or the financial system.

If a BHC and its subsidiary insured depository institutions are well capitalized, well managed, and have satisfactory CRA ratings, it may submit an election to the Federal Reserve Board to become an FHC.

Permissible activities for FHCs include those “so closely related to banking as to be a proper incident thereto” as well as certain additional activities deemed “financial in nature or incidental to such financial activity” or complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of the depository institution or the financial system.

If we were required to become a BHC, we may be required to modify or discontinue certain of our business activities, which may materially adversely affect our results of operations and financial condition.

1 unchanged sentence

We are generally unable to control the amount of premiums that are required to be paid for FDIC insurance.

If there are bank or financial institution failures, we may be required to pay significantly higher premiums than the levels currently imposed or additional special assessments or taxes that could adversely affect our earnings.

If there are bank or financial institution failures, or changes in the method for calculating premiums, we may be required to pay significantly higher premiums than the levels currently imposed or additional special assessments or taxes that could adversely affect our earnings.

Any future increases or required prepayments in FDIC insurance premiums may materially adversely affect our results of operations.

3 unchanged sentences

The Bank Secrecy Act, as amended by the PATRIOT Act, requires depository institutions and their holding companies to undertake activities including maintaining an anti-money laundering program, verifying the identity of partners and customers, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies.

The Financial Crimes Enforcement Network (FinCEN), a unit of the Treasury Department that administers the Bank Secrecy Act, is authorized to impose significant civil money penalties for violations of those requirements and has recently engaged in coordinated enforcement efforts with the Federal Banking Agencies , as well as the U.S.

Tabl e of Contents

Financial Crimes Enforcement Network (FinCEN), a unit of the Treasury Department that administers the Bank Secrecy Act, is authorized to impose significant civil money penalties for violations of those requirements and has recently engaged in coordinated enforcement efforts with the Federal Banking Agencies , as well as the U.S.

Department of Justice, Drug Enforcement Administration, and Internal Revenue Service (IRS).

Legislators and regulators in the United States and other countries are increasingly adopting or revising privacy, data protection, data governance, account access, and information and cyber security laws, including data localization, authentication and notification laws.

We are also subject to scrutiny of compliance with the

rules enforced by the OFAC, which may require sanctions for dealing with certain persons or countries.

We cannot provide assurance that our programs and controls will be effective to ensure our compliance with all applicable anti-money laundering and anti-terrorism financing laws and regulations, and our failure to comply could subject us to significant sanctions, fines, penalties and reputational harm, all of which could have a material adverse effect on our business, results of operations and financial condition.

Regulation in the areas of privacy, data protection, data governance, account access and information and cyber security could increase our costs and affect or limit our business opportunities and how we collect and/or use Personal Information, and any actual or perceived failure to comply with any of these new or existing laws could adversely affect our business, results of operations, or financial condition.

In connection with running our business, we receive, store, use and otherwise process information that relates to individuals and/or constitutes “personal data,” “personal information,” “personally identifiable information,” “nonpublic personal information” or similar terms under applicable data privacy laws (collectively, Personal Information), including from and about actual and prospective customers, as well as our employees and business contacts.

We are therefore subject to a variety of federal and state laws, regulations and other requirements relating to the privacy, security and handling of Personal Information.

For example, the CCPA and related laws in other jurisdictions require us to adhere to certain disclosure restrictions and deletion obligations with respect to the Personal Information of their residents, and allow for penalties for violations and, in some cases, a private right of action.

The GLBA includes both a “Privacy Rule,” which imposes obligations on financial institutions relating to the use or disclosure of nonpublic personal information, and a “Safeguards Rule,” which imposes obligations on financial institutions to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information.

Failure to comply with the GLBA could result in substantial financial penalties.

These laws also impose transparency and other obligations with respect to Personal Information and provide individuals with rights with respect to their Personal Information.

Legislators and regulators in the United States are increasingly adopting or revising privacy, data protection, data governance, account access, and information and cyber security laws, including data localization, authentication and notification laws.

As such laws are interpreted and applied (in some cases, with significant differences or conflicting requirements across jurisdictions), compliance and technology costs will continue to increase, particularly in the context of ensuring that adequate data governance, data protection, data transfer and account access mechanisms are in place.

Compliance with current or future privacy, data protection, data governance, account access, and information and cyber security laws could significantly impact our collection, use, sharing, retention and safeguarding of consumer and/or employee information and could restrict our ability to provide certain products and services, which could materially and adversely affect our profitability.

Our failure to comply with such laws could result in potentially significant regulatory and/or governmental investigations and/or actions, litigation, fines, sanctions, ongoing regulatory monitoring, customer attrition, decreases in the use or acceptance of our cards and damage to our reputation and our brand.

For more information on regulatory and legislative activity in this area, see “Privacy and Data Protection Regulation” above.

We may not be able to effectively manage the operational and compliance risks to which we are exposed.

Operational risk is the risk arising from inadequate or failed internal processes or systems, human errors or misconduct, or adverse external events.

Operational losses result from internal fraud;

external fraud;

inadequate or inappropriate employment practices and workplace safety;

failure to meet professional obligations involving partners, products, and business practices;

damage to physical assets;

business disruption and systems failures;

and/or failures in execution, delivery, and process management.

As processes or organizations are changed, or new products and services are introduced, we may not fully appreciate or identify new operational risks that may arise from such changes.

Through human error, fraud or malfeasance, conduct risk can result in harm to customers, broader markets and us and our employees.

Tabl e of Contents

Compliance risk arises from the failure to adhere to applicable laws, rules, regulations and internal policies and procedures.

We need to continually update and enhance our control environment to address operational and compliance risks.

Operational and compliance failures or deficiencies in our control environment can expose us to reputational and legal risks as well as fines, civil money penalties or payment of damages and can lead to diminished business opportunities and diminished ability to expand key operations.

Compliance with current or future privacy, data protection, data governance, account access, and information and cyber security laws could significantly impact our collection, use, sharing, retention and safeguarding of Personal Information and could restrict our ability to provide certain products and services, which could materially and adversely affect our profitability.

In addition, any failure or perceived failure to comply with such laws, regulations and other requirements relating to the privacy, security and handling of information could result in potentially significant regulatory and/or governmental investigations and/or claims, actions or litigation (including class actions).

We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines, be required to change our business, or face sanctions or ongoing regulatory monitoring.

These proceedings and any subsequent adverse outcomes could subject us to significant customer attrition, decreases in the use or acceptance of our cards and damage to our reputation and our brand.

If any of these events were to occur, our business, results of operations, and financial condition could be materially adversely affected.

For more information on regulatory and legislative activity in this area, see “Privacy, Information Security and Data Protection” above.

Our failure to protect our intellectual property rights and use of open source software may harm our competitive position, and litigation to protect our intellectual property rights or defend against third-party allegations of infringement may be costly, any of which could negatively impact our business, results of operations and profitability.

Third parties may infringe or misappropriate our trademarks or other intellectual property rights, which could have a material adverse effect on our business, operating results or financial condition.

The actions we take to protect our trademarks and other proprietary rights may not be adequate.

Litigation may be necessary to enforce our intellectual property rights, protect our trade secrets or determine the validity and scope of the proprietary rights of others.

Any infringement or misappropriation could harm any competitive advantage we currently derive or may derive from our proprietary rights.

Third parties may infringe or misappropriate our trademarks or other intellectual property rights, which could adversely impact our business, operating results or financial condition.

The actions we take to protect our patents, copyrights, trademarks and other proprietary rights may not be adequate.

Litigation may be necessary to enforce our intellectual property rights, protect our patents, copyrights, trademarks or trade secrets or determine the validity and scope of the

Tabl e of Contents

proprietary rights of others.

Any infringement or misappropriation could harm any competitive advantage we currently derive or may derive from our intellectual property or other proprietary rights.

Third parties may also assert infringement claims against us.

Any claims and an adverse determination in any resulting litigation could subject us to significant liability for damages and require us to either design around a third party’s patent or license alternative technology from another party.

In addition, litigation is time consuming and expensive to defend and could result in the diversion of our time and resources.

Any claims and an adverse determination in any resulting litigation could subject us to significant liability for damages and require us to either design around a third-party’s intellectual property or license alternative technology from another party.

Moreover, it has become common in recent years for individuals and groups to purchase intellectual property assets for the sole purpose of making claims of infringement and attempting to extract settlements from companies like ours.

Even in instances where we believe that claims and allegations of intellectual property infringement against us are without merit, litigation is time consuming and expensive to defend and could result in the diversion of our time and resources.

Further, our competitors or other third parties may independently design around or develop similar technology, or otherwise duplicate our services or products in a way that would preclude us from asserting our intellectual property rights against them.

In addition, our contractual arrangements may not effectively prevent disclosure of our intellectual property or confidential and proprietary information or provide an adequate remedy in the event of an unauthorized disclosure.

Aspects of our platform include software covered by open source licenses.

United States courts have not interpreted the terms of various open source licenses, but could interpret them in a manner that imposes unanticipated conditions or restrictions on our platform.

If portions of our proprietary software are determined to be subject to an open source license, we could also be required to, under certain circumstances, publicly release or license, at no cost, our products that incorporate the open source software or the affected portions of our source code.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software because open source licensors generally do not provide warranties or other contractual protections regarding infringement, misappropriation, security vulnerabilities, defects or errors in the code or other violations, any of which could result in liability to us and negatively impact our business, results of operations, profitability and financial condition.

Our platform utilizes software covered by open source licenses.

The use of open source software involves a number of risks, many of which cannot be eliminated and could negatively affect our business.

For example, United States courts have not interpreted the terms of various open source licenses and there is a risk that some open source licenses to which we are subject could be interpreted in a manner that could impose unanticipated conditions or restrictions on our ability to use or to commercialize our platform.

By the terms of certain open source licenses, if we combine our proprietary software with open source software in a certain manner, we could be required to, under certain circumstances, release the source code of our proprietary software and to make our proprietary software available under open source licenses.

We may face claims alleging noncompliance with open source licenses or misappropriation, infringement, or other violation of third-party rights resulting from our use of open source software.

These claims could result in litigation, damage our reputation in the open-source community, or require us to purchase costly software licenses, devote additional research or development resources to reengineer our platform, discontinue use of our platform if reengineering could not be accomplished on a timely or cost-effective basis, and/or make the source code of our proprietary software generally available, any of which could result in liability to us and negatively impact our business, results of operations, profitability and financial condition.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software because open source software licensors generally do not provide

any warranties or other contractual protections for the open source software, including contractual protections regarding infringement, misappropriation, security vulnerabilities, or defects or errors in the code, any of which could result in liability to us and negatively impact our business, results of operations, profitability and financial condition.

We have international operations that subject us to various international risks as well as increased compliance and regulatory risks and costs.

We have international operations, primarily in India, and some of our third-party service providers provide services to us from other countries, all of which subject us to a number of international risks, including, among other things, sovereign volatility and socio-political instability.

In recent years, we have taken initiatives to move a greater percentage of our call center and servicing personnel offshore, which may increase our reliance on these international operations and the risk associated therewith.

Any future social or political instability in the countries in which we operate could have a material adverse effect on our business.

9 unchanged sentences

There can be no assurance that our historical tax positions will not be challenged by the relevant taxing authorities, or that we would be successful in defending our positions in connection with any such challenge.

On August 16, 2022, President Biden signed into law the Inflation Reduction Act (IRA), which, among other changes, imposes a 15% corporate alternative minimum tax (CAMT) on the “adjusted financial statement income” of certain large

Tabl e of Contents

corporations (generally, corporations reporting at least $1 billion average adjusted pre-tax net income on their consolidated financial statements) as well as an excise tax of 1% on the fair market value of certain public company stock repurchases for tax years beginning after December 31, 2022.

Effective January 1, 2023, we adopted the applicable provisions under the IRA, which has not had a significant impact on our financial position, results of operations or cash flows, nor has it resulted in significant changes to the supporting operational processes, controls or governance.

If we become subject to CAMT in the future, our cash obligations for U.S.

federal income taxes could be increased.

To the extent the 1% excise tax will apply to any repurchases of shares under any new repurchase programs, the number of shares we repurchase and our cash flow may be affected.

Anti-takeover provisions in our organizational documents and Delaware law may discourage or prevent a change of control, even if an acquisition would be beneficial to our stockholders, which could affect our stock price adversely and prevent or delay change of control transactions or attempts by our stockholders to replace or remove our current management.

3 unchanged sentences

Any delay or prevention of a change of control transaction or changes in our Board of Directors could cause the market price of our common stock to decline or delay or prevent our stockholders from receiving a premium over the market price of our common stock that they might otherwise receive.

There are certain risks associated with the Convertible Notes that we issued in 2023, including that the conversion of the Convertible Notes may dilute the ownership interest of our existing stockholders and affect our per share results and the trading price of our common stock.

In addition, the fundamental change provisions associated with the Convertible Notes may delay or prevent an otherwise beneficial takeover attempt of us.

The Convertible Notes that we issued in June 2023 are convertible and, upon any such conversion, we will pay cash up to the aggregate principal amount of the Convertible Notes to be converted and pay or deliver, as the case may be, cash, shares of our common stock, or a combination of cash and shares of our common stock (at our election), in respect of the remainder, if any, of our conversion obligation in excess of the aggregate principal amount of the Convertible Notes being converted.

The issuance of shares of our common stock, if any, upon conversion of the Convertible Notes may dilute the ownership interests of existing stockholders, to the extent such dilution is not offset by the Capped Call transactions.

Issuances of stock, if any, upon conversion of the Convertible Notes may also affect our per share results of operations.

Any sales in the public market of our common stock issuable upon such conversions could adversely affect prevailing market prices of our common stock.

For additional information regarding our Convertible Notes and the associated Capped Call transactions, see Note 10, “Borrowings of Long-Term and Other Debt” to our audited Consolidated Financial Statements included as part of this Annual Report on Form 10-K.

In addition, the indenture governing the Convertible Notes contains certain provisions that allow holders of Convertible Notes to require us to purchase all or a portion of their notes upon the occurrence of certain fundamental changes described in the indenture.

These provisions and the provisions in the indenture requiring an increase to the conversion rate of the Convertible Notes for conversions in connection with a make-whole fundamental change may, in certain circumstances, delay or prevent a takeover of us and the removal of incumbent management that might otherwise be beneficial to investors.

Tabl e of Contents

Cybersecurity, Technology and Vendor Risks

10 unchanged sentences

These outages and interruptions resulted in a number of adverse impacts, including customer complaints, negative social media postings, reputational damage, regulatory scrutiny, lost potential revenue, remediation costs, timing-related impacts to our Delinquency rate and Net loss rate data, and increased consulting and professional fees.

Furthermore, in late November 2023, the FDIC issued a consent order to one of our subsidiaries arising out of the transition, and we may be subject to further regulatory scrutiny or actions in connection with the transition.

For additional information regarding this consent order, see “Item 1.

Furthermore, in late November 2023, the FDIC issued a consent order to one of our subsidiaries arising out of the transition, and in August 2024 each of our Banks entered into an agreement with the FDIC to pay CMPs of $1 million per Bank, also related to the transition.

For additional information regarding the consent order and the CMPs, see “Item 1.

Business – Supervision and Regulation” above.

These challenges associated with the transition have adversely impacted, and may continue to adversely impact, our business, results of operations, financial condition, and result in damage to our reputation and our brand.

These challenges associated with the transition have adversely impacted, and may continue to adversely impact, our business, results of operations, financial condition, and result in

Tabl e of Contents

damage to our reputation and our brand.

Moreover, now that we have completed this transition, it would be difficult and disruptive for us to replace certain of these third-party vendors, particularly Fiserv, in a timely or seamless manner if they were unwilling or unable to continue to provide us with these services in the future (as a result of their financial or business conditions or otherwise), which could materially impact our business and operations.

Failure to safeguard our data and consumer privacy could affect our reputation among our partners and their customers, and may expose us to legal claims.

Although we have extensive physical and cyber security controls and have implemented a cybersecurity risk management and governance program and associated procedures, our data has in the past been and in the future may be subject to unauthorized access.

In such instances of unauthorized access, we may have data loss that could harm our customers and brand partners.

This in turn could lead to reputational risk as concerns with security and privacy of data may result in consumers and future and existing brand partners not wanting to use our product offerings.

We also have arrangements in place with our partners and other third parties through which we share and receive information about their customers who are or may become our customers, which magnifies certain information security issues.

If we, our third-party providers, or brand partners fail to safeguard our confidential information and/or experience a data security incident, there may be damage to our brand and reputation, material financial penalties and legal claims, which could materially adversely affect our business, results of operations, and financial condition.

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, IT Systems).

We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services.

We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners, brand partners, and others, including Personal Information, as well as proprietary information belonging to our business such as trade secrets (collectively, Confidential Information).

Information security risks for large financial institutions have increased with the adoption of new technologies, including those used on mobile devices, to conduct financial and other business transactions, and the increased sophistication and activity level of threat actors.

These threat actors employ advanced techniques and tools, including AI, to circumvent security controls, evade detection and remove forensic evidence.

Consequently, we may face challenges in detecting, investigating, remediating or recovering from future attacks or incidents, which could lead to a material adverse impact on our IT Systems, Confidential Information or business.

There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information.

Furthermore, given the nature of complex systems, software and services like ours, and the scanning tools that we deploy across our networks and products, we regularly identify and track security vulnerabilities.

We are unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor.

We and certain of our third-party providers have in the past been, and in the future may be, subject to cyberattacks and we expect such attacks and incidents to continue in varying degrees.

For example, we have suffered cyberattacks relating to unauthorized access to customer accounts, and in such instances, we have notified impacted customers and regulators as required by law.

While to date no incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future.

In such instances of an adverse impact on our IT Systems or Confidential Information, we may have data loss that could harm our customers and brand partners.

This in turn could lead to reputational risk as concerns with security and privacy of data may result in consumers and future and existing brand partners not wanting to use our product offerings.

We also have arrangements in place with our partners and other third parties through which we share and receive Confidential Information about their customers who are or may become our customers, which magnifies certain information security issues.

The use of our products and services could decline if any compromise of physical or cyber security occurred.

In addition, any unauthorized release of customer information or any public perception that we released customer information without

Tabl e of Contents

authorization, could subject us to legal claims from our partners or their customers, consumers or regulatory enforcement actions, which may adversely affect our partner relationships and result in damage to our reputation and our brand .

In addition, any unauthorized release of Confidential Information or any public perception that we released Confidential Information without authorization, could subject us to legal claims (including class actions) from our partners or their customers, consumers or regulatory enforcement actions (including fines and penalties), which may adversely affect our partner relationships and result in damage to our reputation and our brand, and/or cause us to incur significant incident response, system restoration or remediation and future compliance costs.

Any or all of the foregoing could materially adversely affect our business, results of operations, and financial condition.

We cannot be certain that our cybersecurity insurance coverage will be adequate for cybersecurity liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that our insurer will not deny coverage as to any future claim.

Business interruptions, including loss of data center capacity, interruption due to cyber-attacks, loss of network connectivity or inability to utilize proprietary software of third-party vendors, could affect our ability to timely meet the needs of our partners and customers and harm our business.

Our ability, and that of our third-party service providers and brand partners, to protect our data centers and other facilities and systems against damage, loss or performance degradation from power loss, network failure, cyber-attacks, including ransomware or denial of service attacks, insider threats, hardware and software defects or malfunctions, human error, computer viruses or other malware, public health crises, disruptions in telecommunications services, fraud, fires and other disasters and other events is critical.

In order to provide many of our services, we must be able to store, retrieve, process and manage large amounts of data, as well as periodically expand and upgrade our technology capabilities.

Any damage to our data centers or other facilities and systems, or those of our third-party service providers or brand partners, any failure of our network links that interrupts our operations or any impairment of our ability to use our software or the proprietary software of third party vendors, including impairments due to cyber-attacks, could adversely affect our ability to meet our partners’ and customers’ needs and their confidence in utilizing us for future services.

In addition, any failure to successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies in a timely manner could have an adverse impact on our business if we are not able to be competitive with other financial services companies, and could also adversely impact our internal controls (including internal controls over financial reporting), results of operations, and financial condition.

We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information.

Our ability, and that of our third-party service providers and brand partners, to protect our IT Systems and Confidential Information against damage, loss or performance degradation from power loss,

Tabl e of Contents

network failure, cyber-attacks, including ransomware or denial of service attacks, insider threats, state-sponsored threats, hardware and software defects or malfunctions, human error, computer viruses or other malware, public health crises, disruptions in telecommunications services, fraud, fires and other disasters and other events is critical.

To provide many of our services, we must be able to store, retrieve, process and manage large amounts of data, as well as periodically expand and upgrade our IT Systems.

Any damage to our IT Systems, including those of our third-party service providers or brand partners, any failure of our network links that interrupts our operations or any impairment of our ability to use our software or the proprietary software of third-party vendors, including impairments due to cyber-attacks, could adversely affect our ability to meet our partners’ and customers’ needs and their confidence in utilizing us for future services.

In addition, any failure to successfully implement new IT Systems, or improvements or upgrades to existing IT Systems in a timely manner could have an adverse impact on our business if we are not able to be competitive with other financial services companies and could also adversely impact our internal controls (including internal controls over financial reporting), results of operations, and financial condition.

If we are not able to invest successfully in, and compete at the leading edge of, technological developments in our industry, our revenue and profitability could be materially adversely affected.

Our industry is subject to rapid and significant technological changes.

In order to compete in our industry, we need to continue to invest in advanced digital and other technology across all areas of our business, including in access management, vulnerability management, transaction processing, data management and analytics, machine learning and artificial intelligence, customer interactions and communications, alternative payment and financing mechanisms, authentication technologies and digital identification, tokenization, real-time settlement, and risk management and compliance systems.

In order to compete in our industry, we need to continue to invest in advanced digital and other technology across all areas of our business, including in access management, vulnerability management, transaction processing, data management and analytics, AI technology, customer interactions and communications, alternative payment and financing mechanisms, authentication technologies and digital identification, tokenization, real-time settlement, and risk management and compliance systems.

Incorporating new technologies into our products and services, including developing the appropriate governance and controls consistent with statutory and regulatory expectations, requires substantial expenditures and takes considerable time, and ultimately may not be successful.

3 unchanged sentences

In addition, we may underestimate the time and expense we must invest in new products and services before they generate significant revenues, if at all.

Our use of artificial intelligence and machine learning is subject to risks related to flaws in our algorithms and datasets that may be insufficient or contain biased information.

These deficiencies could undermine the decisions based on impact to data quality, predictions or analysis such technologies produce, subjecting us to competitive harm, legal liability, and harm to our reputation or brand.

Our ability to develop, acquire or access competitive technologies or business processes on acceptable terms may also be limited by intellectual property rights that third parties, including those that current and potential competitors, may assert.

In addition, our ability to adopt new technologies may be inhibited by the emergence of industry-wide standards, a changing legislative and regulatory environment, an inability to develop appropriate governance and controls, a lack of internal product and engineering expertise, resistance to change from partners or consumers, lack of appropriate change management processes or the complexity of our systems.

The development and use of AI present risks and challenges that may adversely impact our business or customers.

We or our third-party vendors, clients or counterparties have developed or incorporated, or may in the future develop or incorporate, AI technology in certain business processes, services or products.

The development and use of AI presents a number of risks and challenges to our business.

The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the United States and internationally, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI.

These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance.

AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential or proprietary information, that reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others or that is otherwise harmful.

In addition, certain uses of AI technology may be subject to regulation, such as requirements to explain how the AI model works and why it generates a particular output, eliminate biases built into the AI model, reduce erroneous outputs, and comply with regulations requiring watermarking AI-generated content and disclosures when consumers are interacting with AI or when decisions are made by AI, as well as requiring documentation or explanation of the basis on which decisions are made.

These additional requirements may impose increased costs on our technology and compliance functions, which could have an adverse effect on our results of operations and financial condition.

Tabl e of Contents

Further, we may rely on AI models developed by third parties, and would be dependent in part on the manner in which those third parties develop, train and deploy their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models and other matters over which we may have limited visibility.

Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

We are also exposed to risks arising from the use of AI technology by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks (including sophisticated social engineering attacks and AI-powered hacking).

Malicious actors could use AI to create deepfakes of our leadership or other personnel, contributing to loss of customer trust and significant reputational damage in addition to financial harm.

Risks Related to the LoyaltyOne Spinoff

The LoyaltyOne spinoff could result in substantial tax liability to us and our stockholders, and more generally, we have been adversely affected by LVI’s performance, and we may continue to be adversely affected by LVI’s ongoing bankruptcy proceedings or litigation or other disputes involving or relating to LVI.

The LoyaltyOne spinoff could result in substantial tax liability to us and our stockholders, and more generally, we may be adversely affected by LVI’s ongoing bankruptcy proceedings or pending or future litigation or other disputes involving or relating to LVI.

In November 2021, we completed the spinoff of our former LoyaltyOne segment, consisting of the Canadian AIR MILES® Reward Program and the Netherlands-based BrandLoyalty businesses, into an independent, publicly traded company, LVI.

15 unchanged sentences

In addition, it is possible the IRS could view this disposition as inconsistent with the PLR and, as a result, the IRS could take the position that we cannot rely on the PLR.

More generally, we have been adversely affected by LVI’s performance, and we may continue to be adversely affected by the ongoing LVI Bankruptcy Proceedings or disputes involving or relating to LVI.

During 2022, LVI’s stock price decreased significantly and, as a result, we wrote down the value of our 19% shareholding in LVI from $50 million as of December 31, 2021, to $6 million as of December 31, 2022.

As of March 31, 2023, we had written down the value of these LVI shares to zero.

We continued to hold our 19% ownership interest in LVI until it, along with all other common stock of LVI, was cancelled and extinguished pursuant to LVI’s Chapter 11 Plan, which became effective in June 2023.

Furthermore, though we believe that our process and decision-making with respect to the spinoff transaction were entirely appropriate, LoyaltyOne, Co.

(the LVI subsidiary that operated its Canadian AIR MILES business) filed suit against us and Joseph Motes, our general counsel, in the Ontario Superior Court of Justice in Canada in October 2023.

The lawsuit asserts that Mr.

Motes, in his capacity as a pre-spinoff director of LoyaltyOne, Co., breached various fiduciary duties owed to LoyaltyOne, Co.

in connection with the LVI spinoff and certain other transactions, and that Bread Financial assisted in and benefited from those breaches.

The lawsuit seeks damages in the amount of $775 million.

LVI has also established a litigation trust in the U.S.

Chapter 11 proceedings to pursue claims against us and one or more members of our management team in respect of the spinoff transaction, although no such claims have been filed to date.

While we believe that the suit filed against us in Canada and any other claims in connection with the spinoff are without merit and we will defend ourselves vigorously, litigation is complex and the outcomes are inherently uncertain.

Furthermore, though we believe that our process and decision-making with respect to the spinoff transaction were entirely appropriate, we and certain members of our Board of Directors and executive management team have been named as defendants in various litigation matters relating to the spinoff.

LoyaltyOne, Co.

is also contesting our entitlement to certain potential tax refunds under the tax matters agreement, and we may also become

(the LVI subsidiary that operated its Canadian AIR MILES business) filed suit against us and our general counsel in the Ontario Superior Court of Justice in Canada in October 2023.

The lawsuit asserts that our general counsel, in his capacity as a pre-spinoff director of LoyaltyOne, Co., breached various fiduciary duties owed to LoyaltyOne, Co.

in connection with the LVI spinoff and

Tabl e of Contents

involved in other disputes with respect to the spinoff agreements with LVI, or incur other liabilities or obligations under contractual arrangements with LVI.

In addition, a putative federal securities class action complaint was filed in April 2023 against us and current and former members of our management team concerning disclosures made about LVI’s business, which we believe is without merit and we will defend ourselves vigorously.

certain other transactions, and that Bread Financial assisted in and benefited from those breaches.

The lawsuit seeks damages in the amount of $775 million.

Pursuant to LVI’s Chapter 11 Plan, LVI and a liquidating trustee also established a liquidating trust to pursue claims, including against individuals and entities in respect of the spinoff transaction, and in February 2024 that liquidating trustee commenced certain actions against us.

Specifically:

(i) in LVI’s U.S.

Chapter 11 case in the Bankruptcy Court for the Southern District of Texas, the liquidating trustee filed an adversary proceeding against us and our general counsel alleging actual and constructive fraudulent transfers, among other claims, in connection with the spinoff;

and (ii) in Delaware Chancery Court, the liquidating trustee filed an action against us, each of the members of our Board of Directors at the time of the spinoff, and certain members of our executive management team alleging breaches of fiduciary duties (and aiding and abetting breaches of fiduciary duties) in connection with the spinoff.

Among other things, in each of these actions the liquidating trustee seeks damages in the amount of approximately $750 million plus interest, fees and expenses.

LoyaltyOne, Co.

is also contesting our entitlement to certain potential tax refunds under the tax matters agreement, and we may also become involved in other disputes with respect to the spinoff agreements with LVI or incur other liabilities or obligations under contractual arrangements with LVI.

Finally, a putative federal securities class action complaint was filed in April 2023 against us and current and former members of our management team concerning disclosures made about LVI’s business.

For additional detail regarding these pending litigation matters, see Note 16 “Commitments and Contingencies” to our audited Consolidated Financial Statements.

While we believe that each of these suits and any other claims in connection with the spinoff are without merit and we will defend ourselves vigorously, litigation is complex and the outcomes are inherently uncertain.

Any litigation or dispute arising out of or relating to the spinoff could distract management, result in significant legal and other costs, and otherwise adversely impact our financial position, results of operations and financial condition.

10 unchanged sentences

Each of these Board Committees consists entirely of independent directors and provides regular reports to the full Board regarding matters reviewed at their Committee meetings.

Each of our Banks also has a comprehensive Enterprise Risk Management Framework, approved by the board of directors of the respective Bank, which includes governance, compliance, reporting and other requirements.

Risk Management Roles and Responsibilities

In addition to our Board and Board Committees, responsibility for risk management also flows to other individuals and entities throughout the Company, including various management committees and executive management.

Our ERM Framework defines our “three lines of defense” risk management model, which includes the following:

In addition to our Board and Board Committees, responsibility for risk management also flows to other individuals and legal entities throughout the Company, including, the Board of Directors of each of our Banks and committees thereof, various management committees and executive management.

Our “three lines of defense” risk management model is defined within our ERM Framework and includes the following:

• The “first line of defense” is comprised of the business areas that engage in activities that generate revenue or provide operational support or services that introduce risk to us.

1 unchanged sentence

The first line of defense identifies and manages key risk indicators and risks and controls consistent with our risk appetite.

The executive officers who serve as leaders in the “first line of defense,” are responsible for ensuring that their respective functions operate within established risk limits, in accordance with our risk appetite.

The executive officers who serve as leaders in the “first line of defense,” are responsible for ensuring that their respective functions operate within established risk limits, in accordance

Tabl e of Contents

with our risk appetite.

These leaders are also responsible for identifying risks, considering risk when developing strategic plans, budgets and new products, and implementing appropriate risk controls when pursuing business strategies and objectives.

1 unchanged sentence

• The “second line of defense” consists of an independent risk management team charged with oversight and monitoring of risk within the business.

The second line of defense is responsible for, among other things, formulating our ERM Framework and related policies and procedures, effectively challenging the first line of defense and identifying, monitoring and reporting on aggregate risks of the business and support functions.

The second line of defense is responsible for, among other things, formulating and overseeing our ERM Framework and related policies and procedures, effectively challenging the first line of defense and identifying, monitoring and reporting on aggregate risks of the business and support functions.

Our risk management team, which is led by our CRO and includes compliance, provides oversight of our risk profile and is responsible for maintaining a compliance program that includes compliance risk assessment, policy development, testing and reporting activities.

The CRO manages our risk management team and is responsible for establishing and implementing standards for the identification, management, measurement, monitoring and reporting of risk on an Enterprise-wide basis.

The CRO is responsible for developing an appropriate risk appetite with corresponding limits that aligns with

Tabl e of Contents

supervisory expectations, and proposing our risk appetite to the Board of Directors.

The CRO is responsible for developing an appropriate risk appetite with corresponding limits that aligns with supervisory expectations, along with proposing our risk appetite to the Board of Directors.

The CRO regularly reports to the Risk & Technology Committee as well as the Banks’ Risk and Compliance Committees on risk management matters.

4 unchanged sentences

Management Committees

We operate several internal management committees, including at each of our Banks, a Bank Risk Management Committee (BRMC) and, effective January 2023, an IT Governance Committee (ITGC).

The BRMCs and ITGCs are the highest-level management committees at the Banks to oversee risks and are responsible for risk governance, risk oversight and making recommendations on the Banks’ risk appetite.

The BRMCs and ITGCs monitor compliance with limits and related escalation requirements, and oversee implementation of risk policies.

In addition to the BRMCs and ITGCs, we maintain the following risk management committees at each of our Banks to oversee the risks listed below:

We operate several internal management committees, including at each of our Banks, a Bank Risk Management Committee (BRMC).

The BRMCs are the highest-level management committees at the Banks to oversee risks and are responsible for risk governance, risk oversight and making recommendations on the Banks’ risk appetite.

The BRMCs monitor compliance with limits and related escalation requirements, and oversee implementation of risk policies.

In addition to the BRMCs, we maintain the following risk management committees at each of our Banks to oversee the risks listed below:

the Credit Risk Management Committee;

3 unchanged sentences

and the Asset & Liability Management Committee;

Each of these Committees is responsible for one or more of the Banks’ eight risk categories, which are described in greater detail below under the heading “Risk Categories”.

we also maintain a Parent Company Asset & Liability Management Committee and a Capital Management Committee.

Each of these Committees is responsible for one or more of the eight risk categories, which are described in detail below under the heading “Risk Categories”.

For its risk category(ies) of responsibility, each Committee provides risk governance, risk oversight and monitoring.

Each Committee reviews key risk exposures, trends and significant compliance matters, and provides guidance on steps to monitor, control and escalate significant risks.

We include the risk information provided by the BRMCs and the ITGCs, and these management risk committees, along with additional risk information that is identified at the Parent Company level in our determination and assessment of the risks that are presented to and discussed with our Board and Board Committees.

We include the risk information provided by the BRMCs and these risk management committees, along with additional risk information that is identified at the Parent Company level, in our determination and assessment of the risks that are presented to and discussed with our Board and Board Committees.

Risk Categories

We have divided risk into the following eight categories:

credit, market, liquidity, operational, compliance, model, strategic and reputational risk.

We evaluate the potential impact of a risk event on us (including our subsidiaries) by assessing the customer, partner, financial, reputational, and legal and regulatory impacts.

We evaluate the potential impact of a risk event on us (including our subsidiaries) by assessing the customer, partner, financial, reputational and legal and regulatory impacts, and have divided risk into the following categories.

During 2024, we made various enhancements to our risk management practices, particularly within the Market, Liquidity and Capital risk categories, and we will continue to evaluate the structure of risk pillars and other potential enhancements going forward.

Tabl e of Contents

Credit Risk is the risk arising from an obligor’s failure to meet the terms of any contract or otherwise perform as agreed.

Credit Risk is found in all activities in which settlement or repayment depends on counterparty, issuer or borrower performance.

We are exposed to credit risk relating to the credit card and BNPL loans we make to our customers.

Our credit risk relates to the risk that consumers using the private label, co-brand, general purpose or business credit cards or BNPL loans that we issue will not repay their loan balances.

To minimize our risk of credit card or other loan write-offs, we have developed automated proprietary scoring technology and verification procedures to make risk-based origination decisions when approving new account-holders, establishing or adjusting account-holder credit limits and applying our risk-based pricing.

The credit risk on our credit card and BNPL loans is quantified through our Allowance for credit losses which is recorded net with Credit card and other loans on our Consolidated Balance Sheets.

Credit risk is overseen and monitored by the Credit Risk Management Committee.

Tabl e of Contents

We are exposed to credit risk primarily relating to the credit card and other loans we make to our customers.

Our credit risk relates to the risk that consumers using the private label, co-brand, general purpose or DTC credit cards, or other loans that we issue will not repay their loan balances.

As part of our efforts to minimize our risk of credit card or other loan write-offs, we have developed automated proprietary scoring technology and verification procedures to make risk-based origination decisions when approving new account holders, establishing or adjusting account holder credit limits and applying our risk-based pricing.

The credit risk on our Credit card and other loans balances is quantified through our Allowance for credit losses which is recorded net with Credit card and other loans on our Consolidated Balance Sheets.

Credit risk is overseen and monitored by the Credit Risk Management Committee at each Bank.

Market risk is the risk to current or anticipated earnings, capital or economic value arising from changes in the market

value of portfolios, securities or other financial instruments.

Market Risk includes interest rate risk which is the risk arising from movements in interest rates.

Interest rate risk results from:

• differences between the timing of rate changes and the timing of cash flows (repricing risk);

• changing rate relationships among different yield curves affecting an organization’s activities (basis risk);

• changing rate relationships across the spectrum of maturities (yield curve risk);

• interest-related options embedded in certain products (options risk).

• Repricing risk – differences between the timing of rate changes and the timing of cash flows;

• Basis risk – changing rate relationships among different yield curves affecting an organization’s activities;

• Yield curve risk – changing rate relationships across the spectrum of maturities;

• Options risk – interest-related options embedded in certain products.

Our principal market risk exposures arise from volatility in interest rates and their impact on economic value, capitalization levels and earnings.

We use various market risk measurement techniques and analyses to measure, assess and manage the impact of changes in interest rates on our Net interest income.

The approach we use to quantify interest rate risk is a sensitivity analysis, which we believe best reflects the risk inherent in our business.

This approach calculates the impact on Net interest income from an instantaneous and sustained 100 basis point increase or decrease in interest rates.

Historically, we have not used interest rate derivative contracts to manage interest rate risk;

however, as part of our ongoing evolution of interest rate risk mitigation tools, we established interest rate risk hedging capabilities in 2024, employing interest rate swaps on our credit card loans portfolio to reduce interest rate risk sensitivity.

To the extent we are unable to effectively match the interest rate sensitivity of our assets and liabilities, our net earnings could be materially adversely affected.

We use various industry standard market risk measurement techniques and sensitivity analyses to estimate, assess and manage the impact of positive or negative changes in interest rates on our Net interest income and economic value of equity under various interest rate scenarios.

We believe these approaches provide useful insights into the interest rate risk inherent in our business, and how to effectively manage such risk.

As of December 31, 2024, based on the composition of our fixed rate and floating rate assets and liabilities on our Consolidated Balance Sheets, our net interest income and economic value of equity are expected to increase in higher rate scenarios and decrease in lower rate scenarios.

One standard sensitivity measure we use calculates the impact on net interest income from a hypothetical instantaneous and sustained 100 basis point increase or decrease in interest rates.

Due to the mix of fixed and floating rate assets and liabilities on our Consolidated Balance Sheet as of December 31, 2024, this hypothetical instantaneous 100 basis point increase or decrease in interest rates would have an insignificant impact on our annual net interest income.

Actual changes in our net interest income will depend on many factors, and therefore may differ from our estimated risk to changes in interest rates.

The Asset & Liability Management Committee assists the Banks’ Board of Directors and Bank Management in overseeing, reviewing, and monitoring market risk.

In addition to this industry standard measure, we also consider the potential impact of alternative interest rate scenarios in our internal interest rate risk management decisions, such as larger rate shocks (higher than +/- 100 basis points), or steepening and flattening yield curve scenarios.

We also regularly review the sensitivity of our interest rate risk metrics to changes in our key modeling assumptions.

In 2023 and 2024, we implemented a new and improved asset liability management model that is capable of assessing a broader array of interest rate risk scenarios, including a wider range of interest rate and balance sheet assumptions.

The interest rate risk model that we use in deriving these measures incorporates contractual information, behavioral assumptions and modeling methodologies, which project borrower and deposit behavior patterns.

Other market inputs, such as interest rates, market prices and interest rate volatility, are also critical components of our interest rate risk measures.

We regularly update and enhance these assumptions, scenarios and model as we believe appropriate to reflect our best assessment of the market environment and the expected behavior patterns of our existing assets and liabilities.

There are inherent limitations, however, in any methodology used to estimate the exposure to changes in market interest rates.

Tabl e of Contents

sensitivity analysis described above contemplates only certain movements in interest rates and is performed at a particular point in time based on our existing Consolidated Balance Sheet.

Accordingly, changes in customer behavior and strategic actions that management may take in the future may cause the composition of our assets and liabilities to change from the assumptions and projections previously used in scenarios considered, and could cause our actual Net interest income and economic value of equity to differ from previous sensitivity analysis outcomes.

The Board of Directors of the Parent Company and each Bank approve our market risk management policies, risk appetites, and associated risk limits which guide our market risk management activities.

The Asset & Liability Management Committee of the Parent Company and each of the Banks assists the Board of Directors of the Parent Company and each of the Banks, as well as management, in overseeing, reviewing, and monitoring market risk.

Capital risk refers to the potential threat to an institution's financial stability or safety due to inadequate capital resources to support business operations and safeguard against unexpected losses.

These risks can arise from various stressed operating conditions, including macroeconomic, credit, liquidity, market, and regulatory factors.

We manage capital in alignment with the risk characteristics of our business, the economic environment, and the expectations of regulators and shareholders.

This includes considering the impact of capital stress testing in our assessment of capital adequacy.

Capital risk is managed by balancing stakeholder interests, such as safety and soundness, profit, growth, value, and operational and non-financial factors, while reasonably considering both near-term and long-term impacts.

Our policies, risk appetite limits, and capital ratio operating targets ensure that we and the Banks maintain sufficient capital to withstand capital stress events over a specified period.

The Capital Planning Committee and Asset & Liability Management Committees of the Parent Company and each of the Banks assist the Board of Directors and management in overseeing, reviewing, and monitoring capital risk.

Liquidity Risk

2 unchanged sentences

Liquidity Risk also results from an organization’s failure to recognize or address changes in market conditions.

The primary liquidity objective is to maintain a liquidity profile that will enable us, even in times of stress or market disruption, to fund our existing assets and meet liabilities in a timely manner and at an acceptable cost.

Our primary liquidity objective is to maintain a liquidity profile that will enable us, even in times of stress or market disruption, to fund our existing assets and meet liabilities in a timely manner and at an acceptable cost.

Policy and risk appetite limits require us and the Banks to ensure that sufficient liquid assets are available to survive liquidity stresses over a specified time period.

The Asset & Liability Management Committee assists the Banks Board of Directors and Bank Management in overseeing, reviewing, and monitoring liquidity risk.

Operational Risk

Operational Risk is the risk arising from inadequate or failed internal processes or systems, human errors or misconduct, or adverse external events.

Operational losses result from internal fraud;

external fraud;

inadequate or inappropriate employment practices and workplace safety;

failure to meet obligations involving customers, partners, products, and business practices;

damage to physical assets;

business disruption and systems failures;

and/or failures in execution, delivery, and process management.

Operational losses result from internal or external fraud, inadequate or inappropriate employment practices and workplace safety, failure to meet obligations involving customers, partners, products and business practices, damage to physical assets, business disruption and systems failures, and/or failures in execution, delivery and process management.

Operational risk is inherent in all business activities and can impact us through direct or indirect financial loss, brand damage, customer dissatisfaction and legal and regulatory penalties.

We have implemented an operational risk framework that is defined in the Operational Risk Management Policy.

The Operational Risk Management Committee, chaired by our Chief Operational Risk Officer, oversees and monitors operational risk exposures, including escalating issues and recommending policies, procedures and practices to manage operational risks.

We have implemented an operational risk framework that is defined in our Operational Risk Management Policy.

The Operational Risk Management Committee of each Bank, chaired by our Chief Operational Risk Officer (CORO), oversees and monitors operational risk exposures, including escalating issues and recommending policies, procedures and practices to manage operational risks.

As part of our Operational Risk Program, we maintain an information and cybersecurity risk management program, which is led by our Chief Information Security Officer (CISO) and is designed to protect the confidentiality, integrity, and availability of critical information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

The Program leverages security technology, a team of internal and external experts, and operations based on the National Institute of Standards and Technology Cybersecurity Framework.

This consists of controls designed to protect, detect, identify, respond and recover from cybersecurity incidents.

The Program leverages security technology, a team of internal and external experts, and operations based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) consisting

Tabl e of Contents

of controls designed to govern, protect, detect, identify, respond and recover from cybersecurity incidents.

We continue to invest in enhancements to cybersecurity capabilities and engage in industry and government forums to promote advancements to the broader financial services cybersecurity ecosystem.

For further discussion of our cybersecurity risk management program, see “Item IC.—Cybersecurity”.

Tabl e of Contents

Compliance Risk

Compliance Risk is the risk arising from violations of laws or regulations, or from nonconformance with prescribed practices, internal policies and procedures, or ethical standards.

This risk exposes organizations to fines, payment of damages, and the voiding of contracts.

This risk exposes organizations to a variety of adverse impacts, including enforcement or other supervisory actions, fines, penalties, payment of damages, restrictions on business activities and the voiding of contracts.

Our Compliance organization is responsible for establishing and maintaining our Compliance Risk Management Program.

Pursuant to this Program, we seek to manage and mitigate compliance risk by assessing, controlling, monitoring, measuring and reporting the legal and regulatory risks to which we are exposed.

The Compliance Risk Management Committee, chaired by the Chief Compliance Officer, oversees the implementation and execution of the Compliance Management System and monitors compliance exposures to manage compliance risks.

The Compliance Risk Management Committee of each Bank, chaired by the Chief Compliance Officer, oversees the implementation and execution of the Compliance Management System and monitors compliance exposures to manage compliance risks.

Model Risk is the risk arising from decisions based on incorrect or misused model outputs and reports.

Model risk occurs primarily for three reasons:

(1) a model may have fundamental errors and produce inaccurate outputs when viewed against its design objective and intended business uses;

(2) a model may be used incorrectly or inappropriately, or there may be a misunderstanding about its limitations and assumptions;

or (3) the model produces results that are not compliant with fair lending or other laws and regulations.

We manage model risk through a comprehensive model governance framework, including policies and procedures for model development, maintenance and performance monitoring activities, independent model validation and change management capabilities.

• a model may have fundamental errors, including with respect to the model’s construction, or interpretation, and produce inaccurate outputs when viewed against its design objective and intended business uses;

• a model may be used incorrectly or inappropriately, or there may be a misunderstanding about its limitations and assumptions, including models being calibrated on historical cycles and correlations which may not be predictive of the future, or failures to update assumptions appropriately or in a timely manner ;

• the model produces results that are not compliant with fair lending or other laws and regulations.

We also assess model performance on an ongoing basis.

Model Risk oversight and monitoring is conducted by the Model Risk Management Committee.

Model Risk oversight and monitoring is conducted by the Model Risk Management Committee of each Bank.

Strategic Risk

1 unchanged sentence

This risk is a function of an organization’s strategic goals, business strategies, resources and quality of implementation.

Strategic decisions are reviewed and approved by business leaders and various committees and must be aligned with our Company policies.

Strategic decisions are reviewed and approved by business leaders and various committees and must be aligned with our policies.

We seek to manage strategic and business risks through risk controls embedded in these processes, as well as overall risk management oversight over business goals.

2 unchanged sentences

Reputational Risk is the risk arising from negative public opinion.

This risk may impair our competitiveness by affecting our ability to establish new relationships or services, or continue servicing existing relationships.

Reputational Risk is inherent in all activities and requires us to exercise caution in dealing with stakeholders, such as customers, counterparties, correspondents, investors, regulators, employees, and the community.

This risk may impair competitiveness by affecting the ability to establish new relationships or services or continue servicing existing relationships.

Reputational Risk is inherent in all activities and requires us to exercise caution in dealing with stakeholders, such as customers, brand partners, other contractual counterparties, investors, regulators, employees and the community.

Executive management is responsible for considering the reputational risk implications of business activities and strategies and ensuring the relevant subject matter experts are engaged as needed.

Tabl e of Contents

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors