KEYCORP /NEW/ 10-K

key-20231231 Table of contents UNITED STATES SECURITIES AND EXCHANGE COMMISSION Washington, D.C. 20549 FORM 10-K ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 For the fiscal year ended December 31 , 2023 Commission file number: 1-11302 KeyCorp Exact name of registrant as specified in its charter: Ohio 34-6542451 State or other jurisdiction of incorporation or organization: I.R.S. Employer Identification Number: 127 Public Square, Cleveland, Ohio 44114-1306 Address of principal executive offices: Zip Code: ( 216 ) 689-3000 Registrant’s telephone number, including area code: SECURITIES REGISTERED PURSUANT TO SECTION 12(b) OF THE ACT: Title of each class Trading Symbol(s) Name of each exchange on which registered Common Shares, $1 par value KEY New York Stock Exchange Depositary Shares (each representing a 1/40th interest in a share of Fixed-to-Floating Rate KEY PrI New York Stock Exchange Perpetual Non-Cumulative Preferred Stock, Series E) Depositary Shares (each representing a 1/40th interest in a share of Fixed Rate Perpetual Non- KEY PrJ New York Stock Exchange Cumulative Preferred Stock, Series F) Depositary Shares (each representing a 1/40th interest in a share of Fixed Rate Perpetual Non- KEY PrK New York Stock Exchange Cumulative Preferred Stock, Series G) Depositary Shares (each representing a 1/40th interest in a share of Fixed Rate Reset Perpetual Non- KEY PrL New York Stock Exchange Cumulative Preferred Stock, Series H) SECURITIES REGISTERED PURSUANT TO SECTION 12(g) OF THE ACT: NONE Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐ Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒ Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐ Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this Chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐ Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act. Large accelerated filer ☒ Accelerated filer ☐ Non-accelerated filer ☐ Smaller reporting company ☐ Emerging growth company ☐ If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐ Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒ If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previous issued financial statements. ☐ Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to § 240.10D-1(b). ☐ Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒ The aggregate market value of voting and non-voting common stock held by nonaffiliates of the Registrant was $ 8,646,175,313 (based on the June 30, 2023, closing price of KeyCorp Common Shares of $9.24 as reported on the New York Stock Exchange). As of February 20, 2024, there were 933,841,692 Common Shares outstanding. Certain specifically designated portions of KeyCorp’s definitive Proxy Statement for its 2024 Annual Meeting of Shareholders are incorporated by reference into Part III of this Form 10-K. Table of contents Forward-looking Statements From time to time, we have made or will make forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These statements do not relate strictly to historical or current facts. Forward-looking statements usually can be identified by the use of words such as “goal,” “objective,” “plan,” “expect,” “assume,” “anticipate,” “intend,” “project,” “believe,” “estimate,” “will,” “would,” “should,” “could,” or other words of similar meaning. Forward-looking statements provide our current expectations or forecasts of future events, circumstances, results or aspirations. Our disclosures in this report contain forward-looking statements. We may also make forward-looking statements in other documents filed with or furnished to the SEC. In addition, we may make forward-looking statements orally to analysts, investors, representatives of the media and others. Forward-looking statements, by their nature, are subject to assumptions, risks, and uncertainties, many of which are outside of our control. Our actual results may differ materially from those set forth in our forward-looking statements. There is no assurance that any list of risks and uncertainties or risk factors is complete. In addition, no assurance can be given that any plan, initiative, projection, goal, commitment, expectation, or prospect set forth in this report can or will be achieved. Factors that could cause our actual results to differ from those described in forward-looking statements include, but are not limited to: • our concentrated credit exposure in commercial and industrial loans; • deterioration of commercial real estate market fundamentals; • defaults by our loan clients or counterparties; • adverse changes in credit quality trends; • declining asset prices; • geopolitical destabilization; • deterioration of asset quality and an increase in credit losses; • labor shortages and supply chain constraints, as well as the impact of inflation; • the extensive regulation of the U.S. financial services industry; • complex and evolving laws and regulations regarding privacy and cybersecurity; • changes in accounting policies, standards, and interpretations; • operational or risk management failures by us or critical third parties; • breaches of security or failures of our technology systems due to technological or other factors and cybersecurity threats; • negative outcomes from claims, litigation, investigations, or governmental proceedings; • failure or circumvention of our controls and procedures; • the occurrence of natural disasters, which may be exacerbated by climate change; • societal responses to climate change; • increased operational risks resulting from remote work; • evolving capital and liquidity standards under applicable regulatory rules; • disruption of the U.S. financial system, including the impact of inflation and a potential global economic downturn or recession; • our ability to receive dividends from our subsidiaries, including KeyBank; • unanticipated changes in our liquidity position, including but not limited to, changes in our access to or the cost of funding and our ability to secure alternative funding sources; • downgrades in our credit ratings or those of KeyBank; • a worsening of the U.S. economy due to financial, political or other shocks; • our ability to anticipate interest rate changes and manage interest rate risk; • deterioration of economic conditions in the geographic regions where we operate; • the soundness of other financial institutions, including instability in the financial industry; • impairment of goodwill; • our ability to manage our reputational risks, including ESG-related risks; • our ability to timely and effectively implement our strategic initiatives; • increased competitive pressure; • our ability to adapt our products and services to industry standards and consumer preferences; • our ability to attract and retain talented executives and employees; • unanticipated adverse effects of strategic partnerships or acquisitions and dispositions of assets or businesses; and • our ability to develop and effectively use the quantitative models we rely upon in our business planning. 2 Table of contents Any forward-looking statements made by us or on our behalf speak only as of the date they are made, and we do not undertake any obligation to update any forward-looking statement to reflect the impact of subsequent events or circumstances, except as required by applicable securities laws. Before making an investment decision, you should carefully consider all risks and uncertainties disclosed in our SEC filings, including this report on Form 10-K and our subsequent reports on Forms 10-Q and 8-K and our registration statements under the Securities Act of 1933, as amended, all of which are or will upon filing be accessible on the SEC’s website at www.sec.gov and on our website at www.key.com/ir. Terminology Throughout this discussion, references to “Key,” “we,” “our,” “us,” and similar terms refer to the consolidated entity consisting of KeyCorp and its subsidiaries. “KeyCorp” refers solely to the parent holding company, and “KeyBank” refers solely to KeyCorp’s subsidiary bank, KeyBank National Association. “KeyBank (consolidated)” refers to the consolidated entity consisting of KeyBank and its subsidiaries. We want to explain some industry-specific terms at the outset so you can better understand the discussion that follows. • We use the phrase continuing operations in this document to mean all of our businesses other than our government-guaranteed and private education lending business, which are accounted for as discontinued operations . • We engage in capital markets activities primarily through business conducted by our Commercial Bank segment . These activities encompass a variety of products and services. Among other things, we trade securities as a dealer, enter into derivative contracts (both to accommodate clients’ financing needs and to mitigate certain risks), and conduct transactions in foreign currencies (to accommodate clients’ needs). • For regulatory purposes, capital is divided into two classes. Federal regulations currently prescribe that at least one-half of a bank or BHC’s total risk-based capital must qualify as Tier 1 capital . Both total and Tier 1 capital serve as bases for several measures of capital adequacy, which is an important indicator of financial stability and condition. Banking regulators evaluate a component of Tier 1 capital, known as Common Equity Tier 1 , under the Regulatory Capital Rules . The “Capital” section of this report under the heading “Capital adequacy” provides more information on total capital, Tier 1 capital, and the Regulatory Capital Rules, including Common Equity Tier 1, and describes how these measures are calculated. 3 Table of contents The acronyms and abbreviations identified below are used throughout this report, including in the Notes to Consolidated Financial Statements and in the Management’s Discussion and Analysis of Financial Condition and Results of Operations. You may find it helpful to refer back to this page as you read this report. ABO: Accumulated benefit obligation. ALCO: Asset/Liability Management Committee. ALLL: Allowance for loan and lease losses. A/LM: Asset/liability management. AML: Anti-money laundering. AOCI: Accumulated other comprehensive income (loss). APBO: Accumulated postretirement benefit obligation. AQN Strategies: Arbitria Quum Notitia, LLC. ARRC: Alternative Reference Rates Committee. ASC: Accounting Standards Codification. ASR: Accelerated Stock Repurchase. ASU: Accounting Standards Update. ATMs: Automated teller machines. BSA: Bank Secrecy Act. BHCA: Bank Holding Company Act of 1956, as amended. BHCs: Bank holding companies. Board: KeyCorp Board of Directors. CAPM: Capital Asset Pricing Model. CARES Act: Coronavirus Aid, Relief, and Economic Security Act. CCAR: Comprehensive Capital Analysis and Review. Cain Brothers: Cain Brothers & Company, LLC. CECL: Current Expected Credit Losses. CFPB: Consumer Financial Protection Bureau, also known as the Bureau of Consumer Financial Protection. CFTC: Commodities Futures Trading Commission. CMBS: Commercial mortgage-backed securities. CMO: Collateralized mortgage obligation. Common Shares: KeyCorp common shares, $1 par value. CVA: Credit Valuation Adjustment. DCF: Discounted cash flow. DIF: Deposit Insurance Fund of the FDIC. Dodd-Frank Act: Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. EAD: Exposure at default. EBITDA: Earnings before interest, taxes, depreciation, and amortization. EPS: Earnings per share. ERISA: Employee Retirement Income Security Act of 1974. ERM: Enterprise risk management. ESG: Environmental, social, and governance EVE: Economic value of equity. FASB: Financial Accounting Standards Board. FDIA: Federal Deposit Insurance Act, as amended. FDIC: Federal Deposit Insurance Corporation. Federal Reserve: Board of Governors of the Federal Reserve System. FHLB: Federal Home Loan Bank of Cincinnati. FHLMC: Federal Home Loan Mortgage Corporation. FICO: Fair Isaac Corporation. FINRA: Financial Industry Regulatory Authority. First Niagara: First Niagara Financial Group, Inc. FNMA: Federal National Mortgage Association. FSOC: Financial Stability Oversight Council. FVA: Fair value of employee benefit plan assets. GAAP: U.S. generally accepted accounting principles. GNMA: Government National Mortgage Association. HTC: Historic tax credit. IDI: Insured depository institution. IRS: Internal Revenue Service. ISDA: International Swaps and Derivatives Association. KBCM: KeyBanc Capital Markets, Inc. KBING: Key Business Impact and Networking Groups. KCC: Key Capital Corporation. KCDC: Key Community Development Corporation. KCIC: Key Community Investment Capital LLC. KEF: Key Equipment Finance. LCR: Liquidity coverage ratio. LGD: Loss given default. LIBOR: London Interbank Offered Rate. LIHTC: Low-income housing tax credit. LTV: Loan-to-value. Moody’s: Moody’s Investor Services, Inc. MRM: Market Risk Management group. MRC: Market Risk Committee. N/A: Not applicable. NAV: Net asset value. NFA: National Futures Association. N/M: Not meaningful. NMTC: New market tax credit. NOW: Negotiable Order of Withdrawal. NPR: Notice of proposed rulemaking. NSF: Non-sufficient funds. NYSE: New York Stock Exchange. OCC: Office of the Comptroller of the Currency. OCI: Other comprehensive income (loss). OREO: Other real estate owned. PBO: Projected benefit obligation. PCCR: Purchased credit card relationship. PCD: Purchased credit deteriorated. PD: Probability of default. PPP: Paycheck Protection Program. RMBS: Residential mortgage-backed securities. S&P: Standard and Poor’s Ratings Services, a Division of The McGraw-Hill Companies, Inc. SEC: U.S. Securities & Exchange Commission. SIFIs: Systemically important financial institutions, including large, interconnected BHCs and nonbank financial companies designated by FSOC for supervision by the Federal Reserve. SOFR: Secured Overnight Financing Rate. TDR: Troubled debt restructuring. TE: Taxable-equivalent. U.S. Treasury: United States Department of the Treasury. VaR: Value at risk. VEBA: Voluntary Employee Beneficiary Association. VIE: Variable interest entity. 4 Table of contents KEYCORP 2023 FORM 10-K ANNUAL REPORT TABLE OF CONTENTS Item Number Page Number PART I 1 Business 6 1A Risk Factors 25 1B Unresolved Staff Comments 42 1C Cybersecurity 42 2 Properties 45 3 Legal Proceedings 45 4 Mine Safety Disclosures 45 PART II 5 Market for the Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities 46 6 RESERVED 47 7 Management’s Discussion and Analysis of Financial Condition and Results of Operations 47 7A Quantitative and Qualitative Disclosures About Market Risk 95 8 Financial Statements and Supplementary Data 96 Management’s Annual Report on Internal Control over Financial Reporting 97 Reports of Independent Registered Public Accounting Firm 98 Consolidated Financial Statements and Related Notes 102 Consolidated Balance Sheets 102 Consolidated Statements of Income 103 Consolidated Statements of Comprehensive Income 104 Consolidated Statements of Changes in Equity 105 Consolidated Statements of Cash Flows 106 Notes to Consolidated Financial Statements 107 9 Changes in and Disagreements with Accountants on Accounting and Financial Disclosure 181 9A Controls and Procedures 181 9B Other Information 181 9C Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 181 PART III 10 Directors, Executive Officers and Corporate Governance 181 11 Executive Compensation 182 12 Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters 182 13 Certain Relationships and Related Transactions, and Director Independence 182 14 Principal Accountant Fees and Services 182 PART IV 15 Exhibits and Financial Statement Schedules 182 (a) (1) Financial Statements — See listing in Item 8 above 182 (a) (2) Financial Statement Schedules — None required 183 (a) (3) Exhibits 184 16 Form 10-K Summary 186 Signatures 187 5 Table of contents PART I ITEM 1. BUSINESS Overview KeyCorp, organized in 1958 under the laws of the State of Ohio, is headquartered in Cleveland, Ohio. We are a BHC under the BHCA and one of the nation’s largest bank-based financial services companies, with consolidated total assets of approximately $188.3 billion at December 31, 2023. KeyCorp is the parent holding company for KeyBank National Association, its principal subsidiary, through which most of our banking services are provided. Through KeyBank and certain other subsidiaries, we provide a wide range of retail and commercial banking, commercial leasing, investment management, consumer finance, student loan refinancing, commercial mortgage servicing and special servicing, and investment banking products and services to individual, corporate, and institutional clients through two major business segments: Consumer Bank and Commercial Bank. As of December 31, 2023, these services were provided across the country through KeyBank’s 959 full-service retail banking branches and a network of 1,217 ATMs in 15 states, as well as additional offices, online and mobile banking capabilities, including our national digital bank, Laurel Road, and a telephone banking call center. Additional information pertaining to our two business segments is included in the “Business Segment Results” section in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this report, and in Note 25 (“Business Segment Reporting”) of the Notes to Consolidated Financial Statements presented in Item 8. Financial Statements and Supplementary Data, which are incorporated herein by reference. In addition to the customary banking services of accepting deposits and making loans, our bank and its trust company subsidiary offer personal and institutional trust custody services, personal financial and planning services, access to mutual funds, treasury services, and international banking services. Through our bank, trust company, and registered investment adviser subsidiaries, we provide investment management services to clients that include large corporate and public retirement plans, foundations and endowments, high-net-worth individuals, and multi-employer trust funds established for providing pension or other benefits to employees. We provide other financial services — both within and outside of our primary banking markets — through various nonbank subsidiaries. These services include community development financing, securities underwriting, investment banking and capital markets products, and brokerage. We also provide merchant services to businesses. KeyCorp is a legal entity separate and distinct from its banks and other subsidiaries. Accordingly, the right of KeyCorp, its security holders, and its creditors to participate in any distribution of the assets or earnings of its banks and other subsidiaries is subject to the prior claims of the creditors of such banks and other subsidiaries, except to the extent that KeyCorp’s claims in its capacity as a creditor may be recognized. We derive the majority of our revenues within the United States from customers domiciled in the United States. Revenue from foreign countries and external customers domiciled in foreign countries was immaterial to our consolidated financial statements. Demographics Our management structure and basis of presentation is divided into two business segments, Consumer Bank and Commercial Bank. Note 25 (“Business Segment Reporting”) describes the products and services offered by each of these business segments and provides more detailed financial information pertaining to the segments, including changes in basis of presentation. The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our Laurel Road digital brand by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services. In addition, wealth management and investment services are offered to assist non-profit and high-net-worth clients with their banking, trust, portfolio management, charitable giving, and related needs. The Commercial Bank consists of the Commercial and Institutional operating segments. The Commercial operating segment is a full-service, commercial banking platform that focuses primarily on serving the borrowing, cash 6 Table of contents management, and capital markets needs of middle market clients within Key’s 15-state branch footprint. It is also a significant, national, commercial real estate lender and third-party servicer of commercial mortgage loans and special servicer of CMBS. The Institutional operating segment operates nationally in providing lending, equipment financing, and banking products and services to large corporate and institutional clients. The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology. The operating segment includes the KBCM platform which provides a broad suite of capital markets products and services including syndicated finance, debt and equity capital markets, derivatives, foreign exchange, financial advisory, public finance, commercial payments, equipment finance, and commercial mortgage banking. Additionally, KBCM provides fixed income and equity sales and trading services to investor clients. Additional Information Our executive offices are located at 127 Public Square, Cleveland, Ohio 44114-1306, and our telephone number is (216) 689-3000. Our website is www.key.com, and the investor relations section of our website may be reached through www.key.com/ir. We make available free of charge, on or through the investor relations section of our website, annual reports on Form 10-K, quarterly reports on Form 10-Q, and current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as well as proxy statements, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. Also posted on our website, and available in print upon request from any shareholder to our Investor Relations Department, are the charters for our Technology Committee, Audit Committee, Compensation and Organization Committee, Executive Committee, Nominating and Corporate Governance Committee, and Risk Committee; our Corporate Governance Guidelines; the Code of Business Conduct and Ethics for our directors, officers, and employees; our Standards for Determining Independence of Directors; our policy for Review of Transactions Between KeyCorp and Its Directors, Executive Officers and Other Related Persons; our Statement of Political Activity; and our Corporate Responsibility Report. Within the time period required by the SEC and the NYSE, we will post on our website any amendment to the Code of Ethics and any waiver applicable to any senior executive officer or director. We also make available a summary of filings made with the SEC of statements of beneficial ownership of our equity securities filed by our directors and officers under Section 16 of the Exchange Act. The “Regulatory Disclosures & Filings” section under the “Financials” tab of the investor relations section of our website includes public disclosures concerning our historic annual and mid-year stress-testing activities under the Dodd-Frank Act and our quarterly regulatory capital disclosures under the third pillar of Basel III. Information contained on or accessible through, including any reports available on, our website or any other website referenced in this report is not part of this report. References to websites in this report are intended to be inactive textual references only. Shareholders may obtain a copy of any of the above-referenced corporate governance documents by writing to our Investor Relations Department at Investor Relations, KeyCorp, 127 Public Square, Mailcode OH-01-27-0737, Cleveland, Ohio 44114-1306; by calling (216) 689-4221; or by sending an e-mail to investor_relations@keybank.com. Competition The market for banking and related financial services is highly competitive. Key competes with other providers of financial services, such as BHCs, commercial banks, savings associations, credit unions, mortgage banking companies, finance companies, mutual funds, insurance companies, investment management firms, investment banking firms, broker-dealers, and other local, regional, national, and global institutions that offer financial services. Some of our competitors are larger and may have more financial resources, while some of our competitors enjoy fewer regulatory constraints and may have lower cost structures. The financial services industry has become more competitive as technology advances have lowered barriers to entry, enabling more companies, including nonbank companies, to provide financial services. For more information on competition and related risks, see Item 1A. Risk Factors - “ We operate in a highly competitive industry.” Mergers and acquisitions have also led to increased concentration in the banking industry, placing added competitive pressure on Key’s core banking products and services as we see competitors enter some of our markets or offer similar products. We compete by offering quality products and innovative services at competitive prices, and by maintaining our product and service offerings to keep pace with customer preferences and industry standards. 7 Table of contents Human Capital Engaging a diverse and talented team is a top strategic priority for Key. Our human capital management strategy is focused on attracting, developing, and retaining the talent our businesses need to deliver strong returns to our shareholders, which we do by offering a competitive total rewards package, providing opportunities for career development and growth, and fostering a culture that is fair and inclusive. Competitive Rewards We make investments to hire and retain the people we need to serve our customers and communities and regularly review our pay practices to reflect changing market and economic conditions. We have steadily increased our starting minimum wage since 2015, and as of December 31, 2023, 98% of employees earned $18 or more per hour, with 89% of employees earning $20 or more per hour. We have made other compensation adjustments in response to market trends, competitive pressures, and a dynamic market for talent. These investments include a comprehensive and competitive total rewards program, representing our investment in our teammates’ collective success and reflecting our commitment to helping them thrive. Key’s benefits offerings include employee health and welfare plans, a 401(k) plan with competitive matching contributions (dollar for dollar, up to the first 7% of eligible pay contributed on a per pay period basis for eligible employees), up to ten weeks of paid parental leave, a Discounted Stock Purchase Plan, wellness incentives, and a lifestyle reimbursement account program for covered expenses related to health, mental wellness, family needs, and finances. Teammates can also participate in a variety of company-sponsored volunteer and giving opportunities, including Neighbors Make the Difference Day, our national employee volunteer day, and the Employee Matching Gift Program, which offers eligible employees the opportunity to support qualified nonprofit organizations and multiply their contributions through the KeyBank Foundation. We have a pay-for-performance culture that is guided by the following three principles: • Pay decisions are based on Key’s performance, business unit performance, and individual performance. • We deliver pay in a way that balances short-term and long-term financial performance objectives and aligns to shareholder value creation. • We support sustainable performance with policies that focus on prudent risk-taking and the balance between risk and reward. We design our compensation programs to balance risk and reward and align with the guidance of our regulators, and we regularly monitor these programs to remain within our risk tolerances. We subject all discretionary incentives paid to our employees to a robust risk adjustment process that begins before grant and extends beyond payment. Career Development and Growth We invest in our teammates’ growth and professional development through a variety of internal networking groups, including our twelve Key Business Impact and Networking Groups (“KBINGs”), formal and informal mentoring programs, including Key’s enterprise-wide formal mentoring program, MentorMe at Key, and a suite of leadership development programs. We also offer employees the opportunities to develop and enhance their skills through formal learning curricula and to obtain tuition reimbursement for eligible collegiate or post-collegiate education and relevant certifications. Creating a Fair and Inclusive Culture Key’s purpose is to help our clients, colleagues, and communities thrive. We remain committed to attracting a talented and diverse workforce and supplier base that represents the clients and communities we serve. In 2023 , we continued to focus on increasing minority representation in management and leadership roles, expanding our overall recruiting focus, developing diverse candidate pipelines, increasing supplier diversity, providing mentorship opportunities, offering implicit bias training, and leveraging our KBINGs to strengthen both engagement and inclusion. 8 Table of contents In addition, we are committed to pay equity as a foundational element of our culture. As of February 2023 , at KeyBank women earn on average more than 99% of what their male teammates earn, and people of color earn on average more than 99% of what their white teammates earn, after taking into account an employee’s job. Our analysis is based on total compensation (base salary and all discretionary incentives) covering all teammates eligible for a discretionary incentive, other than our Executive Leadership Team whose pay is set by our Board of Directors. Our pay equity and parity measures are evaluated annually, and we engage third-party partners to consult on our pay equity analysis and practices as needed. More information about our commitment to pay equity and our commitment to increasing diversity is available at www.key.com/about/diversity/pay-equity-commitment.html. As of December 31, 2023, our overall workforce was 57.8% female. In addition, as of December 31, 2023, our workforce was also 74.9% White, 9.0% Black/African American, 7.0% Hispanic/Latino, 6.4% Asian and 2.7% other. Our Board of Directors is 46% diverse (six of our 13 total Directors are diverse, with four women, one of whom is also a minority, and two male minorities) and our Executive Leadership Team is 42% diverse (four women and one minority out of 12 total executives). For more information about our diversity and inclusion efforts, a more detailed breakdown of employee diversity by EEO-1 categories, and information about how we work every day and in every way to help our clients, colleagues, and communities thrive, please see our website and our annual Environmental, Social, and Governance report at https://www.key.com/about/diversity/diversity-and-inclusion.html. Key’s Workforce Key had an average of 17,692 full time equivalent employees in 2023 . As of December 31, 2023, a total of 17,333 full-time and part-time employees worked in the following regions, which are generally aligned to the regions Key uses for its retail branch banking network: Region Employee Count East 12,459 West 2,322 All Other 2,552 9 Table of contents We invest significant time and resources in creating an attractive work environment and competitive total rewards package that attracts and retains top talent. Key’s annualized rate for voluntary turnover as of December 31, 2023, was 14.6%, lower than our annualized voluntary turnover rate for 2022, which was 18.0%, and lower than our previous five year historical average of 16.8%. Information About Our Executive Officers KeyCorp’s executive officers are principally responsible for managing the operations of KeyCorp, making policy for KeyCorp, executing on strategic decisions, and managing material risks, subject to the supervision and direction of the Board. All executive officers are subject to annual election at the annual organizational meeting of the Board held each May. Set forth below are the names and ages of the executive officers of KeyCorp as of December 31, 2023, the positions held by each at KeyCorp during the past five years, and the year each first became an executive officer of KeyCorp. On January 1, 2024, Darrin J. Benhart became Chief Risk Officer. Because Darrin Benhart and James Waters have been employed at KeyCorp for less than five years, information is being provided concerning their prior business experience. There are no family relationships among the directors or the executive officers, and there is no arrangement or understanding between any executive officer and any other person pursuant to which the executive officer was selected. Victor B. Alexander (44) - Mr. Alexander has been KeyCorp’s Head of Consumer Bank and an executive officer of KeyCorp since January 2020. Prior to that time, he served as the Head of Home Lending from October 2018 to January 2020 and Treasurer from July 2017 to October 2018. Darrin L. Benhart (58) - Mr. Benhart became Chief Risk Officer and an executive officer of KeyCorp on January 1, 2024. Prior to that time, he served as Deputy Chief Risk Officer and Head of Enterprise Risk Management from August 2023 to December 2023 and Chief Enterprise Risk Officer from July 2022 to August 2023. Prior to July 2022, he served as a National Bank Examiner with the OCC from March 1992 to March 2022. Amy G. Brady (57) - Ms. Brady is KeyCorp’s Chief Information Officer, serving in that role since May 2012. Ms. Brady has been an executive officer of KeyCorp since she joined in 2012. She has been a director of DuPont de Nemours, Inc., a multi-industry specialty solutions company, since 2019. Trina M. Evans (59) - Ms. Evans has been the Director of Corporate Center for KeyCorp since August 2012. Prior to this role, Ms. Evans was the Chief Administrative Officer for Key Community Bank and the Director of Client Experience for KeyBank. She became an executive officer of KeyCorp in March 2013. Kenneth C. Gavrity (47) - Mr. Gavrity has been Head of Commercial Bank since November 2023 and became an executive officer of KeyCorp in May 2021. Prior to this, Mr. Gavrity served as Head of Enterprise Payments from January 2019 to November 2023 and Head of Commercial Payments from 2016 to 2019. Christopher M. Gorman (63) - Mr. Gorman has been Chairman, Chief Executive Officer, and President of KeyCorp since May 1, 2020. Mr. Gorman previously served as President and Chief Operating Officer from September 2019 to May 2020 and President of Banking and Vice Chairman from 2017 to September 2019. From 2016 to 2017, he served as Merger Integration Executive responsible for leading the integration efforts related to KeyCorp’s merger with First Niagara. Prior to that, Mr. Gorman was the President of Key Corporate Bank from 2010 to 2016. He became an executive officer of KeyCorp in 2010. Clark H.I. Khayat (52) - Mr. Khayat has been Chief Financial Officer since March 2023 and an executive officer since September 2018. Mr. Khayat rejoined KeyCorp as Chief Strategy Officer in January 2018 and served in that role until March 2023. Mr. Khayat had previously served as Head of Key’s Enterprise Commercial Payments group from April 2014 to June 2016. Allyson M. Kidik (44) - Ms. Kidik has been the Chief Risk Review Officer and General Auditor and an executive officer of KeyCorp since July 2022. Ms. Kidik previously served as Senior Deputy General Auditor from 2018 to 2022 and Deputy General Auditor from 2015 to 2018. 10 Table of contents Angela G. Mago (58) - Ms. Mago has served as the Chief Human Resources Officer since November 2023. She previously served as Head of Commercial Bank from May 2019 to November 2023 and Co-Head of Key Corporate Bank from 2016 to May 2019. She became an executive officer of KeyCorp in 2016. Mark W. Midkiff (61) - On December 31, 2023, Mr. Midkiff was Chief Risk Officer and an executive officer of KeyCorp since January 2018. Andrew J. Paine III (54) - Mr. Paine has been the Head of Institutional Bank since 2019. He previously served as Co-Head of Key Corporate Bank from 2016 to May 2019. He also serves as President of KeyBanc Capital Markets Inc., a role he has held since 2013. He became an executive officer of KeyCorp in 2016. Douglas M. Schosser (53) - Mr. Schosser has been the Chief Accounting Officer and an executive officer of KeyCorp since May 2015. Jaime Warder (50) - Mr. Warder has been Head of Digital Banking since January 2019 and became an executive officer of KeyCorp in May 2021. Prior to this, Mr. Warder served as Head of Business Banking and Investment Services from 2017 to 2019. James L. Waters (57) - Mr. Waters became the General Counsel and Secretary and an executive officer of KeyCorp in July 2021. From 2018 to 2021, he served as General Counsel and Corporate Secretary of Cullen/Frost Bankers, Inc., a financial holding company. Prior to 2018, he was a partner of the law firm Haynes and Boone, LLP. Supervision and Regulation The regulatory framework applicable to BHCs and banks is intended primarily to protect consumers, the DIF, taxpayers and the banking system as a whole, rather than to protect the security holders and creditors of financial services companies. Comprehensive reform of the legislative and regulatory environment for financial services companies occurred in 2010 and remains ongoing, with additional reforms expected following the bank failures that occurred in early 2023. We cannot predict changes in applicable laws, regulations or regulatory agency policies, but any such changes may materially affect our business, financial condition, results of operations, or access to liquidity or credit. Overview Federal law establishes a system of regulation under which the Federal Reserve is the umbrella regulator for BHCs, while their subsidiaries are principally regulated by prudential or functional regulators: (i) the OCC for national banks and federal savings associations; (ii) the FDIC for state non-member banks and savings associations; (iii) the Federal Reserve for state member banks; (iv) the CFPB for consumer financial products or services; (v) the SEC and FINRA for securities broker/dealer activities; (vi) the SEC, CFTC, and NFA for swaps and other derivatives; and (vii) state insurance regulators for insurance activities. Certain specific activities, including traditional bank trust and fiduciary activities, may be conducted in a bank without the bank being deemed a “broker” or a “dealer” in securities for purposes of securities functional regulation. Under the BHCA, BHCs generally may not directly or indirectly own or control more than 5% of the voting shares, or substantially all of the assets, of any bank, without prior approval from the Federal Reserve. In addition, BHCs are generally prohibited from engaging in commercial or industrial activities. However, a BHC that satisfies certain requirements regarding management, capital adequacy, and Community Reinvestment Act performance may elect to be treated as a Financial Holding Company (“FHC”) for purposes of federal law, and as a result may engage in a substantially broader scope of activities that are considered to be financial in nature or complementary to those activities. KeyCorp has elected to be treated as a FHC and, as such, is authorized to engage in securities underwriting and dealing, insurance agency and underwriting, and merchant banking activities. In addition, the Federal Reserve has permitted FHCs, like KeyCorp, to engage in the following activities, under the view that such activities are complementary to a financial activity: physical commodities trading activities, energy management services, and energy tolling, among others. Under federal law, a BHC also must serve as a source of financial strength to its subsidiary depository institution(s) by providing financial assistance in the event of financial distress. This support may be required when the BHC does not have the resources to, or would prefer not to, provide it. Certain loans by a BHC to a subsidiary bank are subordinate in right of payment to deposits in, and certain other indebtedness of, the subsidiary bank. In addition, 11 Table of contents federal law provides that in the bankruptcy of a BHC, any commitment by the BHC to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment. The Dodd-Frank Act created the FSOC to overlay the U.S. supervisory framework for BHCs, insured depository institutions, and other financial service providers, by serving as a systemic risk oversight body. Specifically, the FSOC is authorized to: (i) identify risks to U.S. financial stability that could arise from the material financial distress or failure, or ongoing activities, of large, interconnected SIFIs, or that could arise outside the financial services marketplace; (ii) promote market discipline by eliminating expectations that the U.S. government will shield shareholders, creditors, and counterparties from losses in the event of failure; and (iii) respond to emerging threats to the stability of the U.S. financial system. The FSOC is responsible for facilitating regulatory coordination; information collection and sharing; designating nonbank financial companies for consolidated supervision by the Federal Reserve; designating systemic financial market utilities and systemic payment, clearing, and settlement activities requiring prescribed risk management standards and heightened federal regulatory oversight; recommending stricter standards for SIFIs; and, together with the Federal Reserve, determining whether action should be taken to break up firms that pose a grave threat to U.S. financial stability. As an FHC, KeyCorp is subject to regulation, supervision, and examination by the Federal Reserve under the BHCA. Our national bank subsidiaries and their subsidiaries are subject to regulation, supervision, and examination by the OCC. At December 31, 2023, we operated one full-service, FDIC-insured national bank subsidiary, KeyBank, and one national bank subsidiary that is limited to fiduciary activities. The FDIC also has certain, more limited regulatory, supervisory, and examination authority over KeyBank and KeyCorp under the FDIA and the Dodd-Frank Act. We have other financial services subsidiaries that are subject to regulation, supervision, and examination by the Federal Reserve, as well as other state and federal regulatory agencies and self-regulatory organizations. Because KeyBank engages in derivative transactions, in 2013 it provisionally registered as a swap dealer with the CFTC and became a member of the NFA, the self-regulatory organization for participants in the U.S. derivatives industry. Our securities brokerage and asset management subsidiaries are subject to supervision and regulation by the SEC, FINRA, and state securities regulators, and our insurance subsidiaries are subject to regulation by the insurance regulatory authorities of the states in which they operate. Our other nonbank subsidiaries are subject to laws and regulations of both the federal government and the various states in which they are authorized to do business. Regulatory capital requirements Background KeyCorp and KeyBank are subject to regulatory capital requirements that are based largely on the work of an international group of supervisors known as the Basel Committee on Banking Supervision (“Basel Committee”). The Basel Committee is responsible for establishing international bank supervisory standards for implementation in member jurisdictions, to enhance and align bank regulation on a global scale, and to promote financial stability. The regulatory capital framework developed by the Basel Committee and implemented in the United States is a predominately risk-based capital framework that establishes minimum capital requirements based on the amount of regulatory capital a banking organization maintains relative to the amount of its total assets, adjusted to reflect credit risk (“risk-weighted assets”). Each banking organization subject to this regulatory capital framework is required to satisfy certain minimum risk-based capital measures (e.g., a tier 1 risk-based capital ratio requirement of tier 1 capital to total risk-weighted assets), and in the United States, a minimum leverage ratio requirement of tier 1 capital to average total on-balance sheet assets, which serves as a backstop to the risk-based measures. A capital instrument is assigned to one of two tiers based on the relative strength and ability of that instrument to absorb credit losses on a going concern basis. Capital instruments with relatively robust loss-absorption capacity are assigned to tier 1, while other capital instruments with relatively less loss-absorption capacity are assigned to tier 2. A banking organization’s total capital equals the sum of its tier 1 and tier 2 capital. The Basel Committee also developed a market risk capital framework (that also has been implemented in the United States) to address the substantial exposure to market risk faced by banking organizations with significant trading activity and augment the credit risk-based capital requirements described above. For example, the minimum total risk-based capital ratio requirement for a banking organization subject to the market risk capital rule equals the ratio of the banking organization’s total capital to the sum of its credit risk-weighted assets and market 12 Table of contents risk-weighted assets. Only KeyCorp is subject to the market risk capital rule, as KeyBank does not engage in substantial trading activity. Basel III To address deficiencies in the international regulatory capital standards identified during the 2007-2009 global financial crisis, in 2010 the Basel Committee released comprehensive revisions to the international regulatory capital framework, commonly referred to as “Basel III.” The Basel III revisions are designed to strengthen the quality and quantity of regulatory capital, in part through the introduction of a Common Equity Tier 1 capital requirement; provide more comprehensive and robust risk coverage, particularly for securitization exposures, equities, and off-balance sheet positions; and address pro-cyclicality concerns through the implementation of capital buffers. The Basel Committee also released a series of revisions to the market risk capital framework to address deficiencies identified during its initial implementation (e.g., arbitrage opportunities between the credit risk-based and market risk capital rules) and in connection with the global financial crisis. KeyCorp and KeyBank are subject to regulatory capital requirements implemented by the U.S. banking agencies that are based largely on Basel III (“Regulatory Capital Rules”). Consistent with the international framework, the Regulatory Capital Rules further restrict the type of instruments that may be recognized in tier 1 and tier 2 capital; establish a minimum Common Equity Tier 1 capital ratio requirement of 4.5% and capital buffers to absorb losses during periods of financial stress while allowing an institution to provide credit intermediation as it would during a normal economic environment; and refine several of the methodologies used for determining risk-weighted assets. The Regulatory Capital Rules provide additional requirements for large banking organizations with over $250 billion in total consolidated assets or $10 billion in foreign exposure, but those additional requirements do not apply to KeyCorp or KeyBank. However, some of those additional requirements will apply to KeyCorp and KeyBank if proposed revisions to the Regulatory Capital Rules are adopted. The proposed revisions to the Regulatory Capital Rules are discussed below under the heading “Recent regulatory capital-related developments.” For purposes of the Regulatory Capital Rules, KeyCorp and KeyBank are treated as “standardized approach” banking organizations. Under the Regulatory Capital Rules, standardized approach banking organizations, such as KeyCorp and KeyBank, are required to meet the minimum capital and leverage ratios set forth in the following table. At December 31, 2023, KeyCorp’s ratios under the fully phased-in Regulatory Capital Rules are set forth in the following table. Minimum Capital Ratios and KeyCorp Ratios Under Regulatory Capital Rules Ratios (including stress capital buffer) Regulatory Minimum Requirement Stress Capital Buffer (b) Regulatory Minimum With Stress Capital Buffer KeyCorp December 31, 2023 (c) Common Equity Tier 1 4.50 % 2.50 % 7.00 % 10.02 % Tier 1 Capital 6.00 2.50 8.50 11.67 Total Capital 8.00 2.50 10.50 14.15 Leverage (a) 4.00 N/A 4.00 9.03 (a) As a standardized approach banking organization, KeyCorp is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018. However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules discussed below are adopted. (b) Stress capital buffer must consist of Common Equity Tier 1 capital. As a standardized approach banking organization, KeyCorp is not subject to the countercyclical capital buffer of up to 2.5% imposed upon an advanced approaches banking organization under the Regulatory Capital Rules. However, KeyCorp will be subject to the countercyclical capital buffer if proposed revisions to the Regulatory Capital Rules discussed below are adopted. (c) Ratios reflect the five-year transition of CECL impacts on regulatory ratios. Revised prompt corrective action framework The federal prompt corrective action (“PCA”) framework under the FDIA groups FDIC-insured depository institutions into one of five prompt corrective action capital categories: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” In addition to implementing the Basel III capital framework in the United States, the Regulatory Capital Rules also revised the PCA capital category threshold ratios applicable to FDIC-insured depository institutions such as KeyBank, with an effective date of January 1, 2015. The Revised PCA framework table below identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the Prompt Corrective Action Framework. 13 Table of contents “Well Capitalized” and “Adequately Capitalized” Capital Category Ratios under Revised Prompt Corrective Action Framework Prompt Corrective Action Capital Category Ratio Well Capitalized (a) Adequately Capitalized Common Equity Tier 1 Risk-Based 6.5 % 4.5 % Tier 1 Risk-Based 8.0 6.0 Total Risk-Based 10.0 8.0 Tier 1 Leverage (b) 5.0 4.0 (a) A “well capitalized” institution also must not be subject to any written agreement, order or directive to meet and maintain a specific capital level for any capital measure. (b) As a standardized approach banking organization, KeyBank is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018. However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules discussed below are adopted. As of December 31, 2023, KeyBank (consolidated) satisfied the risk-based and leverage capital requirements necessary to be considered “well capitalized” for purposes of the revised prompt corrective action framework. However, investors should not regard this determination as a representation of the overall financial condition or prospects of KeyBank because the PCA framework is intended to serve a limited supervisory function. Moreover, it is important to note that the PCA framework does not apply to BHCs, like KeyCorp. Recent regulatory capital-related developments In December 2017, the Basel Committee released its final revisions to Basel III. The revisions seek to restore credibility in the calculation of risk-weighted assets and improve the comparability of regulatory capital ratios across banking organizations by: (1) enhancing the robustness and risk-sensitivity of the standardized approach for credit risk, credit valuation adjustment, and operational risk; (2) constraining the use of internal models by placing limits on certain inputs used to calculate capital requirements under the internal ratings-based approach for credit risk (used by advanced approaches banking organizations) and removing the ability to use an internal model for purposes of determining the capital charge for CVA risk and operational risk; (3) introducing a leverage ratio buffer to further limit the leverage of global systemically-important banks; and (4) replacing the existing Basel II output floor with a more robust, risk-sensitive floor based on the Basel III standardized approach. A final rule adopted by the federal banking agencies in February 2019 provides banking organizations with the option to phase in, over a three-year period, the adverse day-one regulatory capital effects of the adoption of the CECL accounting standard. On August 20, 2020, the federal banking agencies issued a final rule that gives banking organizations that adopt CECL before the end of 2020 the option to delay for two years CECL’s adverse effects on regulatory capital. This is in addition to the three-year transition period already in place, resulting in an optional five-year transition. Key elected to adopt CECL as planned in the first quarter of 2020 and exercised the option to use a five-year transition to measure CECL’s effects on regulatory capital. On July 27, 2023, the federal banking agencies issued a proposal (the “Capital Proposal”) that would make significant changes to the Regulatory Capital Rules applicable to banking organizations with total assets of $100 billion or more and their depository institution subsidiaries (“Large Banking Organizations”) (including KeyCorp and KeyBank) and banking organizations with significant trading activity. This proposal would implement the final elements of the Basel III capital framework and make other changes to the Regulatory Capital Rules in response to the bank failures that occurred in 2023. The Capital Proposal would establish a new framework for calculating risk-weighted assets (the “expanded risk-based approach”) that would apply to Large Banking Organizations. The expanded risk-based approach would include a new more risk-sensitive standardized approach for measuring credit risk and operational risk. It would also include new standardized approaches for measuring market risk and credit valuation adjustment risk but would allow the use of internal models for market risk in certain circumstances with regulatory approval. Under the Capital Proposal, a Large Banking Organization would be required to calculate its risk-based capital ratios under both the expanded risk-based approach and the current standardized approach and would use the lower of the two. All capital buffer requirements, including the stress capital buffer requirement, would apply regardless of whether the expanded risk-based approach or the existing standardized approach produces the lower ratio. The Capital Proposal would also align the calculation of regulatory capital for Category III and IV banking organizations with the calculation of regulatory capital for Category I and II banking organizations. KeyCorp and KeyBank are Category IV banking organizations. Under the proposal, Category III and IV banking organizations would be required to include most components of AOCI, including net unrealized gains and losses on available-for-sale securities, in regulatory capital. Category III and IV banking organizations would also be required to apply the 14 Table of contents same capital deductions and minority interest treatments that currently apply to Category I and Category II banking organizations. In addition, all Large Banking Organizations would be subject to the supplementary leverage ratio and countercyclical capital buffer requirement and would be required to make certain enhanced public disclosures. The expanded total risk-weighted assets calculation used in the expanded risk-based approach would be phased in over a three-year period starting on July 1, 2025. For Category III and IV banking organizations, the requirement to reflect AOCI in regulatory capital would also be phased in over a three-year period starting on July 1, 2025. All other elements of the calculation of regulatory capital would apply on the effective date of the final rule, which is expected to be on or about July 1, 2025. Comments on this proposal were due by January 16, 2024. Liquidity requirements U.S. banking organizations are subject to regulatory liquidity requirements based on international liquidity standards established by the Basel Committee in 2010, and subsequently revised between 2013 and 2014 (as revised, the “Basel III liquidity framework”). The Basel III liquidity framework establishes quantitative standards designed to ensure that a banking organization is appropriately positioned, from a balance sheet perspective, to satisfy its short- and long-term funding needs. To address short-term liquidity risk, the Basel III liquidity framework established a liquidity coverage ratio (“Basel III LCR”), calculated as the ratio of a banking organization’s high-quality liquid assets to its total net cash outflows over 30 consecutive calendar days. In addition, to address long-term liquidity risk, the Basel III liquidity framework established a net stable funding ratio (“Basel III NSFR”), calculated as the ratio of the amount of stable funding available to a banking organization to its required amount of stable funding. Consistent with the Basel III LCR, the final rules implementing the Basel III LCR for U.S. banking organizations (the “Liquidity Coverage Rules”) established a minimum LCR for certain internationally active bank and nonbank financial companies (excluding KeyCorp), and a modified version of the LCR (“Modified LCR”) for BHCs and other depository institution holding companies with over $50 billion in consolidated assets that are not internationally active (including KeyCorp). Under the Liquidity Coverage Rules, KeyCorp was required to calculate a Modified LCR on a monthly basis and was required to satisfy a minimum Modified LCR requirement of 100%. KeyBank was not subject to the LCR or the Modified LCR under the Liquidity Coverage Rules. Large BHCs, like KeyCorp, are also subject to liquidity requirements contained in regulations adopted pursuant to the Dodd-Frank Act and the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”). As enacted in 2010, the Dodd-Frank Act required the Federal Reserve to impose enhanced prudential standards and early remediation requirements (collectively, “EPSs”), including enhanced liquidity standards, upon BHCs (like KeyCorp) with at least $50 billion in total consolidated assets. EGRRCPA, enacted on May 24, 2018, raised the asset threshold above which the Federal Reserve is required to apply EPSs to BHCs from $50 billion to $250 billion. EGRRCPA gave the Federal Reserve the authority to continue to apply EPSs to any BHCs having at least $100 billion but less than $250 billion in total consolidated assets (like KeyCorp) if it determines that the application of the EPS is appropriate to prevent or mitigate risks to financial stability or to promote the safety and soundness of the BHC or BHCs, taking into consideration the BHC’s or BHCs’ capital structure, riskiness, complexity, financial activities, size, and other relevant factors. As a result of the Federal Reserve’s implementation of certain of the EPSs, KeyCorp is subject to requirements relating to cash flow projections, a contingency funding plan, liquidity risk limits, the monitoring of liquidity risks (with respect to collateral, legal entities, currencies, business lines, and intraday exposures), liquidity stress testing, a liquidity buffer, and liquidity risk management requirements, including requirements that apply to the board of directors, the risk committee, senior management, and the independent review function. Final rules related to the implementation of EGRRCPA (“Tailoring Rules”) became effective on December 31, 2019. The Tailoring Rules established four risk-based categories of banking organizations with $100 billion or more in total consolidated assets and applied tailored regulatory requirements to each respective category. Based on Key’s analysis of the Tailoring Rules, KeyCorp falls within the least restrictive of those categories (“Category IV Firms”). 15 Table of contents Under one of the Tailoring Rules, Category IV Firms with weighted short-term wholesale funding of less than $50 billion will not be subject to a reduced LCR. KeyCorp does not meet the $50 billion threshold and is not subject to the reduced LCR or an LCR public disclosure requirement. Under another Tailoring Rule, Category IV Firms (like KeyCorp) are required to conduct internal liquidity stress tests quarterly and are subject to simplified liquidity risk management requirements. Category IV Firms are still required to maintain a liquidity buffer that is sufficient to meet the projected net stressed cash-flow need over a 30-day planning horizon under the firm’s internal liquidity stress test and remain subject to monthly tailored FR 2052a liquidity reporting requirements. Under the final rules adopted by the federal banking agencies to implement the Basel III NSFR for U.S. banking organizations, certain banking organizations with more than $100 billion in total assets must maintain minimum amounts of stable funding to support their assets, commitments, and derivatives exposures over a one-year time horizon. Under the rules, Key, as a Category IV firm with average weighted short-term wholesale funding of less than $50 billion, is not subject to an NSFR requirement. Capital planning and stress testing The Federal Reserve’s capital plan rule requires each U.S.-domiciled, top-tier BHC with total consolidated assets of at least $100 billion (like KeyCorp) to develop and maintain a written capital plan supported by a robust internal capital adequacy process. The capital plan must be submitted to the Federal Reserve for supervisory review in connection with the BHC’s CCAR (described below). The supervisory review includes an assessment of many factors, including KeyCorp’s ability to maintain capital above each minimum regulatory capital ratio on a pro forma basis under expected and stressful conditions throughout the planning horizon. The Federal Reserve’s CCAR is an intensive assessment of the capital adequacy of large U.S. BHCs and of the practices these BHCs use to assess their capital needs. The Federal Reserve expects BHCs subject to CCAR to have and maintain regulatory capital in an amount that is sufficient to withstand a severely adverse operating environment and, at the same time, be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and provide credit intermediation. The Federal Reserve has conducted a supervisory stress test on KeyCorp, pursuant to which the Federal Reserve projects revenues, expenses, losses, and resulting post-stress capital levels and regulatory capital ratios under conditions that affect the U.S. economy or the financial condition of KeyCorp, including supervisory baseline and severely adverse scenarios, that are determined by the Federal Reserve. KeyCorp and KeyBank have also been required to conduct their own company-run stress tests to assess the impact of stress scenarios (including supervisor-provided baseline, adverse, and severely adverse scenarios and, for KeyCorp, one KeyCorp-defined baseline scenario and at least one KeyCorp-defined stress scenario) on their consolidated earnings, losses, and capital over a nine-quarter planning horizon, taking into account their current condition, risks, exposures, strategies, and activities. While KeyBank has only had to conduct an annual stress test, KeyCorp has had to conduct both an annual and a mid-cycle stress test. KeyCorp and KeyBank have been required to report the results of their annual stress tests to the Federal Reserve and the OCC. KeyCorp has been required to report the results of its mid-cycle stress test to the Federal Reserve. Under one of the Tailoring Rules, KeyCorp is no longer required to conduct and publicly disclose the results of company-run stress tests and is subject to a supervisory stress test conducted by the Federal Reserve every other year rather than every year. In 2020 and again in 2022, KeyCorp was required to participate in the Federal Reserve’s CCAR process and was subject to a supervisory stress test conducted by the Federal Reserve. In 2024, KeyCorp will again be required to participate in the Federal Reserve’s CCAR process and will be subject to a supervisory stress test conducted by the Federal Reserve. Since the adoption of a final rule by the federal banking agencies in October 2019, KeyBank is no longer required to conduct annual company-run stress tests. Also, this final rule removes the “adverse” scenario as a required scenario for all stress testing requirements applicable to BHCs and federally-regulated banks so that such stress tests will be required to include only “baseline” and “severely adverse” scenarios. On March 4, 2020, the Federal Reserve adopted a final rule integrating certain aspects of the Federal Reserve’s Regulatory Capital Rules with CCAR and the stress test rules in order to simplify the overall capital framework that is currently applicable to BHCs that have $100 billion or more in total consolidated assets (including KeyCorp). 16 Table of contents Under the final rule, the Federal Reserve amended the capital conservation buffer requirement under the Regulatory Capital Rules by replacing the static risk-weighted assets component of the buffer with a new measure, the stress capital buffer, which will be based on the results of an individual BHC’s supervisory stress test and cannot be less than 2.5 percent of risk-weighted assets. A firm will be subject to limitations on capital distributions and discretionary bonus payments if it does not satisfy all minimum capital requirements and its stress capital buffer requirement. A firm’s stress capital buffer requirement will become effective on October 1 of each year and will remain in effect until September 30 of the following year unless the firm receives an updated stress capital buffer requirement from the Federal Reserve. On August 26, 2020, the federal banking agencies issued a final rule that revises the definition of eligible retained income as that term is used in the agencies’ Regulatory Capital Rules. The revised definition applies to all buffer requirements applicable to a banking organization, including the stress capital buffer requirement adopted by the Federal Reserve on March 4, 2020. The revised definition of eligible retained income will make any automatic limitations on capital distributions that could apply under the agencies’ capital rules more gradual with the objective of promoting continued lending during a period of stress. On January 19, 2021, the Federal Reserve issued a final rule to make conforming changes to the capital planning, regulatory reporting, and stress capital buffer requirements for firms subject to Category IV standards (including KeyCorp) to make these requirements consistent with the tailored regulatory framework for large banking organizations that the Federal Reserve adopted in an October 2019 rulemaking. The final rule revises the elements of the capital plan that Category IV firms are required to submit to the Federal Reserve and makes related changes to regulatory reporting requirements. Also, the final rule updates the frequency for calculating the stress capital buffer for these firms. As a Category IV banking organization subject to a supervisory stress test every other year, KeyCorp was not required to participate in the Federal Reserve’s supervisory stress test in 2023. On July 27, 2023, the Federal Reserve confirmed that KeyCorp’s required stress capital buffer (based on the results of KeyCorp’s June 2022 stress test) is 2.5%, which is the minimum buffer required for banking organizations the size of KeyCorp. This stress capital buffer requirement will remain in effect until September 30, 2024 unless KeyCorp receives an updated stress capital buffer requirement from the Federal Reserve before that date. Dividend restrictions Federal law and regulation impose limitations on the payment of dividends by our national bank subsidiaries, like KeyBank. Historically, dividends paid by KeyBank have been an important source of cash flow for KeyCorp to pay dividends on its equity securities and interest on its debt. Dividends by our national bank subsidiaries are limited to the lesser of the amounts calculated under an earnings retention test and an undivided profits test. Under the earnings retention test, without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year’s net income combined with the retained net income of the two preceding years. Under the undivided profits test, a dividend may not be paid in excess of a bank’s undivided profits. Moreover, under the FDIA, an insured depository institution may not pay a dividend if the payment would cause it to be less than “adequately capitalized” under the prompt corrective action framework or if the institution is in default in the payment of an assessment due to the FDIC. Similarly, under the Regulatory Capital Rules, a banking organization that fails to satisfy the minimum capital conservation buffer requirement will be subject to certain limitations, which include restrictions on capital distributions. For more information about the payment of dividends by KeyBank to KeyCorp, please see Note 3 (“Restrictions on Cash, Dividends, and Lending Activities”) in this report. FDIA, Resolution Authority and Financial Stability Deposit insurance and assessments The DIF provides insurance coverage for domestic deposits funded through assessments on insured depository institutions like KeyBank. The amount of deposit insurance coverage for each depositor’s deposits is $250,000 per depository. The FDIC must assess the premium based on an insured depository institution’s assessment base, calculated as its average consolidated total assets minus its average tangible equity. KeyBank’s current annualized premium assessments can range from $.025 to $.45 for each $100 of its assessment base. The rate charged depends on 17 Table of contents KeyBank’s performance on the FDIC’s “large and highly complex institution” risk-assessment scorecard, which includes factors such as KeyBank’s regulatory rating, its ability to withstand asset and funding-related stress, and the relative magnitude of potential losses to the FDIC in the event of KeyBank’s failure. On October 18, 2022, the FDIC adopted a final rule, applicable to all insured depository institutions (including KeyBank), to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028. Under the final rule, the increase in rates began with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% reserve ratio. On March 10, 2023, and March 12, 2023, Silicon Valley Bank (“SVB”) and Signature Bank (“Signature”) were closed by the state banking authorities in California and New York, respectively, and the FDIC was appointed as receiver of SVB and Signature. All deposits of SVB and Signature were transferred to bridge banks established by the FDIC under the systemic risk exception to the least cost test in the FDIA so that the uninsured deposits as well as the insured deposits of both banks were protected by the FDIC. Under the FDIA, the loss to the DIF arising from the use of the systemic risk exception must be recovered through one or more special assessments. On November 16, 2023, the FDIC issued a final rule to impose a special assessment on IDIs to recover the loss to the DIF resulting from the use of the systemic risk exception to protect the uninsured depositors of SVB and Signature. Under the final rule, the FDIC would collect a special assessment from IDIs at an annual rate of approximately 13.4 basis points over eight quarterly assessment periods, starting with the first quarterly assessment period of 2024. The assessment base for the proposed special assessment is equal to an IDI’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits held by the IDI. Because the estimated loss to the DIF from the use of the systemic risk exception will be periodically adjusted and because the total assessments collected may change due to corrective amendments filed by covered IDIs regarding the reported amount of uninsured deposits for the December 31, 2022 reporting period, the FDIC may cease collection of the special assessment early, extend the special assessment collection period, or impose a final shortfall special assessment. In the final rule, the FDIC indicated that the special assessment is a tax-deductible operating expense for IDIs, and that it assumed that the effect on income of the entire amount of the special assessment would occur in one quarter for the IDIs subject to the assessment. The impact of the special assessment to Key was approximately $190 million, which was recognized upon issuance of the final rule in the fourth quarter of 2023. The FDIC’s final rule for a special assessment discussed above was not intended to recover the loss to the DIF from the failure of First Republic Bank in May 2023 (initially estimated as a $13 billion loss) or to the DIF from the failures of SVB and Signature that was not related to the protection of uninsured depositors (initially estimated as a $2.7 billion loss). The FDIC indicated that no further adjustments to assessments are contemplated at this time to recover those losses but that it will re-evaluate this issue in the future when it updates projections for the DIF balance and the reserve ratio in connection with its periodic review of the DIF Restoration Plan that was adopted in 2022. The FDIC updates these projections at least semiannually. 18 Table of contents Conservatorship and receivership of insured depository institutions Upon the insolvency of an insured depository institution, the FDIC will be appointed as receiver or, in rare circumstances, conservator for the insolvent institution under the FDIA. In an insolvency, the FDIC may repudiate or disaffirm any contract to which the institution is a party if the FDIC determines that performance of the contract would be burdensome and that disaffirming or repudiating the contract would promote orderly administration of the institution’s affairs. If the contractual counterparty made a claim against the receivership (or conservatorship) for breach of contract, the amount paid to the counterparty would depend upon, among other factors, the receivership (or conservatorship) assets available to pay the claim and the priority of the claim relative to others. In addition, the FDIC may enforce most contracts entered into by the insolvent institution, notwithstanding any provision that would terminate, cause a default, accelerate or give other rights under the contract solely because of the insolvency, the appointment of the receiver (or conservator), or the exercise of rights or powers by the receiver (or conservator). The FDIC may also transfer any asset or liability of the insolvent institution without obtaining approval or consent from the institution’s shareholders or creditors. These provisions would apply to obligations and liabilities of KeyCorp’s insured depository institution subsidiary, KeyBank, including obligations under senior or subordinated debt issued to public investors. Receivership of certain SIFIs The Dodd-Frank Act created a new resolution regime, as an alternative to bankruptcy, known as the “orderly liquidation authority” (“OLA”) for certain SIFIs, including BHCs and their affiliates. Under the OLA, the FDIC would generally be appointed as receiver to liquidate and wind down a failing SIFI. The determination that a SIFI should be placed into OLA receivership is made by the U.S. Treasury Secretary, who must conclude that the SIFI is in default or in danger of default and that the SIFI’s failure poses a risk to the stability of the U.S. financial system. This determination must come after supermajority recommendations by the Federal Reserve and the FDIC, and consultation between the U.S. Treasury Secretary and the President. If the FDIC is appointed as receiver under the OLA, its powers and the rights and obligations of creditors and other relevant parties would be determined exclusively under the OLA. The powers of a receiver under the OLA are generally based on the FDIC’s powers as receiver for insured depository institutions under the FDIA. Certain provisions of the OLA were modified to reduce disparate treatment of creditors’ claims between the U.S. Bankruptcy Code and the OLA. However, substantial differences between the two regimes remain, including the FDIC’s right to disregard claim priority in some circumstances, the use of an administrative claims procedure under OLA to determine creditors’ claims (rather than a judicial procedure in bankruptcy), the FDIC’s right to transfer claims to a bridge entity, and limitations on the ability of creditors to enforce contractual cross-defaults against potentially viable affiliates of the entity in receivership. OLA liquidity would be provided through credit support from the U.S. Treasury and assessments made, first, on claimants against the receivership that received more in the OLA resolution than they would have received in ordinary liquidation (to the full extent of the excess), and second, if necessary, on SIFIs like KeyCorp utilizing a risk-based methodology. Depositor preference The FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of its depositors (including claims of its depositors that have subrogated to the FDIC) and certain claims for administrative expenses of the FDIC as receiver have priority over other general unsecured claims. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will be placed ahead of unsecured, nondeposit creditors, including the institution’s parent BHC and subordinated creditors, in order of priority of payment. Resolution plans BHCs with at least $50 billion in total consolidated assets, like KeyCorp, have been required to periodically submit to the Federal Reserve and FDIC a plan discussing how the company could be rapidly and orderly resolved if the company failed or experienced material financial distress. Insured depository institutions with at least $50 billion in total consolidated assets, like KeyBank, have also been required to submit a resolution plan to the FDIC. These plans have been due annually unless the requirement to submit the plans was deferred by the regulators. The Federal Reserve and FDIC make available on their websites the public sections of resolution plans for the companies, including KeyCorp and KeyBank, that submitted plans. The public sections of the resolution plans of KeyCorp and KeyBank are available at http://www.federalreserve.gov/supervisionreg/resolution-plans.htm and 19 Table of contents https://www.fdic.gov/regulations/reform/resplans/. KeyCorp’s last resolution plan was submitted in 2017, and KeyBank’s last resolution plan was submitted in 2022. KeyCorp is no longer required to submit a resolution plan because of the rule change discussed below while KeyBank remains subject to resolution plan requirements as discussed below. In October 2019, the Federal Reserve and FDIC adopted a final rule to modify the resolution planning requirements applicable to large BHCs. Under this final rule, BHCs with less than $250 billion in total consolidated assets will no longer be required to submit a resolution plan unless they have $75 billion or more in certain risk-based indicators. Under this final rule, KeyCorp is no longer subject to resolution planning requirements. On June 25, 2021, the FDIC issued a statement describing the modified approach that it plans to take in implementing certain aspects of its resolution plan rule with respect to IDIs with $100 billion or more in total assets (including KeyBank). In this statement, the FDIC (i) indicated that these institutions will be required to submit resolution plans on a three-year cycle; (ii) described the content requirements for these resolution plan submissions; and (iii) specified that there will be greater emphasis in the future on periodic engagement and capabilities testing by the FDIC with individual institutions. The FDIC stated that resolution plans will be submitted in two groups, with the first group consisting of IDIs whose parent company is not a U.S. global systemically important bank (“GSIB”) or a Category II banking organization and the second group consisting of all other IDIs with $100 billion or more in total assets. KeyBank is in the first group. On August 29, 2023, the FDIC released for public comment a proposal to amend and restate its current resolution plan rule in order to clarify and strengthen resolution plan submission requirements and reflect lessons learned since the adoption of the FDIC’s current resolution plan rule in 2012. Among other things, the proposal would (i) require IDIs with more than $100 billion in total assets (including KeyBank) to submit full resolution plans every two years, (ii) require IDIs with total assets between $50 billion and $100 billion to submit informational filings every two years, (iii) require both groups of filers to submit more limited supplements in the off years, (iv) enhance and clarify the requirements for the content of resolution submissions, (v) codify certain aspects of guidance and feedback provided to filers subject to the current rule, (vi) expand expectations regarding engagement and capabilities testing, and (vii) establish an enhanced credibility standard for the evaluation of resolution submissions. Comments on the proposal were due by November 30, 2023. Other Regulatory Requirements and Developments The Bank Secrecy Act The BSA requires all financial institutions (including banks and securities broker-dealers) to, among other things, maintain a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. It includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting) as well as due diligence and know-your-customer documentation requirements. Key has established and maintains an AML program to comply with the BSA’s requirements. Consumer Financial Protection Bureau Title X of the Dodd-Frank Act created the CFPB, a consumer financial services regulator with supervisory authority over banks and their affiliates with assets of more than $10 billion, like Key, to carry out federal consumer protection laws. The CFPB also regulates financial products and services sold to consumers and has rulemaking authority with respect to federal consumer financial laws. Any new regulatory requirements promulgated by the CFPB or modifications in the interpretations of existing regulations could require changes to Key’s consumer-facing businesses. The Dodd-Frank Act also gives the CFPB broad data collecting powers for fair lending for both small business and mortgage loans, as well as extensive authority to prevent unfair, deceptive and abusive practices. Volcker Rule The Volcker Rule implements Section 619 of the Dodd-Frank Act, which prohibits “banking entities,” such as KeyCorp, KeyBank and their affiliates and subsidiaries, from owning, sponsoring, or having certain relationships with hedge funds and private equity funds (referred to as “covered funds”) and engaging in short-term proprietary trading of financial instruments, including securities, derivatives, commodity futures and options on these instruments. 20 Table of contents The Volcker Rule excepts certain transactions from the general prohibition against proprietary trading, including transactions in government securities (e.g., U.S. Treasuries or any instruments issued by the GNMA, FNMA, FHLMC, a Federal Home Loan Bank, or any state or a political division of any state, among others); transactions in connection with underwriting or market-making activities; and transactions as a fiduciary on behalf of customers. A banking entity may also engage in risk-mitigating hedging activity if it can demonstrate that the hedge reduces or mitigates a specific, identifiable risk or aggregate risk position of the entity. The banking entity is required to conduct an analysis supporting its hedging strategy and the effectiveness of the hedges must be monitored and, if necessary, adjusted on an ongoing basis. Key does not anticipate that the proprietary trading or covered fund restrictions in the Volcker Rule will have a material impact on its business, but it was required to divest certain fund investments. As of June 30, 2023, Key has completed conforming and/or divesting certain indirect investments subject to the Volcker Rule. Enhanced prudential standards and early remediation requirements As enacted in 2010, the Dodd-Frank Act required the Federal Reserve to impose EPSs upon BHCs, like KeyCorp, with at least $50 billion in total consolidated assets. Prudential standards were required to include enhanced risk-based capital requirements and leverage limits, liquidity requirements, risk-management and risk committee requirements, resolution plan requirements, credit exposure report requirements, single counterparty credit limits (“SCCL”), supervisory and company-run stress test requirements and, for certain financial companies, a debt-to-equity limit. Early remediation requirements were required to include limits on capital distributions, acquisitions, and asset growth in early stages of financial decline and capital restoration plans, capital raising requirements, limits on transactions with affiliates, management changes, and asset sales in later stages of financial decline, which would be triggered by forward-looking indicators including regulatory capital and liquidity measures. EGRRCPA, enacted on May 24, 2018, raised the asset threshold above which the Federal Reserve is required to apply EPSs to BHCs from $50 billion to $250 billion and gave the Federal Reserve the authority to apply EPSs to BHCs with at least $100 billion in assets. Please see the discussion under the headings “Regulatory capital requirements - Liquidity requirements” and “Regulatory capital requirements - Capital planning and stress testing” for more information about EGRRCPA and the related Tailoring Rules. Since 2010, the Federal Rule has implemented the following EPSs required under the Dodd-Frank Act: (i) the resolution plan requirements (through a joint final rule adopted with the FDIC), (ii) stress test requirements, (iii) the incorporation of the Regulatory Capital Rules through the Federal Reserve’s previously finalized rules on capital planning and stress tests; (iv) liquidity requirements; (v) the risk management framework, including requirements around the risk committee and the chief risk officer as well as the corporate governance requirements as they relate to liquidity risk management; and (vi) a 15-to-1 debt-to-equity, limit for companies that the FSOC determines pose a “grave threat” to U.S. financial stability. In addition, the Federal Reserve has issued a final rule establishing SCCL requirements, but that rule does not apply to KeyCorp. The Federal Reserve has yet to implement a final rule on the early remediation requirements. Bank transactions with affiliates Federal banking law and regulation imposes qualitative standards and quantitative limitations upon certain transactions by a bank with its affiliates, including the bank’s parent BHC and certain companies the parent BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms, and cannot exceed certain amounts that are determined with reference to the bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. These provisions significantly restrict the ability of KeyBank to fund its affiliates, including KeyCorp, KBCM, and KeyCorp’s nonbanking subsidiaries engaged in making merchant banking investments (and certain companies in which these subsidiaries have invested). Provisions added by the Dodd-Frank Act expanded the scope of: (i) the definition of affiliate to include any investment fund having any bank or BHC-affiliated company as an investment adviser; (ii) credit exposures subject to the prohibition on the acceptance of low-quality assets or securities issued by an affiliate as collateral, the quantitative limits, and the collateralization requirements to now include credit exposures arising out of derivative, repurchase agreement, and securities lending/borrowing transactions; and (iii) transactions subject to quantitative limits to now also include credit collateralized by affiliate-issued debt obligations that are not securities. In addition, 21 Table of contents these provisions require that a credit extension to an affiliate remain secured in accordance with the collateral requirements at all times that it is outstanding, rather than the previous requirement of only at the inception or upon material modification of the transaction. These provisions also raise significantly the procedural and substantive hurdles required to obtain a regulatory exemption from the affiliate transaction requirements. While these provisions became effective on July 21, 2012, the Federal Reserve has not yet issued a proposed rule to implement them. Supervision and governance On November 2, 2018, the Federal Reserve announced that it is adopting a new supervisory rating system for large financial institutions, including BHCs with total consolidated assets of $100 billion or more (like KeyCorp) (“LFI Rating System”), in order to align the Federal Reserve’s rating system with the post-crisis supervisory programs for these firms. The LFI Rating System will provide a supervisory evaluation of whether an institution possesses sufficient operational strength and resilience to maintain safe and sound operations through a range of conditions and will assess an institution’s capital planning and positions, liquidity risk management and positions, and governance and controls. Institutions subject to the LFI Rating System will be rated using the following scale: Broadly Meets Expectations, Conditionally Meets Expectations, Deficient-1, and Deficient-2, with the Conditionally Meets Expectations rating intended to be used as a transitory rating to allow an institution time to remediate a concern identified during the supervisory evaluation. The Federal Reserve assigned an initial rating under the LFI Rating System to KeyCorp in 2020. The governance and controls component of the LFI Rating System was the subject of two separate, but related proposals: (i) proposed guidance regarding supervisory expectations for boards of directors of large financial institutions; and (ii) proposed guidance regarding core principles for effective senior management, business management, and independent risk management and controls for large financial institutions. The final guidance regarding supervisory expectations for boards of directors was issued by the Federal Reserve on February 26, 2021. The Federal Reserve indicated that it intends to use the board effectiveness guidance in informing its assessment of governance and controls at all firms subject to the LFI Rating System (including KeyCorp). The Federal Reserve has not finalized the proposed guidance referenced above regarding core principles for effective senior management, business management, and independent risk management and controls for large financial institutions. This guidance would support the supervisory evaluation under the governance and controls component of the LFI Rating System, together with the above-mentioned guidance regarding the effectiveness of a firm’s board of directors. Community Reinvestment Act The Community Reinvestment Act (“CRA”) was enacted in 1977 to encourage depository institutions to help meet the credit needs of the communities that they serve, including low- and moderate-income (“LMI”) neighborhoods, consistent with the institutions’ safe and sound operations. The CRA requires the federal banking agencies to assess the record of each institution that they supervise in meeting the credit needs of its entire community, including LMI neighborhoods. On October 24, 2023, the federal banking agencies adopted a final rule to strengthen and modernize their regulations implementing the CRA to better achieve the purposes of the law, adapt to changes in the banking industry, and provide clarity and consistency in the application of their regulations. Among other things, the final rule (1) clarifies what activities constitute eligible community development activities, (2) adopts four new tests under which large banks with more than $2 billion in assets (including KeyBank) will be evaluated, (3) applies a new framework for assigning conclusions and ratings to banks, (4) updates requirements for delineating facility-based assessment areas, (5) provides for the evaluation of certain large banks in retail lending assessment areas as well as facility-based assessment areas, and (6) imposes new data collection and reporting requirements. The four new tests under which large banks will be evaluated are a retail lending test, a retail services and products test, a community development financing test, and a community development services test. Various metrics and performance standards will be applied under these tests. Some provisions of the final rule will be effective on April 1, 2024 while many other provisions will be effective on January 1, 2026, and certain reporting requirements will be effective on January 1, 2027. KeyBank is subject to the final rule. 22 Table of contents Developments relating to climate change On March 21, 2022, the SEC issued for public comment a proposal to amend its rules under the Securities Act of 1933 and the Securities Exchange Act of 1934 to require public companies (including KeyCorp) to provide detailed climate-related information in their registration statements and periodic reports. Among other things, the proposal would require public companies to disclose information about (i) climate-related risks that are reasonably likely to have a material impact on the company’s business or financial statements over the short-, medium- or long-term; (ii) the actual and potential impacts of such risks on the company’s strategy, business model, and outlook; (iii) the role of the board of directors in overseeing climate-related risks and management’s role in assessing and managing such risks; (iv) the impact of climate-related events and transitional activities on line items in the company’s consolidated financial statements as well as the financial estimates and assumptions used in the financial statements; and (v) the company’s direct greenhouse gas emissions, indirect emissions from purchased energy, and, if material, indirect emissions from the company’s value chain (which may include financed emissions in a bank’s loan portfolio). The financial services industry has not yet adopted a standardized methodology for banks to use to quantitatively measure indirect emissions from a bank’s value chain, such as financed emissions. Accordingly, this proposal would require many banks to quantify and disclose financed emissions on a comprehensive scale for the first time. We are awaiting issuance of the final rule. On October 24, 2023, the federal banking agencies issued a set of principles that provide a high-level framework for the safe and sound management of exposures to climate-related financial risks for financial institutions with over $100 billion in total consolidated assets. These principles are intended to provide large financial institutions with guidance in their efforts to identify, measure, monitor, and mitigate physical and transition risks associated with climate change. These principles discuss how these risks can be addressed in the following areas: governance; policies, procedures, and limits; strategic planning; risk management; data, risk measurement, and reporting; and scenario analysis. These principles also describe how climate-related financial risks can be addressed in connection with various specific risk categories, including credit risk, liquidity risk, operational risk, and legal/compliance risk. This interagency guidance applies to KeyCorp and KeyBank. Long-term debt requirement On August 29, 2023, the federal banking agencies issued for public comment a proposal that would require certain large BHCs and certain large IDIs to issue and maintain minimum amounts of long-term debt (“LTD”). This proposal would apply to Category II, III, and IV BHCs (including KeyCorp) and IDIs that (i) are not consolidated subsidiaries of U.S. global systemically important banks and (ii) have at least $100 billion in total assets (including KeyBank) or are affiliated with an IDI that has at least $100 billion in total assets. Under the proposal, the required minimum amount of LTD would be the greater of 6 percent of an entity’s total risk-weighted assets, 3.5 percent of an entity’s average total consolidated assets, and 2.5 percent of an entity’s total leverage exposure if it is subject to the supplementary leverage ratio. IDIs that are consolidated subsidiaries of BHCs would be required to issue the LTD to their parent company or another entity that consolidates the IDI. Debt instruments issued to satisfy the minimum LTD requirement would have to meet certain criteria including, among other things, being unsecured, have a remaining maturity of more than one year, and not provide the holder with acceleration rights except in limited circumstances. BHCs subject to the proposal would also have to comply with certain “clean holding-company” requirements such as a cap on liabilities other than eligible LTD and a prohibition on entering into most qualified financial contracts with third parties. The proposal would provide a three-year transition period with the incremental phase-in of the requirements during this period. The federal banking agencies indicated that the proposal would improve the resolvability of the covered entities in case of their failure, reduce costs to the DIF, and mitigate contagion and financial stability risks by reducing the risk of loss to uninsured depositors. Comments on the proposal were due by January 16, 2024. Debit Card Interchange Fee Cap On October 25, 2023, the Federal Reserve issued for public comment a proposal to lower the maximum interchange fee that a debit card issuer with $10 billion or more in total consolidated assets (including KeyBank) can receive for a debit card transaction. The interchange fee cap is currently set at the sum of 21 cents for each transaction plus an amount equal to 0.05% of the value of the transaction and a one cent fraud prevention adjustment for issuers that satisfy certain criteria. In the new proposal, the Federal Reserve proposed to lower the cap to the sum of 14.4 cents for each transaction plus an amount equal to 0.04% of the value of the transaction and a 1.3 cent fraud prevention adjustment. The Federal Reserve indicated that it was proposing this revision to the fee 23 Table of contents cap to reflect changes in issuer costs. The Federal Reserve also proposed to update the amount of the fee cap every other year going forward by using data it collects in a biennial survey of large debit card issuers. Comments on the proposal are due by May 12, 2024. 24 Table of contents ITEM 1A. RISK FACTORS Summary of Risk Factors The following is a summary of some of the material risks and uncertainties that could have an adverse effect on our business. • Credit Risk ◦ We have concentrated credit exposure in commercial and industrial loans, commercial real estate loans, and commercial leases. ◦ Should the fundamentals of the commercial real estate market deteriorate, our financial condition and results of operations could be adversely affected. ◦ We are subject to the risk of defaults by our loan clients and counterparties. ◦ Various factors may cause our allowance for loan and lease losses to increase or to be inadequate. ◦ Declining asset prices could adversely affect us. ◦ Geopolitical destabilization could adversely impact our loan portfolios. • Compliance Risk ◦ We are subject to extensive government regulation, supervision, and tax legislation. ◦ We are subject to complex and evolving laws and regulations regarding privacy and cybersecurity, which could limit our ability to pursue business initiatives, increase the cost of doing business and subject us to compliance risks and potential liability. ◦ Changes in accounting policies, standards, and interpretations could materially affect how we report our financial condition and results of operations. • Operational Risk ◦ We are subject to a variety of operational risks. ◦ We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption. ◦ We rely on third parties to perform significant operational services for us. ◦ We are, and may in the future be, subject to claims, litigation, investigations, and governmental proceedings, which could result in significant financial liability and/or reputational harm. ◦ Our controls and procedures may fail or be circumvented, and our methods of reducing risk exposure may not be effective. ◦ Our operations and financial performance could be adversely affected by severe weather and natural disasters exacerbated by climate change. ◦ Societal and governmental responses to climate change could adversely affect Key’s business and performance, including indirectly through impacts on Key’s customers. ◦ The increased use of remote work infrastructure has expanded potential attack vectors and resulted in increased operational risks. • Liquidity Risk ◦ Capital and liquidity requirements imposed by banking regulations require banks and BHCs to maintain more and higher quality capital and more and higher quality liquid assets. ◦ Federal agencies’ actions to ensure stability of the U.S. financial system may have disruptive effects on us. ◦ We rely on dividends by our subsidiaries for most of our funds. ◦ We are subject to liquidity risk, which could negatively affect our funding levels. ◦ Our credit ratings affect our liquidity position. • Market Risk ◦ A worsening of the U.S. economy and volatile or recessionary conditions in the U.S. or abroad could negatively affect our business or our access to capital markets. ◦ We are subject to interest rate risk, which could adversely affect net interest income. ◦ Our profitability depends upon economic conditions in the geographic regions where we have significant operations and in certain market segments in which we conduct significant business. ◦ The soundness of other financial institutions could adversely affect us. ◦ Depressed market values for our common stock and adverse economic conditions sustained over a period of time may require us to write down all or some portion of our goodwill. 25 Table of contents • Reputation Risk ◦ Damage to our reputation could significantly impact our business and major stakeholders. ◦ Key is subject to environmental, social, and governance (ESG) risks that could adversely affect our reputation, the trading price of our common stock and/or our business and results of operations. • Strategic Risk ◦ We may not realize the expected benefits of our strategic initiatives. ◦ We operate in a highly competitive industry. ◦ Maintaining or increasing our market share depends upon our ability to adapt our products and services to evolving industry standards and consumer preferences, while maintaining competitive products and services. ◦ We may not be able to attract and retain skilled people. ◦ Acquisitions or strategic partnerships may disrupt our business and dilute shareholder value. • Model Risk ◦ We rely on quantitative models to manage certain accounting, risk management, capital planning, and treasury functions. As a financial services organization, we are subject to a number of risks inherent in our transactions and present in the business decisions we make. Described below are the material risks and uncertainties that if realized could have a material and adverse effect on our business, financial condition, results of operations or cash flows, and our access to liquidity. The risks and uncertainties described below are not the only risks we face. Disclosures of risks should not be interpreted to imply that the risks have not already materialized. Our ERM program incorporates risk management throughout our organization to identify, understand, and manage the risks presented by our business activities. Our ERM program identifies Key’s major risk categories as: credit risk, compliance risk, operational risk, liquidity risk, market risk, reputation risk, strategic risk, and model risk. These risk factors, and other risks we may face, are discussed in more detail in other sections of this report. I. Credit Risk We have concentrated credit exposure in commercial and industrial loans, commercial real estate loans, and commercial leases. As of December 31, 2023, approximately 69% of our loan portfolio consisted of commercial and industrial loans, commercial real estate loans, including commercial mortgage and construction loans, and commercial leases. These types of loans are typically larger than single family residential real estate loans and other types of consumer loans and have a different risk profile. The deterioration of a larger loan or a group of loans in this category could cause an increase in criticized and nonperforming loans, which could result in lower earnings from these loans, additional provision for loan and lease losses, and ultimately an increase in loan losses. Should the fundamentals of the commercial real estate market deteriorate, our financial condition and results of operations could be adversely affected. Recent Federal Reserve monetary policy, including shrinkage of its balance sheet and incremental increases in target interest rates early in 2023 followed by a sustained period of relatively high target interest rates throughout the latter part of 2023, continue to impact the commercial and residential real estate markets. Capitalization rates are rising, and property value appreciation has slowed or is now declining. In many markets within Key’s footprint, property values have begun to decrease. Industrial and retail properties continue to remain stable, but multifamily, office, hospitality, and single family detached properties are beginning to show signs of deterioration. Development and construction continue, but at muted levels, and deliveries of additional units into the market have been supported. Oversupply of multifamily housing is a concern in certain urban and gateway markets. However, our exposures in those markets are limited (for example, approximately 5% of our multifamily portfolio is located in New York City, Chicago, Los Angeles, and San Francisco; we also have no exposure to rent controlled properties in New York City). The most severely impacted commercial real estate segments have been in office. Key’s non-owner occupied office exposures are 5% of our total commercial real estate exposure. Substantial deterioration in property market fundamentals could negatively impact our portfolio, with a large portion of our clients active in real estate but in the comparatively better performing multifamily space over the cycle. A correction in the real estate markets could impact the ability of borrowers to make debt service payments on loans or to refinance the loans at maturity. A 26 Table of contents relatively small portion of our commercial real estate loans are construction loans. New construction and value-add or rehabilitation construction projects may not be fully leased at loan origination. These properties typically require additional leasing through the life of the loan to provide cash flow to support debt service payments. If property market fundamentals deteriorate sharply, performance under existing leases could deteriorate and the execution of new leases could slow, compromising the borrower’s ability to cover debt service payments. We are subject to the risk of defaults by our loan clients and counterparties. Many of our routine transactions expose us to credit risk, including the risk of default of our counterparties, which include other financial institutions, or clients. Our credit risk may be exacerbated when the collateral held cannot be realized upon or is liquidated at prices insufficient to recover the full amount of the loan or derivative exposure due to us. In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of counterparties and clients, including financial statements, credit reports and other information. We also rely on representations of those counterparties, clients, or other third parties as to the accuracy and completeness of that information. The inaccuracy of that information or those representations affects our ability to accurately evaluate the default risk of a counterparty or client. In addition, given the Dodd-Frank legislative mandate to centrally clear eligible derivative contracts, we rely on central clearing counterparties to remain open and operationally viable at all times. A financial institution or other counterparty failure, such as the bank failures in early 2023, or a cybersecurity breach could result in the failure of or disruption to a counterparty or client, which may materially and adversely affect our business, financial condition or results of operations. Various factors may cause our allowance for loan and lease losses to increase or to be inadequate. We maintain an ALLL (a reserve established through a provision for loan and lease losses charged to expense) that represents our estimate of losses based on our evaluation of risks within our existing portfolio of loans. The level of the allowance at December 31, 2023 represents management’s estimate of expected credit losses over the contractual life of our existing loan portfolio. The determination of the appropriate level of the ALLL inherently involves a degree of subjectivity and requires that we make significant estimates of current credit risks and current trends and reasonable and supportable forecasts of future economic conditions, all of which may undergo frequent and material changes. Changes in economic conditions affecting borrowers, the softening of certain macroeconomic variables that we are more susceptible to, such as GDP, unemployment, SOFR and other interest rates, the producer price index, and real estate values, along with updated information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may indicate the need for an increase in the ALLL. Further, the multitude and totality of factors impacting our estimates and the subjectivity of components of its calculation may cause the ALLL to be an inadequate representation of the actual losses incurred over the life of our loan portfolio. Both an increase in the ALLL and actual losses exceeding our current estimates will reduce our net income and could impact our capital positions and may materially and adversely affect our business, financial condition or results of operations. Declining asset prices could adversely affect us. During periods of economic stress, the volatility and disruption that the capital and credit markets experience may reach, and have in the past reached, extreme levels. Market disruption may severely stress or even lead to the failure of financial institutions, which can cause further credit market constriction and further liquidation of assets, driving asset prices down even more. Asset price deterioration has a negative effect on the valuation of collateral and certain of the asset categories represented on our balance sheet and reduces our ability to sell assets at prices we deem acceptable. The most recent recession, resulting from the impact of the COVID-19 pandemic, did not have significant lasting impact on collateral value. However, there are still risks to economic stability that could reverse recent stable trends in asset prices. These risks include: • A correction in equity or housing markets; • Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; • Labor-supply constraints, leading to slowing job growth and boosting wages along with inflation (wage-price spiral); and 27 Table of contents • Negative GDP growth, as a result of, in part, the Federal Reserve’s monetary policy efforts to arrest inflationary pressures within the broader economy. Geopolitical destabilization could adversely impact our loan portfolios. While we have minimal direct foreign company exposure in our loan portfolios, there are correlated and contingent risks posed by geopolitical destabilization within our loan portfolio. For example, conflicts across the world, including the Russia-Ukraine war and the Israel-Hamas war, have proven to have a material impact on certain domestic commodity prices, impacting our borrowers' input costs and disrupting supply chains both domestically and abroad. These factors increase potential defaults in our loan portfolio and could ultimately increase loan losses. II. Compliance Risk We are subject to extensive government regulation, supervision, and tax legislation. As a financial services institution, we are subject to extensive federal and state regulation, supervision, and tax legislation. Banking regulations are primarily intended to protect depositors’ funds, the DIF, consumers, taxpayers, and the banking system as a whole, not our debtholders or shareholders. These regulations increase our costs and affect our lending practices, capital structure, investment practices, dividend policy, ability to repurchase our common shares, and growth, among other things. KeyBank and KeyCorp remain covered institutions under the Dodd-Frank Act’s heightened prudential standards and regulations, including its provisions designed to protect consumers from financial abuse. Like similarly situated institutions, Key undergoes routine scrutiny from bank supervisors in the examination process and is subject to enforcement of regulations at the federal and state levels, particularly with respect to consumer banking-related practices, including fair and responsible banking, fair lending, unfair, deceptive or abusive practices, and the Community Reinvestment Act, as well as compliance with AML, BSA and Office of Foreign Assets Control efforts. Changes to existing statutes and regulations, and taxes (including industry-specific taxes and surcharges), or their interpretation or implementation, could affect us in substantial and unpredictable ways. Interpretation of consumer banking-related regulations may evolve as the industry and the regulators seek to increase access to banking products and services by consumers. For example, the CFPB has launched an initiative to reduce the amounts and types of fees financial institutions may charge, including the issuance of proposed rules that would significantly reduce the permissible amount of credit card late fees and NSF fees on transactions that are declined instantaneously or near-instantaneously and the issuance of an advisory opinion prohibiting large financial institutions (including Key) from imposing unreasonable obstacles on customers, such as charging excessive fees, for basic information about their own accounts. Such changes may subject us to additional costs, adversely impact our income, and increase our litigation risk should we fail to appropriately comply and may also impact consumer behavior, limit the types of financial services and products we may offer, affect the investments we make, and change the manner in which we operate. In addition, changes to laws and regulations may impact our customers by requiring them to adjust their operations or practices or impair their ability to pay fees or outstanding loans or afford new products, which could negatively impact demand for our products and services. Certain federal regulations have been in existence for decades without modification to account for modern banking practices, such as digital delivery of products and services, which can create challenges in execution and in the examination process. Emerging technologies, such as cryptocurrencies, could limit KeyBank’s ability to track the movement of funds. KeyBank’s ability to comply with BSA/AML and other regulations is dependent on its ability to improve detection and reporting capabilities and reduce variation in control processes and oversight accountability. Additionally, federal banking law grants substantial enforcement powers to federal banking regulators. This enforcement authority includes, among other things, the ability to assess civil money penalties, fines, or restitution, to issue cease and desist or removal orders, and to initiate injunctive actions against banking organizations and affiliated parties. These enforcement actions may be initiated for violations of laws and regulations, for practices determined to be unsafe or unsound, or for practices or acts that are determined to be unfair, deceptive, or abusive. Failure to comply with these and other regulations, and supervisory expectations related thereto, may result in fines, penalties, lawsuits, regulatory sanctions, reputational damage, or restrictions on our business. Moreover, different government administrations may have different regulatory priorities, which may impact the level of regulation of financial institutions and the enforcement environment. 28 Table of contents For more information, see “Supervision and Regulation” in Item 1 of this report. We are subject to complex and evolving laws and regulations regarding privacy and cybersecurity, which could limit our ability to pursue business initiatives, increase the cost of doing business and subject us to compliance risks and potential liability. We are subject to complex and evolving laws and regulations governing the privacy and protection of personal information of our customers, employees, job applicants, and other individuals. Complying with laws and regulations applicable to our collection, use, transfer, and storage of personal information can increase operating costs, impact the development and marketing of new products or services, and reduce operational efficiency. Any mishandling or misuse of personal information by Key or our vendors could expose us to litigation or regulatory fines, penalties, or other sanctions. At the federal level, we are subject to the Gramm-Leach-Bliley Act of 1999, as amended, which requires financial institutions to, among other things, periodically disclose their privacy policies and practices relating to sharing personal information and, in some cases, enables customers to opt out of the sharing of certain non-public personal information with unaffiliated third parties. We are also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to privacy and cybersecurity. A number of states have also recently enacted consumer privacy laws that impose compliance obligations with respect to personal information or issued guidance regarding the same, such as the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (known as the “CCPA”), and the New York Department of Financial Services Cybersecurity Regulations. In addition, there has been a significant increase in privacy-related litigation in recent years with respect to how organizations collect information and technical data from their public facing websites, and federal and state courts have been creating new legal frameworks around consumer and website privacy, which also creates new risks on businesses. As new privacy-related laws and regulations, and judicially-created frameworks, are implemented in jurisdictions in which KeyBank operates, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for noncompliance and reporting obligations in the case of data breaches, may significantly increase. Compliance with these laws and regulations has required and may continue to require us to change our policies, procedures, and technology for information security and segregation of data, which could, among other things, make us more vulnerable to operational failures, and subject us to monetary penalties for breach of such laws and regulations. As a result, some uncertainty remains as to the aggregate impact upon Key of significant regulations. Changes in accounting policies, standards, and interpretations could materially affect how we report our financial condition and results of operations. The FASB periodically changes the financial accounting and reporting standards governing the preparation of Key’s financial statements. Additionally, those bodies that establish and/or interpret the financial accounting and reporting standards (such as the FASB, SEC, and banking regulators) may change prior interpretations or positions on how these standards should be applied. These changes can be difficult to predict and can materially affect how Key records and reports its financial condition and results of operations. In some cases, Key could be required to retroactively apply a new or revised standard, resulting in changes to previously reported financial results. III. Operational Risk We are subject to a variety of operational risks. In addition to the other risks discussed in this section, we are subject to operational risk, which represents the risk of loss resulting from human error, inadequate or failed internal processes, internal controls, systems, and external events. Operational risk includes the risk of fraud by employees or others outside of Key, clerical and recordkeeping errors, nonperformance by vendors, threats from cyber activity, and computer/telecommunications malfunctions. Fraudulent activity has escalated, become more sophisticated, and is ever evolving as there are more options to access financial services. Operational risk also encompasses compliance and legal risk, which is the risk of loss from violations of, or noncompliance with, laws, rules, regulations, prescribed practices, or ethical standards, as well as the risk of our noncompliance with contractual and other obligations. We are also exposed to operational risk through our outsourcing arrangements, and the effect that changes in circumstances or capabilities of our outsourcing vendors can have on our ability to continue to perform operational functions necessary to our business, 29 Table of contents such as certain loan processing functions. For example, breakdowns or failures of our vendors’ systems or employees could be a source of operational risk to us. Resulting losses from operational risk could take the form of explicit charges, increased operational costs (including remediation costs), harm to our reputation, inability to secure insurance, litigation, regulatory intervention or sanctions, or foregone business opportunities. We rely on our employees to design, manage, and operate our systems and controls to assure that we properly enter into, record and manage processes, transactions and other relationships with customers, vendors, suppliers, and other parties with whom we do business. We also depend on employees and the systems and controls for which they are responsible to assure that we identify and mitigate the risks that are inherent in our relationships and activities. These concerns are increased when we change processes or procedures, introduce new products or services, or implement new technologies, as we may fail to adequately identify or manage operational risks resulting from such changes. These concerns may be further exacerbated by employee turnover or labor shortages. As a result of our necessary reliance on employees to perform these tasks and manage resulting risks, we are thus subject to human vulnerabilities. These range from innocent human error to misconduct or malfeasance, potentially leading to operational breakdowns or other failures. Our controls may not be adequate to prevent problems resulting from human involvement in our business, including risks associated with the design, operation and monitoring of automated systems. We may also fail to adequately develop a culture of risk management among our employees. We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption. We rely heavily on communications, information systems (both internal and provided by third parties), and the internet to conduct our business. Our business is dependent on our ability to process and monitor large numbers of daily transactions in compliance with legal, regulatory, and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage, and transmission of personal and confidential information, such as the personal information of our employees, customers, and clients. These risks may increase in the future as we continue to increase mobile payments and other internet-based product offerings, expand our internal usage of web/cloud-based products and applications, and maintain and develop new relationships with third-party providers, including their downstream service providers. In addition, our ability to extend protections to customers’ information to individual customer devices is limited, especially if the customers willingly provide third parties access to their devices or information. In the event of a failure, interruption, or breach of our information systems, or that of a third party that provides services to us or our customers, we may be unable to avoid impact to our customers. For example, we may experience operational disruptions or interruptions as a result of a cyber incident, including disruption caused by protective containment measures taken by us, such as taking certain first- or third-party systems off-line for a prolonged period. Such a failure, interruption, or breach could result in legal liability, remediation costs, regulatory action, or reputational harm. U.S. financial service institutions and companies have reported breaches in the security of their websites or other systems and several financial institutions, including Key, have had third parties on which they rely experience such breaches. In addition, several financial institutions, including Key, have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disrupt, disable, or degrade services, or sabotage systems or data. Other attacks have attempted to obtain unauthorized access to confidential, proprietary, or personal information or intellectual property, to extort money through the use of “ransomware” or other extortion tactics, or to alter or destroy data or systems, often through various attack vectors and methods, including the introduction of computer viruses or malicious code (commonly referred to as “malware”), phishing, cyberattacks, account takeovers, credential stuffing, and other means. To the extent that we use third parties to provide services to our clients, we cannot control all of the risks at these third parties or third parties’ downstream service providers. Hardware, software, or applications developed by Key or received from third parties may contain exploitable vulnerabilities, bugs, or defects in design, maintenance or manufacture or other issues that could unpredictably compromise information and cybersecurity. We depend on third party service providers and their downstream service providers to implement adequate controls and safeguards to protect against and report cyber incidents. If such parties fail to deter, detect, or report cyber incidents in a timely manner, we may suffer from financial and other harm, including to our information, operations, performance, employees, and reputation. In addition, should an adverse event affecting another company’s systems occur, we may not have indemnification or other protection from the other company sufficient to fully compensate us or otherwise protect us or our clients from the consequences. To date, our losses and costs related to these breaches have not been material, but other similar events in the future could have a material impact on our business strategy, results of operations, or financial condition. 30 Table of contents In addition, our customers routinely use Key-issued credit and debit cards to pay for transactions conducted with businesses in person and over the internet. If the business’s systems that process or store debit or credit card information experience a security breach, our card holders may experience fraud on their card accounts. We may suffer losses associated with such fraudulent transactions, as well as for other costs, such as replacing impacted cards. Key also provides card transaction processing services to some merchant customers under agreements we have with payment networks such as Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a data breach. We also face risks related to the increasing interdependence and interconnectivity of financial entities and technology systems. A technology failure, cyberattack or other security breach that significantly compromises the systems of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us. Any third-party technology failure, cyberattack, or security breach could adversely affect our ability to effect transactions, service clients, or otherwise operate our business and could result in legal liability, remediation costs, regulatory action, or reputational harm. Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of automation, artificial intelligence and robotics, introduces new information security risks and exposure for us and for our third party service providers; such technologies could also result in increasingly sophisticated cyberattacks. Such security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware and SIM card swapping, and other methods. Our security systems, and those of the third-party service providers on which we rely, may not be able to protect our information systems or data from similar attacks due to the rapid evolution and creation of sophisticated cyberattacks. We are also subject to the risk that a malicious actor or our employees may intercept and/or transmit or otherwise misuse unauthorized personal, confidential, or proprietary information or intellectual property. An interception, misuse, or mishandling of personal, confidential, or proprietary information or intellectual property being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action, and reputational harm. We have incurred and will continue to incur significant expense in an effort to improve the reliability and resilience of our systems and their security against internal and external threats. Nonetheless, we cannot guarantee our measures will be effective or sufficient to prevent a cyber incident, and there remains the risk that one or more adverse events might occur. If one does occur, it could go undetected and persist for an extended period of time and/or we may be unable to remediate the event or its consequences timely or adequately. While we do maintain cyber information security and business interruption insurance, losses from a major interruption may exceed our coverage and there can be no assurance that liabilities or losses we may incur will be covered under such policies, that such insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. We rely on third parties to perform significant operational services for us. Third parties perform significant operational services on our behalf. Additionally, some of our third parties outsource aspects of their operations to downstream service providers. These parties are subject to similar risks as Key relating to cybersecurity and breakdowns or failures of their own systems, internal processes and controls, or employees. One or more of these third parties or their downstream service providers may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by such third party. Certain of these third parties may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a third party could also impair our operations if those difficulties interfere with such third party’s ability to serve us. Any unanticipated interruption, delay, or degradation in the performance and delivery of our services could negatively impact our customer relationships. Additionally, some of our outsourcing arrangements are located overseas and, therefore, are subject to risks unique to the regions in which they operate. If a critical third party is unable to meet our needs in a timely manner or if the services or products provided by such third party are terminated or otherwise delayed and if we are not able to identify or develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Additionally, regulatory guidance adopted by federal banking regulators related to how banks select, contract with, evaluate, engage with, and manage their third parties, including such third parties’ use of subcontractors, affects the 31 Table of contents circumstances and conditions under which we work with third parties and their subcontractors and the cost of managing such relationships. We are, and may in the future be, subject to claims, litigation, investigations, and governmental proceedings, which could result in significant financial liability and/or reputational harm. We are subject to, and may in the future be subject to, claims or legal actions taken against us by customers, vendors, shareholders, or other parties. Further, KeyCorp and certain of its directors and officers are currently named, and have in the past been named and may be named in the future, as defendants in various class actions and other litigation relating to our business and activities. We maintain reserves for certain claims when deemed appropriate based upon our assessment that a loss is probable, estimable, and consistent with applicable accounting guidance. At any given time, we have a variety of legal actions asserted against us in various stages of litigation. Resolution of a legal action can often take years. Whether any particular claims and legal actions are founded or unfounded, if such claims and legal actions are not resolved in our favor, they may result in significant financial liability and adversely affect how the market perceives us and our products and services as well as impact customer demand for those products and services. We are also involved, from time to time, in other information-gathering requests, reviews, investigations, and proceedings (both formal and informal) by governmental and self-regulatory agencies regarding our business, including, among other things, accounting, compliance, and operational matters, which may result in adverse judgments, settlements, fines, penalties, injunctions, or other relief which, if significant, could adversely affect our business, results of operations and/or financial condition. Enforcement authorities may also seek admissions of wrongdoing and, in some cases, criminal pleas as part of the resolutions of matters and any such resolution of a matter involving Key could lead to increased exposure to private litigation, could adversely affect Key’s reputation, and could result in limitations on our ability to do business in certain jurisdictions. Further, enforcement matters could impact our supervisory and CRA ratings, which may in turn restrict or limit our activities. In recent years, there has been an increase in the number of investigations and proceedings in the financial services industry. A violation of law or regulation by another financial institution may give rise to an inquiry or investigation by regulators or other authorities of the same or similar practices by Key. For example, on February 9, 2024, affiliates of Key entered into a settlement agreement with the SEC’s Division of Enforcement to resolve an investigation of the affiliates’ compliance with records preservation requirements related to business communications sent over off-channel electronic messaging platforms. The settlement resulted in payment of a $10 million penalty to the SEC along with other prospective relief. The SEC has conducted similar investigations of other financial institutions as part of a widely publicized industry sweep that has included publicly announced settlements with multiple firms. The outcome of regulatory matters as well as the timing of ultimate resolution are inherently difficult to predict, and the uncertain regulatory enforcement environment makes it difficult to estimate probable losses, which can lead to substantial disparities between legal reserves and actual settlements or penalties. Our controls and procedures may fail or be circumvented, and our methods of reducing risk exposure may not be effective. We regularly review and update our internal controls, disclosure controls and procedures, compliance monitoring activities, and corporate governance policies and procedures. We also maintain an ERM program designed to identify, measure, monitor, report, and analyze our risks. Additionally, our internal audit function provides an independent assessment and testing of Key’s internal controls, policies, and procedures. Any system of controls and any system to reduce risk exposure, however well designed, operated, and tested, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. The systems may not work as intended or be circumvented by employees, third parties, or others outside of Key. Additionally, instruments, systems, and strategies used to hedge or otherwise manage exposure to various types of market compliance, credit, liquidity, operational, and business risks and enterprise-wide risk could be less effective than anticipated. As a result, we may not be able to effectively or fully mitigate our risk exposures in particular market environments or against particular types of risk. Our operations and financial performance could be adversely affected by severe weather and natural disasters exacerbated by climate change. Natural disasters, including wildfires, tornadoes, severe storms, and hurricanes, have seemingly become more frequent and severe due to climate change. The timing and effects of these natural disasters are difficult to accurately predict, and the potential impact of such disasters on our operations, employees, and customers could 32 Table of contents have a material adverse effect on our business, financial position, and results of operations. Given our broad regional focus, we are exposed to a wide range of weather-related risk across different geographical areas. Severe weather events can directly affect our operations by interrupting systems, damaging facilities, disrupting our supply chain, and hindering our ability to conduct business as usual. Additionally, these events can indirectly impact us by damaging or destroying customer businesses, impairing their ability to repay loans, or causing damage to properties pledged as collateral for loans made by Key. Although preventative measures may help to mitigate damage, such measures could be costly, and any disaster could adversely affect our ability to conduct our business as usual. In addition, the insurance we maintain may not be adequate to cover our losses resulting from any business interruption resulting from a natural disaster or other severe weather events, and recurring extreme weather events could reduce the availability or increase the cost of insurance. Our failure to comply with evolving regulatory requirements related to natural disaster risk management may also result in legal and financial consequences. Societal and governmental responses to climate change could adversely affect Key’s business and performance, including indirectly through impacts on Key’s customers. Concerns over the long-term impacts of climate change have led and may continue to lead to governmental efforts around the world to mitigate those impacts. New and/or more stringent regulatory requirements could materially affect our results by requiring us to take costly measures to comply with any new laws or regulations related to climate change that may be adopted by federal, state, and local governments. Consumers and businesses also may change their own behavior as a result of these concerns. Key and its customers will need to respond to new laws and regulations, as well as consumer and business preferences resulting from climate change concerns. Key and its customers may face cost increases, asset value reductions, operating process changes, and the like. In addition, the multiple and potentially conflicting laws and regulations regarding climate change that have been or may be adopted by various jurisdictions could increase our cost of doing business and make compliance with such laws and regulations more difficult. The impact on Key’s customers will likely vary depending on their specific attributes, including reliance on or role in carbon intensive activities. Changes to regulations or market shifts to low-carbon products could impact the credit worthiness or the value of assets securing loans of some of our customers, which may require us to adjust our lending portfolios and business strategies. Key’s efforts to take these risks into account in making lending and other decisions, including by increasing business relationships with climate-friendly companies, may not be effective in protecting Key from the negative impact of new laws and regulations or changes in consumer or business behavior. The increased use of remote work infrastructure has expanded potential attack vectors and resulted in increased operational risks. The increase in remote work over the past several years has resulted in an expanded potential attack surface and heightened operational risks and may negatively impact our ability, and the ability of our third-party service providers (including their downstream service providers), to perform services efficiently, securely, and without interruptions. In addition to some of our workforce working remotely periodically or on a full-time basis, our third-party service providers (including their downstream service providers) may utilize personnel who work remotely. Increased levels of remote access create additional cybersecurity risk and opportunities for cybercriminals to exploit vulnerabilities. For example, cybercriminals have become increasingly sophisticated in their attempts to compromise business emails, including by targeting employees through an increase of phishing attempts and fraudulent calls, including through the use of artificial intelligence. These fraudulent activities have resulted in increased fraud losses to us and the financial services industry generally. In addition to enhanced cybersecurity risk, employees and other personnel performing services for us who work remotely may experience disruptions to their home internet or phone connections, decreased efficiency due to delayed network speeds or other interruptions, and/or delays in the dissemination and exchange of information, any of which could negatively impact our operations. We have experienced, and may continue to experience, disruption related to remote work, which disruptions could adversely impact our business, and could result in legal liability, regulatory penalties, litigation expenses, remediation costs, or reputational harm. IV. Liquidity Risk Capital and liquidity requirements imposed by banking regulations require banks and BHCs to maintain more and higher quality capital and more and higher quality liquid assets. Evolving capital standards resulting from the Dodd-Frank Act and the Regulatory Capital Rules adopted by our 33 Table of contents regulators have had and will continue to have a significant impact on banks and BHCs, including Key. For a detailed explanation of the capital and liquidity rules that apply to us, see the section titled “Regulatory capital requirements” under the heading “Supervision and Regulation” in Item 1 of this report. Regulatory capital standards require Key to maintain significant amounts of high-quality capital (e.g., common equity) and could limit our business activities (including lending) and our ability to expand organically or through acquisitions. They could also result in our taking steps to increase our capital that may be dilutive to shareholders or limit our ability to pay dividends or otherwise return capital to shareholders. In addition, regulatory liquidity standards require us to hold high-quality liquid assets, may require us to change our future mix of investment alternatives, and may impact future business relationships with certain customers. Additionally, support of liquidity standards may be satisfied through the use of term wholesale borrowings, which tend to have a higher cost than that of traditional core deposits. Further, the Federal Reserve has detailed the processes that BHCs should maintain to ensure they hold adequate capital under severely adverse conditions and have ready access to funding before engaging in any capital activities. These processes, the severity and other characteristics of which may evolve from year-to-year, are used by the Federal Reserve to, among other things, evaluate our management of capital and the adequacy of our regulatory capital and to determine the stress capital buffer that we must maintain above our minimum regulatory capital requirements. The results of these processes are difficult to predict due to, among other things, the Federal Reserve’s use of proprietary stress models that differ from our internal models and may result in the Federal Reserve imposing capital requirements in excess of our expectations which could require us, as applicable, to revise our stress-testing or capital management approaches, resubmit our capital plan or postpone, cancel, or alter our planned capital actions. The results may also lead to limits on Key’s ability to make distributions, including paying out dividends or buying back shares. In addition, certain regulatory rule changes related to tailoring outlined in the EGRRCPA were finalized in 2019. While marginal relief from certain capital and liquidity standards has been afforded to Key (such as relief from LCR disclosure requirements), overall capital and liquidity management practices and expectations will remain unchanged for the foreseeable future. Moreover, Key has not experienced significant changes to its overall liquidity and capital levels or composition as a result of these final rules. On July 27, 2023, the Federal Reserve, FDIC, and OCC issued a proposal to implement the Basel Committee’s “Basel III” regulatory capital framework and substantially revise the capital requirements applicable to large banking organizations (those with $100 billion or more in total assets such as Key) and to banking organizations with significant trading activity. For more information on the proposal, see the section titled “Regulatory capital requirements” under the heading “Supervision and Regulation” in Item 1 of this report. If implemented as proposed, the proposed rule would significantly increase capital requirements applicable to Key and many activities in which Key engages. Federal agencies’ actions to ensure stability of the U.S. financial system may have disruptive effects on us. The federal government, in recent years, has taken unprecedented steps to provide stability to and confidence in the financial markets. For example, in March 2020, the Federal Reserve initiated a round of emergency interest rate cuts designed to mitigate some of the economic effects resulting from the pandemic and subsequently began raising interest rates in March 2022 in an effort to combat inflation. These initiatives have impacted financial markets and our business and caused increased market and interest rate volatility, higher debt yields, an inverted slope to the yield curve, and unanticipated changes to quality spread premiums that may not follow historical relationships or patterns. In early 2023, a series of bank failures, including SVB and Signature, lead the U.S. Treasury Secretary, the FDIC, and the Federal Reserve to invoke the systemic risk exception to the least-cost resolution requirement under the FDIA to guarantee uninsured deposits of the failed banks. The systemic bank exception can only be invoked for financial market risks that pose a threat to financial stability. As discussed under the section entitled “FDIA, Resolution Authority and Financial Stability” in “Supervision and Regulation” in Item 1 of this report, the FDIC imposed a special assessment on IDIs to recover the loss to the DIF resulting from the use of the systemic risk exception to protect the uninsured depositors of SVB and Signature. The impact of the special assessment to Key is approximately $190 million, which was recognized in the fourth quarter of 2023 and impacted noninterest expense for that quarter. In addition, rating agencies reacted to the volatility caused by the bank failures by issuing updated 34 Table of contents ratings and assessments for numerous U.S. banks, including Key, as discussed below under “Our credit ratings affect our liquidity position.” Following these immediate responses, regulators have issued a number of NPRs and proposed guidance and promised to adopt further measures designed to strengthen capital and liquidity standards and restore confidence in the banking system applicable to Key including those discussed in “Regulatory capital requirements” under the heading “Supervision and Regulation” in Item 1 of this report. These final and proposed rules, if implemented, and any related proposal that may be put forward, including regarding liquidity, could have a material effect on our business, financial condition, and results of operations. Capital and long-term debt requirements require us to divert resources from otherwise profitable lending and investment opportunities to ensure compliance, which may be dilutive to shareholders or limit Key’s ability to buy back shares or issue dividends. Further as market conditions evolve and respond to the influence of these government agency initiatives, or lack thereof, the slope of the yield curve will shift and influence our loan and deposit rates and value of investments. The actions of federal agencies are not fully predictable which contributes to market volatility and changes to the slope of the yield curve. We rely on dividends by our subsidiaries for most of our funds. We are a legal entity separate and distinct from our subsidiaries. With the exception of cash that we may raise from debt and equity issuances, we receive substantially all of our funding from dividends by our subsidiaries. Dividends by our subsidiaries are the principal source of funds for the dividends we pay on our common and preferred stock and interest and principal payments on our debt. Federal banking law and regulations limit the amount of dividends that KeyBank (KeyCorp’s largest subsidiary) can pay. For further information on the regulatory restrictions on the payment of dividends by KeyBank, see “Supervision and Regulation” in Item 1 of this report. In the event KeyBank is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common or preferred stock. Such a situation could result in Key losing access to alternative wholesale funding sources. In addition, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. We are subject to liquidity risk, which could negatively affect our funding levels. Market conditions or other events could negatively affect our access to or the cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, or fund asset growth and new business initiatives at a reasonable cost, in a timely manner and without adverse consequences. Although we maintain a liquid asset portfolio and have implemented strategies to maintain sufficient and diverse sources of funding to accommodate planned as well as unanticipated changes in assets, liabilities, and off-balance sheet commitments under various economic conditions (including a reduced level of wholesale funding sources), a substantial, unexpected, or prolonged change in the level or cost of liquidity could have a material adverse effect on us. If the cost effectiveness or the availability of supply in these credit markets is reduced for a prolonged period of time, our funding needs may require us to access funding and manage liquidity by other means. These alternatives may include generating client deposits, securitizing or selling loans, extending the maturity of wholesale borrowings, borrowing under certain secured borrowing arrangements, using relationships developed with a variety of fixed income investors, and further managing loan growth and investment opportunities. These alternative means of funding may result in an increase to the overall cost of funds and may not be available under stressed conditions, which would cause us to liquidate a portion of our liquid asset portfolio to meet any funding needs. Our credit ratings affect our liquidity position. The rating agencies regularly evaluate the securities issued by KeyCorp and KeyBank. The ratings of our long-term debt and other securities are based on a number of factors, including our financial strength, ability to generate earnings, and other factors. Some of these factors are not entirely within our control, such as conditions affecting the financial services industry and the economy and changes in rating methodologies. Changes in any of these factors could impact our ability to maintain our current credit ratings. For instance, in 2023, rating agencies reacted to the volatility in the banking industry by issuing updated ratings and assessments for numerous U.S. banks, including Key. Among the rating agencies, Moody's, Standard & Poor's, and Fitch Ratings, Inc. each downgraded KeyCorp's and KeyBank's long-term debt ratings. The rationales for the downgrades, which are documented in the 35 Table of contents agencies’ respective credit opinions and analyses, included a challenging environment for the entire banking industry along with other company-specific factors. We may be unable to maintain our current ratings and our ratings may be downgraded again in the future. The impact of the recent downgrades to KeyCorp's or KeyBank's credit ratings, or further downgrades, could adversely affect our access to liquidity and could significantly increase our cost of funds, trigger additional collateral or funding requirements, and decrease the number of investors and counterparties willing to lend to us, reducing our ability to generate income. If future reductions placed on KeyCorp’s or KeyBank's credit ratings result in below-investment grade ratings, it could also create obligations or liabilities under the terms of existing arrangements that could increase our costs under such arrangements. V. Market Risk A worsening of the U.S. economy and volatile or recessionary conditions in the U.S. or abroad could negatively affect our business or our access to capital markets. A worsening of economic and market conditions or downside shocks could result in adverse effects on Key and others in the financial services industry. Recent and persistent interest rate increases and a slowing economy have presented a challenge for the industry, including Key, and affected business and financial performance. In particular, we face the following risks, and other unforeseeable risks, in connection with a downturn in the economic and market environment or in the face of downside shocks or a recession, whether in the United States or internationally: • A loss of confidence in the financial services industry and the debt and equity markets by investors, placing pressure on the price of Key’s common shares, decreasing the credit or liquidity available to Key, or leading to an increase in depositors withdrawing funds; • A decrease in consumer and business confidence levels generally, decreasing credit usage and investment or increasing delinquencies and defaults; • A decrease in household or corporate incomes, reducing demand for Key’s products and services; • A decrease in the value of collateral securing loans to Key’s borrowers or a decrease in the quality of Key’s loan portfolio, increasing loan charge-offs and reducing Key’s net income; • A decrease in our ability to liquidate positions at acceptable market prices; • An increase in competition or consolidation in the financial services industry; • Increased concern over and scrutiny of the capital and liquidity levels of financial institutions generally, and those of our transaction counterparties specifically; • A decrease in confidence in the creditworthiness of the United States or other issuers whose securities we hold; and • An increase in limitations on or the regulation of financial services companies like Key. In the event of severely adverse business and economic conditions generally or specifically in the principal markets in which we conduct business, there can be no assurance that the federal government and the Federal Reserve would intervene or make adjustments to fiscal or monetary policy that would cause business and economic conditions to improve. A worsening of business and economic conditions or market volatility related thereto could have a material adverse effect on our business, financial condition, and results of operations. In addition, volatility and uncertainty related to inflation and the effects of inflation, which has recently led to increased costs for businesses and consumers and caused the Federal Reserve to initiate a series of interest rate increases, may enhance or contribute to some of the risks of our business by adversely affecting the creditworthiness of our borrowers, increasing our costs, or resulting in lower values for our investment securities and other fixed-rate assets. To the extent that the Federal Reserve’s policies around managing inflation do not mitigate the volatility and uncertainty related to inflation and the effects of inflation, or to the extent conditions otherwise worsen, we could experience adverse effects on our business, financial condition, and results of operations. We are subject to interest rate risk, which could adversely affect net interest income. Our earnings are largely dependent upon our net interest income. Net interest income is the difference between interest income earned on interest-earning assets such as loans and securities and interest expense paid on interest-bearing liabilities such as deposits and borrowed funds. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions, the competitive environment within our markets, consumer preferences for specific loan and deposit products, and policies of various governmental and regulatory 36 Table of contents agencies, in particular, the Federal Reserve. Our ability to anticipate changes in these factors or to hedge the related on-and off-balance sheet exposures, and the cost of any such hedging activity, can significantly influence the success of our asset-and-liability management activities and the resulting level of our net interest income and net interest margin. Changes in monetary policy, including changes in interest rate controls being applied by the Federal Reserve, could influence the amount of interest we receive on loans and securities, the amount of interest we pay on deposits and borrowings, our ability to originate loans and obtain deposits, and the fair value of our financial assets and liabilities. When the Federal Reserve raises or reduces interest rates, the behavior of national money market rate indices, the correlation of consumer deposit rates to financial market interest rates, and the setting of benchmark rates may not follow historical relationships, which could influence net interest income and net interest margin. In addition, our ability to change deposit rates in response to changes in interest rates and other market and related factors is limited by client relationship considerations. Moreover, if the interest we pay on deposits and other borrowings increases at a faster rate than the interest we receive on loans and other investments, net interest income, and therefore our earnings, would be adversely affected. Conversely, earnings could also be adversely affected if the interest we receive on loans and other investments falls more quickly than the interest we pay on deposits and other borrowings. The impact of interest rates on our investment portfolio and consolidated financial results, including AOCI, can also affect our ability to maintain our capital ratios within our target ranges as well as the amount and timing of our future share repurchases and dividends. For additional information about the effects on interest rates on our business, refer to the information included under the caption “Risk Management — Market risk management” in Item 7 of this report. Our profitability depends upon economic conditions in the geographic regions where we have significant operations and in certain market segments in which we conduct significant business. We have concentrations of loans and other business activities in geographic regions where our bank branches are located — Washington; Oregon/Alaska; Rocky Mountains; Indiana/Northwest Ohio/Michigan; Central/Southwest Ohio; East Ohio/Western Pennsylvania; Atlantic; Western New York; Eastern New York; and New England — and additional exposure to geographic regions outside of our branch footprint. Economic growth in the various regions where we operate has been uneven, and the health of the overall U.S. economy may differ from the economy of any particular geographic region. Adverse conditions in a geographic region such as inflation, unemployment, recession, natural disasters, impact of public health crises, or other factors beyond our control could impact the ability of borrowers in these regions to repay their loans, decrease the value of collateral securing loans made in these regions, or affect the ability of our customers in these regions to continue conducting business with us. Additionally, a significant portion of our business activities are concentrated within the commercial real estate, healthcare, finance, and utilities market segments. The profitability of some of these market segments depends upon the health of the overall economy, seasonality, the impact of regulation, and other factors that are beyond our control and may be beyond the control of our customers in these market segments. An economic downturn or recession in one or more geographic regions where we conduct our business, or any significant or prolonged impact on the profitability of one or more of the market segments with which we conduct significant business activity, could adversely affect the demand for our products and services, the ability of our customers to repay loans, the value of the collateral securing loans, and the stability of our deposit funding sources. The soundness of other financial institutions could adversely affect us. Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. We have exposure to many different industries and counterparties in the financial services industries, and we routinely execute transactions with such counterparties, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds, insurance companies, and other institutional clients. Financial services institutions are interrelated as a result of trading, clearing, counterparty, or other relationships. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to, and may further lead to, market-wide liquidity problems and could lead to losses or defaults by us or other financial institutions. This phenomenon was evident following the bank failures in early 2023, as financial institutions, like us, were impacted by concerns regarding the soundness or creditworthiness of other financial institutions. Those events caused substantial and cascading 37 Table of contents disruption within the financial markets and adversely impacted the market price and volatility of our common stock. In addition, many of our transactions with other financial institutions expose us to credit risk in the event of default of a counterparty or client. Our credit risk may be affected when the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of our loan or derivatives exposure. There can be no assurance that any such losses would not adversely and materially affect our results of operations. Depressed market values for our common stock and adverse economic conditions sustained over a period of time may require us to write down all or some portion of our goodwill. As of December 31, 2023, the book value of our goodwill was $2.8 billion. Goodwill is periodically tested for impairment by comparing the fair value of each reporting unit to its carrying amount. If the fair value is greater than the carrying amount, then the reporting unit’s goodwill is deemed not to be impaired. The fair value of a reporting unit is impacted by the reporting unit’s expected financial performance and susceptibility to adverse economic, regulatory, and legislative changes. A significant decline in a reporting unit’s expected future cash flows, a significant adverse change in the business climate, slower economic growth or a significant and sustained decline in the price of our common stock may cause the fair value of a reporting unit to be below its carrying amount, resulting in goodwill impairment. If an impairment loss is recorded, it will have little or no impact on the tangible book value of our common stock, or on our regulatory capital levels, but such an impairment loss could significantly reduce our earnings. See the “Critical Accounting Policies” section of Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations in this report for additional information. VI. Reputation Risk Damage to our reputation could significantly impact our business and major stakeholders. Our ability to attract and retain customers, clients, investors, and highly skilled management and employees is affected by our reputation. Damage to our reputation could also adversely impact our credit ratings and access to capital markets. Significant harm to our reputation can arise from various sources, including inappropriate behavior or misconduct of employees, actual or perceived unethical behavior, litigation or regulatory outcomes, inadequate or ineffective risk management practices, failing to deliver minimum or required standards of service and quality, corporate governance and regulatory compliance failures, disclosure of confidential information, significant or numerous failures, interruptions or breaches of our information systems, failure to meet external commitments and goals, including financial and ESG-related commitments, the activities of our clients, customers and counterparties, including vendors, and actions taken by shareholder activists and community organizations. Additionally, actions by the financial services industry generally or by certain members or individuals in the industry as well as legislative or regulatory actions that target or negatively impact the industry may also have a significant adverse effect on our reputation. Negative coverage about Key published in traditional media or on social media websites, whether or not factually correct, may affect our reputation and our business prospects and impact our ability to attract and retain highly skilled employees. Social media facilitates the rapid dissemination of information or misinformation, thereby increasing the potential for rapid and widespread dissemination of inaccurate, false, misleading, or other negative information that could damage our reputation. Negative public opinion can also adversely affect our ability to attract and maintain customer relationships and could subject us to litigation and regulatory action. We are also subject to the risk that disruptions to how our customers access our banking services, such as disruptions to our technology platforms (e.g., online banking websites or mobile applications) or other impacts to our branches, could harm our reputation with customers. In particular, a cybersecurity event impacting Key or our customers’ data or personal information could negatively impact our reputation and customer confidence in Key and our data security procedures. We could also suffer significant reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interests is complex as we expand our business activities through more numerous transactions, obligations, and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to deal with us, which could adversely affect our businesses, and could give rise to litigation or enforcement actions. 38 Table of contents Key is subject to environmental, social, and governance (ESG) risks that could adversely affect our reputation, the trading price of our common stock and/or our business and results of operations. Views about ESG-related issues are diverse, dynamic, and rapidly changing. Financial services companies, including Key, face increasing criticism from social and environmental activists who target companies, including Key, for engaging in business with clients engaged in industries such activists perceive to be harmful to communities or the environment. Such criticism directed at Key could generate dissatisfaction among our stakeholders. Additionally, however we respond to such criticism, we face the risk that current or potential clients may decline to do business with us or current or potential employees refuse to work with us. This can be true regardless of whether we are perceived by some as not having done enough to address activist concerns or by others as having inappropriately yielded to activist pressures. Conversely, certain states have taken, and may in the future take, actions or proposed measures to limit the state’s ability to do business with financial institutions or other businesses identified as discriminating against certain industries or practices based on environmental or social criteria. We could be inherently exposed to reputational, financial, and legal risk, and our ability to retain and attract customers and employees may be negatively impacted as a result of these contrasting arguments in how a financial institution should address these issues. Companies are facing increasing scrutiny from customers, regulators, investors, and other stakeholders related to their ESG practices and disclosures. We may face criticism or a loss of confidence, with accompanying reputational risk, from our perceived action or inaction to deliver on our ESG-related commitments. Investors and other stakeholders, including U.S. institutional investors, are increasingly considering how corporations are incorporating ESG matters, including climate change, into their business strategy when analyzing the expected risk and return of potential investments. The specific ESG factors considered, as well as the approach to incorporating the factors into a broader investment process, vary by investor and can shift over time. These shifts in investing priorities may result in adverse effects on the trading price of KeyCorp’s common stock if investors determine that Key has not made sufficient progress on ESG matters or is not aligned with the investors’ ESG-related priorities. In addition, collecting, measuring, and reporting ESG information and metrics can be costly, difficult and time consuming, is subject to evolving reporting standards, and can present numerous operational, reputational, financial, legal and other risks, any of which could have a material impact on Key, including on Key’s reputation. Further, inadequate processes to collect and review this information prior to disclosure could result in potential liability related to such information. VII. Strategic Risk We may not realize the expected benefits of our strategic initiatives. Our ability to compete depends on a number of factors, including, among others, our ability to develop and successfully execute our strategic plans and initiatives. Our strategic priorities include growing profitability; acquiring and expanding targeted client relationships; effectively managing risk and rewards; maintaining financial strength; and engaging, retaining, and inspiring our diverse and high-performing workforce. The success of these initiatives can be subject to changes in the macroeconomic environment that are beyond our control. In addition, our inability to execute on or achieve the anticipated outcomes of our strategic priorities, or to do so in the expected timeframe, may affect how the market perceives us and could impede our growth and profitability. We operate in a highly competitive industry. We face substantial competition in all areas of our operations from a variety of competitors, some of which are larger and may have more financial resources than us. Our competitors primarily include national and super-regional banks as well as smaller community banks within the various geographic regions in which we operate. We also face competition from many other types of financial institutions, including, without limitation, savings associations, credit unions, mortgage banking companies, finance companies, mutual funds, insurance companies, investment management firms, investment banking firms, broker-dealers and other local, regional, national, and global financial services firms. In addition, technology has lowered barriers to entry and made it possible for nonbanks, including large technology companies, to offer products and services traditionally provided by banks. We expect the competitive landscape of the financial services industry to become even more intense as a result of legislative, regulatory, structural, customer preference, and technological changes. Our ability to compete successfully depends on a number of factors, including: our ability to develop and execute strategic plans and initiatives; our ability to develop, maintain, and build long-term customer relationships based on quality service and competitive prices; our ability to develop competitive products and technologies demanded by 39 Table of contents our customers, while maintaining our high ethical standards and an effective compliance program and keeping our assets safe and sound; our ability to attract, retain, and develop a highly competent employee workforce; and industry and general economic trends. Increased competition in the financial services industry, or our failure to perform in any of these areas, could significantly weaken our competitive position, which could adversely affect our growth and profitability. Strategic risk may also be realized due to events or issues that materialize in other risk factor areas. For example, significant deficiencies in end-to-end operational execution and/or product delivery or failure to comply with applicable laws and regulations may result in unmet client expectations or harm and impact our competitive standing in the industry. Maintaining or increasing our market share depends upon our ability to adapt our products and services to evolving industry standards and consumer preferences, while maintaining competitive products and services. The continuous, widespread adoption of new technologies requires us to evaluate our product and service offerings to ensure they remain competitive. Our success depends, in part, on our ability to adapt our products and services, as well as our distribution of them, to evolving industry standards and consumer preferences. New technologies have altered consumer behavior by allowing consumers to complete transactions such as paying bills or transferring funds directly without the assistance of banks. New products allow consumers to maintain funds in brokerage accounts or mutual funds that would have historically been held as bank deposits. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer loans and deposits and related income generated from those products. The increasing pressure from our competitors, both bank and nonbank, to keep pace and adopt new technologies and products and services requires us to incur substantial expense. We may be unsuccessful in developing or introducing new products and services, modifying our existing products and services, adapting to changing consumer preferences and spending and saving habits, achieving market acceptance or regulatory approval, sufficiently developing or maintaining a loyal customer base, or offering products and services at prices equal to or lower than the prices offered by our competitors. These risks may affect our ability to achieve growth in our market share and could reduce both our revenue streams from certain products and services and our revenues from our net interest income. We may not be able to attract and retain skilled people. Our success depends on our ability to attract, retain, motivate, and develop a talented and diverse workforce. Competition for talent in our business is strong and requires us to make investments to provide compensation and benefits at market levels. Rising wages, as well as inflation, may cause us to increase these investments. Such investments cause compensation and benefits to represent our greatest expense. Additionally, we increasingly compete for talent outside of the core financial services industry. Non-financial institutions may be subject to different pay and hiring expectations than us, which may make it more difficult for us to attract qualified teammates. For example, we are required to deliver a substantial portion of the variable compensation of certain teammates in the form of awards tied to our financial performance. The decline in our share price we experienced in 2023 could impact our ability to retain those individuals. Similarly, our pay practices are subject to scrutiny by our regulators who may identify deficiencies in the structure of, or issue additional guidance on our compensation practices, causing us to make changes that may affect our ability to offer competitive pay to these individuals or that place us at a disadvantage to non-financial service industry competitors. Finally, while remote work opportunities allow us to hire outside of our traditional footprint, it also increases competition. These factors individually, or collectively, may constrain our ability to hire or retain a sufficient number of qualified employees, which could impact our ability to serve our customers and clients. Acquisitions or strategic partnerships may disrupt our business and dilute shareholder value. Acquiring other banks, bank branches, or other businesses involves various risks commonly associated with acquisitions or partnerships, including exposure to unknown or contingent liabilities of the acquired company; diversion of our management’s time and attention; significant integration risk with respect to employees, accounting 40 Table of contents systems, and technology platforms; increased regulatory scrutiny; and the possible loss of key employees and customers of the acquired company. We regularly evaluate merger and acquisition and strategic partnership opportunities and conduct due diligence activities related to possible transactions. As a result, mergers or acquisitions involving cash, debt or equity securities may occur at any time. Acquisitions may involve the payment of a premium over book and market values. Therefore, some dilution of our tangible book value and net income per common share could occur in connection with any future transaction. VIII. Model Risk We rely on quantitative models to manage certain accounting, risk management, capital planning, and treasury functions. We use quantitative models to help provide value input into the management of certain aspects of our business and to assist with certain business decisions, including, but not limited to, estimating CECL, measuring the fair value of financial instruments when reliable market prices are unavailable, estimating the effects of changing interest rates and other market measures on our financial condition and results of operations, managing risk, and for capital planning purposes (including during the capital stress testing process). Models are simplified representations of real-world relationships. Thus, our modeling methodologies rely on many assumptions, historical analyses, correlations, and available data. These assumptions provide only reasonable, not absolute, estimates, particularly in times of market distress when historical correlations on which we rely may no longer be relevant. Additionally, as businesses and markets evolve, our measurements may not accurately reflect this evolution. Models can also produce inadequate estimates due to errors in computer code, use of unsuitable data during development or input into the model during model use, or the use of a model for a purpose outside the scope of the model’s design. If our models fail to produce reliable results on an ongoing basis, we may not make appropriate risk management, capital planning, or other business or financial decisions. Furthermore, strategies that we employ to manage and govern the risks associated with our use of models may not be effective or fully reliable, and as a result, we may realize losses or other lapses. We have an enterprise-wide model risk management program designed to accurately identify, measure, report, monitor, and manage model risk. The management of model risk includes independent validation and model governance, establishing and monitoring model control standards and model risk metrics, and completeness and accuracy of the inventory of models. Banking regulators continue to focus on the models used by banks and bank holding companies in their businesses. The failure or inadequacy of a model may result in increased regulatory scrutiny on us or may result in an enforcement action or proceeding against us by one of our regulators. 41 Table of contents ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITY Cybersecurity Risk Management As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see “Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption” in Item 1A. Risk Factors of this report. Key maintains an Information Security Program (the “IS Program”) to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key’s clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of Key’s information assets. Our Chief Information Security Officer (“CISO”), who is also the Enterprise Security Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key’s Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources. The IS Program is designed to provide safeguards for Key’s assets through a series of administrative, technical, and physical controls. Key employs a variety of security practices and controls to protect information and assets, including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated security personnel. As described in more detail in “Risk Management — Overview” in Item 7 of this report and in “Cybersecurity Governance” below, Key employs the “Three Lines of Defense” in its risk governance framework. Assessing, identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key’s internal audit function (Third Line of Defense): • First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key’s lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure. • Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key’s customers, employees, and other individuals from who Key collects personally identifiable information. • Third Line of Defense – Risk Review Group. The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key’s LOBs, operations, information systems, and technologies. These internal audits provide an independent 42 Table of contents perspective on Key’s processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key’s Operational and Compliance Risk Management Groups, the Board’s Audit Committee, and banking regulators. As part of its cybersecurity risk management strategy, Key regularly reviews its security and privacy controls in the context of industry standard practices, frameworks, evolving laws, and changing client expectations. Key engages external providers periodically to perform a maturity assessment of the IS Program against industry cybersecurity frameworks. Key also engages external advisors periodically to perform security posture assessments of our environment to proactively identify weakness within our security policy and/or configurations. Summary level results from these assessments are shared to internal stakeholders through Key’s Risk Governance committee structure. Key is also subject to cybersecurity and privacy regulatory exams, as required by law for financial institutions. Key has implemented cybersecurity, privacy, and fraud education and awareness programs across the enterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees and contractors with access to assets or data owned or maintained by Key receive mandatory enterprise-wide cybersecurity, privacy, and fraud training on an annual basis. With respect to third party service providers, Key maintains a third party management program that is designed to identify, review, monitor, escalate, and, if necessary, remediate third party information security risks. Key’s third party onboarding process includes risk-based due diligence and security-relevant contract language. Risk-based due diligence can also include an assessment of the strength of certain control areas, including, but not limited to, information security management, physical security, network security, platform security, application security, cloud security, encryption management, business resiliency, and privacy. Once a business relationship is established with a service provider, Key performs risk-based periodic reviews of the third party service provider's security programs. In addition to an established governance approval process for new engagements, Key has established a Third Party Management Committee to oversee compliance with Key’s Third Party Management Policy and Program. Cybersecurity Governance As described in more detail in “Risk Management — Overview” in Item 7 of this report, the Board serves in an oversight capacity to ensure that Key’s risks, including risk from cybersecurity threats, are managed in a manner that is effective and balanced and adds value for our shareholders. The Board’s Risk Committee exercises primary oversight over enterprise-wide risk at Key, including operational risk, which includes cybersecurity risk, and provides oversight of management’s activities related to cybersecurity risk. The Board’s Audit Committee monitors and exercises oversight over cybersecurity risk as part of its joint oversight of operational risk with the Risk Committee. The Board’s Technology Committee provides additional oversight of management’s activities related to Key’s technology strategic investment plan, cybersecurity investments, and major technology vendor relationships and is expected to escalate to the Risk Committee on certain risk management issues. Key’s CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 29 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems. The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2023). The CISO’s update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key’s compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key’s Deputy CISO, also report annually to the Technology Committee to obtain approval on Key’s Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time. Key’s Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity & Access Management Operations, Information Security Governance, and Security Architecture and Engineering. The Deputy CISO has over 16 years of cybersecurity and technology risk management experience across financial 43 Table of contents services and retail, previously served as the Head of Information Security Governance within KeyCorp’s Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp’s Risk Management group. He holds a bachelor’s degree in Finance and Management Information Systems and an MBA. The CISO reports to Key’s Chief Information Officer who oversees all of Key’s shared services for technology, operations, data, servicing, cyber and physical security, and corporate real estate solutions. Our Chief Information Officer, who has served in the role since 2012, has extensive experience overseeing technology and operations delivery for critical enterprise functions and has held various leadership roles during her over 30-year career in the financial services industry. At the management level, our Enterprise Risk Management (ERM) Committee, chaired by the Chief Executive Officer and comprising other senior level executives, including the Chief Information Officer, reports to the Board’s Risk Committee and is responsible for managing risk, including cybersecurity risk. The ERM Committee serves as a senior level forum for review and discussion of material operational risk issues, including cybersecurity risk, and receives regular updates from the CISO regarding cybersecurity risk. The ERM Committee directly oversees the Operational Risk Committee, which provides governance, direction, oversight, and high-level management of operational risk, including cybersecurity risk, and includes senior management representation from the LOB and support areas. The CISO is a voting member of the Operational Risk Committee. The Operational Risk Committee also includes subcommittees which, among other things, address security issues and concerns, pursue security-related program enhancements, address fraud trends, provide input on fraud strategy, weigh the impacts of fraud risk on customers, business clients, and the LOB, and cascades awareness of fraud risks across Key. Key also has a Privacy Team led by a Chief Privacy Officer (CPO) who has over ten years of experience in legal, compliance, and risk roles at financial institutions, focusing primarily on data protection and privacy. Our CPO holds an undergraduate degree in finance, a master’s degree in business administration, and a juris doctorate. He is licensed to practice law in the state of Ohio and has obtained the CIPP/US certification through the International Association of Privacy Professionals. The CPO and Privacy team have the authority to escalate privacy risks to the Board. The Privacy and Information Security teams work together to implement controls around how personally identifiable information is managed and protected and to comply with applicable laws and regulations. Cybersecurity Incidents When a cybersecurity incident is identified, we follow established processes in our enterprise privacy and cyber incident response plans, which are a supplement to our corporate incident response plan. These plans provide a framework to enable the appropriate personnel to recover operations in the event of a cyberattack and manage incidents impacting banking information, including our clients’ and employees’ information. Our Core Incident Response Rapid Emergency Assessment and Coordination Team (Core IR REACT) is responsible for responding to incidents, including cyberattacks, performing a preliminary assessment, and engaging additional support team members as necessary. The Core IR REACT team is a multidisciplinary team that is empowered to escalate issues, as appropriate, to our Crisis Management Team (CMT), which includes the CEO and senior executives from Key’s LOB and major support areas. The CMT provides overall strategic direction for incident responses and recovery. Incidents are also reported internally to key stakeholders through Key’s risk governance committee structure. As discussed above in “Cybersecurity Risk Management,” the RRG shares the results of its independent internal audits of security activities at Key and the effectiveness of the IS Program with the line of business management, Key’s Operational and Compliance Risk Management Groups, the Board’s Audit Committee, and banking regulators. Any identified gaps are risk rated, issued a due date for remediation, and tracked through completion of remediation. Remediation is then verified by the RRG. 44 Table of contents ITEM 2. PROPERTIES The headquarters of KeyCorp and KeyBank are located at 127 Public Square, Cleveland, Ohio 44114-1306 in the Key Center. At December 31, 2023, Key leased approximately 375,414 square feet of the complex, encompassing the first floor branch, the 2nd, 3rd and 5th through 9th office floors, the 12th floor, and the 54th through 56th floors of the 57-story Key Center. In addition, Key owned two buildings in Brooklyn, Ohio, with office space that it operated from and totaling 584,930 square feet at December 31, 2023. Our office space is used by all of our segments. As of the same date, KeyBank owned 415 branches and leased 544 branches. The lease terms for applicable branches are not individually material, with terms ranging from month-to-month to 99 years from inception. ITEM 3. LEGAL PROCEEDINGS The information presented in the Legal Proceedings section of Note 22 (“Commitments, Contingent Liabilities, and Guarantees”) of the Notes to Consolidated Financial Statements is incorporated herein by reference. On at least a quarterly basis, we assess our liabilities and contingencies in connection with outstanding legal proceedings utilizing the latest information available. Where it is probable that we will incur a loss and the amount of the loss can be reasonably estimated, we record a liability in our consolidated financial statements. These legal reserves may be increased or decreased to reflect any relevant developments on a quarterly basis. Where a loss is not probable or the amount of the loss is not estimable, we have not accrued legal reserves, consistent with applicable accounting guidance. Based on information currently available to us, advice of counsel, and available insurance coverage, we believe that our established reserves are adequate and any liabilities that may arise from outstanding legal proceedings will not have a material adverse effect on our consolidated financial condition. We note, however, that in light of the inherent uncertainty in legal proceedings there can be no assurance that the ultimate resolution will not exceed established reserves. As a result, the outcome of a particular matter or a combination of matters may be material to our results of operations for a particular period, depending upon the size of the loss or our income for that particular period. ITEM 4. MINE SAFETY DISCLOSURES Not applicable. 45 Table of contents PART II ITEM 5. MARKET FOR THE REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES The following disclosures included in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations are incorporated herein by reference: Page(s) Discussion of dividends in the section captioned “Capital — Dividends” 68 Discussion of our common shares, shareholder information, and repurchase activities in the section captioned “Capital — Common Shares outstanding” 68 The following graph compares the price performance of our Common Shares (based on an initial investment of $100 on December 31, 2018, and assuming reinvestment of dividends) with that of the S&P 500 Index and a group of other banks that constitute our peer group. The peer group consists of the banks that make up the S&P 500 Regional Bank Index and the banks that make up the Standard & Poor’s 500 Diversified Bank Index. We are included in the S&P 500 Index and the peer group. Share price performance is not necessarily indicative of future price performance. From time to time, KeyCorp or its principal subsidiary, KeyBank, may seek to retire, repurchase, or exchange outstanding debt of KeyCorp or KeyBank, and capital securities or preferred stock of KeyCorp, through cash purchase, privately negotiated transactions, or otherwise. Such transactions, if any, depend on prevailing market conditions, our liquidity and capital requirements, contractual restrictions, and other factors. The amounts involved may be material. In July 2021, the Board of Directors authorized the repurchase of up to $1.5 billion of our Common Shares, effective the third quarter of 2021 through the third quarter of 2022. In September 2022, the Board of Directors approved the extension of the previous authorization through the third quarter of 2023. This authorization expired as of September 30, 2023. During the fourth quarter of 2023, Key repurchased less than $1 million of shares related to equity compensation programs. The following table summarizes our repurchases of our Common Shares for the three months ended December 31, 2023. Calendar month Total number of shares repurchased (a) Average price paid per share Total number of shares purchased as part of publicly announced plans or programs Dollar value of shares that may yet be purchased as part of publicly announced plans or programs (b) October 1 - 31 — $ — — $ — November 1 - 30 — — — — December 1 -31 1,744 13.73 — — Total 1,744 $ 13.73 — (a) Includes Common Shares deemed surrendered by employees in connection with our stock compensation and benefit plans to satisfy tax obligations. We did not complete any open market share repurchases in the fourth quarter of 2023. (b) Our previous share purchase authorization expired as of September 30, 2023 46 Table of contents ITEM 6. [RESERVED] ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS Page Number Introduction 48 Long-term financial targets 49 Corporate strategy 50 Strategic developments 50 Results of Operations 51 Earnings overview 51 Net interest income 51 Provision for credit losses 54 Noninterest income 54 Noninterest expense 56 Income taxes 58 Business Segment Results 58 Consumer Bank 58 Commercial Bank 59 Financial Condition 61 Loans and loans held for sale 61 Securities 67 Deposits and other sources of funds 70 Capital 71 Off-Balance Sheet Arrangements and Aggregate Contractual Obligations 73 Off-balance sheet arrangements 73 Guarantees 74 Risk Management 74 Overview 74 Market risk management 76 Liquidity risk management 82 Credit risk management 85 Operational and compliance risk management 88 GAAP to Non-GAAP Reconciliations 89 Critical Accounting Policies and Estimates 90 Allowance for loan and lease losses 91 Valuation methodologies 92 Derivatives and hedging 94 Contingent liabilities, guarantees and income taxes 94 Accounting and reporting developments 95 47 Table of contents Introduction This section reviews the financial condition and results of operations of KeyCorp and its subsidiaries for 2023 and 2022. Some tables may include additional periods to comply with disclosure requirements or to illustrate trends in greater depth. When you read this discussion, you should also refer to the consolidated financial statements and related notes in this report. The page locations of specific sections and notes that we refer to are presented in the Table of Contents. To review our financial condition and results of operations for 2021 and a comparison between the 2021 and 2022 results, see Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of our 2022 Form 10-K filed with the SEC on February 22, 2023, which discussion is incorporated herein by reference. 48 Table of contents Long-term financial targets (a) See the section entitled “GAAP to non-GAAP Reconciliations,” which presents the computations of certain financial measures related to “cash efficiency.” The section includes tables that reconcile the GAAP performance measures to the corresponding non-GAAP measures, which provides a basis for period-to-period comparisons. (a) See the section entitled “GAAP to non-GAAP Reconciliations,” which presents the computations of certain financial measures related to “tangible common equity.” The section includes tables that reconcile the GAAP performance measures to the corresponding non-GAAP measures, which provides a basis for period-to-period comparisons. Positive Operating Leverage Generate positive operating leverage and a cash e fficiency ratio in the range of 54.0% to 56.0% . For the 2023 fiscal year, our cash efficiency ratio and operating leverage were affected by an increase in noninterest expense and a decrease in revenues. Noninterest expense increased 7% from prior year including the impact of the FDIC special assessment as well as efficiency-related charges as we focused on expense management, including simplifying and streamlining our businesses. Net interest income decreased 13% from prior year reflecting higher interest-bearing deposit costs and a shift in funding mix to higher cost deposits and borrowings. Positive operating leverage remains one of our long-term financial targets. Moderate Risk Profile Maintain a moderate risk profile by targeting a net loan charge-offs to average loans ratio in the range of .40% to .60% throug h a credit cycle. Our net charge-offs to average loans ratio remains near historically low levels and continues to reflect our proven underwrite-to-distribute model. We believe our strong risk management practices will allow us to continue supporting our clients, while maintaining our moderate risk profile, and will position Key to perform well through all business cycles. Financial Return A retur n on average tangible common equity in the range of 16.0% to 19.0%. Our full-year dividend for 2023 was $.82. Our proactive balance sheet optimization efforts drove the increase in our CET1 ratio and improved our liquidity and funding profile. We believe that these proactive efforts will better position Key to deliver sound, profitable growth and value for all of our stakeholders. 49 Table of contents Corporate strategy We remain committed to enhancing long-term shareholder value by continuing to execute our relationship-based business model, growing our franchise, and being disciplined with respect to capital management. We intend to pursue this commitment by growing profitably; acquiring and expanding targeted client relationships; effectively managing risk and rewards; maintaining financial strength; and engaging, retaining, and inspiring our diverse and high-performing workforce. These strategic priorities for enhancing long-term shareholder value are described in more detail below. • Grow profitably — We intend to continue to focus on generating positive operating leverage by growing revenue and creating a more efficient operating environment. We expect our relationship business model to keep generating organic growth as it helps us expand engagement with existing clients and attract new customers. We plan to leverage our continuous improvement culture to maintain an efficient cost structure that is aligned, sustainable, and consistent with the current operating environment and that supports our relationship business model. • Acquire and expand targeted client relationships — We seek to be client-centric in our actions and have taken purposeful steps to enhance our ability to acquire and expand targeted relationships. We seek to provide solutions to serve our clients' needs. We focus on markets and clients where we can be the most relevant. In aligning our businesses and investments against these targeted client segments, we are able to make a meaningful impact for our clients. • Effectively manage risk and rewards — Our risk management activities are focused on ensuring we properly identify, measure, and manage risks across the entire company to maintain safety and soundness and maximize profitability. • Maintain financial strength — With the foundation of a strong balance sheet, we intend to remain focused on sustaining strong reserves, liquidity, and capital. We plan to work closely with our Board and regulators to manage capital to support our clients’ needs and drive long-term shareholder value. Our capital position remains strong, and we are well-positioned relative to our capital priorities. • Engage a high-performing, talented, and diverse workforce — Every day our employees provide our clients with great ideas, extraordinary service, and smart solutions. We intend to continue to engage our high-performing, talented, and diverse workforce to create an environment where they can make a difference, own their careers, be respected, and feel a sense of pride. Strategic developments We took the following actions during 2023 in support of our corporate strategy: • Throughout dynamic market conditions we continued to support our clients , growing in both commercial clients and consumer households and raising $80 billion in capital for our clients. • We’ve continued to focus on relationships , primacy, and quality deposits, while de-emphasizing non-relationship business and significantly improving our funding and liquidity. • Overall, credit quality remains strong reflecting our strong risk management discipline and our proven underwrite-to-distribute business model. We’ve continued to maintain low exposure in high-risk categories such as leveraged lending and office properties. • We proactively managed our balance sheet by reducing risk-weighted assets, improving our capital position . At December 31, 2023, our Common Equity Tier 1 and Tier 1 risk-based capital ratios stood at 10.02% and 11.67%, respectively. • We remained committed to our strategy to engage a high-performing, talented, and diverse workforce. We have been recognized by multiple organizations for our dedication to creating an environment where employees are treated with respect and empowered to bring their authentic selves to work. Some of these awards and recognitions included the Human Rights Campaign naming us one of the 2023 Equality 100 Award recipients as a leader in LGBTQ+ Workplace Inclusion, Bloomberg listing us on the Gender-Equality Index, G.I. Jobs and Military Spouse Magazine recognizing us as a Military Friendly ® and Military Friendly ® Spouse Employer, and receiving the Leading Disability Employer Seal from the National Organization on Disability. We were also named to DiversityInc’s 2023 Top 50 Companies for Diversity. 50 Table of contents Current year expectations - full year 2024 vs. full year 2023 Category Expectations (a) Average loans down 5% to 7% (c) Average deposits flat to down 2% Net interest income (TE) down 2% to 5% (c) Noninterest income up 5%+ Noninterest expense relatively stable (b) Net charge-offs to average loans 30 to 40 basis points (FY2024) Effective tax rate ~20% (FY2024) (a) Guidance range: relatively stable: +/- 2%. (b) Excludes impact of the FDIC special assessment charge of $190 million, efficiency related expenses of $131 million, and a pension settlement charge of $18 million in 2023. (c) Additional Guidance: End of period loans: relatively stable vs. year-end 2023 balances; Net interest income (TE): Up low-single digits vs. 4Q23 annualized exit rate, 10%+ 4Q24 vs. 4Q23. Results of Operations Earnings Overview The following chart provides a reconciliation of net income from continuing operations attributable to Key common shareholders for the year ended December 31, 2022, to the year ended December 31, 2023 (dollars in millions): (a) Includes Preferred dividends. Net interest income One of our principal sources of revenue is net interest income. Net interest income is the difference between interest income received on earning assets (such as loans and securities) and loan-related fee income, and interest expense paid on deposits and borrowings. There are several factors that affect net interest income, including: • the volume, pricing, mix, and maturity of earning assets and interest-bearing liabilities; • the volume and value of net free funds, such as noninterest-bearing deposits and equity capital; • the use of derivative instruments to manage interest rate risk; • interest rate fluctuations and competitive conditions within the marketplace; • asset quality; and • fair value accounting of acquired earning assets and interest-bearing liabilities. To make it easier to compare both the results among several periods and the yields on various types of earning assets (some taxable, some not), we present net interest income in this discussion on a “TE basis” (i.e., as if all income were taxable and at the same rate). For example, $100 of tax-exempt income would be presented as $126, an amount that, if taxed at the statutory federal income tax rate of 21%, would yield $100. 51 Table of contents Net interest income (TE) for 2023 was $3.9 billion, and the net interest margin was 2.17%. Compared to 2022, net interest income (TE) decreased $611 million, and the net interest margin decreased by 47 basis points. The decline in net interest income (TE) and the net interest margin was driven by higher interest-bearing deposit costs and a shift in funding mix to higher cost deposits and borrowings. Partly offsetting the decline in net interest income and the net interest margin were higher earning asset balances and yields. Average loans totaled $118.0 billion for 2023, compared to $111.3 billion in 2022. The $6.7 billion increase was driven by growth in commercial and industrial loans and consumer mortgage balances during the first half of 2023. Average deposits totaled $144.1 billion for 2023, a decrease of $2.8 billion compared to 2022. The decrease was driven by changing client behavior as a result of higher interest rates. Figure 1 shows the various components of our balance sheet that affect interest income and expense and their respective yields or rates over the past three years. This figure also presents a reconciliation of TE net interest income to net interest income reported in accordance with GAAP for each of those years. The net interest margin, which is an indicator of the profitability of our earning assets less the cost of funding, is calculated by dividing taxable-equivalent net interest income by average earning assets. 52 Table of contents Figure 1. Consolidated Average Balance Sheets, Net Interest Income, and Yields/Rates from Continuing Operations (h) Year ended December 31, 2023 2022 2021 Dollars in millions Average Balance Interest (a) Yield/ Rate (a) Average Balance Interest (a) Yield/ Rate (a) Average Balance Interest (a) Yield/ Rate (a) ASSETS Loans (b), (c) Commercial and industrial (d) $ 59,379 $ 3,444 5.80 % $ 54,970 $ 2,148 3.91 % $ 50,931 $ 1,795 3.52 % Real estate — commercial mortgage 15,968 931 5.83 15,572 633 4.07 13,118 472 3.60 Real estate — construction 2,755 185 6.71 2,229 99 4.44 2,113 77 3.61 Commercial lease financing 3,703 116 3.13 3,869 98 2.54 4,019 114 2.84 Total commercial loans 81,805 4,676 5.72 76,640 2,978 3.89 70,181 2,458 3.50 Real estate — residential mortgage 21,428 699 3.26 19,036 559 2.94 12,252 348 2.84 Home equity loans 7,522 433 5.76 8,115 347 4.28 8,967 336 3.74 Consumer direct loans 6,228 304 4.88 6,490 277 4.27 5,105 233 4.56 Credit cards 986 136 13.88 959 107 11.23 925 94 10.11 Consumer indirect loans 35 1 .71 62 — — 2,839 90 3.19 Total consumer loans 36,199 1,573 4.35 34,662 1,290 3.72 30,088 1,101 3.66 Total loans 118,004 6,249 5.30 111,302 4,268 3.84 100,269 3,559 3.55 Loans held for sale 1,012 61 6.06 1,278 56 4.41 1,700 50 2.96 Securities available for sale (b), (e) 37,718 793 1.80 42,325 752 1.62 35,765 546 1.53 Held-to-maturity securities (b) 9,008 312 3.46 7,676 213 2.77 7,035 185 2.63 Trading account assets 1,138 55 4.85 850 31 3.61 820 19 2.35 Short-term investments 7,349 414 5.63 4,264 97 2.28 17,529 28 .16 Other investments (e) 1,392 73 5.28 952 22 2.26 621 7 1.14 Total earning assets 175,621 7,957 4.37 168,647 5,439 3.15 163,739 4,394 2.69 Allowance for loan and lease losses (1,419) (1,101) (1,340) Accrued income and other assets 17,425 18,340 16,520 Discontinued assets 384 492 632 Total assets $ 192,011 $ 186,378 $ 179,551 LIABILITIES Money market deposits $ 34,539 $ 666 1.93 % $ 35,966 $ 52 .14 % $ 36,959 $ 15 .04 % Demand deposits 54,711 1,102 2.01 49,707 182 .37 47,777 26 .05 Savings deposits 6,343 3 .04 7,798 1 .01 6,893 1 .02 Certificates of deposit ($100,000 or more) (f) 4,517 171 3.79 1,455 8 .56 2,135 16 .72 Other time deposits 9,277 380 4.10 2,892 36 1.25 2,540 9 .37 Total interest-bearing deposits 109,387 2,322 2.12 97,818 279 .29 96,304 67 .07 Federal funds purchased and securities sold under repurchase agreements 1,647 79 4.81 2,107 41 1.93 239 — .02 Bank notes and other short-term borrowings 5,890 308 5.24 2,963 90 3.02 770 8 1.08 Long-term debt (f), (g) 20,983 1,305 6.22 14,915 475 3.19 12,391 221 1.79 Total interest-bearing liabilities 137,907 4,014 2.91 117,803 885 .75 109,704 296 .27 Noninterest-bearing deposits 34,672 49,044 48,731 Accrued expense and other liabilities 5,167 4,309 2,819 Discontinued liabilities (g) 384 492 632 Total liabilities 178,130 171,648 161,886 EQUITY Key shareholders’ equity 13,881 14,730 17,665 Noncontrolling interests — — — Total equity 13,881 14,730 17,665 Total liabilities and equity $ 192,011 $ 186,378 $ 179,551 Interest rate spread (TE) 1.46 % 2.40 % 2.42 % Net interest income (TE) and net interest margin (TE) $ 3,943 2.17 % $ 4,554 2.64 % $ 4,098 2.50 % Less: TE adjustment (b) 30 27 27 Net interest income, GAAP basis $ 3,913 $ 4,527 $ 4,071 (a) Results are from continuing operations. Interest excludes the interest associated with the liabilities referred to in (g) below, calculated using a matched funds transfer pricing methodology. (b) Interest income on tax-exempt securities and loans has been adjusted to a TE basis using the statutory federal income tax rate in effect that calendar year. (c) For purposes of these computations, nonaccrual loans are included in average loan balances. (d) Commercial and industrial average loan balances include $196 million, $157 million, and $134 million of assets from commercial credit cards for the years ended December 31, 2023, December 31, 2022, and December 31, 2021, respectively. (e) Yield is calculated on the basis of amortized cost. (f) Rate calculation excludes basis adjustments related to fair value hedges. (g) A portion of long-term debt and the related interest expense is allocated to discontinued liabilities as a result of applying our matched funds transfer pricing methodology to discontinued operations. (h) Average balances presented are based on daily average balances over the respective stated period. 53 Table of contents Figure 2 shows how the changes in yields or rates and average balances from the prior year affected net interest income. The section entitled “Financial Condition” contains additional discussion about changes in earning assets and funding sources. Figure 2. Components of Net Interest Income Changes from Continuing Operations 2023 vs. 2022 Dollars in millions Average Volume Yield/ Rate Net Change (a) INTEREST INCOME Loans $ 261 $ 1,720 $ 1,981 Loans held for sale (13) 18 5 Securities available for sale (87) 128 41 Held-to-maturity securities 41 58 99 Trading account assets 12 12 24 Short-term investments 104 213 317 Other investments 14 37 51 Total interest income (TE) 332 2,186 2,518 INTEREST EXPENSE Money market deposits (2) 616 614 Demand deposits 20 900 920 Savings deposits — 2 2 Certificates of deposit ($100,000 or more) 43 120 163 Other time deposits 169 175 344 Total interest-bearing deposits 230 1,813 2,043 Federal funds purchased and securities sold under repurchase agreements (11) 49 38 Bank notes and other short-term borrowings 126 92 218 Long-term debt 248 582 830 Total interest expense 593 2,536 3,129 Net interest income (TE) $ (261) $ (350) $ (611) (a) The change in interest not due solely to volume or rate has been allocated in proportion to the absolute dollar amounts of the change in each. Provision for credit losses Our provision for credit losses was a net charge of $489 million for 2023, compared to $502 million for 2022. The decrease in our provision for credit losses was driven by a lower reserve build, partly due to planned balance sheet optimization efforts over 2023, offset by higher net charge-offs. In 2022, the increase in provision for credit losses was a result of reserve increases largely driven by changes in the economic outlook and loan growth. 54 Table of contents Noninterest income Noninterest income for 2023 was $2.5 billion, compared to $2.7 billion during 2022. Noninterest income represented 39% of total revenue for 2023 and 37% of total revenue for 2022. The following discussion explains the composition of certain elements of our noninterest income and the factors that caused those elements to change. Figure 3. Noninterest Income (a) Other noninterest income includes operating lease income and other leasing gains, corporate services income, corporate-owned life insurance income, consumer mortgage income, commercial mortgage servicing fees, and other income. See the "Consolidated Statements of Income" in Part II, Item 8. Financial Statements and Supplementary Data of this report. 55 Table of contents Trust and investment services income Trust and investment services income consists of brokerage commissions, trust and asset management commissions, and insurance income. The assets under management or administration that primarily generate these revenues are shown in Figure 4. For 2023, trust and investment services income decreased $10 million, or 1.9%. This was primarily due to a decrease in transactional commission based revenues slightly offset by an increase in investment management income and other fees stemming from increased assets under management. A significant portion of our trust and investment services income depends on the value and mix of assets under management. At December 31, 2023, our bank, trust, and registered investment advisory subsidiaries had assets under management or administration of $54.9 billion, compared to $51.3 billion at December 31, 2022. The increase from 2022 to 2023 was attributable to movements in the equity markets and new business. Figure 4. Assets Under Administration Year ended December 31, Change 2023 vs. 2022 Dollars in millions 2023 2022 Amount Percent Discretionary assets under management by investment type: Equity $ 30,724 $ 28,313 $ 2,411 8.5 % Fixed income 13,775 14,432 (657) (4.6) Money market 6,187 5,238 949 18.1 Total discretionary assets under management $ 50,686 $ 47,983 $ 2,703 5.6 % Non-discretionary assets under administration 4,173 3,299 874 26.5 Total $ 54,859 $ 51,282 $ 3,577 7.0 % Investment banking and debt placement fees Investment banking and debt placement fees consist of syndication fees, debt and equity underwriting fees, merger and acquisition and debt placement advisor fees, gains on sales of commercial mortgages, and agency origination fees. For 2023, investment banking and debt placement fees decreased $96 million, or 15.0%, from the prior year reflective of the continued challenging environment in the capital markets. Service charges on deposit accounts Service charges on deposit accounts decreased $80 million, or 22.9%, in 2023 compared to the prior year. This decrease reflects the full year impact of new fee terms implemented in the second half of 2022 which eliminated NSF fees and introduced Key Coverage Zone TM for overdraft fees, as well as lower account analysis fees related to the interest rate environment. Cards and payments income Cards and payments income, which consists of debit card, consumer and commercial credit card, and merchant services income remained relatively flat and only decreased $1 million, or 0.3%, in 2023 compared to 2022. Other noninterest income Other noninterest income decreased $61 million, or 7.1%, in 2023 compared to 2022, driven by decreases in corporate services income from lower derivatives trading income, decreases in operating lease income as our operating lease portfolio runs off, and decreases in consumer mortgage income from lower gain on sale margins. These decreases were slightly offset by an increase in commercial mortgage servicing fees driven by a higher servicing portfolio. Noninterest expense Noninterest expense for 2023 was $4.7 billion, compared to $4.4 billion for 2022. Figure 5 gives a breakdown of our major categories of noninterest expense as a percentage of total noninterest expense for the twelve months ended December 31, 2023. The following discussion explains the composition of certain elements of our noninterest expense and the factors that caused those elements to change. 56 Table of contents Figure 5. Noninterest Expense (a) Other noninterest expense includes equipment, operating lease expense, marketing, intangible asset amortization and other miscellaneous expense. See the "Consolidated Statements of Income" in Part II, Item 8. Financial Statements and Supplementary Data of this report. Personnel As shown in Figure 6, personnel expense, the largest category of our noninterest expense, increased by $94 million, or 3.7%, in 2023 compared to 2022. Activity for the year was driven by higher salaries and severance with an offset from decreased incentive compensation costs from lower revenue generation in our variable expense businesses. Figure 6. Personnel Expense Year ended December 31, Dollars in millions Change 2023 vs. 2022 2023 2022 Amount Percent Salaries and contract labor $ 1,649 $ 1,500 $ 149 9.9 % Incentive and stock-based compensation (a) 525 693 (168) (24.2) Employee benefits 405 363 42 11.6 Severance 81 10 71 N/M Total personnel expense $ 2,660 $ 2,566 $ 94 3.7 % N/M - Not meaningful (a) Excludes directors’ stock-based compensation of $3 million in 2023 and $3 million in 2022, reported as “other noninterest expense” in Figure 5. Non-personnel expense In total, other non-personnel expense increased $230 million, or 12.5%, in 2023 compared to 2022 primarily due to the $190 million FDIC special assessment charge, as well as corporate real estate related rationalization costs recorded within other expense. 57 Table of contents Income taxes We recorded a tax provision from continuing operations of $196 million for 2023, compared to $422 million for 2022. The effective tax rate, which is the provision for income taxes as a percentage of income from continuing operations before income taxes, was 16.9% for 2023 and 18.1% for 2022. In 2023, our federal tax expense and effective tax rate differ from the amount that would be calculated using the federal statutory tax rate primarily due to investments in tax-advantaged assets, such as corporate-owned life insurance, and tax credits associated with low-income housing investments, and periodic adjustments to our tax reserves as described in Note 14 (“Income Taxes”). Business Segment Results This section summarizes the financial performance of our two major business segments (operating segments): Consumer Bank and Commercial Bank. Note 25 (“Business Segment Reporting”) describes the products and services offered by each of these business segments and provides more detailed financial information pertaining to the segments. Dollars in the charts are presented in millions. Consumer Bank Segment imperatives • Execute a relationship-oriented growth strategy, which will enable us to grow (i) stable, low-cost deposits and (ii) valuable fee income streams, including wealth management and cards and payments • Simplify our business to improve execution and efficiency while managing risk • Meet the needs of our clients and communities in markets where we operate Market and business overview As the banking industry moves forward, so do our clients. Anticipating our clients’ needs not only today, but also for tomorrow and into the future, has become one of the biggest challenges for the banking industry. We view these challenges as an opportunity to help our current client base meet their own goals, as well as attract new and diverse clients. Key Consumer Bank’s focus on durable, long-term client relationships centered in core checking has been evident through the execution of our strategic priorities through focus areas such as developing a core Consumer relationship product suite and driving long-term deposits and fee income through new and enhanced products and services. Key continues to adapt to an increasingly digital world with an increased focus on client experience across our online banking channels. The advice our bankers provide, in combination with our products, services and digital platforms, place Key in a strong position to develop long-lasting and meaningful relationships with our current and prospective clients. Our goal is to help our clients move forward on their financial journeys and to be by their sides along the way. Summary of operations • Net income attributable to Key of $248 million in 2023, compared to $365 million in 2022, a decrease of 32.1%, largely driven by higher interest rates on deposits and the FDIC special assessment charge • Taxable equivalent net interest income decreased in 2023 by $133 million, or 5.5%, from the prior year, reflecting higher interest-bearing deposit costs • Average loans and leases increased in 2023 by $1.1 billion, or 2.6%, from the prior year, driven by increases in residential mortgage loans • Average deposits decreased in 2023 by $6.2 billion, or 6.8%, from the prior year, driven by changes in client behavior due to the higher interest rate environment 58 Table of contents • Provision for credit losses decreased $82 million in 2023 compared to the prior year, driven by lower reserves due to planned balance sheet optimization efforts and changes in the economic outlook, offset by higher net charge-offs • Noninterest income decreased in 2023 by $51 million, or 5.1%, driven by decreases in service charges on deposit accounts as a result of declining overdraft fee and NSF fees. • Noninterest expense increased in 2023 by $52 million, or 1.9%, primarily reflective of the FDIC special assessment charge Commercial Bank Segment imperatives • Solve complex client needs through a differentiated product set of banking and capital markets capabilities • Drive targeted scale through distinct product capabilities delivered to a broad set of clients • Utilize industry expertise and broad capabilities to build relationships with narrowly targeted client sets 59 Table of contents Market and business overview Building relationships and delivering complex solutions for middle market clients requires a distinctive operating model that understands their business and can provide a broad set of product capabilities. As competition for these clients intensifies, we have positioned the business to maintain and grow our competitive advantage by building targeted scale in businesses and client segments. Strong market share in businesses such as real estate loan servicing and equipment finance highlights our ability to successfully meet customer needs through targeted scale in distinct product capabilities. Clients expect us to understand every aspect of their business. Our seven industry verticals are aligned to drive targeted scale in segments where we have a breadth of industry expertise. Our business model is positioned to meet our client needs because our focus is not on being a universal bank, but rather being the right bank for our clients. Summary of operations • Net income attributable to Key of $839 million in 2023, compared to $1.1 billion in 2022, a decrease of 26.7%, largely driven by an increase in reserves, increase in FDIC special assessment charges, lower investment banking and debt placement fees, and lower corporate services income • Taxable equivalent net interest income decreased in 2023 by $52 million, or 2.8%, from the prior year, reflecting higher interest-bearing deposit costs and a shift in funding mix to higher-cost deposits • Average loan and lease balances increased $5.6 billion in 2023, or 8.0%, driven by an increase in commercial and industrial loans and commercial real estate • Average deposit balances decreased $798 million in 2023, or 1.5%, driven by changing client behavior due to the current economic environment while also being impacted by our focus on growing deposits across our commercial businesses • Provision for credit losses increased $62 million in 2023 compared to the prior year, resulting from higher net-charge-offs and reserve increases driven by changes in portfolio activity and the economic outlook • Noninterest income decreased $178 million in 2023, or 11.1%, from the prior year, driven by lower investment banking and debt placement fees, reflecting lower syndication and merger and acquisition advisory revenues, as well as a decline in corporate services income • Noninterest expense increased by $69 million in 2023, or 4.0%, from the prior year, primarily due to the FDIC special assessment charge 60 Table of contents Financial Condition Loans and loans held for sale Figure 7. Breakdown of Loans as of December 31, 2023 (a) Other consumer loans include Consumer direct loans, Credit cards, and Consumer indirect loans. See Note 4 (“Loan Portfolio”) Item 8. Financial Statements of this report. 61 Table of contents Figure 8 shows the composition of our loan portfolio at December 31 for each of the past two years. Figure 8. Composition of Loans 2023 2022 December 31, Dollars in millions Amount Percent of Total Amount Percent of Total COMMERCIAL Commercial and industrial (a) $ 55,815 49.6 % $ 59,647 50.0 % Commercial real estate: Commercial mortgage 15,187 13.5 16,352 13.7 Construction 3,066 2.7 2,530 2.1 Total commercial real estate loans 18,253 16.2 18,882 15.8 Commercial lease financing (b) 3,523 3.1 3,936 3.3 Total commercial loans 77,591 68.9 82,465 69.1 CONSUMER Real estate — residential mortgage 20,958 18.6 21,401 17.9 Home equity loans 7,139 6.4 7,951 6.6 Consumer direct loans 5,890 5.2 6,508 5.4 Credit cards 1,002 0.9 1,026 0.9 Consumer indirect loans 26 — 43 0.1 Total consumer loans 35,015 31.1 36,929 30.9 Total loans (c) $ 112,606 100.0 % $ 119,394 100.0 % (a) Loan balances include $207 million and $172 million, of commercial credit card balances at December 31, 2023, and December 31, 2022, respectively. (b) Commercial lease financing includes receivables held as collateral for a secured borrowing of $7 million and $8 million at December 31, 2023, and December 31, 2022, respectively. Principal reductions are based on the cash payments received from these related receivables. Additional information pertaining to this secured borrowing is included in Note 20 (“Long-Term Debt”). (c) Total loans exclude loans of $339 million at December 31, 2023, and $434 million at December 31, 2022, related to the discontinued operations of the education lending business. At December 31, 2023, total loans outstanding from continuing operations were $112.6 billion, compared to $119.4 billion at the end of 2022. For more information on balance sheet carrying value, see Note 1 (“Summary of Significant Accounting Policies”) under the headings “Loans” and “Loans Held for Sale.” Commercial loan portfolio Commercial loans outstanding were $77.6 billion at December 31, 2023, a decrease of $4.9 billion, or 5.9%, compared to December 31, 2022 . The decrease was across all major commercial loan categories as a result of our planned balance sheet optimization efforts. Figure 9 provides our commercial loan portfolio by industry classification as of December 31, 2023, and December 31, 2022. 62 Table of contents Figure 9. Commercial Loans by Industry December 31, 2023 Commercial and industrial Commercial real estate Commercial lease financing Total commercial loans Percent of total Dollars in millions Industry classification: Agriculture $ 925 $ 114 $ 74 $ 1,113 1.4 % Automotive 2,153 833 4 2,990 3.9 Business services 3,387 243 112 3,742 4.8 Commercial real estate 8,229 13,113 8 21,350 27.5 Construction materials and contractors 2,311 292 265 2,868 3.7 Consumer goods 3,851 622 268 4,741 6.1 Consumer services 4,568 774 327 5,669 7.3 Equipment 2,405 171 168 2,744 3.5 Finance 8,908 104 284 9,296 12.0 Healthcare 3,222 1,456 303 4,981 6.4 Materials and extraction 2,402 304 152 2,858 3.7 Oil and gas 2,212 37 12 2,261 2.9 Public exposure 2,241 8 513 2,762 3.6 Technology, media, and telecom 807 11 78 896 1.2 Transportation 988 97 466 1,551 2.0 Utilities 6,418 6 459 6,883 8.9 Other 788 68 30 886 1.1 Total $ 55,815 $ 18,253 $ 3,523 $ 77,591 100.0 % December 31, 2022 Commercial and industrial Commercial real estate Commercial lease financing Total commercial loans Percent of total Dollars in millions Industry classification: Agriculture $ 829 $ 110 $ 83 $ 1,022 1.2 % Automotive 1,678 751 12 2,441 2.9 Business services 3,514 246 148 3,908 4.7 Commercial real estate 8,883 13,919 10 22,812 27.7 Construction materials and contractors 2,649 318 322 3,289 4.0 Consumer goods 4,643 576 288 5,507 6.7 Consumer services 5,009 900 346 6,255 7.6 Equipment 2,584 180 161 2,925 3.5 Finance 8,805 112 461 9,378 11.4 Healthcare 3,589 1,372 330 5,291 6.4 Materials and extraction 3,128 240 145 3,513 4.3 Oil and gas 2,399 33 20 2,452 3.0 Public exposure 2,534 9 580 3,123 3.8 Technology, media, and telecom 1,082 12 89 1,183 1.4 Transportation 1,092 137 477 1,706 2.1 Utilities 6,725 5 450 7,180 8.7 Other 504 (38) 14 480 .6 Total $ 59,647 $ 18,882 $ 3,936 $ 82,465 100.0 % Commercial and industrial . Commercial and industrial loans are the largest component of our loan portfolio, representing 50% of our total loan portfolio at December 31, 2023, and 50% at December 31, 2022. This portfolio is approximately 88% variable rate and consists of loans primarily to large corporate, middle market, and small business clients. Commercial and industrial loans totaled $55.8 billion at December 31, 2023, a decrease of $3.8 billion, or 6.4%, compared to December 31, 2022 . The decrease was broad-based and spread across most industry categories, reflecting our planned balance sheet optimization efforts. Commercial real estate loans . Our commercial real estate portfolio includes project loans primarily focused in market-rate and affordable multi-family housing loans, owner-occupied commercial and industrial operating company buildings, and community center grocer-anchored retail centers. These three commercial real estate segments make up 75% of our commercial real estate portfolio. Our non-owner-occupied portfolio is focused on operators of commercial real estate who not only utilize our loan products, but also our broader industry-focused products and services and provide consistent pipelines into our agency, CMBS, and other long-term market take out products. This focus ensures our relationship clients foster and build portfolios with stable, recurring cash flows, with adequate, balanced cash reserves to support our balance sheet exposures through the economic cycle. At December 31, 2023, commercial real estate loans totaled $18.3 billion, comprised of $15.2 billion of mortgage loans and $3.1 billion of construction loans. Compared to December 31, 2022, this portfolio decreased $629 million driven by our planned balance sheet optimization efforts. 63 Table of contents Since the global financial crisis in 2008, we have limited our construction business and reduced our overall construction loans from 42% to 17% of commercial real estate loans as of December 31, 2023. Construction loans provide a stream of funding for properties not fully leased at origination to support debt service payments over the term of the contract or project. As of December 31, 2023, 78% of our construction portfolio are multi-family project loans. Our office exposure only represents 5% of commercial real estate loans at period end. As shown in Figure 10, our commercial real estate loan portfolio includes various property types and geographic locations of the underlying collateral. These loans include commercial mortgage and construction loans in both Consumer Bank and Commercial Bank. Figure 10. Commercial Real Estate Loans Geographic Region Dollars in millions West Southwest Central Midwest Southeast Northeast National Total Percent of Total Construction Commercial Mortgage December 31, 2023 Nonowner-occupied: Diversified $ 3 $ — $ — $ 3 $ — $ 16 $ 164 $ 186 1.0 % $ — $ 186 Industrial 58 24 80 110 230 280 20 802 4.4 168 634 Land & Residential 5 3 3 5 3 21 — 40 .2 18 22 Lodging 48 — 3 4 46 66 55 222 1.2 5 217 Medical Office 37 — 42 1 21 97 75 273 1.5 27 246 Multifamily 1,237 552 1,271 1,272 2,707 1,370 444 8,853 48.5 2,389 6,464 Office 142 — 153 76 118 285 50 824 4.5 — 824 Retail 213 6 84 183 102 297 213 1,098 6.0 75 1,023 Self Storage 62 — 45 15 72 32 171 397 2.2 4 393 Senior Housing 124 22 143 88 65 120 213 775 4.2 126 649 Skilled Nursing — — — 66 — 202 215 483 2.6 — 483 Student Housing — — — 27 158 — — 185 1.0 59 126 Other 1 12 8 35 37 67 160 320 1.8 — 320 Total nonowner-occupied 1,930 619 1,832 1,885 3,559 2,853 1,780 14,458 79.2 2,871 11,587 Owner-occupied 1,141 1 414 720 167 1,352 — 3,795 20.8 195 3,600 Total $ 3,071 $ 620 $ 2,246 $ 2,605 $ 3,726 $ 4,205 $ 1,780 $ 18,253 100.0 % $ 3,066 $ 15,187 Nonowner-occupied: Nonperforming loans $ 1 $ — $ 46 $ 1 $ 9 $ 5 $ 38 $ 100 N/M $ — $ 100 Accruing loans past due 90 days or more 1 — — 6 — 3 — 10 N/M — 10 Accruing loans past due 30 through 89 days 3 — 12 — 7 7 — 29 N/M — 29 December 31, 2022 Nonowner-occupied: Diversified $ 9 $ — $ — $ 4 $ — $ 24 $ 231 $ 268 1.4 % $ — $ 268 Industrial 75 25 101 135 220 284 52 892 4.7 203 689 Land & Residential 1 3 3 3 3 24 — 37 .2 15 22 Lodging 58 — 10 4 20 72 41 205 1.1 22 183 Medical Office 47 — 43 9 19 98 25 241 1.3 64 177 Multifamily 1,083 533 1,388 1,264 2,813 1,370 438 8,889 47.1 1,705 7,184 Office 189 1 173 113 128 300 95 999 5.3 — 999 Retail 282 35 112 183 69 395 235 1,311 6.9 106 1,205 Self Storage 85 13 50 20 79 37 202 486 2.6 4 482 Senior Housing 150 57 144 76 118 120 235 900 4.8 194 706 Skilled Nursing — — — 52 — 239 143 434 2.3 — 434 Student Housing — — — 53 199 13 — 265 1.4 39 226 Other 24 4 9 79 42 83 195 436 2.3 2 434 Total nonowner-occupied 2,003 671 2,033 1,995 3,710 3,059 1,892 15,363 81.4 2,354 13,009 Owner-occupied 1,149 5 364 580 128 1,293 — 3,519 18.6 176 3,343 Total $ 3,152 $ 676 $ 2,397 $ 2,575 $ 3,838 $ 4,352 $ 1,892 $ 18,882 100.0 % $ 2,530 $ 16,352 Nonperforming loans $ — $ — $ — $ 2 $ — $ 7 $ 12 $ 21 N/M $ — $ 21 Accruing loans past due 90 days or more — — — — — 8 — 8 N/M — 8 Accruing loans past due 30 through 89 days — — 1 11 — 6 — 18 N/M — 18 West – Alaska, California, Hawaii, Idaho, Montana, Oregon, Washington, and Wyoming Southwest – Arizona, Nevada, and New Mexico Central – Arkansas, Colorado, Oklahoma, Texas, and Utah Midwest – Illinois, Indiana, Iowa, Kansas, Michigan, Minnesota, Missouri, Nebraska, North Dakota, Ohio, South Dakota, and Wisconsin Southeast – Alabama, Delaware, Florida, Georgia, Kentucky, Louisiana, Maryland, Mississippi, North Carolina, South Carolina, Tennessee, Virginia, Washington, D.C., and West Virginia Northeast – Connecticut, Maine, Massachusetts, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island, and Vermont National – Accounts in three or more regions 64 Table of contents Consumer loan portfolio Consumer loans outstanding at December 31, 2023, totaled $35.0 billion, a decrease of $1.9 billion, or 5.2%, from one year ago . This decrease reflects lower residential and consumer direct loans. The residential mortgage portfolio is comprised of loans originated by our Consumer Bank and is the largest segment of our consumer loan portfolio as of December 31, 2023, representing approximately 60% of consumer loans. This is followed by our home equity portfolio comprising approximately 20% of consumer loans outstanding at year end. We held the first lien position for approximately 64% of the home equity portfolio at December 31, 2023, and 66% at December 31, 2022. For loans with real estate collateral, we track borrower performance monthly. Regardless of the lien position, credit metrics are refreshed quarterly, including recent FICO scores as well as updated loan-to-value ratios. This information is used in establishing the ALLL. Our methodology is described in Note 1 (“Summary of Significant Accounting Policies”) under the heading “Allowance for Loan and Lease Losses.” Figure 11 presents our consumer loans by geography. Figure 11. Consumer Loans by State Dollars in millions Real estate — residential mortgage Home equity loans Consumer direct loans Credit cards Consumer indirect loans Total December 31, 2023 Washington $ 4,520 $ 1,020 $ 226 $ 88 $ 1 $ 5,855 Ohio 2,704 1,029 250 203 1 4,187 New York 805 1,993 774 347 1 3,920 Colorado 3,001 277 149 32 — 3,459 California 2,294 14 496 3 4 2,811 Oregon 1,269 585 108 43 — 2,005 Pennsylvania 445 517 377 63 2 1,404 Florida 782 42 412 14 4 1,254 Utah 851 252 64 18 — 1,185 Connecticut 765 255 112 29 1 1,162 Other 3,522 1,155 2,922 162 12 7,773 Total $ 20,958 $ 7,139 $ 5,890 $ 1,002 $ 26 $ 35,015 December 31, 2022 Washington $ 4,621 $ 1,100 $ 253 $ 87 $ 2 $ 6,063 Ohio 2,766 1,173 347 214 5 4,505 New York 840 2,256 770 359 1 4,226 Colorado 3,006 301 171 32 — 3,510 California 2,357 16 538 4 6 2,921 Oregon 1,268 630 117 43 — 2,058 Pennsylvania 459 580 403 61 3 1,506 Florida 851 45 453 14 6 1,369 Texas 336 3 397 4 3 743 Illinois 134 3 212 2 1 352 Other 4,763 1,844 2,847 206 16 9,676 Total $ 21,401 $ 7,951 $ 6,508 $ 1,026 $ 43 $ 36,929 65 Table of contents Loan sales As shown in Figure 12, during 2023, we sold $8.9 billion of our loans . Sales of loans classified as held for sale generated net gains of $135 million during 2023. Figure 12 summarizes our loan sales during 2023 and 2022. Figure 12. Loans Sold (Including Loans Held for Sale) Dollars in millions Commercial Commercial Real Estate Commercial Lease Financing Residential Real Estate Total 2023 Fourth quarter $ 35 $ 1,735 $ 21 $ 339 $ 2,130 Third quarter 85 2,861 49 345 3,340 Second quarter 118 1,431 28 283 1,860 First quarter 125 1,121 164 135 1,545 Total $ 362 $ 7,148 $ 262 $ 1,103 $ 8,875 2022 Fourth quarter $ 33 $ 2,774 $ 114 $ 235 $ 3,156 Third quarter 211 1,882 43 353 2,489 Second quarter 41 1,851 150 496 2,538 First quarter 1,469 1,909 39 901 4,318 Total $ 1,754 $ 8,416 $ 346 $ 1,985 $ 12,501 Figure 13 shows loans that are either administered or serviced by us but not recorded on the balance sheet; this includes loans that were sold. Figure 13. Loans Administered or Serviced December 31, Dollars in millions 2023 2022 2021 2020 2019 Commercial real estate loans $ 499,449 $ 488,478 $ 444,131 $ 371,016 $ 347,186 Residential mortgage 11,193 11,026 10,312 8,311 6,146 Education loans 248 312 415 516 625 Commercial lease financing 1,946 1,646 1,236 1,359 1,047 Commercial loans 667 723 750 684 591 Consumer direct 408 509 699 1,711 2,243 Consumer indirect 792 1,536 2,714 — — Total $ 514,703 $ 504,230 $ 460,257 $ 383,597 $ 357,838 In the event of default by a borrower, we are subject to recourse with respect to approximately $7.5 billion of the $514.7 billion of loans administered or serviced at December 31, 2023. These are primarily associated with commercial real estate loans administered or serviced. Additional information about this recourse arrangement is included in Note 22 (“Commitments, Contingent Liabilities, and Guarantees”) under the heading “Recourse agreement with FNMA.” We derive income from several sources when retaining the right to administer or service loans that are sold. We earn noninterest income (recorded as “Consumer mortgage income” and “Commercial mortgage servicing fees”) from fees for servicing or administering loans. This fee income is reduced by the amortization of related servicing assets. In addition, we earn interest income from investing funds generated by escrow deposits collected in connection with the servicing loans. Additional information about our mortgage servicing assets is included in Note 9 (“Mortgage Servicing Assets”). 66 Table of contents Maturities and sensitivity of certain loans to changes in interest rates Figure 14 shows the remaining maturities of our loan portfolio and the sensitivity of certain loans to changes in interest rates as of December 31, 2023. Figure 14. Remaining Maturities and Sensitivity of Certain Loans to Changes in Interest Rates (a) December 31, 2023 Dollars in millions Within One Year One - Five Years Five - Fifteen Years Over Fifteen Years Total Commercial Commercial and industrial $ 13,086 $ 37,501 $ 5,058 $ 170 $ 55,815 Commercial Mortgage 5,261 6,553 3,025 348 15,187 Real estate — construction 1,283 1,299 135 349 3,066 Commercial lease financing 388 1,857 1,278 — 3,523 Total commercial loans $ 20,018 $ 47,210 $ 9,496 $ 867 $ 77,591 Consumer Real estate - residential mortgage $ 180 $ 40 $ 769 $ 19,969 $ 20,958 Home equity loans 96 250 2,135 4,658 7,139 Consumer direct loans 497 946 2,395 2,052 5,890 Credit Cards 1,002 — — — 1,002 Consumer indirect loans — 20 5 1 26 Total consumer loans 1,775 1,256 5,304 26,680 35,015 Total loans $ 21,793 $ 48,466 $ 14,800 $ 27,547 $ 112,606 Loans with floating or adjustable interest rates (b) $ 41,916 $ 4,428 $ 13,153 $ 59,497 Loans with predetermined interest rates (c) 6,550 10,372 14,394 31,316 Total $ 48,466 $ 14,800 $ 27,547 $ 90,813 (a) Accrued interest of $522 million at December 31, 2023, is presented in "Accrued income and other assets" on the Consolidated Balance Sheets and is excluded from the amortized cost basis disclosed in this table. (b) Floating and adjustable rates vary in relation to other interest rates (such as the base lending rate) or a variable index that may change during the term of the loan. (c) Predetermined interest rates either are fixed or may change during the term of the loan according to a specific formula or schedule. Securities Our securities portfolio is constructed to help manage overall interest rate risk and provide a source of liquidity, including holding securities used to accommodate pledging requirements. Our securities portfolio totaled $45.8 billion at December 31, 2023, compared to $47.8 billion at December 31, 2022. Available-for-sale securities were $37.2 billion at December 31, 2023, compared to $39.1 billion at December 31, 2022. Held-to-maturity securities were $8.6 billion at December 31, 2023, compared to $8.7 billion at December 31, 2022. As shown in Figure 15, all of our mortgage-backed securities, which include both securities available-for-sale and held-to-maturity securities, are issued by government-sponsored enterprises or GNMA, and are traded in liquid secondary markets. These securities are recorded on the balance sheet at fair value for the available-for-sale portfolio and at cost for the held-to-maturity portfolio. For more information about these securities, see Note 6 (“Fair Value Measurements”) under the heading “Qualitative Disclosures of Valuation Techniques,” and Note 7 (“Securities”). Figure 15. Mortgage-Backed Securities by Issuer December 31, Dollars in millions 2023 2022 FHLMC & FNMA $ 24,302 $ 25,371 GNMA 11,665 11,620 Total (a) $ 35,967 $ 36,991 (a) Includes securities held in the available-for-sale and held-to-maturity portfolios. 67 Table of contents Securities available for sale The majority of our securities available-for-sale portfolio consists of Federal Agency CMOs and mortgage-backed securities. CMOs are debt securities secured by a pool of mortgages or mortgage-backed securities. These mortgage securities generate interest income, serve as collateral to support certain pledging agreements, and provide liquidity value under regulatory requirements. We periodically evaluate our securities available-for-sale portfolio in light of established A/LM objectives, changing market conditions that could affect the profitability of the portfolio, the regulatory environment, and the level of interest rate risk to which we are exposed. These evaluations may cause us to take steps to adjust our overall balance sheet positioning. In addition, the size and composition of our securities available-for-sale portfolio could vary with our needs for liquidity and the extent to which we are required (or elect) to hold these assets as collateral to secure public funds and trust deposits. Although we generally use debt securities for this purpose, other assets, such as securities purchased under resale agreements or letters of credit, are used occasionally when they provide a lower cost of collateral or more favorable risk profiles. Our investing activities continue to complement other balance sheet developments and provide for our ongoing liquidity management needs. Our actions to not reinvest the monthly security cash flows at various times served to provide the liquidity necessary to address our funding requirements. These funding requirements included periodic loan growth and occasional debt maturities. At other times, we may make additional investments that go beyond the replacement of maturities or mortgage security cash flows as our liquidity position and/or interest rate risk management strategies may require. Lastly, our focus on investing in high quality liquid assets, including GNMA-related securities, is related to liquidity management strategies to satisfy regulatory requirements. Figure 16 shows the composition, TE yields, and remaining maturities of our securities available for sale. For more information about these securities, including gross unrealized gains and losses by type of security and securities pledged, see Note 7 (“Securities”). 68 Table of contents Figure 16. Securities Available for Sale Dollars in millions U.S. Treasury, Agencies, and Corporations Agency Residential Collateralized Mortgage Obligations (a) Agency Residential Mortgage-backed Securities (a),(b) Agency Commercial Mortgage-backed Securities (a) Total Weighted-Average Yield (b) December 31, 2023 Remaining maturity: One year or less $ 7,711 $ 29 $ 1 $ 72 $ 7,813 0.50 % After one through five years 1,090 1,653 2,303 2,633 7,679 2.44 After five through ten years 117 8,949 830 5,372 15,268 2.06 After ten years 108 4,847 455 1,015 6,425 1.78 Fair value $ 9,026 $ 15,478 $ 3,589 $ 9,092 $ 37,185 — Amortized cost 9,300 18,911 4,189 10,295 42,695 1.79 % Weighted-average yield (b) 0.83 % 1.79 % 1.62 % 2.70 % 1.79 % — Weighted-average maturity 1.1 years 9.0 years 5.9 years 6.8 years 6.4 years — December 31, 2022 Fair value $ 9,415 $ 16,433 $ 3,920 $ 9,349 $ 39,117 — % Amortized cost 10,044 20,180 4,616 10,712 45,552 1.67 (a) Maturity is based upon expected average lives rather than contractual terms. (b) Weighted-average yields are calculated based on amortized cost. Such yields have been adjusted to a TE basis using the statutory federal income tax rate in effect that calendar year. Held-to-maturity securities The majority of our held-to-maturity portfolio consists of Federal Agency CMOs and mortgage-backed securities. The portfolio is also comprised of asset-backed securities and foreign bonds. Figure 17 shows the composition, yields, and remaining maturities of these securities. Figure 17. Held-to-Maturity Securities Dollars in millions Agency Residential Collateralized Mortgage Obligations (a) Agency Residential Mortgage-backed Securities (a) Agency Commercial Mortgage-backed Securities (a) Asset-backed securities Other Securities Total Weighted-Average Yield (b) December 31, 2023 Remaining maturity: One year or less $ 14 $ — $ 4 $ 733 $ 4 $ 755 2.11 % After one through five years 1,446 112 2,155 2 25 3,740 3.34 After five through ten years 2,562 8 278 3 — 2,851 3.72 After ten years 1,148 45 36 — — 1,229 4.26 Amortized cost $ 5,170 $ 165 $ 2,473 $ 738 $ 29 $ 8,575 3.49 % Fair value 4,896 152 2,270 709 29 8,056 — Weighted-average yield (b) 3.82 % 2.81 % 3.26 % 2.09 % 4.09 % 3.49 % — Weighted-average maturity 7.5 years 7.3 years 4.0 years .6 years 2.5 years 5.9 years — December 31, 2022 Amortized cost $ 4,586 $ 181 $ 2,522 $ 1,407 $ 14 $ 8,710 3.18 % Fair value 4,308 165 2,315 1,311 14 8,113 — (a) Maturity is based upon expected average lives rather than contractual terms. (b) Weighted-average yields are calculated based on amortized cost. Such yields have been adjusted to a TE basis using the statutory federal income tax rate in effect that calendar year. 69 Table of contents Deposits and other sources of funds Figure 18. Breakdown of Deposits at December 31, 2023 The following presents the breakdown of our deposits by product for the noted periods. December 31, Dollars in billions 2023 2022 Money market deposits $ 37.0 $ 34.6 Demand deposits 57.7 52.1 Savings deposits 5.4 7.7 Time deposits 14.8 7.4 Noninterest bearing deposits 30.7 40.8 Total $ 145.6 $ 142.6 Our highly diversified deposit base is our primary source of funding. At December 31, 2023, our deposits totaled $145.6 billion, an increase of $3.0 billion, compared to December 31, 2022. The increase reflects our durable relationship-based business model, in addition to changing client behavior as a result of higher interest rates. Uninsured deposits totaled $61.5 billion and $67.1 billion at December 31, 2023 and December 31, 2022, respectively. Uninsured deposits are defined as the portion of deposit accounts in U.S. offices that exceed the FDIC insurance limit or similar state deposit insurance regimes and amounts in any other uninsured investment or deposit accounts that are classified as deposits and not subject to any federal or state deposit insurance regimes. Figure 19 presents estimated uninsured deposits for the noted periods which reflect amounts disclosed in KeyBank’s Call Report adjusted for intercompany deposits, which are not customer facing and are eliminated in consolidation, and accrued interest. 70 Table of contents Figure 19. Estimated Uninsured Deposits December 31, Dollars in billions 2023 2022 Uninsured deposits (a) $ 61.5 $ 67.1 Total deposits 145.6 142.6 Uninsured % of Deposits 42 % 47 % (a) Intercompany deposits and accrued interest excluded from uninsured deposits $ 9.5 $ 8.4 As of December 31, 2023 and December 31, 2022, approximately $13.1 billion and $11.6 billion, respectively, of uninsured deposits were collateralized by government-backed securities. Figure 20 presents the maturity distribution of estimated uninsured time deposits. Figure 20. Maturity Distribution of Uninsured Time Deposit Amounts December 31, Dollars in millions 2023 2022 Remaining maturity: Three months or less $ 480 $ 32 After three through six months 324 78 After six through twelve months 353 82 After twelve months 52 97 Total $ 1,209 $ 289 Wholesale funds, consisting of short-term borrowings and long-term debt, totaled $22.6 billion at December 31, 2023, compared to $28.8 billion at December 31, 2022. The decrease reflects our balance sheet optimization efforts, which reduced our need for wholesale borrowings. For more information regarding our wholesale funds, see Item 7. Management’s Discussion & Analysis of Financial Condition & Results of Operations under the heading “Risk Management - Liquidity risk management” of this report. Capital Our capital management objective is to maintain capital levels consistent with our risk appetite and of a sufficient amount to operate under a wide range of economic conditions. Our current capital levels position us well to execute against our capital priorities including supporting organic growth and paying dividends. The following sections discuss certain ways we have deployed our capital. For further information, see the Consolidated Statements of Changes in Equity and Note 24 (“Shareholders' Equity”). (a) Common Share repurchases were suspended during the second quarter of 2020 in response to the COVID-19 pandemic and resumed in the first quarter of 2021. Dividends Consistent with our capital plans, the Board declared a quarterly dividend of $.205 per Common Share for each of the four quarters of 2023. These quarterly dividend payments brought our annual dividend to $.82 per Common Share for 2023. 71 Table of contents Common Shares outstanding Our Common Shares are traded on the NYSE under the symbol KEY with 28,577 holders of record at December 31, 2023. Our book value per Common Share was $13.02 based on 936.6 million shares outstanding at December 31, 2023, compared to $11.79 based on 933.3 million shares outstanding at December 31, 2022. At December 31, 2023, our tangible book value per Common Share was $10.02, compared to $8.75 at December 31, 2022. Figure 21 shows activities that caused the change in our outstanding Common Shares over the past two years. Figure 21. Changes in Common Shares Outstanding 2023 Quarters In thousands 2023 Fourth Third Second First 2022 Shares outstanding at beginning of period 933,325 936,161 935,733 935,229 933,325 928,850 Open market repurchases and return of shares under employee compensation plans (4,383) (2) (10) (38) (4,333) (1,736) Shares issued under employee compensation plans (net of cancellations) 7,622 405 438 542 6,237 6,211 Shares outstanding at end of period 936,564 936,564 936,161 935,733 935,229 933,325 During 2023, Common Shares outstanding increased by 3.2 million shares, primarily driven by issuances under employee compensation plans. For more information on share repurchases activity, see Note 24 (“Shareholders' Equity”). At December 31, 2023, we had 320.1 million treasury shares, compared to 323.4 million treasury shares at December 31, 2022. Going forward, we expect to reissue treasury shares as needed in connection with stock-based compensation awards and for other corporate purposes. Capital adequacy Capital adequacy is an important indicator of financial stability and performance. All of our capital ratios remained in excess of regulatory requirements at December 31, 2023. Our capital and liquidity levels are intended to position us to weather an adverse operating environment while continuing to serve our clients’ needs, as well as to meet the Regulatory Capital Rules described in the “Supervision and regulation” section of Item 1 of this report. Our shareholders’ equity to assets ratio was 7.8% at December 31, 2023, compared to 7.1% at December 31, 2022. Our tangible common equity to tangible assets ratio was 5.1% at December 31, 2023, compared to 4.4% at December 31, 2022. The minimum capital and leverage ratios under the Regulatory Capital Rules together with the estimated ratios of KeyCorp at December 31, 2023, calculated on a fully phased-in basis, are set forth under the heading “Basel III” in the “Supervision and Regulation” section in Item 1 of this report. Figure 22 represents the details of our regulatory capital positions at December 31, 2023, and December 31, 2022, under the Regulatory Capital Rules. Information regarding the regulatory capital ratios of KeyCorp’s banking subsidiaries is presented in Note 24 (“Shareholders' Equity”). 72 Table of contents Figure 22. Capital Components and Risk-Weighted Assets December 31, Dollars in millions 2023 2022 COMMON EQUITY TIER 1 Key shareholders’ equity (GAAP) $ 14,637 $ 13,454 Less: Preferred Stock (a) 2,446 2,446 Add: CECL phase-in (b) 118 178 Common Equity Tier 1 capital before adjustments and deductions 12,309 11,186 Less: Goodwill, net of deferred taxes 2,594 2,612 Intangible assets, net of deferred taxes 49 88 Deferred tax assets 1 1 Net unrealized gains (losses) on available-for-sale securities, net of deferred taxes (4,296) (4,857) Accumulated gains (losses) on cash flow hedges, net of deferred taxes (656) (1,160) Amounts in AOCI attributed to pension and postretirement benefit costs, net of deferred taxes (277) (277) Total Common Equity Tier 1 capital 14,894 14,779 TIER 1 CAPITAL Common Equity Tier 1 14,894 14,779 Additional Tier 1 capital instruments and related surplus 2,446 2,446 Less: Deductions — — Total Tier 1 capital 17,340 17,225 TIER 2 CAPITAL Tier 2 capital instruments and related surplus 2,020 2,200 Allowance for losses on loans and liability for losses on lending-related commitments (c) 1,668 1,351 Less: Deductions — — Total Tier 2 capital 3,688 3,551 Total risk-based capital $ 21,028 $ 20,776 RISK-WEIGHTED ASSETS Risk-weighted assets on balance sheet $ 115,861 $ 125,900 Risk-weighted off-balance sheet exposure 31,555 35,745 Market risk-equivalent assets 1,159 826 Gross risk-weighted assets 148,575 162,471 Less: Excess allowance for loan and lease losses — — Net risk-weighted assets $ 148,575 $ 162,471 AVERAGE QUARTERLY TOTAL ASSETS $ 191,948 $ 193,986 CAPITAL RATIOS Tier 1 risk-based capital 11.67 % 10.60 % Total risk-based capital 14.15 12.79 Leverage (d) 9.03 8.88 Common Equity Tier 1 10.02 9.10 (a) Net of capital surplus. (b) Amount reflects our decision to adopt the CECL transitional provision. (c) The ALLL included in Tier 2 capital is limited by regulation to 1.25% of the institution’s standardized total risk-weighted assets (excluding its standardized market risk-weighted assets). The ALLL includes $16 million and $21 million of allowance classified as “discontinued assets” on the balance sheet at December 31, 2023, and December 31, 2022, respectively. (d) This ratio is Tier 1 capital divided by average quarterly total assets as defined by the Federal Reserve less: (i) goodwill, (ii) the disallowed intangible and deferred tax assets, and (iii) other deductions from assets for leverage capital purposes. Off-Balance Sheet Arrangements Off-balance sheet arrangements We are party to various types of off-balance sheet arrangements, which could lead to contingent liabilities or risks of loss that are not reflected on the balance sheet. Variable interest entities In accordance with the applicable accounting guidance for consolidations, we consolidate a VIE if we have: (i) a variable interest in the entity; (ii) the power to direct activities of the VIE that most significantly impact the entity’s economic performance; and (iii) the obligation to absorb losses of the entity or the right to receive benefits from the entity that could potentially be significant to the VIE (i.e., we are considered to be the primary beneficiary). Additional information regarding the nature of VIEs and our involvement with them is included in Note 1 (“Summary of Significant Accounting Policies”) under the heading “Principles of Consolidation and Basis of Presentation” and in Note 13 (“Variable Interest Entities”). 73 Table of contents Commitments to extend credit or funding Loan commitments provide for financing on predetermined terms as long as the client continues to meet specified criteria. These commitments generally carry variable rates of interest and have fixed expiration dates or other termination clauses. We typically charge a fee for our loan commitments. Since a commitment may expire without resulting in a loan or being fully utilized, the total amount of an outstanding commitment may significantly exceed any related cash outlay. Further information about our loan commitments at December 31, 2023, is presented in Note 22 (“Commitments, Contingent Liabilities, and Guarantees”) under the heading “Commitments to Extend Credit or Funding.” Other off-balance sheet arrangements Other off-balance sheet arrangements include financial instruments that do not meet the definition of a guarantee in accordance with the applicable accounting guidance, and other relationships, such as liquidity support provided to asset-backed commercial paper conduits, indemnification agreements and intercompany guarantees. Information about such arrangements is provided in Note 22 under the heading “Other Off-Balance Sheet Risk.” Guarantees We are a guarantor in various agreements with third parties. As guarantor, we may be contingently liable to make payments to the guaranteed party based on changes in a specified interest rate, foreign exchange rate or other variable (including the occurrence or nonoccurrence of a specified event). These variables, known as underlyings, may be related to an asset or liability, or another entity’s failure to perform under a contract. Additional information regarding these types of arrangements is presented in Note 22 (“Commitments, Contingent Liabilities, and Guarantees”) under the heading “Guarantees.” Risk Management Overview Like all financial services companies, we engage in business activities and assume the related risks. The most significant risks we face are credit, compliance, operational, liquidity, market, reputation, strategic, and model risks. Our risk management activities are shown in the following chart, and we manage such risks across the entire enterprise to maintain safety and soundness and maximize profitability. Certain of these risks are defined and discussed in greater detail in the remainder of this section. Federal banking regulators continue to emphasize with financial institutions the importance of relating capital management strategy to the level of risk at each institution. We believe our internal risk management processes help us achieve and maintain capital levels that are commensurate with our business activities and risks, and 74 Table of contents conform to regulatory expectations. The table below depicts our risk management hierarchy and associated responsibilities and activities of each group. 75 Table of contents Group Overview and Responsibilities Activities Board of Directors – Oversight capacity – Oversees that Key’s risks are managed in a manner that is effective and balanced – Fiduciary duty to Key’s shareholders – Understands Key's risk philosophy – Approves the risk appetite – Inquires about risk practices – Reviews the portfolio of risks – Compares the actual risks to the risk appetite – Is apprised of significant risks, both actual and emerging, and determines whether management is responding appropriately – Challenges management and promotes accountability Board of Directors Audit Committee (a) – Oversight of financial statement integrity, regulatory and legal requirements, independent auditors’ qualifications and independence, and the performance of the internal audit function and independent auditors – Financial reporting, legal matters, and fraud risk – Meets with management and approves significant policies relating to the risk areas overseen by the Audit Committee – Receives reports on enterprise risk – Meets bi-monthly – Convenes to discuss the content of our financial disclosures and quarterly earnings releases Board of Directors Risk Committee (a) – Assist the Board in oversight of strategies, policies, procedures, and practices relating to the assessment and management of enterprise-wide risk, including credit, market, liquidity, model, operational, compliance, reputation, and strategic risks – Assist the Board in overseeing risks related to capital adequacy, capital planning, and capital actions – Reviews and provides oversight of management’s activities related to the enterprise-wide risk management framework, which includes an annual review of the ERM Policy, including the Risk Appetite Statement, and management and ERM reports – Approves any material changes to the charter of the ERM Committee and significant policies relating to risk management, including corporate risk tolerances for major risk categories ERM Committee – Chaired by the Chief Executive Officer and comprising other senior level executives – Manage risk and ensure that the corporate risk profile is managed in a manner consistent with our risk appetite – Oversees the ERM Program, which encompasses our risk philosophy, policy, framework, and governance structure for the management of risks across the entire company – Approves and manages the risk-adjusted capital framework we use to manage risks Disclosure Committee – Includes representatives from each of the Three Lines of Defense – Meets quarterly to review recent internal and external events to determine whether all appropriate disclosures have been made in reports filed with the SEC – Convenes quarterly to discuss the content of our 10-Q and 10-K Tier 2 Risk Governance Committees – Include attendees from each of the Three Lines of Defense – The First Line of Defense is the line of business primarily responsible to accept, own, proactively identify, monitor, and manage risk – The Second Line of Defense comprises Risk Management representatives who provide independent, centralized oversight over all risk categories by aggregating, analyzing, and reporting risk information – Risk Review, our internal audit function, provides the Third Line of Defense. Its role is to provide independent assessment and testing of the effectiveness of, appropriateness of, and adherence to KeyCorp’s risk management policies, practices, and controls – Supports the ERM Committee by identifying early warning events and trends, escalating emerging risks, and discussing forward-looking assessments Chief Risk Officer – Ensure that relevant risk information is properly integrated into strategic and business decisions – Ensure appropriate ownership of risks – Provides input into performance and compensation decisions – Assesses aggregate enterprise risk – Monitors capabilities to manage critical risks – Executes appropriate Board and stakeholder reporting (a) The Audit and Risk Committees meet jointly, as appropriate, to discuss matters that relate to each committee’s responsibilities. Committee chairpersons routinely meet with management during interim months to plan agendas for upcoming meetings and to discuss emerging trends and events that have transpired since the preceding meeting. All members of the Board receive formal reports designed to keep them abreast of significant developments during the interim months. Market risk management Market risk is the risk that movements in market risk factors, including interest rates, foreign exchange rates, equity prices, commodity prices, credit spreads, and volatilities will reduce Key’s income and the value of its portfolios. These factors influence prospective yields, values, or prices associated with the instrument. We are exposed to market risk both in our trading and nontrading activities, which include asset and liability management activities. Our risk management activities are focused on ensuring that we properly identify, measure, and manage such risks across the entire enterprise to maintain safety and soundness, and to maximize profitability. Information regarding our fair value policies, procedures, and methodologies is provided in Note 1 (“Summary of Significant Accounting Policies”) under the heading “Fair Value Measurements” and Note 6 (“Fair Value Measurements”) in this report. 76 Table of contents Trading market risk Key incurs market risk as a result of trading activities that are used in support of client facilitation and hedging activities, principally within our investment banking and capital markets businesses. Key has exposures to a wide range of risk factors including interest rates, equity prices, foreign exchange rates, credit spreads, and commodity prices, as well as the associated implied volatilities and spreads. Our primary market risk exposures are a result of trading and hedging activities in the derivative and fixed income markets, including securitization exposures. At December 31, 2023, we did not have any re-securitization positions. We maintain modest trading inventories to facilitate customer flow, make markets in securities, and hedge certain risks including but not limited to credit risk and interest rate risk. The risks associated with these activities are mitigated in accordance with the Market Risk hedging policy. The majority of our positions are traded in active markets. Management of trading market risks . Market risk management is an integral part of Key’s risk culture. The Risk Committee of our Board provides oversight of trading market risks. The ERM Committee and the Market Risk Committee regularly review and discuss market risk reports prepared by our MRM that contain our market risk exposures and results of monitoring activities. Market risk policies and procedures have been defined and take into account our tolerance for risk and consideration for the business environment. The Market Risk Committee approves market risk policies and recommends our significant market risk policy to the ERM Committee, the KeyBank Board, and the Risk Committee of the Board for approval. The MRM, as the second line of defense, is an independent risk management function that partners with the lines of business to identify, measure, and monitor market risks throughout our company. The MRM is responsible for ensuring transparency of significant market risks, monitoring compliance with established limits, and escalating limit exceptions to appropriate senior management. The various business units and trading desks are responsible for ensuring that market risk exposures are well-managed and prudent. Market risk is monitored through various measures, such as VaR, and through routine stress testing, sensitivity, and scenario analyses. The MRM conducts stress tests for each position using historical worst case and standard shock scenarios. VaR, stressed VaR, and other analyses are prepared daily and distributed to appropriate management. Covered positions. We monitor the market risk of our covered positions as defined in the Market Risk Rule, which includes all of our trading positions as well as all foreign exchange and commodity positions, regardless of whether the position is in a trading account. Key’s covered positions may also include mortgage-backed and asset-backed securities that may be identified as securitization positions or re-securitization positions under the Market Risk Rule. The MRM as well as the LOB that trades securitization positions monitor the positions, the portfolio composition and the risks identified in this section on a daily basis consistent with the Market Risk policies and procedures. At December 31, 2023, covered positions did not include any re-securitization positions. Instruments that are used to hedge nontrading activities, such as bank-issued debt and loan portfolios, equity positions that are not actively traded, and securities financing activities, do not meet the definition of a covered position. The MRM is responsible for identifying our portfolios as either covered or non-covered. The Covered Position Working Group develops the final list of covered positions, and a summary is provided to the Market Risk Committee. Our significant portfolios of covered positions are detailed below. We analyze market risk by portfolios of covered positions and do not separately measure and monitor our portfolios by risk type. The descriptions below incorporate the respective risk types associated with each of these portfolios. • Fixed income includes those instruments associated with our capital markets business and the trading of securities as a dealer. These instruments may include positions in municipal bonds, bonds backed by the U.S. government, agency and corporate bonds, certain mortgage-backed and asset-backed securities, securities issued by the U.S. Treasury, money markets, and certain CMOs. The activities and instruments within the fixed income portfolio create exposures to interest rate and credit spread risks. • Interest rate derivatives include interest rate swaps, caps, and floors, which are transacted primarily to accommodate the needs of commercial loan clients. In addition, we enter into interest rate derivatives to offset or mitigate the interest rate risk related to the client positions. The activities within this portfolio create exposures to interest rate risk. VaR and stressed VaR. VaR is the estimate of the maximum amount of loss on an instrument or portfolio due to adverse market conditions during a given time interval within a stated confidence level. Stressed VaR is used to assess extreme conditions on market risk within our trading portfolios. The MRM calculates VaR and stressed VaR 77 Table of contents on a daily basis, and the results are distributed to appropriate management. VaR and stressed VaR results are also provided to our regulators and utilized in regulatory capital calculations. We use a historical simulation VaR model to measure the potential adverse effect of changes in interest rates, foreign exchange rates, equity prices, and credit spreads on the fair value of our covered positions and other non-covered positions. We analyze market risk by portfolios and do not separately measure and monitor our portfolios by risk type. Historical scenarios are customized for specific positions, and numerous risk factors are incorporated in the calculation. Additional consideration is given to the risk factors to estimate the exposures that contain optionality features, such as options and cancellable provisions. VaR is calculated using daily observations over a one-year time horizon, and approximates a 95% confidence level. Statistically, this means that we would expect to incur losses greater than VaR, on average, five out of 100 trading days, or three to four times each quarter. We also calculate VaR and stressed VaR at a 99% confidence level. The VaR model is an effective tool in estimating ranges of possible gains and losses on our positions. However, there are limitations inherent in the VaR model since it uses historical results over a given time interval to estimate future performance. Historical results may not be indicative of future results, and changes in the market or composition of our portfolios could have a significant impact on the accuracy of the VaR model. We regularly review and enhance the modeling techniques, inputs, and assumptions used. Our market risk policy includes the independent validation of our VaR model by Key’s internal model validation group on an annual basis. The Model Risk Committee oversees the Model Validation Program, and results of validations are discussed with the ERM Committee. Actual losses for the total covered positions did not exceed aggregate daily VaR for any day during the quarters ended December 31, 2023, and December 31, 2022. The MRM backtests our VaR model on a daily basis to evaluate its predictive power. The test compares VaR model results at the 99% confidence level to daily held profit and loss. Results of back testing are provided to the Market Risk Committee. Backtesting exceptions occur when trading losses exceed VaR. We do not engage in correlation trading or utilize the internal model approach for measuring default and credit migration risk. Our net VaR approach incorporates diversification, but our VaR calculation does not include the impact of counterparty risk and our own credit spreads on derivatives. The aggregate VaR at the 99% confidence level with a one day holding period for all covered positions was $1.6 million at December 31, 2023, and $1.1 million at December 31, 2022. Figure 23 summarizes our VaR at the 99% confidence level with a one day holding period for significant portfolios of covered positions for the three months ended December 31, 2023, and December 31, 2022. Figure 23. VaR for Significant Portfolios of Covered Positions 2023 2022 Three months ended December 31, Three months ended December 31, Dollars in millions High Low Mean December 31, High Low Mean December 31, Trading account assets: Fixed income $ 1.3 $ .7 $ 1.1 $ 1.1 $ 1.1 $ .4 $ .7 $ .4 Derivatives: Interest rate $ .5 $ .3 $ .4 $ .4 $ .7 $ .2 $ .3 $ .6 Stressed VaR is calculated by running the portfolios through a predetermined stress period which is approved by the Market Risk Committee and is calculated at the 99% confidence level using the same model and assumptions used for general VaR. The aggregate stressed VaR for all covered positions was $4.0 million at December 31, 2023, and $1.9 million at December 31, 2022. Figure 24 summarizes our stressed VaR at the 99% confidence level with a one day holding period for significant portfolios of covered positions for the three months ended December 31, 2023, and December 31, 2022. The increase in stressed VaR is due to a change in the size and composition of our fixed income inventory. 78 Table of contents Figure 24. Stressed VaR for Significant Portfolios of Covered Positions 2023 2022 Three months ended December 31, Three months ended December 31, Dollars in millions High Low Mean December 31, High Low Mean December 31, Trading account assets: Fixed income $ 4.7 $ 1.9 $ 3.1 $ 3.6 $ 2.4 $ 1.1 $ 1.6 $ 1.1 Derivatives: Interest rate $ .4 $ .2 $ .3 $ .3 $ .7 $ .2 $ .3 $ .6 Internal capital adequacy assessment. Market risk is a component of our internal capital adequacy assessment. Our risk-weighted assets include a market risk-equivalent asset amount, which consists of a VaR component, stressed VaR component, a de minimis exposure amount, and a specific risk add-on including the securitization positions. The aggregate market value of the securitization positions as defined by the Market Risk Rule was $6 million at December 31, 2023, all of which were mortgage-backed security positions. Specific risk is the price risk of individual financial instruments, which is not accounted for by changes in broad market risk factors and is measured through a standardized approach. Market risk weighted assets, including the specific risk calculations, are run quarterly by the MRM in accordance with the Market Risk Rule, and approved by the Chief Market Risk Officer. Nontrading market risk Most of our nontrading market risk is derived from interest rate fluctuations and its impacts on our traditional loan and deposit products, as well as investments, hedging relationships, long-term debt, and certain short-term borrowings. Interest rate risk, which is inherent in the banking industry, is measured by the potential for fluctuations in net interest income and the EVE. Such fluctuations may result from changes in interest rates and differences in the repricing and maturity characteristics of interest-earning assets and interest-bearing liabilities. We manage the exposure to changes in net interest income and the EVE in accordance with our risk appetite and in accordance with the Board approved ERM policy. Interest rate risk positions are influenced by a number of factors, including the balance sheet positioning that arises out of customer preferences for loan and deposit products, economic conditions, the competitive environment within our markets, changes in market interest rates that affect client activity, and our hedging, investing, funding, and capital positions. The primary components of interest rate risk exposure consist of reprice risk, basis risk, yield curve risk, and option risk. • “Reprice risk ” is the exposure to changes in the level of interest rates and occurs when the volume of interest-bearing liabilities and the volume of interest-earning assets they fund (e.g., deposits used to fund loans) do not mature or reprice at the same time. • “Basis risk” is the exposure to asymmetrical changes in interest rate indexes and occurs when floating-rate assets and floating-rate liabilities reprice at the same time, but in response to different market factors or indexes. • “Yield curve risk” is the exposure to non-parallel changes in the slope of the yield curve (where the yield curve depicts the relationship between the yield on a particular type of security and its term to maturity) and occurs when interest-bearing liabilities and the interest-earning assets that they fund do not price or reprice to the same term point on the yield curve. • “Option risk” is the exposure to a customer or counterparty’s ability to take advantage of the interest rate environment and terminate or reprice one of our assets, liabilities, or off-balance sheet instruments prior to contractual maturity without a penalty. Option risk occurs when exposures to customer and counterparty early withdrawals or prepayments are not mitigated with an offsetting position or appropriate compensation. The management of nontrading market risk is centralized within Corporate Treasury. The Risk Committee of our Board provides oversight of nontrading market risk. The ERM Committee, the ALCO, and the Treasury Risk Oversight Committee (“TROC”) review reports on the interest rate risk exposures described above. In addition, the ALCO reviews reports on stress tests and sensitivity analyses related to interest rate risk. These committees have various responsibilities related to managing nontrading market risk, including recommending, approving, and monitoring strategies that maintain risk positions within approved tolerance ranges. The A/LM policy provides the framework for the oversight and management of interest rate risk and is administered by the ALCO. The MRM, as the second line of defense, provides additional oversight. 79 Table of contents LIBOR Transition Key had successfully transitioned substantially all of it its products away from LIBOR as of June 30, 2023. For most financial products, the most common alternative reference rates have been SOFR-based benchmarks. This is true for both new originations and legacy LIBOR contracts that were subject to amendment or a transition by their terms. We have also originated a small number of new loans using credit sensitive rates in a limited and managed fashion. Net interest income simulation analysis. The primary tool we use to measure our interest rate risk is simulation analysis. For purposes of this analysis, we estimate our net interest income based on the current and projected composition of our on- and off-balance sheet positions, accounting for recent and anticipated trends in customer activity. The analysis also incorporates assumptions for the current and projected interest rate environments and balance sheet growth projections based on a most likely macroeconomic view. The modeling incorporates investment portfolio and swap portfolio balances consistent with management's desired interest rate risk positioning. The simulation model estimates the amount of net interest income at risk by simulating the change in net interest income that would occur if rates were to gradually increase or decrease from current levels over the next 12 months (subject to a floor on market interest rates at zero). Figure 25 presents the results of the simulation analysis at December 31, 2023, and December 31, 2022. At December 31, 2023, our simulated impact to changes in interest rates was moderate low. The exposure to declining rates has decreased as a result of the change in balance sheet mix compared to the December 31, 2022 analysis. Tolerance levels for risk management require the development of remediation plans to maintain residual risk within tolerance if simulation modeling demonstrates that a gradual, parallel 200 basis point increase or 200 basis point decrease in interest rates over the next 12 months would adversely affect net interest income over the same period by more than 5.5%. Current modeled exposure is within Board approved tolerances. If a tolerance level is breached and determined inconsistent with risk appetite, the development of a remediation plan is required to reduce exposure back to within tolerance. Figure 25. Simulated Change in Net Interest Income December 31, 2023 December 31, 2022 Basis point change assumption -200 +200 -200 +200 Assumed floor in market rates (in basis points) — N/A — N/A Rising rate beta N/A Mid 50s N/A Mid 40s Tolerance level (5.50) % (5.50) % (5.50) % (5.50) % Interest rate risk assessment (0.01) % (2.08) % (1.66) % (2.61) % +200 NII at risk beta sensitivity December 31, 2023 Beta assumption Mid 60s Low 60s Mid 50s Low 50s Interest rate risk assessment (4.65) % (3.36) % (2.08) % (0.85) % Simulation analysis produces a sophisticated estimate of interest rate exposure based on assumptions inputs within the model. Assumptions are tailored to the specific interest rate environment and validated on a regular basis. However, actual results may differ from those derived in simulation analyses due to unanticipated changes to the balance sheet composition, customer behavior, product pricing, market interest rates, changes in management’s desired interest rate risk positioning, investment, funding and hedging activities or repercussions from exogenous events . Regular stress tests and sensitivity analyses are performed on the model inputs that could materially change the resulting risk assessments. Assessments are performed using different yield curve shapes, including steepenings or flattenings of the curve, immediate changes in market interest rates, and changes in the relationship of money market interest rates. Assessments are also performed on changes to the following assumptions: loan and deposit balances, the pricing of deposits without contractual maturities, changes in lending spreads, prepayments on loans and securities, investment, funding and hedging activities, and liquidity and capital management strategies. The results of additional assessments indicate that net interest income could increase or decrease from the base simulation results presented in Figure 25. Net interest income is highly dependent on the timing, magnitude, frequency, and path of interest rate changes and the associated assumptions for deposit repricing relationships, lending spreads, and the balance behavior of transaction accounts. If fixed rate assets increase by $1 billion, or fixed rate liabilities decrease by $1 billion, then the benefit to rising rates would decrease by approximately 29 basis points. If the interest-bearing liquid deposit beta assumption increases or decreases by 5% (e.g., 40% to 45%), then the benefit to rising rates would decrease or increase by approximately 123 basis points. 80 Table of contents The current interest rate risk position could fluctuate to higher or lower levels of risk depending on the competitive environment and client behavior that may affect the actual volume, mix, maturity, and repricing characteristics of loan and deposit flows. Corporate Treasury discretionary activities related to funding, investing, and hedging may also change as a result of changes in customer business flows or changes in management’s desired interest rate risk positioning. As changes occur to both the configuration of the balance sheet and the outlook for the economy, management proactively evaluates hedging opportunities that may change our interest rate risk profile. Simulations are also conducted that measure the effect of changes in market interest rates in the second and third years of a three-year horizon. These simulations are conducted in a similar manner to those based on a 12-month horizon. To capture longer-term exposures, changes in the EVE are calculated as discussed in the following section. Economic value of equity modeling. EVE complements net interest income simulation analysis as it estimates risk exposure beyond 12-, 24-, and 36-month horizons. EVE modeling measures the extent to which the economic values of assets, liabilities, and off-balance sheet instruments may change in response to fluctuations in interest rates. EVE is calculated by subjecting the balance sheet to an immediate increase or decrease in interest rates, measuring the resulting change in the values of assets, liabilities, and off-balance sheet instruments, and comparing those amounts with the base case of the current interest rate environment. EVE policy limits are measured against a +200 basis point/policy decline scenario. The resulting rate in the policy decline scenario is equal to the greater of the current fed funds target and zero. As of December 31, 2023, the policy decline scenario is minus 200 basis points. This analysis is highly dependent upon assumptions applied to assets and liabilities with non-contractual maturities. Those assumptions are based on historical behaviors, as well as forward expectations. Remediation plans are similarly developed if this analysis indicates that our EVE will decrease by more than 15% in response to an immediate increase or decrease in interest rates. The position is within these guidelines as of December 31, 2023. Management of interest rate exposure. The results of the various interest rate risk analyses are used to formulate A/LM strategies to achieve the desired risk profile while managing to objectives for capital adequacy and liquidity risk exposures. Specifically, risk positions are managed by purchasing securities, issuing term debt with floating or fixed interest rates, and using derivatives. Interest rate swaps and options are predominantly used, which modify the interest rate characteristics of certain assets and liabilities. Figure 26 shows all swap positions held for A/LM purposes. These positions are used to convert the contractual interest rate index of agreed-upon amounts of assets and liabilities (i.e., notional amounts) to another interest rate index. For example, fixed-rate debt is converted to a floating rate through a “receive fixed/pay variable” interest rate swap. The volume, maturity, and mix of portfolio swaps change frequently to reflect broader A/LM objectives and the balance sheet positions to be hedged. For more information about how interest rate swaps are used to manage our risk profile, see Note 8 (“Derivatives and Hedging Activities”). Figure 26. Portfolio Swaps and Options by Interest Rate Risk Management Strategy December 31, 2023 Weighted-Average December 31, 2022 Dollars in millions Notional Amount Fair Value Maturity (Years) Receive Rate Pay Rate Notional Amount Fair Value Receive fixed/pay variable — conventional loans $ 15,000 $ (641) 2.3 2.0 % 5.4 % $ 28,450 $ (1,503) Receive fixed/pay variable — conventional debt 8,976 (395) 3.9 2.5 5.4 10,995 (551) Receive fixed/pay variable — forward loans 4,000 (27) 2.6 3.5 5.0 1,300 (8) Receive fixed/pay variable — forward debt 1,411 (40) 6.6 3.1 5.3 — — Pay fixed/receive variable — conventional debt 50 1 4.5 5.6 3.6 50 1 Pay fixed/receive variable — securities 8,655 (152) 4.1 5.4 4.0 405 48 Total portfolio swaps $ 38,092 $ (1,254) (a) 3.3 3.1 % 5.0 % $ 41,200 $ (2,013) (a) Floors — forward purchased $ 3,250 $ 26 2.1 — % — % $ — $ — Floors — forward sold 3,250 (11) 2.1 — — — — Total floors $ 6,500 $ 15 — — % — % $ — $ — a. Excludes accrued interest of $58 million and $62 million at December 31, 2023, and December 31, 2022, respectively. 81 Table of contents Liquidity risk management Liquidity risk, which is inherent in the banking industry, is measured by our ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, and fund new business opportunities at a reasonable cost, in a timely manner, and without adverse consequences. Liquidity management involves maintaining sufficient and diverse sources of funding to accommodate planned, as well as unanticipated, changes in assets and liabilities under both normal and adverse conditions. Governance structure We manage liquidity for all of our affiliates on an integrated basis. This approach considers the funding sources available to each entity, as well as each entity’s capacity to manage through adverse conditions. The approach also recognizes that adverse market conditions or other events that could negatively affect the availability or cost of liquidity will affect the access of all affiliates to sufficient wholesale funding. The management of consolidated liquidity risk is centralized within Corporate Treasury. Oversight and governance is provided by the Board, the ERM Committee, the ALCO, the TROC, and the Chief Risk Officer. The Asset Liability Management Policy provides the framework for the oversight and management of liquidity risk and is administered by the ALCO. The Corporate Treasury Oversight group within the MRM, as the second line of defense, provides additional oversight. Our current liquidity risk management practices are in compliance with the Federal Reserve Board’s Enhanced Prudential Standards. These committees regularly review liquidity and funding summaries, liquidity trends, peer comparisons, variance analyses, liquidity projections, internal liquidity stress tests, and goal tracking reports. The reviews generate a discussion of positions, trends, and directives on liquidity risk and shape a number of our decisions. When liquidity pressure is elevated, positions are monitored more closely and reporting is more intensive. To ensure that emerging issues are identified, we also communicate with individuals inside and outside of the company on a daily basis. Factors affecting liquidity Our liquidity could be adversely affected by both direct and indirect events. An example of a direct event would be a downgrade in our public credit ratings by a rating agency. Examples of indirect events (events unrelated to us) that could impair our access to liquidity would be an act of terrorism or war, natural disasters, global pandemics, political events, or the default or bankruptcy of a major corporation, mutual fund, or hedge fund. Similarly, market speculation, or rumors about us or the banking industry in general, may adversely affect the cost and availability of normal funding sources. During 2023, rating agencies reacted to the volatility in the banking industry by issuing updated ratings for numerous U.S. banks, including Key. On August 21, 2023, Standard & Poor’s downgraded KeyCorp’s and KeyBank’s Long-term Debt ratings from “BBB+” to “BBB”, and from “A-” to “BBB+”, respectively. On October 10, 2023, Fitch Ratings, Inc. downgraded both KeyCorp and KeyBank’s respective Long-Term Debt ratings from “A-” to “BBB+” and, on October 20, 2023, Moody’s downgraded KeyCorp and KeyBank's Long-term Debt ratings from "Baa1" to "Baa2", and from "A3" to "Baa1.” The rationales for Standard & Poor’s, Fitch Ratings, Inc., and Moody’s downgrades are documented in their respective credit opinions and analyses. Our credit ratings at December 31, 2023, are shown in Figure 27. While we believe these credit ratings, under normal conditions in the capital markets, will enable KeyCorp or KeyBank to issue fixed income securities to investors, downgrades in our credit ratings could increase our cost of funds, trigger additional collateral or funding requirements, and decrease the number of investors and counterparties willing to lend to us. 82 Table of contents Figure 27. Credit Ratings December 31, 2023 Short-Term Borrowings Long-Term Deposits (a) Senior Long-Term Debt Subordinated Long-Term Debt Capital Securities Preferred Stock KEYCORP (THE PARENT COMPANY) Standard & Poor’s A-2 N/A BBB BBB- BB BB Moody’s P-2 N/A Baa2 Baa2 Baa3 Ba1 Fitch F2 N/A BBB+ N/A BB BB DBRS R-1 (low) N/A A A (low) A (low) BBB KEYBANK Standard & Poor’s A-2 N/A BBB+ BBB N/A N/A Moody’s P-2 P-1/A2 Baa1 Baa2 N/A N/A Fitch F2 F2/A- BBB+ BBB N/A N/A DBRS R-1 (middle) A (high) A (high) A N/A N/A (a) P-1 rating assigned by Moody’s is specific to KeyBank’s short-term bank deposit ratings. F2 assigned by Fitch Ratings, Inc. is specific to KeyBank’s short-term deposit ratings. Managing liquidity risk Most of our liquidity risk is derived from our business model, which involves taking in deposits, many of which can be withdrawn at any time, and lending them out in the form of illiquid loan assets. The assessments of liquidity risk are measured under the assumption of normal operating conditions as well as under stressed environments. We manage these exposures in accordance with our risk appetite, and within Board-approved policy limits. We regularly monitor our liquidity position and funding sources and measure our capacity to obtain funds in a variety of hypothetical scenarios in an effort to maintain an appropriate mix of available and affordable funding. In the normal course of business, we perform a monthly internal liquidity stress test for both KeyCorp and KeyBank. In a “heightened monitoring mode,” we may conduct internal liquidity stress tests more frequently, and use assumptions to reflect the changed market environment. Our testing incorporates estimates for loan and deposit lives based on our historical studies. Internal liquidity stress tests analyze potential liquidity scenarios under various funding constraints and time periods. Ultimately, they determine the periodic effects that major direct and indirect events would have on our access to funding markets and our ability to fund our normal operations. To compensate for the effect of these assumed liquidity pressures, we consider alternative sources of liquidity and maturities over different time periods to project how funding needs would be managed. Our primary source of funding for KeyBank are customer deposits resulting in a consolidated loan-to-deposit ratio of 78% as of December 31, 2023 . If the cash flows needed to support operating and investing activities are not satisfied by deposit balances, we rely on wholesale funding or on-balance sheet liquid reserves. Conversely, excess cash generated by operating, investing, and deposit-gathering activities may be used to repay outstanding debt or invest in liquid assets. We maintain a Contingency Funding Plan that outlines the process for addressing a liquidity crisis. As part of the plan, we maintain on-balance sheet liquid reserves referred to as our liquid asset portfolio, which consists of high quality liquid assets. During a problem period, that reserve could be used as a source of funding to provide time to develop and execute a longer-term strategy. Figure 28 shows our available contingent liquidity at December 31, 2023 and December 31, 2022. In 2023, our secured term borrowings decreased $1.5 billion from a reduction in FHLB borrowings. Figure 28. Available Contingent Liquidity December 31, Dollars in billions 2023 2022 Available contingent liquidity: Unpledged securities $ 7.5 $ 33.2 Net balances of federal funds sold and balances in our Federal Reserve account 10.7 2.4 Unused secured borrowing capacity at the Federal Reserve Bank of Cleveland 54.7 33.8 Unused secured borrowing capacity at the FHLB 13.6 6.7 Total $ 86.5 $ 76.1 83 Table of contents Long-term liquidity strategy Our long-term liquidity strategy is to be predominantly funded by core deposits. However, we may use wholesale funds to sustain an adequate liquid asset portfolio, meet daily cash demands, and allow management flexibility to execute business initiatives. Key’s client-based relationship strategy provides for a strong core deposit base that, in conjunction with intermediate and long-term wholesale funds managed to a diversified maturity structure and investor base, supports our liquidity risk management strategy. We use the loan-to-deposit ratio as a metric to monitor these strategies. Our target loan-to-deposit ratio is 90-100% (at December 31, 2023, our loan-to-deposit ratio was 77.9%), which we calculate as the sum of total loans, loans held for sale, and nonsecuritized discontinued loans divided by deposits. Liquidity programs We have several liquidity programs, which are described in Note 20 (“Long-Term Debt”), that are designed to enable KeyCorp and KeyBank to raise funds in the public and private debt markets. The proceeds from most of these programs can be used for general corporate purposes, including acquisitions. These liquidity programs are reviewed from time to time by the Board and are renewed and replaced as necessary. There are no restrictive financial covenants in any of these programs. On January 26, 2023, KeyBank issued $500 million of 4.70% Fixed Rate Senior Bank Notes due January 26, 2026 and $1 billion of 5.00% Fixed Rate Senior Bank Notes due January 26, 2033. Accordingly, at December 31, 2023, there was $15.5 billion available for issuance under the KeyBank Bank Note Program. Liquidity for KeyCorp The primary source of liquidity for KeyCorp is from subsidiary dividends, primarily from KeyBank. KeyCorp has sufficient liquidity when it can service its debt; support customary corporate operations and activities (including acquisitions); support occasional guarantees of subsidiaries’ obligations in transactions with third parties at a reasonable cost, in a timely manner, and without adverse consequences; and fund capital distributions in the form of dividends and share buybacks. We use a parent cash coverage months metric as the primary measure to assess parent company liquidity. The parent cash coverage months metric measures the number of months into the future where projected obligations can be met with the current quantity of liquidity. We generally issue term debt to supplement dividends from KeyBank to manage our liquidity position at or above our targeted levels. The parent company generally maintains cash and short-term investments in an amount sufficient to meet projected debt maturities over at least the next 24 months. At December 31, 2023, KeyCorp held $2.7 billion in cash and short-term investments, which we projected to be sufficient to meet our projected obligations, including the repayment of our maturing debt obligations for the periods prescribed by our risk tolerance. Typically, KeyCorp meets its liquidity requirements through regular dividends from KeyBank, supplemented with term debt. Federal banking law limits the amount of capital distributions that a bank can make to its holding company without prior regulatory approval. A national bank’s dividend-paying capacity is affected by several factors, including net profits (as defined by statute) for the two previous calendar years and for the current year, up to the date of dividend declaration. During 2023, KeyBank paid $675 million in cash dividends to KeyCorp, and during the fourth quarter of 2023, KeyBank paid $150 million cash dividends to KeyCorp. At January 1, 2024, KeyBank had regulatory capacity to pay $2.3 billion in dividends to KeyCorp without prior regulatory approval. KeyCorp had no debt issuances during 2023 . Our liquidity position and recent activity Over the past 12 months, our liquid asset portfolio, which includes overnight and short-term investments, as well as unencumbered, high quality liquid securities held as protection against a range of potential liquidity stress scenarios, has increased primarily due to an increase in Key's cash position. The liquid asset portfolio continues to exceed the amount that we estimate would be necessary to manage through an adverse liquidity event by providing sufficient time to develop and execute a longer-term solution. From time to time, KeyCorp or KeyBank may seek to retire, repurchase, or exchange outstanding debt, capital securities, preferred shares, or common shares through cash purchase, privately negotiated transactions or other 84 Table of contents means. During the third quarter of 2023, Key repurchased $92.3 million of KeyBank senior debt consisting of $13.1 million of 3.30% Senior Unsecured Debt due June 1, 2025, $64.7 million of 4.15% Senior Unsecured Debt due August 8, 2025, and $14.5 million of 4.70% Senior Unsecured Debt due January 26, 2026. Additional information on repurchases of Common Shares by KeyCorp is included in Part II, Item 5. Market for the Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities of this report. Such transactions depend on prevailing market conditions, our liquidity and capital requirements, contractual restrictions, regulatory requirements, and other factors. The amounts involved may be material, individually or collectively. The Consolidated Statements of Cash Flows summarize our sources and uses of cash by type of activity for the years ended December 31, 2023, and December 31, 2022. Credit risk management Credit risk is the risk of loss arising from an obligor’s inability or failure to meet contractual payment or performance terms. Like other financial services institutions, we make loans, extend credit, distribute credit risk, purchase securities, provide financial and payments products, and enter into financial derivative contracts, all of which have related credit risk. Credit policy, approval, and evaluation We manage credit risk exposure through a multifaceted program. The Credit Risk Committee approves management credit policies and recommends significant credit policies to the Enterprise Risk Management Committee, the KeyBank Board, and the Risk Committee of the Board for approval. These policies are communicated throughout the organization to foster a consistent approach to granting credit. Our credit risk management team and certain individuals within our lines of business, to whom credit risk management has delegated limited credit authority, are responsible for credit approval. Individuals with assigned credit authority are authorized to grant exceptions to credit policies. It is not unusual to make exceptions to established policies when mitigating circumstances dictate, however, a corporate level tolerance has been established to keep exceptions at an acceptable level based upon portfolio and economic considerations. Our credit risk management team uses risk models to evaluate consumer loans. These models, known as scorecards, forecast the probability of serious delinquency and default for an applicant. The scorecards are embedded in the application processing system, which allows for real-time scoring and automated decisions for many of our products. We periodically validate the loan scoring processes. We maintain an active concentration management program to mitigate concentration risk in our credit portfolios. For individual obligors, we employ a sliding scale of exposure, known as hold limits, which is dictated by the type of loan and strength of the borrower. Allowance for loan and lease losses 85 Table of contents We estimate the appropriate level of the ALLL on at least a quarterly basis. The methodology used is described in Note 1 (“Summary of Significant Accounting Policies”) under the heading “Allowance for Loan and Lease Losses.” Briefly, the ALLL estimate uses various models and estimation techniques based on our historical loss experience, current borrower characteristics, current conditions, reasonable and supportable forecasts and other relevant factors. The ALLL at December 31, 2023, represents our best estimate of the lifetime expected credit losses inherent in the loan portfolio at that date. For more information, see Note 5 (“Asset Quality”). As shown in Figure 29, our ALLL from continuing operations increased by $171 million, or 12.8%, from December 31, 2022. The commercial ALLL increased by $196 million, or 22.7%, from December 31, 2022, driven by portfolio migration and changes in the economic outlook, including the impact from higher interest rates and lower commercial real estate values, partly offset by balance sheet reductions. The consumer ALLL decreased $25 million, or 5.3%, from December 31, 2022, largely driven by changes in the economic forecasts, including improved home price values. Figure 29. Allocation of the Allowance for Loan and Lease Losses 2023 2022 December 31, Dollars in millions Total Allowance Percent of Allowance to Total Allowance Percent of Loan Type to Total Loans Total Allowance Percent of Allowance to Total Allowance Percent of Loan Type to Total Loans Commercial and industrial $ 556 36.9 % 49.6 % $ 601 45.0 % 50.0 % Commercial real estate: Commercial mortgage 419 27.8 13.5 203 15.2 13.7 Construction 52 3.4 2.7 28 2.1 2.1 Total commercial real estate loans 471 31.2 16.2 231 17.3 15.8 Commercial lease financing 33 2.2 3.1 32 2.4 3.3 Total commercial loans 1,060 70.3 68.9 864 64.7 69.1 Real estate — residential mortgage 162 10.7 18.6 196 14.7 17.9 Home equity loans 86 5.7 6.4 98 7.3 6.6 Consumer direct loans 121 8.0 5.2 111 8.3 5.4 Credit cards 78 5.2 .9 66 4.9 .9 Consumer indirect loans 1 .1 — 2 .1 .1 Total consumer loans 448 29.7 31.1 473 35.3 30.9 Total loans (a) $ 1,508 100.0 % 100.0 % $ 1,337 100.0 % 100.0 % (a) Excludes allocations of the ALLL related to the discontinued operations of the education lending business in the amount of $16 million at December 31, 2023, and $21 million at December 31, 2022. Net loan charge-offs Figure 30 shows the trend in our net loan charge-offs by loan type, while the composition of loan charge-offs and recoveries by type of loan is presented in Figure 32. Figure 31 shows the ratio of net charge-offs by loan category as a percentage of the respective average loan balance. Over the past 12 months, net loan charge-offs increased $83 million. Figure 30. Net Loan Charge-offs from Continuing Operations Year ended December 31, Dollars in millions 2023 2022 Commercial and industrial $ 144 $ 103 Real estate — commercial mortgage 37 18 Real estate — construction (1) (1) Commercial lease financing (a) (5) (2) Total commercial loans 175 118 Real estate — residential mortgage (a) (3) (7) Home equity loans (1) (2) Consumer direct loans 43 26 Credit cards 30 24 Consumer indirect loans — 2 Total consumer loans 69 43 Total net loan charge-offs $ 244 $ 161 Net loan charge-offs to average loans .21 % .14 % Net loan charge-offs from discontinued operations — education lending business $ 3 $ 4 (a) Credit amounts indicate that recoveries exceeded charge-offs. 86 Table of contents Figure 31. Net Loan Charge-offs to Average Loans from Continuing Operations Year ended December 31, 2023 2022 Commercial and industrial 0.24 % 0.19 % Real estate — commercial mortgage 0.23 0.12 Real estate — construction (0.04) (0.04) Commercial lease financing (a) (0.14) (0.05) Total commercial loans 0.21 0.15 Real estate — residential mortgage (a) (0.01) (0.04) Home equity loans (0.01) (0.02) Consumer direct loans 0.69 0.40 Credit cards 3.04 2.50 Consumer indirect loans — 3.23 Total consumer loans 0.19 0.12 Total net loan charge-offs 0.21 % 0.14 % (a) Credit amounts indicate that recoveries exceeded charge-offs. Figure 32. Summary of Loan and Lease Loss Experience from Continuing Operations Year ended December 31, Dollars in millions 2023 2022 Average loans outstanding $ 118,004 $ 111,302 Allowance for loan and lease losses at beginning of period $ 1,337 $ 1,061 Loans charged off: Commercial and industrial $ 188 $ 153 Real estate — commercial mortgage 39 23 Real estate — construction — — Total commercial real estate loans (a) 39 23 Commercial lease financing — 2 Total commercial loans (b) 227 178 Real estate — residential mortgage 1 (2) Home equity loans 2 1 Consumer direct loans 50 34 Credit cards 37 30 Consumer indirect loans 1 4 Total consumer loans 91 67 Total loans charged off 318 245 Recoveries: Commercial and industrial 44 50 Real estate — commercial mortgage 2 5 Real estate — construction 1 1 Total commercial real estate loans (a) 3 6 Commercial lease financing 5 4 Total commercial loans (b) 52 60 Real estate — residential mortgage 4 5 Home equity loans 3 3 Consumer direct loans 7 8 Credit cards 7 6 Consumer indirect loans 1 2 Total consumer loans 22 24 Total recoveries 74 84 Net loan charge-offs (244) (161) Provision (credit) for loan and lease losses 415 437 Allowance for loan and lease losses at end of year $ 1,508 $ 1,337 Liability for credit losses on lending-related commitments at beginning of the year 225 160 Provision (credit) for losses on lending-related commitments 74 65 Liability for credit losses on lending-related commitments at end of the year (c) $ 296 $ 225 Total allowance for credit losses at end of the year $ 1,804 $ 1,562 Net loan charge-offs to average total loans .21 % .14 % Allowance for loan and lease losses to period-end loans 1.34 1.12 Allowance for credit losses to period-end loans 1.60 1.31 Allowance for loan and lease losses to nonperforming loans 262.7 345.5 Allowance for credit losses to nonperforming loans 314.3 403.6 Discontinued operations — education lending business: Loans charged off $ 4 $ 6 Recoveries 1 2 Net loan charge-offs $ (3) $ (4) (a) See Figure 10 and the accompanying discussion in the “Loans and loans held for sale” section for more information related to our commercial real estate loan portfolio. (b) See Figure 9 and the accompanying discussion in the “Loans and loans held for sale” section for more information related to our commercial loan portfolio. (c) Included in “accrued expense and other liabilities” on the balance sheet. 87 Table of contents Nonperforming assets Figure 33 shows the composition of our nonperforming assets. As shown in Figure 33, nonperforming assets increased $171 million during 2023. See Note 1 (“Summary of Significant Accounting Policies”) under the headings “Nonperforming Loans,” “Impaired Loans,” and “Allowance for Loan and Lease Losses” for a summary of our nonaccrual and charge-off policies. Figure 33. Summary of Nonperforming Assets and Past Due Loans from Continuing Operations December 31, Dollars in millions 2023 2022 Commercial and industrial $ 297 $ 174 Real estate — commercial mortgage 100 21 Real estate — construction — — Total commercial real estate loans (a) 100 21 Commercial lease financing — 1 Total commercial loans (b) 397 196 Real estate — residential mortgage 71 77 Home equity loans 97 107 Consumer direct loans 3 3 Credit cards 5 3 Consumer indirect loans 1 1 Total consumer loans 177 191 Total nonperforming loans 574 387 Nonperforming loans held for sale — 20 OREO 17 13 Other nonperforming assets — — Total nonperforming assets $ 591 $ 420 Accruing loans past due 90 days or more $ 107 $ 60 Accruing loans past due 30 through 89 days 222 180 Restructured loans — accruing and nonaccruing (c) N/A 236 Restructured loans included in nonperforming loans (c) N/A 118 Nonperforming assets from discontinued operations — education lending business 3 3 Nonperforming loans to period-end portfolio loans .51 % .32 % Nonperforming assets to period-end portfolio loans plus OREO and other nonperforming assets (c) .52 .35 (a) See Figure 10 and the accompanying discussion in the “Loans and loans held for sale” section for more information related to our commercial real estate loan portfolio. (b) See Figure 9 and the accompanying discussion in the “Loans and loans held for sale” section for more information related to our commercial loan portfolio. (c) Restructured loans (i.e., TDRs) are those for which Key, for reasons related to a borrower’s financial difficulties, grants a concession to the borrower that it would not otherwise consider. See Note 5 (“Asset Quality“) for more information on our TDRs. These concessions are made to improve the collectability of the loan and generally take the form of a reduction of the interest rate, extension of the maturity date or reduction in the principal balance. Figure 34 shows the types of activity that caused the change in our nonperforming loans during each of the last four quarters and the years ended December 31, 2023, and December 31, 2022. Figure 34. Summary of Changes in Nonperforming Loans from Continuing Operations 2023 Quarters Dollars in millions 2023 Fourth Third Second First 2022 Balance at beginning of period $ 387 $ 455 $ 431 $ 416 $ 387 $ 454 Loans placed on nonaccrual status 768 297 159 169 143 398 Charge-offs (318) (95) (87) (76) (60) (244) Loans sold (38) (9) (4) (23) (2) (15) Payments (132) (56) (25) (20) (31) (113) Transfers to OREO (9) (2) (3) (2) (2) (5) Loans returned to accrual status (84) (16) (16) (33) (19) (88) Balance at end of period $ 574 $ 574 $ 455 $ 431 $ 416 $ 387 Operational and compliance risk management Like all businesses, we are subject to operational risk, which is the risk of loss resulting from human error or malfeasance, inadequate or failed internal processes and systems, and external events. These events include, among other things, threats to our cybersecurity, as we are reliant upon information systems and the internet to conduct our business activities. Operational risk intersects with compliance risk, which is the risk of loss from violations of, or noncompliance with, laws, rules and regulations, prescribed practices, and ethical standards. Under the Dodd-Frank Act, large financial companies like Key are subject to heightened prudential standards and regulation. This heightened level of regulation has increased our operational risk. While operational and compliance 88 Table of contents risk are separate risk disciplines in KeyCorp’s ERM framework, losses and/or additional regulatory compliance costs are included in operational loss reporting and could take the form of explicit charges, increased operational costs, or harm to our reputation. We seek to mitigate operational risk through identification and measurement of risk, alignment of business strategies with risk appetite and tolerance, and a system of internal controls and reporting. We continuously strive to strengthen our system of internal controls to improve the oversight of our operational risk and to ensure compliance with laws, rules, and regulations. For example, an operational event database tracks the amounts and sources of operational risk and losses. This tracking mechanism helps to identify weaknesses and to highlight the need to take corrective action. We also rely upon software programs designed to assist in assessing operational risk and monitoring our control processes. This technology has enhanced the reporting of the effectiveness of our controls to senior management and the Board. The Operational Risk Management Program provides the framework for the structure, governance, roles, and responsibilities, as well as the content, to manage operational risk for Key. The Compliance Risk Management Program serves the same function in managing compliance risk for Key. The Operational Risk Committee and the Compliance Risk Committee support the ERM Committee by identifying early warning events and trends, escalating emerging risks, and discussing forward-looking assessments. Both the Operational Risk Committee and the Compliance Risk Committee include attendees from each of the Three Lines of Defense. Primary responsibility for managing and monitoring internal control mechanisms lies with the managers of our various lines of business. The Operational Risk Committee and Compliance Risk Committee are senior management committees that oversee our level of operational and compliance risk and direct and support our operational and compliance infrastructure and related activities. These committees and the Operational Risk Management and Compliance Risk Management functions are an integral part of our ERM Program. Our Risk Review function regularly assesses the overall effectiveness of our Operational Risk Management and Compliance Risk Management Programs and our system of internal controls. Risk Review reports the results of reviews on internal controls and systems to senior management and the Audit Committee and updates the Risk Committee, as appropriate, on matters related to the oversight of these controls. Cybersecurity For information on our cybersecurity risk management and governance practices, please see Item 1C. Cybersecurity of this report. GAAP to Non-GAAP Reconciliations Non-GAAP financial measures have inherent limitations, are not required to be uniformly applied, and are not audited. Although these non-GAAP financial measures are frequently used by investors to evaluate a company, they have limitations as analytical tools, and should not be considered in isolation, nor as a substitute for analyses of results as reported under GAAP. The tangible common equity ratio and the return on tangible common equity ratio have been a focus for some investors, and management believes that these ratios may assist investors in analyzing Key’s capital position without regard to the effects of intangible assets and preferred stock. Since analysts and banking regulators may assess our capital adequacy using tangible common equity, we believe it is useful to enable investors to assess our capital adequacy on these same bases. 89 Table of contents Year ended December 31, Dollars in millions 2023 2022 2021 Tangible common equity to tangible assets at period end Key shareholders’ equity (GAAP) $ 14,637 $ 13,454 $ 17,423 Less: Intangible assets (a) 2,806 2,844 2,820 Preferred Stock (b) 2,446 2,446 1,856 Tangible common equity (non-GAAP) $ 9,385 $ 8,164 $ 12,747 Total assets (GAAP) $ 188,281 $ 189,813 $ 186,346 Less: Intangible assets (a) 2,806 2,844 2,820 Tangible assets (non-GAAP) $ 185,475 $ 186,969 $ 183,526 Tangible common equity to tangible assets ratio (non-GAAP) 5.06 % 4.37 % 6.95 % Average tangible common equity Average Key shareholders’ equity (GAAP) $ 13,881 $ 14,730 $ 17,665 Less: Intangible assets (average) (c) 2,826 2,839 2,829 Preferred Stock (average) 2,500 2,114 1,900 Average tangible common equity (non-GAAP) $ 8,555 $ 9,777 $ 12,936 Return on average tangible common equity from continuing operations Income (loss) from continuing operations attributable to Key common shareholders (GAAP) $ 821 $ 1,793 $ 2,506 Average tangible common equity (non-GAAP) $ 8,555 $ 9,777 $ 12,936 Return on average tangible common equity from continuing operations (non-GAAP) 9.60 % 18.34 % 19.37 % Return on average tangible common equity consolidated Net income (loss) attributable to Key common shareholders (GAAP) $ 824 $ 1,799 $ 2,519 Average tangible common equity (non-GAAP) 8,555 9,777 12,936 Return on average tangible common equity consolidated (non-GAAP) 9.63 % 18.40 % 19.47 % (a) For the years ended December 31, 2023, December 31, 2022, and December 31, 2021, intangible assets exclude $1 million, $2 million, and $3 million, respectively, of period-end purchased credit card relationships. (b) Net of capital surplus. (c) For the years ended December 31, 2023, December 31, 2022, and December 31, 2021, average intangible assets exclude $1 million, $2 million, and $4 million, respectively, of average purchased credit card relationships. The cash efficiency ratio is a ratio of two non-GAAP performance measures, adjusted noninterest expense and total taxable-equivalent revenue. Accordingly, there is no directly comparable GAAP performance measure. The cash efficiency ratio excludes the impact of our intangible asset amortization from the calculation. We believe this ratio provides greater consistency and comparability between our results and those of our peer banks. Additionally, this ratio is used by analysts and investors to evaluate how effectively management is controlling noninterest expenses in generating revenue, as they develop earnings forecasts and peer bank analysis. Year ended December 31, Dollars in millions 2023 2022 2021 Cash efficiency ratio Noninterest expense (GAAP) $ 4,734 $ 4,410 $ 4,429 Less: Intangible asset amortization (GAAP) 39 47 58 Adjusted noninterest expense (non-GAAP) $ 4,695 $ 4,363 $ 4,371 Net interest income (GAAP) $ 3,913 $ 4,527 $ 4,071 Plus: TE adjustment 30 27 27 Net interest income TE (non-GAAP) 3,943 4,554 4,098 Noninterest income (GAAP) 2,470 2,718 3,194 Total TE revenue (non-GAAP) $ 6,413 $ 7,272 $ 7,292 Cash efficiency ratio (non-GAAP) 73.2 % 60.0 % 59.9 % Critical Accounting Policies and Estimates Our business is dynamic and complex. Consequently, we must exercise judgment in choosing and applying accounting policies and methodologies. These choices are critical; not only are they necessary to comply with GAAP, they also reflect our view of the appropriate way to record and report our overall financial performance. All accounting policies are important, and all policies described in Note 1 (“Summary of Significant Accounting Policies”) should be reviewed for a greater understanding of how we record and report our financial performance. In our opinion, some accounting policies are more likely than others to have a critical effect on our financial results and to expose those results to potentially greater volatility. These policies apply to areas of relatively greater business importance, or require us to exercise judgment and to make assumptions and estimates that affect amounts reported in the financial statements. Because these assumptions and estimates are based on current circumstances, they may prove to be inaccurate, or we may find it necessary to change them. The following is a description of our current critical accounting policies. 90 Table of contents Allowance for loan and lease losses The allowance for loan and lease losses represents management’s estimate of all expected credit losses over the expected contractual life of our existing loan portfolio. Determining the appropriateness of the allowance is complex and requires judgment by management about the effect of matters that are inherently uncertain. These critical estimates include significant use of our own historical data and complex methods to interpret them. We have an ongoing process to evaluate and enhance the quality, quantity, and timeliness of our data and interpretation methods used in the determination of these allowances. These evaluations are inherently subjective, as they require material estimates and may be susceptible to significant change, and include, among others: • PD, • LGD, • Outstanding balance of the loan, • Movement through delinquency stages, • Amounts and timing of expected future cash flows, • Value of collateral, which may be obtained from third parties, • Economic forecasts which are obtained from a third party provider, and • Qualitative factors, such as changes in current economic conditions, that may not be reflected in modeled results. As described in our accounting policy related to the ALLL in Note 1 (“Summary of Significant Accounting Policies”) of this report under the heading “Allowance for Loan and Lease Losses," we employ a disciplined process and methodology to establish our ALLL, which has three main components: (i) asset specific / individual loan reserves; (ii) quantitative (formulaic or pooled) reserves; and (iii) qualitative (judgmental) reserves. We use a non-DCF factor-based approach to estimate expected credit losses that include component PD/LGD/EAD models as well as less complex estimation methods for smaller loan portfolios. Probability of default models estimate the likelihood a borrower will cease making payments as agreed. These models use observed loan-level information and projected paths of macroeconomic variables. Borrower credit attributes including FICO scores of consumers and internally assigned risk ratings for commercial borrowers are significant inputs to the models. Consumer FICO scores are refreshed quarterly and commercial risk ratings are updated annually with select borrowers updated more frequently. The macroeconomic trends that have a significant impact on the probability of default vary by portfolio segment. Exposure at default models estimate the loan balance at the time of default. We use an amortization based formulaic approach to estimate account level EAD for all term loans. We use portfolio specific methods in each of our revolving product portfolios. LGD models estimate the loss we will suffer once a loan is in default. Account level inputs to LGD models include collateral attributes, such as loan to value. If we observe limitations in the data or models, we use model overlays to make adjustments to model outputs to capture a particular risk or compensate for a known limitation. These variables and others may result in actual loan losses that differ from the originally estimated amounts. This estimate produced by our models is forward-looking and requires management to use forecasts about future economic conditions to determine the expected credit loss over the remaining life of an instrument. Moody’s Consensus forecast is the source of macroeconomic projections, including the interest rate forecasts used in the credit models. We use a two year reasonable and supportable period across all products to forecast economic conditions. As the length of the life of a financial asset increases, these inputs may become impractical to estimate as reasonable and supportable. We believe the two year time horizon appropriately aligns with our business planning, available industry guidance, and reliability of various forecasting services. Following this two year period in which supportable forecasts can be generated, for all modeled loan portfolios, we revert expected credit losses to a level that is consistent with our historical information by reverting the macroeconomic variables (model inputs) to their long run average. We revert to historical loss rates for less complex estimation methods for smaller portfolios. A four quarter reversion period is used where the macroeconomic variables linearly revert to their long run average following the two year reasonable and supportable period. We use a 20 year lookback period for determining long run historical average of the macroeconomic variables. We determined the 20 year lookback period is appropriate as it captures the previous two economic cycles as well as the impact from the pandemic. The ALLL is sensitive to various macroeconomic drivers such as GDP and unemployment as well as portfolio attributes such as remaining term, outstanding balance, risk ratings, FICO, LTV, and delinquency status. Our ALLL models were designed to capture the correlation between economic and portfolio changes. As such, evaluating 91 Table of contents shifts in individual portfolio attributes and macroeconomic variables in isolation may not be indicative of past or future performance. It is difficult to estimate how potential changes in any one factor or input might affect the overall ALLL because we consider a wide variety of factors and inputs in estimating the ALLL. Changes in the factors and inputs considered may not occur at the same rate and may not be consistent across all geographies or product types, and changes in factors and input may be directionally inconsistent, such that improvement in one factor may offset deterioration in others. However, to consider the impact of a hypothetical alternate economic forecast, we compare the modeled quantitative allowance results using a downside economic scenario. The maximum difference in the quarterly macroeconomic variables between the base and downside scenarios over the two year reasonable and supportable period includes an approximate 4 percentage point decline in GDP annualized growth and an approximate 3 percentage point increase in the U.S. unemployment rate. The difference between these two scenarios would have driven an increase of approximately 1.7x for commercial and 1.6x for the consumer modeled allowance results. Similarly, deteriorating conditions for portfolio factors were also considered by moderately stressing key portfolio drivers, relative to the baseline portfolio conditions. Stressing risk ratings by two ratings for commercial loans generates a 1.6x increase in the commercial modeled allowance results. Stressing FICO by ten points, and LTV and utilization by 10% for consumer loans generates a 1.2x increase in the consumer modeled allowance results. Note that these analyses demonstrate the sensitivity of the ALLL to key quantitative assumptions, but exclude potential impacts to non-modeled allowance components and reserves for individually assessed loans. Furthermore, these analyses are not intended to estimate changes in the overall ALLL as they do not reflect qualitative factors, changes in current economic conditions that may not be reflected in quantitatively derived results, and other relevant factors that must be considered to ensure the ALLL reflects our best estimate of current expected credit losses. Valuation methodologies Fair value measurements We measure or monitor many of our assets and liabilities on a fair value basis. Fair value is generally defined as the price that would be received to sell an asset or paid to transfer a liability (an exit price) as opposed to the price that would be paid to acquire the asset or received to assume the liability (an entry price), in an orderly transaction between market participants at the measurement date under current market conditions. While management uses judgment when determining the price at which willing market participants would transact when there has been a significant decrease in the volume or level of activity for the asset or liability in relation to “normal” market activity, management’s objective is to determine the point within the range of fair value estimates that is most representative of a sale to a third-party investor under current market conditions. The value to us if the asset or liability were held to maturity is not included in the fair value estimates. A fair value measure should reflect the assumptions that market participants would use in pricing the asset or liability, including the assumptions about the risk inherent in a particular valuation technique, the effect of a restriction on the sale or use of an asset and the risk of nonperformance. Fair value is measured based on a variety of inputs. Fair value may be based on quoted market prices for identical assets or liabilities traded in active markets (Level 1 valuations). If market prices are not available, quoted market prices for similar instruments traded in active markets, quoted prices for identical or similar instruments in markets that are not active, or model-based valuation techniques for which all significant assumptions are observable in the market are used (Level 2 valuations). Where observable market data is not available, the valuation is generated from model based techniques that use significant assumptions not observable in the market, but observable based on our specific data (Level 3 valuations). Unobservable assumptions reflect our estimates for assumptions that market participants would use in pricing the asset or liability. Valuation techniques typically include option pricing models, discounted cash flow models and similar techniques, but may also include the use of market prices of assets or liabilities that are not directly comparable to the subject asset or liability. The selection and weighting of the various fair value techniques may result in a fair value higher or lower than carrying value. Considerable judgment may be involved in determining the amount that is most representative of fair value. 92 Table of contents For assets and liabilities recorded at fair value, our policy is to maximize the use of observable inputs and minimize the use of unobservable inputs when developing fair value measurements for those items where there is an active market. In certain cases, when market observable inputs for model-based valuation techniques may not be readily available, we are required to make judgments about assumptions market participants would use in estimating the fair value of the financial instrument. The models used to determine fair value adjustments are regularly evaluated by management for relevance under current facts and circumstances. Changes in market conditions may reduce the availability of quoted prices or observable data. For example, reduced liquidity in the capital markets or changes in secondary market activities could result in observable market inputs becoming unavailable. When market data is not available, we use valuation techniques requiring more management judgment to estimate the appropriate fair value. Fair value is used on a recurring basis for certain assets and liabilities in which fair value is the primary measure of accounting. Fair value is used on a nonrecurring basis to measure certain assets or liabilities (including held-to-maturity securities, commercial loans held for sale, and OREO) for impairment or for disclosure purposes in accordance with current accounting guidance. Impairment analysis also relates to long-lived assets and core deposit and other intangible assets. An impairment loss is recognized if the carrying amount of the asset is not likely to be recoverable and exceeds its fair value. In determining the fair value, management uses models and applies the techniques and assumptions previously discussed. See Note 1 under the heading “Fair Value Measurements” and Note 6 (“Fair Value Measurements”) for a detailed discussion of determining fair value, including pricing validation processes. Goodwill The valuation and testing methodologies used in our analysis of goodwill impairment are summarized in Note 1 under the heading “Goodwill and Other Intangible Assets.” Goodwill is initially recorded as the excess of the purchase price over the fair value of net assets acquired in a business combination. Goodwill is tested for impairment for all three of our reporting units: Consumer Bank, Commercial Bank and Institutional Bank. We perform our annual impairment test as of October 1st and on an interim basis if events or changes in circumstances between annual tests suggest additional testing is needed. Testing may be either quantitative or qualitative. Fair value is measured during quantitative tests using a combination of income and market approaches. If the fair value of a reporting unit declines below its carrying value, an impairment charge will be recognized for any amount by which the carrying value exceeds the reporting unit’s fair value, to the extent that the loss recognized does not exceed the amount of the goodwill allocated to that reporting unit. When utilizing the qualitative testing approach, Key examines numerous qualitative factors such as financial performance, market capitalization and other industry and economic trends to conclude whether it is more likely than not that goodwill is impaired. We performed a quantitative annual goodwill impairment test as of October 1, 2023. The quantitative test estimates the fair value of the reporting units using the income approach (weighted 50%) and two market based approaches: the publicly traded company approach (weighted 25%) and the recent transactions approach (weighted 25%). For the market based approaches, valuations of reporting units considered a combination of earnings and equity multiples based on either public companies with characteristics similar to the reporting unit or actual prices paid from recent transactions. Since the fair values determined under the market approaches are representative of noncontrolling interests, the valuations incorporated a control premium. For the income approach, estimated future cash flows were derived from internal forecasts and economic expectations for each reporting unit. The inputs and assumptions utilized for the valuation of each reporting unit include projections of future cash flows, discount rates, valuation multiples of comparable public companies, and recent transaction information. Future cash flows are based on multi-year forecasts for each reporting unit and include inputs and assumptions such as net interest margin, expected credit losses, noninterest income, noninterest expense, and required capital. A terminal growth rate is estimated for each reporting unit based on market expectations of inflation and economic conditions in the financial services industry. Discount rates are developed using the CAPM which considers a risk free rate, 5-year adjusted beta based on peer companies, a market equity risk premium, a size premium, and a company specific risk premium. The discount rates used for the Consumer, Commercial, and Institutional reporting units were, 13%, 13.5%, and 13.5%, respectively. 93 Table of contents The results of the annual goodwill impairment test indicated that the fair values of the Consumer, Commercial and Institutional Bank reporting units were in excess of their respective carrying values, therefore, there was no goodwill impairment. However, for the Institutional Bank reporting unit, the fair value of the reporting united exceeded its carrying value by 7%, indicating that the $133 million of goodwill allocated to this reporting unit could be at risk of future impairment. The combined fair value of all reporting units was considered reasonable by comparison to Key's market capitalization. The estimated fair values of each reporting unit are sensitive to changes in management’s estimates and assumptions. Changes in the estimates and assumptions could result in instances in which the fair value of a reporting unit is less than its carrying value. We have performed sensitivity analyses around certain assumptions to assess their reasonableness and impact on the reporting units’ fair values. The analysis of the Institutional Bank reporting unit indicated that if the discount rate utilized in the income approach was increased or decreased by 50 basis points, the estimated fair value of the reporting unit inclusive of the weighted results of the market approaches would decrease or increase approximately 2%, respectively. If the noninterest income rate utilized in the income approach was increased or decreased by 10%, the estimated fair value of the reporting unit inclusive of the weighted results of the market approaches would increase or decrease by approximately 10%, respectively, which if a decrease would result in goodwill impairment. Determining the fair value of a reporting unit is subject to uncertainty as it is reliant on estimates of cash flows that extend far into the future, and, by their nature, are difficult to estimate over such an extended time frame. In the future, changes in the assumptions or the discount rate could produce a material non-cash goodwill impairment. Additionally, we monitored events and circumstances during the period from October 1, 2023 through December 31, 2023, including macroeconomic and market factors, industry and banking sector events, Key specific performance indicators, a comparison of management’s forecast and assumptions to those used in the October 1, 2023 quantitative impairment test, and the sensitivity of the October 1, 2023 quantitative test results to changes in assumptions through December 31, 2023. Based on these considerations, we concluded that it was not more-likely-than-not that the fair value of one or more of the reporting units was below its respective carrying value as of December 31, 2023. Additional information is provided in Note 12 (“Goodwill and Other Intangible Assets”). Derivatives and hedging We primarily use interest rate swaps to hedge interest rate risk for asset and liability management purposes. These derivative instruments modify the interest rate characteristics of specified on-balance sheet assets and liabilities. Our accounting policies related to derivatives reflect the current accounting guidance, which provides that all derivatives should be recognized as either assets or liabilities on the balance sheet at fair value, after taking into account the effects of master netting agreements. Accounting for changes in the fair value (i.e., gains or losses) of a particular derivative depends on whether the derivative has been designated and qualifies as part of a hedging relationship, and further, on the type of hedging relationship. The application of hedge accounting requires significant judgment to interpret the relevant accounting guidance, as well as to assess hedge effectiveness, identify similar hedged item groupings, and measure changes in the fair value of the hedged items. We believe our methods of addressing these judgments and applying the accounting guidance are consistent with both the guidance and industry practices. Additional information relating to our use of derivatives is included in Note 1 under the heading “Derivatives and Hedging,” and Note 8 (“Derivatives and Hedging Activities”). Contingent liabilities, guarantees and income taxes Note 22 (“Commitments, Contingent Liabilities, and Guarantees”) summarizes contingent liabilities arising from litigation and contingent liabilities arising from guarantees in various agreements with third parties under which we are a guarantor, and the potential effects of these items on the results of our operations. We record a liability for the fair value of the obligation to stand ready to perform over the term of a guarantee. Contingent aspects of guarantees within the scope of ASC 326 are assessed a reserve under CECL. There is a risk that our actual future payments in the event of a default by the guaranteed party could exceed the recorded amount. See Note 22 (“Commitments, Contingent Liabilities, and Guarantees”) for a comparison of the liability recorded and the maximum potential undiscounted future payments for the various types of guarantees that we had outstanding at December 31, 2023. It is not always clear how the Internal Revenue Code and various state tax laws apply to transactions that we undertake. In the normal course of business, we may record tax benefits and then have those benefits contested by the IRS or state tax authorities. We have provided tax reserves that we believe are adequate to absorb potential 94 Table of contents adjustments that such challenges may necessitate. However, if our judgment later proves to be inaccurate, the tax reserves may need to be adjusted, which could have an adverse effect on our results of operations and capital. Additionally, we conduct quarterly assessments that determine the amount of deferred tax assets that are more-likely-than-not to be realized, and therefore recorded. The available evidence used in connection with these assessments includes a history of pretax income, projected future taxable income, potential tax-planning strategies, and projected future reversals of deferred tax liabilities. These assessments are subjective and may change. Based on these criteria, and all available positive and negative evidence, we establish a valuation allowance for deferred tax assets when we are unable to conclude it is more likely than not that they will be realized. However, if our assessments prove incorrect, they could have a material adverse effect on our results of operations in the period in which they occur. For further information on our accounting for income taxes, see Note 1 (“Summary of Significant Accounting Policies”) and Note 14 (“Income Taxes”). Accounting and reporting developments Accounting guidance pending adoption Standard Required Adoption Description Effect on Financial Statements or Other Significant Matters ASU 2023-05 Business Combinations— Joint Venture Formations (Subtopic 805-60) January 1, 2025 Early adoption is permitted. This guidance requires that a joint venture apply a new basis of accounting upon its initial formation. By doing this, a joint venture, upon formation, will recognize and initially measure its assets and liabilities at fair value, with certain exceptions. Existing joint ventures have the option to apply this new guidance retrospectively as long as they have sufficient information to do so. The guidance is not expected to have any impact on Key’s financial condition or results of operations. ASU 2023-06 Disclosure Improvements The date on which the SEC’s removal of related disclosures from Regulation S-X or Regulation S-K becomes effective. Early adoption is prohibited. This guidance clarifies and improves disclosure requirements for a variety of topics. The amendments should be applied prospectively. The guidance is not expected to have a material impact on Key’s disclosures. ASU 2023-07 Segment Reporting (Topic 280) Annual periods beginning January 1, 2024 Interim periods beginning January 1, 2025 Early adoption is permitted. This guidance requires certain segment disclosures in annual and interim periods. It also clarifies that companies may report on additional measures if the chief operating decision maker uses more than one measure of a segment’s profit or loss in assessing segment performance and deciding how to allocate resources. The guidance should be applied on a retrospective basis. We are still assessing the impact on Key’s disclosures. ASU 2023-09 Income Taxes (Topic 740) January 1, 2025 Early adoption is permitted. This guidance requires certain tax disclosures related to rate reconciliation and income taxes paid. The guidance should be applied on a prospective or retrospective basis. We are still assessing the impact on Key’s disclosures. ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK The information included under the caption “Risk Management — Market risk management” in the MD&A beginning on page 76 is incorporated herein by reference. 95 Table of contents ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA Page Number Management’s Annual Report on Internal Control over Financial Reporting 97 Report of Independent Registered Public Accounting Firm on Internal Control over Financial Reporting 98 Report of Independent Registered Public Accounting Firm (PCAOB ID: 42 ) 99 Consolidated Balance Sheets 102 Consolidated Statements of Income 103 Consolidated Statements of Comprehensive Income 104 Consolidated Statements of Changes in Equity 105 Consolidated Statements of Cash Flows 106 Notes to Consolidated Financial Statements 107 Note 1. Summary of Significant Accounting Policies 107 Note 2. Earnings Per Common Share 119 Note 3. Restrictions on Cash, Dividends and Lending Activities 119 Note 4. Loan Portfolio 120 Note 5. Asset Quality 121 Note 6. Fair Value Measurements 130 Note 7. Securities 140 Note 8. Derivatives and Hedging Activities 142 Note 9. Mortgage Servicing Assets 148 Note 10. Leases 150 Note 11. Premises and Equipment 153 Note 12. Goodwill and Other Intangible Assets 153 Note 13. Variable Interest Entities 154 Note 14. Income Taxes 157 Note 15. Acquisitions and Discontinued Operations 159 Note 16. Securities Financing Activities 159 Note 17. Stock-Based Compensation 160 Note 18. Employee Benefits 162 Note 19. Short-Term Borrowings 168 Note 20. Long-Term Debt 169 Note 21. Trust Preferred Securities Issued by Unconsolidated Subsidiaries 170 Note 22. Commitments, Contingent Liabilities, and Guarantees 171 Note 23. Accumulated Other Comprehensive Income 174 Note 24. Shareholders’ Equity 175 Note 25. Business Segment Reporting 177 Note 26. Condensed Financial Information of the Parent Company 179 Note 27. Revenue from Contracts with Customers 180 96 Table of contents Management’s Annual Report on Internal Control over Financial Reporting We are responsible for the preparation, content and integrity of the financial statements and other statistical data and analyses compiled for this annual report. The financial statements and related notes have been prepared in conformity with U.S. generally accepted accounting principles and include amounts which of necessity are based on management’s best estimates and judgments and give due consideration to materiality. We believe the financial statements and notes present fairly our financial position, results of operations and cash flows in all material respects. We are responsible for establishing and maintaining a system of internal control that is designed to protect our assets and the integrity of our financial reporting as defined in the Securities Exchange Act of 1934, as amended. This corporate-wide system of controls includes policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Corporation; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of the consolidated financial statements in conformity with U.S. generally accepted accounting principles, and that receipts and expenditures of the Corporation are made only in accordance with authorizations of management and directors of the Corporation; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Corporation’s assets that could have a material effect on the consolidated financial statements. All employees are required to comply with our code of ethics. We conduct an annual certification process to ensure that our employees meet this obligation. Although any system of internal control can be compromised by human error or intentional circumvention of required procedures, we believe our system provides reasonable assurance that financial transactions are recorded and reported properly, providing an adequate basis for reliable financial statements. During 2023, the Audit Committee of the Board of Directors met regularly with Management, internal audit, and the independent registered public accounting firm, Ernst & Young LLP , to review the scope of their audits and to discuss the evaluation of internal accounting controls and financial reporting matters. The independent registered public accounting firm and the internal auditors have free access to, and meet confidentially with, the audit committee to discuss appropriate matters. Also, the Corporation maintains a Disclosure Review Committee. This committee’s purpose is to design and maintain disclosure controls and procedures to ensure that material information relating to the financial and operating condition of the Corporation is properly reported to its Chief Executive Officer, Chief Financial Officer, General Auditor, and the Audit Committee of the Board of Directors in connection with the preparation and filing of periodic reports and the certification of those reports by the Chief Executive Officer and the Chief Financial Officer. Management’s Assessment of Internal Control over Financial Reporting Management assessed, with participation of the Corporation’s Chief Executive Officer and Chief Financial Officer, the effectiveness of our internal control and procedures over financial reporting using criteria described in “Internal Control - Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework). Based on that assessment, we believe we maintained an effective system of internal control over financial reporting as of December 31, 2023. Because of inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. The Corporation's internal control over financial reporting as of December 31, 2023, has been audited by Ernst & Young LLP, an independent registered public accounting firm, as stated in their accompanying report dated February 22, 2024. Christopher M. Gorman Clark H. Khayat Chairman and Chief Executive Officer Chief Financial Officer 97 Table of contents Report of Independent Registered Public Accounting Firm To the Shareholders and the Board of Directors of KeyCorp Opinion on Internal Control over Financial Reporting We have audited KeyCorp’s internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (the COSO criteria). In our opinion, KeyCorp maintained, in all material respects, effective internal control over financial reporting as of December 31, 2023, based on the COSO criteria. We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of KeyCorp as of December 31, 2023 and 2022 , and the related consolidated statements of income, comprehensive income, changes in equity and cash flows for each of the three years in the period ended December 31, 2023, and the related notes and our report dated February 22, 2024 expressed an unqualified opinion thereon. Basis for Opinion KeyCorp’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management’s Annual Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on KeyCorp’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to KeyCorp in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion. Definition and Limitations of Internal Control Over Financial Reporting A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. Cleveland, Ohio February 22, 2024 98 Table of contents Report of Independent Registered Public Accounting Firm To the Shareholders and the Board of Directors of KeyCorp Opinion on the Financial Statements We have audited the accompanying consolidated balance sheets of KeyCorp as of December 31, 2023 and 2022 , and the related consolidated statements of income, comprehensive income, changes in equity, and cash flows for each of the three years in the period ended December 31, 2023, and the related notes (collectively referred to as the “consolidated financial statements”). In our opinion, the consolidated financial statements present fairly, in all material respects, the financial position of KeyCorp at December 31, 2023 and 2022 , and the consolidated results of its operations and its cash flows for each of the three years in the period ended December 31, 2023, in conformity with U.S. generally accepted accounting principles. We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), KeyCorp’s internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) and our report dated February 22, 2024 expressed an unqualified opinion thereon. Basis for Opinion These financial statements are the responsibility of KeyCorp’s management. Our responsibility is to express an opinion on KeyCorp’s financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to KeyCorp in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion. Critical Audit Matters The critical audit matters communicated below are matters arising from the current period audit of the financial statements that were communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective or complex judgments. The communication of the critical audit matters does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matters below, providing separate opinions on the critical audit matters or on the accounts or disclosures to which they relate. 99 Table of contents Allowance for Loan and Lease Losses Description of the Matter KeyCorp’s loan and lease portfolio totaled $112.6 billion as of December 31, 2023 and the associated ALLL was $1.5 billion. As discussed in Note 1 and 5 of the financial statements, the ALLL represents management’s current estimate of lifetime credit losses inherent in the loan portfolio at the balance sheet date. Management estimates the ALLL using relevant available information, from internal and external sources, relating to past events, current portfolio specific and economic conditions, and reasonable and supportable forecasts. The ALLL is the sum of (i) asset specific / individual loan reserves; (ii) quantitative (formulaic or pooled) reserves; and (iii) qualitative (judgmental) reserves. Management estimates the quantitative reserves using probability of default / loss given default / exposure at default models (“loss forecasting models”), as well as other estimation methods for smaller loan portfolios. The ALLL also considers qualitative factors related to idiosyncratic risk factors, changes in current economic conditions that may not be reflected in quantitatively derived results, and other relevant factors to reflect management’s best estimate of current expected credit losses. Auditing management’s ALLL was complex due to the loss forecasting models used to compute the quantitative reserve and involves a high degree of subjectivity and judgment in evaluating management’s determination of the economic forecast and qualitative factor adjustments to the ALLL described above. How We Addressed the Matter in Our Audit We obtained an understanding, evaluated the design and tested the operating effectiveness of controls over KeyCorp’s ALLL process, including controls over the appropriateness of the ALLL methodology, the development, operation and monitoring of loss forecasting models, the reliability and accuracy of data used in developing the ALLL estimate, and management’s review and approval process over the economic forecast, qualitative adjustments and overall ALLL results. With the assistance of EY specialists, we tested management’s loss forecasting models including evaluating the conceptual soundness of model methodology, assessing model performance and governance, testing key modeling assumptions, including the reasonable and supportable forecast period, and independently recalculating model output. We also verified the underlying economic forecast data used to estimate the quantitative reserve was complete and accurate. To test the qualitative factor adjustments, among other procedures, we assessed management’s methodology and considered whether relevant risks were reflected in the models and whether adjustments to the model output were appropriate. We tested the completeness, accuracy and relevance of the underlying data used to estimate the qualitative adjustments. We evaluated whether qualitative adjustments were reasonable based on changes in economic conditions, the loan portfolio, management’s policies and procedures, and lending personnel. For example, we evaluated the reasonableness of qualitative adjustments (or lack thereof) for concentrations of credit by independently comparing to loan portfolio information. We also assessed whether qualitative adjustments were consistent with publicly available information (e.g., macroeconomic data). Further, we performed an independent search for the existence of new or contrary information relating to risks impacting the qualitative factor adjustments to validate that management’s considerations are appropriate. Additionally, we evaluated whether the overall ALLL, inclusive of qualitative factor adjustments, appropriately reflects losses expected in the loan and lease portfolio by comparing to peer bank data. 100 Table of contents Goodwill Impairment Test of the Institutional Bank Reporting Unit Description of the Matter KeyCorp has a goodwill balance of $2.8 billion as of December 31, 2023, of which $133 million is allocated to the Institutional Bank reporting unit. As discussed in Notes 1 and 12 of the financial statements, management performs an annual goodwill impairment test at the reporting unit level as of October 1, or more frequently as events occur or circumstances change that may indicate that it is more likely than not that the fair value of any reporting unit may be less than its carrying value. Management estimates the fair value of its reporting units by using a combination of income and market approaches. The income approach consists of discounted cash flow modeling that uses internal forecasts and various other inputs and assumptions. The market approach incorporates comparable public company multiples along with data related to recent merger and acquisition activity. Auditing management's annual goodwill impairment test for the Institutional Bank reporting unit was complex and highly judgmental due to the significant estimation required to determine the fair value of the reporting unit. In particular, the fair value estimate was sensitive to the (i) discounted cash flow method of the income approach and its significant assumptions, which include the terminal growth rate and discount rate and (ii) valuation multiples of comparable public companies and recent transaction information. How We Addressed the Matter in Our Audit We obtained an understanding, evaluated the design and tested the operating effectiveness of controls over KeyCorp’s goodwill impairment review process, including controls over management’s review of the significant assumptions described above. With the assistance of EY specialists, we evaluated management’s fair value methodology, assessed the reasonableness of significant assumptions used in the discounted cash flow method, evaluated the appropriateness of selected multiples of comparable public companies and recent transaction information used in the market approach, developed an independent fair value range of the Institutional Bank reporting unit and compared the results to management’s fair value estimate and carrying value of the Institutional Bank reporting unit, and reconciled management’s estimated fair value of KeyCorp to its market capitalization as of the annual measurement date. We have served as KeyCorp’s auditor since 1994. Cleveland, Ohio February 22, 2024 101 Table of contents Consolidated Balance Sheets December 31, Dollars in millions, except per share data 2023 2022 ASSETS Cash and due from banks $ 941 $ 887 Short-term investments 10,817 2,432 Trading account assets 1,142 829 Securities available for sale 37,185 39,117 Held-to-maturity securities (fair value: $ 8,056 and $ 8,113 ) 8,575 8,710 Other investments 1,244 1,308 Loans, net of unearned income of $ 356 and $ 368 112,606 119,394 Allowance for loan and lease losses ( 1,508 ) ( 1,337 ) Net loans 111,098 118,057 Loans held for sale (a) 483 963 Premises and equipment 661 636 Goodwill 2,752 2,752 Other intangible assets 55 94 Corporate-owned life insurance 4,383 4,369 Accrued income and other assets 8,601 9,223 Discontinued assets 344 436 Total assets $ 188,281 $ 189,813 LIABILITIES Deposits in domestic offices: Interest-bearing deposits $ 114,859 $ 101,761 Noninterest-bearing deposits 30,728 40,834 Total deposits 145,587 142,595 Federal funds purchased and securities sold under repurchase agreements 38 4,077 Bank notes and other short-term borrowings 3,053 5,386 Accrued expense and other liabilities 5,412 4,994 Long-term debt 19,554 19,307 Total liabilities 173,644 176,359 EQUITY Preferred stock 2,500 2,500 Common Shares, $ 1 par value; authorized 2,100,000,000 and 2,100,000,000 shares; issued 1,256,702,081 and 1,256,702,081 shares 1,257 1,257 Capital surplus 6,281 6,286 Retained earnings 15,672 15,616 Treasury stock, at cost ( 320,138,094 and 323,377,500 shares) ( 5,844 ) ( 5,910 ) Accumulated other comprehensive income (loss) ( 5,229 ) ( 6,295 ) Total equity 14,637 13,454 Total liabilities and equity $ 188,281 $ 189,813 (a) Total loans held for sale include Real estate — residential mortgage loans held for sale at fair value of $ 51 million at December 31, 2023, and $ 24 million at December 31, 2022 . See Notes to Consolidated Financial Statements 102 Table of contents Consolidated Statements of Income Year ended December 31, Dollars in millions, except per share amounts 2023 2022 2021 INTEREST INCOME Loans $ 6,219 $ 4,241 $ 3,532 Loans held for sale 61 56 50 Securities available for sale 793 752 546 Held-to-maturity securities 312 213 185 Trading account assets 55 31 19 Short-term investments 414 97 28 Other investments 73 22 7 Total interest income 7,927 5,412 4,367 INTEREST EXPENSE Deposits 2,322 279 67 Federal funds purchased and securities sold under repurchase agreements 79 41 — Bank notes and other short-term borrowings 308 90 8 Long-term debt 1,305 475 221 Total interest expense 4,014 885 296 NET INTEREST INCOME 3,913 4,527 4,071 Provision for credit losses 489 502 ( 418 ) Net interest income after provision for credit losses 3,424 4,025 4,489 NONINTEREST INCOME Trust and investment services income 516 526 530 Investment banking and debt placement fees 542 638 937 Cards and payments income 340 341 415 Service charges on deposit accounts 270 350 337 Corporate services income 302 372 288 Commercial mortgage servicing fees 190 167 160 Corporate-owned life insurance income 132 132 128 Consumer mortgage income 51 58 131 Operating lease income and other leasing gains 92 103 148 Other income (a) 35 31 120 Total noninterest income 2,470 2,718 3,194 NONINTEREST EXPENSE Personnel 2,660 2,566 2,561 Net occupancy 267 295 300 Computer processing 368 314 284 Business services and professional fees 168 212 227 Equipment 88 92 100 Operating lease expense 77 101 126 Marketing 109 123 126 Other expense 997 707 705 Total noninterest expense 4,734 4,410 4,429 INCOME (LOSS) FROM CONTINUING OPERATIONS BEFORE INCOME TAXES 1,160 2,333 3,254 Income taxes 196 422 642 INCOME (LOSS) FROM CONTINUING OPERATIONS 964 1,911 2,612 Income (loss) from discontinued operations 3 6 13 NET INCOME (LOSS) 967 1,917 2,625 Less: Net income (loss) attributable to noncontrolling interests — — — NET INCOME (LOSS) ATTRIBUTABLE TO KEY $ 967 $ 1,917 $ 2,625 Income (loss) from continuing operations attributable to Key common shareholders $ 821 $ 1,793 $ 2,506 Net income (loss) attributable to Key common shareholders 824 1,799 2,519 Per Common Share: Income (loss) from continuing operations attributable to Key common shareholders $ .88 $ 1.94 $ 2.64 Income (loss) from discontinued operations, net of taxes — .01 .01 Net income (loss) attributable to Key common shareholders (b) .89 1.94 2.65 Per Common Share — assuming dilution: Income (loss) from continuing operations attributable to Key common shareholders $ .88 $ 1.92 $ 2.62 Income (loss) from discontinued operations, net of taxes — .01 .01 Net income (loss) attributable to Key common shareholders (b) .88 1.93 2.63 Weighted-average Common Shares outstanding (000) 927,217 924,363 947,065 Effect of convertible preferred stock — — — Effect of Common Share options and other stock awards 5,542 8,696 10,349 Weighted-average Common Shares and potential Common Shares outstanding (000) (c) 932,759 933,059 957,414 (a) Net securities gains (losses) totaled $( 11 ) million for the year ended December 31, 2023, $ 9 million for the year ended December 31, 2022, and $ 7 million for the year ended December 31, 2021. (b) EPS may not foot due to rounding. (c) Assumes conversion of Common Share options and other stock awards and/or convertible preferred stock, as applicable. See Notes to Consolidated Financial Statements. 103 Table of contents Consolidated Statements of Comprehensive Income Year ended December 31, Dollars in millions 2023 2022 2021 Net income (loss) $ 967 $ 1,917 $ 2,625 Other comprehensive income (loss), net of tax: Net unrealized gains (losses) on securities available for sale, net of income taxes of $( 222 ), $ 1,415 , and $ 306 705 ( 4,492 ) ( 970 ) Net unrealized gains (losses) on derivative financial instruments, net of income taxes of $( 114 ), $ 382 , and $ 122 361 ( 1,212 ) ( 388 ) Net pension and postretirement benefit costs, net of income taxes of $ 0 , $ 1 , and $( 11 ) — ( 5 ) 34 Total other comprehensiv