What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-14 compared with 2024-02-16 · 121 added, 101 removed, 264 unchanged (46% of the section changed)

17 unchanged sentences

Continued economic uncertainty and a recessionary or stagnant economy could adversely affect our business, financial condition, and results of operations.

Our performance could be negatively affected to the extent there is deterioration in business and economic conditions, including persistent inflation, rising interest rates, supply chain issues or labor shortages, which have direct or indirect material adverse impacts on us, our customers, and our counterparties.

trade policies, including the imposition of tariffs and retaliatory tariffs, which have direct or indirect material adverse impacts on us, our customers, and our counterparties.

These conditions could result in one or more of the following:

4 unchanged sentences

The markets we serve are dependent on industrial and manufacturing businesses and, thus, are particularly vulnerable to adverse changes in economic conditions affecting these sectors.

2023 Form 10-K 27

government debt default would have a material adverse impact on our business and financial performance, including a decrease in the value of Treasury bonds and other government securities held by us, which could negatively impact the Bank’s capital position and its ability to meet regulatory requirements.

28 Huntington Bancshares Incorporated

government debt default would have a material adverse impact on our business and financial performance, including a decrease in the value of Treasury bonds and other government securities held by us, which could negatively impact Huntington’s and the Bank’s capital positions and their ability to meet regulatory requirements.

Other negative impacts of a U.S.

19 unchanged sentences

Rising interest rates reduce the value of our fixed-rate securities.

Any unrealized loss from these portfolios impacts OCI, shareholders’ equity, and the Tangible Common Equity ratio.

Any realized loss from these portfolios impacts regulatory capital ratios.

Unrealized losses from available-for-sale securities impact our OCI, shareholders’ equity, and the Tangible Common Equity ratio.

Any realized securities losses impact our regulatory capital ratios.

For more information, refer to “ Market Risk ” section of the MD&A.

6 unchanged sentences

In addition to volatility associated with interest rates, the Company also has exposure to equity markets related to the investments within the benefit plans and other income from client-based transactions.

28 Huntington Bancshares Incorporated

2024 Form 10-K 29

Inflation could negatively impact our business, our profitability, and our stock price.

7 unchanged sentences

Certain of our competitors are larger and have more resources than we do, enabling them to be more aggressive than us in competing for loans and deposits.

Our competitors could be made larger through merger or consolidation.

In our market areas, we face competition from other banks and financial service companies that offer similar services.

2 unchanged sentences

Legislative or regulatory changes also could lead to increased competition in the financial services sector.

For example, the Economic Growth Act and the Tailoring Rules reduce the regulatory burden of certain large BHCs and raise the asset thresholds at which more onerous requirements apply, which could cause certain large BHCs to become more competitive or to more aggressively pursue expansion.

Our ability to compete successfully depends on a number of factors, including customer convenience, quality of service by investing in new products and services, electronic platforms, personal contacts, pricing, and range of products.

7 unchanged sentences

Our primary source of liquidity is our large supply of deposits from consumer and commercial customers.

The continued availability of this supply depends on customer willingness to maintain deposit balances with banks in general, and us in particular.

The continued availability of this supply depends on customer willingness to maintain deposit balances with banks in general, and with us in particular.

The availability of deposits can also be impacted by regulatory changes (e.g., changes in FDIC insurance, liquidity requirements, etc.), changes in the financial condition of Huntington, other banks, or the banking industry in general, changes in the interest rates our competitors pay on their deposits, and other events which can impact the perceived safety or economic benefits of bank deposits.

While we make significant efforts to consider and plan for hypothetical disruptions in our deposit funding, market-related, geopolitical, or other events could impact the liquidity derived from deposits.

2023 Form 10-K 29

We are a holding company and depend on dividends by our subsidiaries for most of our funds.

30 Huntington Bancshares Incorporated

We are a holding company and depend on dividends by our subsidiaries for liquidity needs.

Huntington is an entity separate and distinct from the Bank.

The Bank conducts most of our operations, and Huntington depends upon dividends from the Bank to service Huntington’s debt and to pay dividends to Huntington’s shareholders.

The Bank conducts most of our operations, and Huntington depends upon dividends from the Bank to service Huntington’s operating costs and to pay dividends to Huntington’s shareholders.

The availability of dividends from the Bank is limited by various statutes and regulations.

6 unchanged sentences

If we lose access to capital markets, we may not be able to meet the cash flow requirements of our depositors, creditors, and borrowers, or have the operating cash needed to fund corporate expansion and other corporate activities.

Wholesale funding sources can include securitization, federal funds purchased, securities sold under repurchase agreements, non-core deposits, and long-term debt.

Wholesale funding sources can include securitization, federal funds purchased, securities sold under repurchase agreements, brokered deposits, and long-term debt.

The Bank is also a member of the FHLB, which provides members access to funding through advances collateralized with mortgage-related assets.

8 unchanged sentences

A reduction in our credit rating could adversely affect our access to capital and could increase our cost of funds.

The credit rating agencies regularly evaluate Huntington and the Bank, and credit ratings are based on a number of factors, including our financial strength and ability to generate earnings, as well as factors not entirely within our control, including conditions affecting the financial services industry, the economy, and changes in rating methodologies.

The credit rating agencies regularly evaluate Huntington and the Bank.

Credit ratings are based on a number of factors, including our financial strength and ability to generate earnings, as well as factors not entirely within our control, including conditions affecting the financial services industry, the economy, and changes in rating methodologies.

There can be no assurance that we will maintain our current credit ratings.

1 unchanged sentence

This could affect our growth, profitability, and financial condition, including liquidity.

30 Huntington Bancshares Incorporated

2024 Form 10-K 31

Instability in global economic conditions and geopolitical matters, as well as volatility in financial markets, could have a material adverse effect on our results of operations and financial condition.

10 unchanged sentences

We rely on our employees and third parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance, failure, or breach of our or of third-party systems or infrastructure, expose us to risk.

For example, our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact or upon whom we rely.

Our financial, accounting, data processing, backup, or other operating or security systems and infrastructure may fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions or provide services.

For example, our ability to conduct business may be adversely affected by any significant operational disruptions, compromises or failures of us or of third parties with which we do business or upon which we rely.

We face indirect technology, cybersecurity, data privacy and operational risks relating to the contractors, customers, clients, and other third parties with which we do business or upon which we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power.

As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems and infrastructure, a disruption, compromise or failure that significantly degrades, damages or destroys the systems or infrastructure, or the confidential, proprietary, personal and other information stored or processed thereon, of one or more financial entities could have a material impact on counterparties or other market participants, including us.

This consolidation, interconnectivity, and complexity increases the risk of operational disruption, compromise or failure.

Any third-party disruption, compromise or failure, including any technology failure, cyber-attack or other information or security breach, termination, or constraint could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk, or expand our business.

32 Huntington Bancshares Incorporated

Our financial, accounting, data processing, backup, or other operational or security systems and infrastructure may also fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions, provide services, or otherwise conduct business.

Such events may include:

sudden increases in customer transaction volume;

electrical, telecommunications, or other major physical infrastructure outages;

electrical, telecommunications, or other major service outages;

client access to our digital platforms and mobile applications;

disease pandemics;

cyber-attacks;

cyber-attacks or other information or security breaches;

software or hardware failures;

and events arising from local or larger scale political or social matters, including wars and terrorist attacks.

Additional events beyond our control that could impact our business directly or indirectly include natural disasters such as earthquakes and weather events, including tornadoes, hurricanes, and floods.

Additional events beyond our control that could impact our business directly or indirectly include natural disasters such as wildfires, earthquakes, and weather events, including tornadoes, hurricanes, and floods.

Neither the occurrence nor the potential impact of these events can be predicted, and the frequency and severity of weather events may be impacted by climate changes.

In addition, we may need to take our systems off-line if they become infected with malware or a computer virus or as a result of another form of cyber-attack.

In the event that backup systems are utilized, they may not process data as quickly as our primary systems and some data might not have been saved to backup systems, potentially resulting in a temporary or permanent loss of such data.

In addition, our ability to implement backup systems and other safeguards with respect to third-party systems is more limited than with respect to our own systems.

We frequently update our systems to support our operations and growth and to remain compliant with applicable laws, rules, and regulations.

In addition, we may need to take our systems or infrastructure off-line if they become subject to a cyber-attack or other information or security breach, such as becoming infected with malware or a computer virus.

For more information on cybersecurity risks, see “ Risk Factors—Compliance Risks —We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our employees, contractors, colleagues and customers, malware intrusion or data corruption attempts, and identity theft, that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation and create significant legal and financial exposure.”

We frequently update our systems and infrastructure to support our operations and growth and to remain compliant with applicable laws, rules, and regulations.

This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions.

Implementation and testing of controls related to our computer systems, security monitoring, and retaining and training personnel required to operate our systems also entail significant costs.

Implementation and testing of controls related to our computer systems and infrastructure, security monitoring, and retaining and training personnel required to operate our systems and infrastructure also entail significant costs.

For more information regarding the Company’s process for assessing, identifying, and managing material risks from cybersecurity threats, refer to Item 1C:

Cybersecurity .

There can be no guarantee that our updates to our systems and infrastructure or any other measures we take in order to prevent, mitigate or remediate any disruption, compromise or failure of our systems or infrastructure will be successful, adequate or otherwise result in our intended outcomes.

For example, in the event that backup systems are utilized, they may not process data as quickly as our primary systems, and some data might not have been saved to backup systems, potentially resulting in a temporary or permanent loss of such data.

In addition, our ability to implement backup systems and infrastructure and other safeguards with respect to third-party systems or infrastructure is more limited than with respect to our own systems and infrastructure.

Even when a disruption, compromise, or failure is prevented, mitigated, or remediated in a timely manner, doing so may have required expending substantial resources and management attention or taking other actions that could adversely affect customer satisfaction or retention, as well as harm our reputation.

We also cannot be sure that our existing insurance coverage will continue to be available on acceptable terms, or at all, or that our insurers will not deny coverage to any future claim.

Operational risk exposures could adversely impact our operations, liquidity, and financial condition, as well as cause reputational harm.

In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption.

2023 Form 10-K 31

We face security risks, including denial of service attacks, hacking, social engineering attacks targeting our colleagues and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential information, adversely affect our business or reputation, and create significant legal and financial exposure.

Our computer systems and network infrastructure and those of third parties, on which we are highly dependent, are subject to security risks and could be susceptible to cyber-attacks, such as denial of service attacks, hacking, terrorist activities, or identity theft.

Our business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties.

We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation, and create significant legal and financial exposure.

Our computer and data management systems and network infrastructure, and those of third parties on which we are highly dependent, are subject to cybersecurity risks and could be susceptible to cyber-attacks or other information or security breaches.

Our business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, personal, and other information in our computer and data management systems and network infrastructure, and in the computer and data management systems and network infrastructure of third parties.

In addition, to access our network, products, and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks.

We, our customers, regulators, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks.

These cyber-attacks include computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, improper access by employees or vendors, attacks on personal email of employees, ransom demands to not expose security vulnerabilities in our systems or the systems of third parties or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, or destruction of confidential, proprietary, and other information of ours, our employees, our customers, or of third parties, damage our systems or otherwise materially disrupt our or our customers’ or other third parties’ network access or business operations.

As cyber-threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents.

Despite efforts to ensure the integrity of our systems and implement controls, processes, policies, and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement sufficient preventive measures against such security breaches, which may result in material losses or consequences for us.

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the internet and telecommunications technologies to conduct financial transactions.

2024 Form 10-K 33

These cyber-attacks or other information or security breaches include computer viruses, denial of service attacks, hacking, social engineering attacks (including phishing and smishing attacks) targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, ransomware, improper access by employees or contractors, identity theft, and other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, destruction, or other processing of confidential, proprietary, personal, and other information of ours, our employees, our customers, or of third parties, damage our systems and infrastructure or otherwise materially disrupt our, our customers’, or other third parties’ network access or business operations.

As cyber-attacks or other information or security breaches continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or cyber-attacks or other information or security breaches.

Despite efforts to ensure the integrity of our systems and implement controls, processes, policies, and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement sufficient preventive measures against such cyber-attacks or other information or security breaches, which may result in material losses or consequences for us.

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions.

For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications.

In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage.

In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI.

Even the most advanced internal control environment may be vulnerable to compromise.

1 unchanged sentence

Targeted social engineering and email attacks (i.e., “spear phishing” attacks) are becoming more sophisticated and are extremely difficult to prevent.

In such an attack, an attacker will attempt to fraudulently induce colleagues, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our clients.

In such an attack, an attacker will attempt to fraudulently induce colleagues, contractors, customers, clients, or other users of our systems and infrastructure to disclose sensitive information in order to gain access to our, our customers’, or our clients’ systems and infrastructure, or the confidential, proprietary, personal, or other information stored or processed thereon.

Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive.

The techniques used by cyber criminals change frequently, may not be recognized until launched, and may not be recognized until well after a breach has occurred.

The techniques used by cyber threat actors change frequently, may not be recognized until launched, and may not be recognized until well after a cyber-attack or other information or security breach has occurred.

The speed at which new vulnerabilities are discovered and exploited, often before security patches are published, continues to rise.

Remote work further increases the risk that we may experience cyber incidents as a result of our employees, vendors, and other third parties with which we interact working remotely on less secure systems and environments.

Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our employees, colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments.

The risk of a security breach caused by a cyber-attack or other information security breach at a third party with which we do business or upon which we rely, or by unauthorized access by such third party, has also increased in recent years.

Additionally, the existence of cyber-attacks or other information or security breaches at such third parties with access to our confidential, proprietary, personal, and other information may not be disclosed to us in a timely manner.

Further, our ability to monitor such third parties’ cybersecurity practices is limited.

Although we generally have agreements relating to cybersecurity and data privacy in place with third parties, we cannot guarantee that such agreements will prevent a cyber-attack or other information or security breach impacting our confidential, proprietary, personal, or other information, or enable us to obtain adequate or any reimbursement from such third parties in the event we should suffer any disruption, compromise, failure, liability, reputational harm, or other cost or expense.

Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber-attacks or other information or security breaches attributed to such third parties as they relate to the information we share with them.

34 Huntington Bancshares Incorporated

The risk of a security breach caused by a cyber-attack at a vendor or by unauthorized vendor access has also increased in recent years.

Additionally, the existence of cyber-attacks or security breaches at third-party vendors with access to our data may not be disclosed to us in a timely manner.

Further, our ability to monitor our vendors’ cybersecurity practices is limited.

Although we generally have agreements relating to cybersecurity and data privacy in place with our vendors, we cannot guarantee that such agreements will prevent a cyber-incident impacting our systems or information or enable us to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents.

Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber-incidents attributed to our vendors as they relate to the information we share with them.

We also face indirect technology, cybersecurity, and operational risks relating to the customers, clients, and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power.

As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems, a technology failure, cyber-attack, or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including us.

This consolidation, interconnectivity, and complexity increases the risk of operational failure.

Any third-party technology failure, cyber-attack, or other information or security breach, termination, or constraint could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk, or expand our business.

Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences.

Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business.

Hacking of personal information and identity theft risks, in particular, could cause serious reputational harm.

A successful penetration or circumvention of system security could cause us serious negative consequences, including:

loss of customers and business opportunities;

costs associated with maintaining business relationships after an attack or breach;

significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential information, intellectual property, funds, and/or those of our customers;

or damage to our or our customers’ and/or third parties’ computers or systems.

The occurrence of any of these events could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition.

In addition, we may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

For more information regarding the Company’s process for assessing, identifying, and managing material risks from cybersecurity threats, refer to Item 1C:

Cybersecurity .

Cybersecurity and data privacy are areas of heightened legislative and regulatory focus.

As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus.

The federal bank regulatory agencies have proposed regulations that would enhance cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, including us and the Bank, and would focus on cyber risk governance and management, management of internal and external dependencies, incident response, cyber resilience, and situational awareness.

Laws in all 50 states generally require, among other things, notification to affected individuals when there has been a security breach of their personal data under certain circumstances.

For more information regarding cybersecurity and data privacy, refer to Item 1:

Business - “ Regulatory Matters .”

2023 Form 10-K 33

We receive, maintain, and store non-public personal information of our customers and counterparties, including, but not limited to, personally identifiable information and personal financial information.

The sharing, use, disclosure, and protection of these types of information are governed by federal and state law.

Both personally identifiable information and personal financial information are increasingly subject to legislation and regulation, the intent of which is to protect the privacy of personal information and personal financial information that is collected and handled.

For example, under California state law, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information.

Numerous other states have also enacted or are in the process of enacting state-level privacy, data protection and/or data security laws and regulations.

For more information regarding data privacy laws and regulations, refer to Item 1:

Business - “ Regulatory Matters .”

Further, we make public statements about our use, collection, disclosure, and other processing of personal information through our privacy policies, information provided on our website and press statements.

Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so.

The publication of our privacy policies and other statements that provide promises and assurances about privacy, data protection, and data security can subject us to potential government or legal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices.

We may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information we may store or maintain.

We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or require changes to our business practices or privacy policies.

If cybersecurity, data privacy, data protection, data transfer, or data retention laws are implemented, interpreted, or applied in a manner inconsistent with our current practices, we may be subject to fines, litigation, or regulatory enforcement actions or ordered to change our business practices, policies, or systems in a manner that adversely impacts our operating results.

Furthermore, the public perception that a cyber-attack or other information or security breach on our systems or infrastructure has been successful, whether or not this perception is correct, may damage our reputation with customers, clients, and third parties with which we do business.

Hacking of confidential, proprietary, personal, and other information and identity theft risks, in particular, could cause serious reputational harm.

A successful penetration or circumvention of our cybersecurity measures could cause us serious negative consequences, including:

loss of customers, clients, and business opportunities;

costs associated with maintaining business relationships after a cyber-attack or other information or security breach;

significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential, proprietary, personal, and other information, intellectual property, funds, and/or those of our customers or clients;

or damage to our, our customers’, our clients’, and/or third parties’ systems or infrastructure.

The occurrence of any of these events could result in a violation of applicable data privacy laws and regulations and other laws and regulations, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our cybersecurity measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity, and financial condition.

In addition, we may not have adequate insurance coverage to compensate for losses from a major cyber-attack or other information or security breach.

We also cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all or that our insurers will not deny coverage to any future claim.

We face significant operational risks which could lead to financial loss, expensive litigation, and loss of confidence by our customers, regulators, and capital markets.

9 unchanged sentences

Relative to acquisitions, we incur risks and challenges associated with the integration of employees, accounting systems, and technology platforms from acquired businesses and institutions in a timely and efficient manner, and we cannot guarantee that we will be successful in retaining existing customer relationships or achieving anticipated operating efficiencies expected from such acquisitions.

Acquisitions may be subject to the receipt of approvals from certain governmental authorities, including the Federal Reserve, the OCC, and the U.S.

Department of Justice, as well as the approval of our shareholders and the shareholders of companies that we seek to acquire.

Acquisitions may be subject to the receipt of approvals from certain governmental authorities, including the Federal Reserve, the OCC, and the DOJ, as well as the approval of our shareholders and the shareholders of companies that we seek to acquire.

These approvals for acquisitions may not be received, may take longer than expected, or may impose conditions that are not presently anticipated or that could have an adverse effect on the combined company following the acquisitions.

2 unchanged sentences

Therefore, dilution of our tangible book value and net income per common share could occur in connection with any future transaction.

34 Huntington Bancshares Incorporated

2024 Form 10-K 35

Failure to maintain effective internal controls over financial reporting could impair our ability to accurately and timely report our financial results or prevent fraud, resulting in loss of investor confidence and adversely affecting our business and our stock price.

27 unchanged sentences

Replacing a third-party service provider could also take a long period of time and result in increased expenses.

2023 Form 10-K 35

36 Huntington Bancshares Incorporated

Changes in accounting policies, standards, and interpretations could affect how we report our financial condition and results of operations.

20 unchanged sentences

While the timing and severity of climate change may not be entirely predictable and our risk management processes may not be effective in mitigating climate risk exposure, we continue to build capabilities to identify, assess, and manage climate risks.

36 Huntington Bancshares Incorporated

2024 Form 10-K 37

We use AI in connection with our business and operations, which exposes us to inherent risks that may expose us to material harm.

We use AI in connection with our business and operations.

AI is complex and rapidly evolving, and the introduction of AI, a relatively new and emerging technology in the early stages of commercial use, into our business and operations may subject us to new or heightened legal, regulatory, ethical, operational, reputational, or other risks.

The models underlying AI may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are, and output that may be, incomplete, inadequate, misleading, biased, poor-quality or otherwise flawed, any of which may not be easily detectable.

Further, inappropriate or controversial data practices by developers and end-users or other factors adversely affecting public opinion of AI could impair the acceptance of AI, including those incorporated in our business and operations.

If the AI that we use is deficient, inaccurate or controversial, we could incur operational inefficiencies, competitive harm, legal and regulatory action, brand or reputational harm, or other adverse impacts on our business and financial results.

Further, there can be no assurance that our use of AI will be successful in enhancing our business or operations or otherwise result in our intended outcomes, and our competitors may incorporate AI into their businesses or operations more quickly or more successfully than us.

AI and the use thereof is also subject to a variety of existing laws and regulations, including fair lending, consumer protection, intellectual property, cybersecurity, data privacy, and equal opportunity, and is expected to be subject to new laws and regulations or new applications of existing laws and regulations.

AI is the subject of evolving review by various governmental and regulatory agencies, and changes in laws and regulations governing AI may adversely affect our ability to use AI.

Additionally, various federal, state and foreign governments and regulators have implemented, or are considering implementing, general legal and regulatory frameworks for the appropriate use of AI.

It is possible that we will not be able to anticipate how to respond to these rapidly developing laws and regulations.

Further, if we do not have sufficient rights to use the data or algorithms on which our AI solutions rely or the output generated thereby, we also may incur liability through the violation of applicable laws and regulations, such as fair lending laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party.

We may not be able to sufficiently mitigate or detect any of the foregoing risks or concerns given our and other market participants’ lack of experience with using AI, the pace of technological change, and rapid adoption of AI by our business partners and competitors.

Any actual or perceived failure to address risks or concerns relating to the use of AI, whether unfounded or not, could adversely affect our business and operations.

Compliance Risks:

We operate in a highly regulated industry, and the laws and regulations that govern our operations, corporate governance, executive compensation and financial accounting, or reporting, including changes in them, or our failure to comply with them, may adversely affect us.

The banking industry is highly regulated.

3 unchanged sentences

These laws and regulations, many of which are discussed in Item 1:

Business - “ Regulatory Matters ,” among other matters, prescribe minimum capital requirements, impose limitations on our business activities (including foreclosure and collection practices), limit the dividend or distributions that we can pay, restrict the ability of institutions to guarantee our debt, and impose certain specific accounting requirements that may be more restrictive and may result in greater or earlier charges to earnings or reductions in our capital than accounting principles generally accepted in the U.S.

Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations often impose additional compliance costs.

2 unchanged sentences

Further, any new laws, rules, and regulations could make compliance more difficult or expensive or otherwise adversely affect our business and financial condition.

38 Huntington Bancshares Incorporated

Under the supervision of the CFPB, our consumer and business banking products and services are subject to heightened regulatory oversight and scrutiny with respect to compliance under consumer laws and regulations.

1 unchanged sentence

Also, federal and state regulators have been increasingly focused on sales practices of branch personnel, including taking regulatory action against other financial institutions.

In addition, increased regulatory inquiries and investigations, as well as any additional legislative or regulatory developments affecting our consumer businesses, and any required changes to our business operations resulting from these developments, could result in significant loss of revenue, require remuneration to our customers, trigger fines or penalties, limit the products or services we offer, require us to increase our prices and, therefore, reduce demand for our products, impose additional compliance costs on us, increase the cost of collection, cause harm to our reputation, or otherwise adversely affect our consumer businesses.

In addition, increased regulatory inquiries and investigations, as well as any additional legislative or regulatory developments affecting our consumer businesses, and any required changes to our business operations resulting from these developments, could result in significant loss of revenue, require remuneration to our customers, trigger fines or penalties, limit the products or services we offer, limit the fees we are able to charge, require us to increase our prices and, therefore, reduce demand for our products, impose additional compliance costs on us, increase the cost of collection, cause harm to our reputation, or otherwise adversely affect our consumer businesses.

Legislative and regulatory actions taken now or in the future that impact the financial industry may materially adversely affect us by increasing our costs, adding complexity in doing business, impeding the efficiency of our internal business processes, negatively impacting the recoverability of certain of our recorded assets, requiring us to increase our regulatory capital, limiting our ability to pursue business opportunities, and otherwise resulting in a material adverse impact on our financial condition, results of operation, liquidity, or stock price.

2 unchanged sentences

In addition, if we do not appropriately comply with current or future legislation and regulations, especially those that apply to our consumer operations, which has been an area of heightened focus, we may be subject to fines, penalties or judgments, or material regulatory restrictions on our businesses, which could adversely affect operations and, in turn, financial results.

2023 Form 10-K 37

We expect the current administration will continue to implement a regulatory reform agenda that is significantly different than that of the former administration.

This reform agenda could include a heightened focus on consumer protection, fair lending, the regulation of loan portfolios and credit concentrations to borrowers impacted by climate change, heightened scrutiny on Bank Secrecy Act and AML requirements, topics related to social equity, executive compensation, and increased capital and liquidity, as well as limits on share buybacks and dividends.

In addition, mergers and acquisitions could be dampened by increased antitrust scrutiny.

We also expect reform proposals for the short-term wholesale markets.

We expect the Trump administration will seek to implement a regulatory reform agenda that is significantly different than that of the Biden administration.

We expect there will be changes in rulemaking, supervision, examination, and enforcement priorities of the federal banking agencies.

The evolving regulatory and supervisory environment and uncertainty about the timing and scope of future laws, regulations, and policies may contribute to decisions we may make to suspend, reduce, or withdraw from existing businesses, activities, or initiatives, which may result in potential lost revenue or significant restructuring or related costs or exposures.

3 unchanged sentences

During 2023, the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank, and First Republic Bank, respectively.

The failure of other banks and financial institutions and the measures taken by governments and regulators in response to these events could adversely impact our business, financial condition, and results of operations.

The failure of other banks and financial institutions and the measures taken by governments and regulators in response to these events, including increased regulatory scrutiny and heightened supervisory expectations could adversely impact our business, financial condition, and results of operations.

The resolution of significant pending litigation, if unfavorable, could have an adverse effect on our results of operations for a particular period.

3 unchanged sentences

For more information on litigation risks, see Note 21 - “ Commitments and Contingent Liabilities ” to the Consolidated Financial Statements.

2024 Form 10-K 39

Noncompliance with the Bank Secrecy Act and other anti-money laundering statutes and regulations could cause us material financial loss.

The Bank Secrecy Act and the Patriot Act contain anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S.

The Bank Secrecy Act contains anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S.

financial system for money laundering and terrorist financing activities.

The Bank Secrecy Act, as amended by the Patriot Act, requires depository institutions and their holding companies to undertake activities including maintaining an anti-money laundering program, verifying the identity of clients, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies.

FinCEN, a unit of the Treasury Department that administers the Bank Secrecy Act, is authorized to impose significant civil money penalties for violations of those requirements and has recently engaged in coordinated enforcement efforts with the federal bank regulatory agencies, as well as the U.S.

Department of Justice, Drug Enforcement Administration, and IRS.

The Bank Secrecy Act requires financial institutions to undertake activities including maintaining an anti-money laundering program, verifying the identity of clients, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies.

There is also increased scrutiny of compliance with the rules enforced by the OFAC.

3 unchanged sentences

Business - “ Regulatory Matters .”

Cybersecurity and data privacy are areas of heightened legislative and regulatory focus.

For example, the federal bank regulatory agencies (namely, the Federal Reserve, FDIC and OCC) have proposed regulations that would enhance cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, including us and the Bank, and would focus on cyber risk governance and management, management of internal and external dependencies, incident response, cyber resilience, and situational awareness.

Although the FDIC and OCC each withdrew this proposal, the Federal Reserve has not withdrawn its propose and may still propose such a rule.

For more information regarding applicable cybersecurity and data privacy legislation and regulations, refer to Item 1:

Business - “ Regulatory Matters .”

We share, use, collect, disclose and otherwise process personal information of our customers and counterparties, including, but not limited to, personal financial information.

The sharing, use, collection, disclosure, and other processing of these types of information are governed by increasingly stringent and evolving legislation and regulations, the intent of which is to protect the privacy of personal information, including personal financial information.

We may become subject to new legislation or regulations concerning cybersecurity and data privacy.

We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to change our business practices, policies, or systems or otherwise incur significant additional costs and expenses in order to comply.

Further, we make public statements about our sharing, use, collection, disclosure, and other processing of personal information through our privacy policies, information provided on our website, and press statements.

Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so.

Our public statements and documentation that provide promises and assurances about cybersecurity and data privacy can subject us to potential government or legal action if they are found to be deceptive, unfair, or misrepresent our actual practices.

40 Huntington Bancshares Incorporated

Strategic Risk:

If cybersecurity or data privacy legislation or regulations are implemented, interpreted, or applied in a manner inconsistent with our current practices, or if we fail to comply (or are perceived to have failed to comply) with applicable legislation and regulation relating to cybersecurity and data privacy, we may be subject to fines, civil or criminal penalties, sanctions, litigation (including class actions), investigations or inquiries, or regulatory enforcement actions or ordered to change our business practices, policies, or systems in a manner that adversely impacts our operating results.

Strategic Risks:

We operate in a highly competitive industry which depends on our ability to successfully execute our strategic plan and adapt our products and services to evolving industry standards and consumer preferences.

We are subject to intense competition from both other financial institutions and from non-bank entities, including FinTech companies.

Technology has lowered the barriers to entry, with customers having a growing variety of traditional and nontraditional alternatives, including crowdfunding, digital wallets, and money transfer services.

Technology has lowered the barriers to entry, with customers having a growing variety of traditional and nontraditional alternatives, such as crowdfunding, digital wallets, cryptocurrencies, and money transfer services.

The continuous widespread adoption of new technologies, including internet services and mobile applications, and advanced ATM functionality, is influencing how individuals and firms conduct their financial affairs and is changing the delivery channels for financial services.

Our “People-First, Digitally-Powered” strategic plan considers the implications of these changes in technology.

Our “People-First, Customer-Centered” strategic plan considers the implications of these changes in technology and how it may impact our customers.

Additionally, these changes require us to adapt our product and services, as well as our distribution of them, to evolving industry standards and customer preferences.

11 unchanged sentences

The loss of key personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business, financial condition, or operating results.

2024 Form 10-K 41

Bank regulations regarding capital and liquidity, including the CCAR assessment process and the U.S.

5 unchanged sentences

There can be no assurance that the Federal Reserve or OCC will respond favorably to our capital plans, planned capital actions, or stress test results, and the Federal Reserve, OCC, or other regulatory capital requirements may limit or otherwise restrict how we utilize our capital, including common stock dividends and stock repurchases.

2023 Form 10-K 39

We are also required to maintain minimum capital ratios and the Federal Reserve and OCC may determine that Huntington and/or the Bank, based on size, complexity, or risk profile, must maintain capital ratios above these minimums in order to operate in a safe and sound manner.

8 unchanged sentences

Our ability to attract and retain customers, clients, investors, and employees is affected by our reputation.

Significant harm to our reputation can arise from various sources, including officer, director, or employee misconduct, actual or perceived unethical behavior, conflicts of interest, security breaches, litigation or regulatory outcomes, compensation practices, failing to deliver minimum or required standards of service and quality, failing to address customer and agency complaints, compliance failures, unauthorized release of personal, proprietary or confidential information due to cyber-attacks or otherwise, perception of our environmental, social, and governance practices and disclosures, and the activities of our clients, customers, and counterparties, including vendors.

Significant harm to our reputation can arise from various sources, including officer, director, or employee misconduct, actual or perceived unethical behavior, conflicts of interest, security breaches, litigation or regulatory outcomes, compensation practices, failing to deliver minimum or required standards of service and quality, failing to address customer and agency complaints, compliance failures, unauthorized release, gathering, monitoring, misuse, loss, destruction or other processing of confidential, proprietary, personal, and other information due to cyber-attacks or other information or security breaches, disruptions, compromises or failures of our systems or infrastructure, perception of our corporate responsibility or environmental practices and disclosures, and the activities of our clients, customers, and counterparties, including vendors.

Reputation risk related to corporate policies and practices on corporate responsibility and ESG topics is increasingly complex.

Divergent ideological and social views may create competing stakeholder, legislative, and regulatory scrutiny that may impact our reputation or operations.

In particular, there is an increasing number of state-level anti-ESG initiatives in the U.S.

that may conflict with other regulatory requirements or our various stakeholders’ expectations.

Such divergent, sometimes conflicting, views on corporate responsibility and ESG-related matters increase the risk that any action or lack thereof by us on such matters will be perceived negatively by some stakeholders.

Actions by the financial service industry generally or by institutions or individuals in the industry can adversely affect our reputation indirectly by association.

1 unchanged sentence

All of these could adversely affect our growth, results of operation, and financial condition.

42 Huntington Bancshares Incorporated

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors