KEYCORP /NEW/ 10-K

ITEM 1. BUSINESS Overview KeyCorp, organized in 1958 under the laws of the State of Ohio, is headquartered in Cleveland, Ohio. We are a BHC under the BHCA and one of the nation’s largest bank-based financial services companies, with consolidated total assets of approximately $187.2 billion at December 31, 2024. KeyCorp is the parent holding company for KeyBank National Association, its principal subsidiary, through which most of our banking services are provided. Through KeyBank and certain other subsidiaries, we provide a wide range of retail and commercial banking, commercial leasing, investment management, consumer finance, student loan refinancing, commercial mortgage servicing and special servicing, and investment banking products and services to individual, corporate, and institutional clients through two major business segments: Consumer Bank and Commercial Bank. As of December 31, 2024, these services were provided across the country through KeyBank’s 944 full-service retail banking branches and a network of 1,182 ATMs in 15 states, as well as additional offices, online and mobile banking capabilities, including our national digital brand, Laurel Road, and a telephone banking call center. Additional information pertaining to our two business segments is included in the “Business Segment Results” section in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this report, and in Note 25 (“Business Segment Reporting”) of the Notes to Consolidated Financial Statements presented in Item 8. Financial Statements and Supplementary Data, which are incorporated herein by reference. In addition to the customary banking services of accepting deposits and making loans, our bank and its trust company subsidiary offer personal and institutional trust custody services, personal financial and planning services, access to mutual funds, treasury services, and international banking services. Through our bank, trust company, and registered investment adviser subsidiaries, we provide investment management services to clients that include large corporate and public retirement plans, foundations and endowments, high-net-worth individuals, and multi-employer trust funds established for providing pension or other benefits to employees. We provide other financial services — both within and outside of our primary banking markets — through various nonbank subsidiaries. These services include community development financing, securities underwriting, investment banking and capital markets products, and brokerage. We also provide merchant services to businesses. KeyCorp is a legal entity separate and distinct from its banks and other subsidiaries. Accordingly, the right of KeyCorp, its security holders, and its creditors to participate in any distribution of the assets or earnings of its banks and other subsidiaries is subject to the prior claims of the creditors of such banks and other subsidiaries, except to the extent that KeyCorp’s claims in its capacity as a creditor may be recognized. We derive the majority of our revenues within the United States from customers domiciled in the United States. Revenue from foreign countries and external customers domiciled in foreign countries was immaterial to our consolidated financial statements. Demographics Our management structure and basis of presentation is divided into two business segments, Consumer Bank and Commercial Bank. Note 25 (“Business Segment Reporting”) describes the products and services offered by each of these business segments and provides more detailed financial information pertaining to the segments, including changes in basis of presentation. The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our Laurel Road digital brand by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services. In addition, wealth management and investment services are offered to assist non-profit and high-net-worth clients with their banking, trust, portfolio management, charitable giving, and related needs. The Commercial Bank consists of the Commercial and Institutional operating segments. The Commercial operating segment is a full-service, commercial banking platform that focuses primarily on serving the borrowing, cash 6 Table of contents management, and capital markets needs of middle market clients within Key’s 15-state branch footprint. The Institutional operating segment operates nationally in providing lending, equipment financing, and banking products and services to large corporate and institutional clients. The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology. It is also a significant, national, commercial real estate lender and third-party master and special servicer of commercial mortgage loans. The operating segment includes the KBCM platform which provides a broad suite of capital markets products and services including syndicated finance, debt and equity underwriting, fixed income and equity sales and trading, derivatives, foreign exchange, mergers & acquisition and other advisory, and public finance. Additional Information Our executive offices are located at 127 Public Square, Cleveland, Ohio 44114-1306, and our telephone number is (216) 689-3000. Our website is www.key.com, and the investor relations section of our website may be reached through www.key.com/ir. We make available free of charge, on or through the investor relations section of our website, annual reports on Form 10-K, quarterly reports on Form 10-Q, and current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as well as proxy statements, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. Also posted on our website, and available in print upon request from any shareholder to our Investor Relations Department, are the charters for the committees of our Board of Directors, which includes the Audit Committee, Compensation and Organization Committee, Executive Committee, Nominating and Corporate Governance Committee, Risk Committee, and Technology Committee; our Corporate Governance Guidelines; the Code of Business Conduct and Ethics for our directors, officers, and employees; our Standards for Determining Independence of Directors; our policy for Review of Transactions Between KeyCorp and Its Directors, Executive Officers and Other Related Persons; our Statement of Political Activity; and our Corporate Responsibility Report. Within the time period required by the SEC and the NYSE, we will post on our website any amendment to the Code of Ethics and any waiver applicable to any senior executive officer or director. We also make available a summary of filings made with the SEC of statements of beneficial ownership of our equity securities filed by our directors and officers under Section 16 of the Exchange Act. The “Regulatory Disclosures & Filings” section under the “Financials” tab of the investor relations section of our website includes public disclosures concerning our historic annual and mid-year stress-testing activities under the Dodd-Frank Act and our quarterly regulatory capital disclosures under the third pillar of Basel III. Information contained on or accessible through, including any reports available on, our website or any other website referenced in this report is not part of this report. References to websites in this report are intended to be inactive textual references only. Shareholders may obtain a copy of any of the above-referenced corporate governance documents by writing to our Investor Relations Department at Investor Relations, KeyCorp, 127 Public Square, Mailcode OH-01-27-0737, Cleveland, Ohio 44114-1306; by calling (216) 689-4221; or by sending an e-mail to investor_relations@keybank.com. 7 Table of contents Competition The market for banking and related financial services is highly competitive and continuously evolving. Legislative, regulatory, economic, and technology changes, as well as consolidation within the financial services industry, could result in increased competition from new and existing market participants. Key competes with other providers of financial services, such as BHCs, commercial banks, savings associations, credit unions, mortgage banking companies, finance companies, mutual funds, insurance companies, investment management firms, private credit funds, investment banking firms, broker-dealers, financial technology companies, and other local, regional, national, and global institutions that offer financial services. Some of our competitors are larger and may have more financial resources, while some of our competitors enjoy fewer regulatory constraints and may have lower cost structures. The financial services industry has become more competitive as technology advances have lowered barriers to entry, enabling more companies, including nonbank companies, to provide financial services. Mergers and acquisitions have also led to increased concentration in the banking industry, placing added competitive pressure on Key’s core banking products and services as we see competitors enter some of our markets or offer similar products. We compete by offering quality products and innovative services at competitive prices, and by maintaining our product and service offerings to keep pace with customer preferences and industry standards. Successfully competing in our markets also depends on our ability to invest in technology and infrastructure, execute transactions reliably and effectively, maintain and enhance our reputation, and attract, retain, and motivate talented employees, all while prudently managing risks and expenses. For more information on competition and related risks, see Item 1A. Risk Factors - “We operate in a highly competitive industry.” Human Capital Engaging a high performing and collaborative workforce is a top strategic priority for Key. Our human capital management strategy is focused on attracting, retaining, developing, motivating and rewarding the talent our businesses need to drive sound, profitable growth, and ultimately, enhance shareholder value, which we do by offering a competitive total rewards package, providing opportunities for career development and growth, and fostering a culture that is fair and inclusive for all. Competitive Rewards We make investments to hire and retain the people we need to serve our customers and communities and regularly review our pay practices to reflect changing market and economic conditions. We have steadily increased our starting minimum wage since 2015, and as of December 31, 2024, 93% of employees earned $20 or more per hour. We have made other compensation adjustments in response to market trends, competitive pressures, and a dynamic market for talent. These investments include a comprehensive and competitive total rewards program, representing our investment in our teammates’ collective success and reflecting our commitment to helping them thrive. Key’s benefits offerings include employee health and welfare plans, a 401(k) plan with competitive matching contributions (dollar for dollar, up to the first 7% of eligible pay contributed on a per pay period basis for eligible employees), up to ten weeks of paid parental leave, a Discounted Stock Purchase Plan, wellness incentives, and a lifestyle reimbursement account program for covered expenses related to health, mental wellness, family needs, and finances. Teammates can also participate in a variety of company-sponsored volunteer and giving opportunities, including Neighbors Make the Difference Day, our national employee volunteer day, and the Employee Matching Gift Program, which offers eligible employees the opportunity to support qualified nonprofit organizations and multiply their contributions through the KeyBank Foundation. We have a pay-for-performance culture that is guided by the following three principles: • Pay decisions are based on Key’s performance, business unit performance, and individual performance. • We deliver pay in a way that balances short-term and long-term financial performance objectives and aligns to shareholder value creation. • We support sustainable performance with policies that focus on prudent risk-taking and the balance between risk and reward. We design our compensation programs to balance risk and reward and align with the guidance of our regulators, and we regularly monitor these programs to remain within our risk tolerances. We subject all discretionary 8 Table of contents incentives paid to our employees to a robust risk adjustment process that begins before grant and extends beyond payment. Career Development and Growth We invest in our teammates’ growth and professional development through a variety of internal networking groups that are open to all teammates, including our Key Business Impact and Networking Groups (“KBINGs”), formal and informal mentoring programs, including Key’s enterprise-wide formal mentoring program, MentorMe at Key, and a suite of leadership development programs. We also offer employees the opportunities to develop and enhance their skills through formal learning curricula and to obtain tuition reimbursement for eligible collegiate or post-collegiate education and relevant certifications. Key’s Workforce Key had an average of 16,753 full time equivalent employees in 2024 . As of December 31, 2024, a total of 17,406 full-time and part-time employees worked in the following regions, which are generally aligned to the regions Key uses for its retail branch banking network: Region Employee Count East 12,399 West 2,834 All Other 2,173 We invest significant time and resources in creating an attractive work environment and competitive total rewards package that attracts and retains top talent. Key’s annualized rate for voluntary turnover as of December 31, 2024, was 13.2%, lower than our annualized voluntary turnover rate for 2023, which was 14.6%, and lower than our previous five-year historical average of 15.3%. Information About Our Executive Officers KeyCorp’s executive officers are principally responsible for managing the operations of KeyCorp, making policy for KeyCorp, executing on strategic decisions, and managing material risks, subject to the supervision and direction of 9 Table of contents the Board. All executive officers are subject to annual election at the annual organizational meeting of the Board held each May. Set forth below are the names and ages of the executive officers of KeyCorp as of December 31, 2024, the positions held by each at KeyCorp during the past five years, and the year each first became an executive officer of KeyCorp. On January 23, 2025, Mohit (Mo) Ramani became Chief Risk Officer. Because Mo Ramani and James Waters have been employed at KeyCorp for less than five years, information is being provided concerning their prior business experience. There are no family relationships among the directors or the executive officers, and there is no arrangement or understanding between any executive officer and any other person pursuant to which the executive officer was selected. Victor B. Alexander (45) - Mr. Alexander has been KeyCorp’s Head of Consumer Bank and an executive officer of KeyCorp since January 2020. Prior to that time, he served as the Head of Home Lending from October 2018 to January 2020 and Treasurer from July 2017 to October 2018. Darrin L. Benhart (59) - On December 31, 2024, Mr. Benhart was Chief Risk Officer and an executive officer of KeyCorp and had served in such capacity since January 1, 2024. Prior to that time, he served as Deputy Chief Risk Officer and Head of Enterprise Risk Management from August 2023 to December 2023 and Chief Enterprise Risk Officer from July 2022 to August 2023. Prior to July 2022, he served as a National Bank Examiner with the OCC from March 1992 to March 2022. Amy G. Brady (58) - Ms. Brady is KeyCorp’s Chief Information Officer, serving in that role since May 2012. Ms. Brady has been an executive officer of KeyCorp since she joined in 2012. She has been a director of DuPont de Nemours, Inc., a multi-industry specialty solutions company, since 2019. Trina M. Evans (60) - Ms. Evans has been the Director of Corporate Center for KeyCorp since August 2012. Prior to this role, Ms. Evans was the Chief Administrative Officer for Key Community Bank and the Director of Client Experience for KeyBank. She became an executive officer of KeyCorp in March 2013. Kenneth C. Gavrity (48) - Mr. Gavrity has been Head of Commercial Bank since November 2023 and became an executive officer of KeyCorp in May 2021. Prior to this, Mr. Gavrity served as Head of Enterprise Payments from January 2019 to November 2023 and Head of Commercial Payments from 2016 to 2019. Stacy L. Gilbert (53) - Ms. Gilbert has been the Chief Accounting Officer and an executive officer of KeyCorp since March 2024. Prior to her appointment as Chief Accounting Officer, Ms. Gilbert served as Corporate Controller for KeyCorp since August 2023. She previously served as Assistant Corporate Controller and Senior Director of External Reporting and Accounting Policy. She first joined the Company in 2002, holding a variety of accounting roles, before leaving to join FirstMerit Corporation in 2008. She re-joined the Company in 2016. Christopher M. Gorman (64) - Mr. Gorman has been Chairman, Chief Executive Officer, and President of KeyCorp since May 1, 2020. Mr. Gorman previously served as President and Chief Operating Officer from September 2019 to May 2020 and President of Banking and Vice Chairman from 2017 to September 2019. From 2016 to 2017, he served as Merger Integration Executive responsible for leading the integration efforts related to KeyCorp’s merger with First Niagara. Prior to that, Mr. Gorman was the President of Key Corporate Bank from 2010 to 2016. He became an executive officer of KeyCorp in 2010. Clark H.I. Khayat (53) - Mr. Khayat has been Chief Financial Officer since March 2023 and an executive officer since September 2018. Mr. Khayat rejoined KeyCorp as Chief Strategy Officer in January 2018 and served in that role until March 2023. Mr. Khayat had previously served as Head of Key’s Enterprise Commercial Payments group from April 2014 to June 2016. Allyson M. Kidik (45) - Ms. Kidik has been the Chief Risk Review Officer and General Auditor and an executive officer of KeyCorp since July 2022. Ms. Kidik previously served as Senior Deputy General Auditor from 2018 to 2022 and Deputy General Auditor from 2015 to 2018. Angela G. Mago (59) - Ms. Mago has served as the Chief Human Resources Officer since November 2023. She previously served as Head of Commercial Bank from May 2019 to November 2023 and Co-Head of Key Corporate Bank from 2016 to May 2019. She became an executive officer of KeyCorp in 2016. 10 Table of contents Andrew J. Paine III (55) - Mr. Paine has been the Head of Institutional Bank since 2019. He previously served as Co-Head of Key Corporate Bank from 2016 to May 2019. He also serves as President of KeyBanc Capital Markets Inc., a role he has held since 2013. He became an executive officer of KeyCorp in 2016. Mohit Ramani (51) - Mr. Ramani became Chief Risk Officer and an executive officer of KeyCorp on January 23, 2025. Prior to that time, he served in a variety of roles with Truist Financial Corporation, including Deputy Chief Risk Officer and Chief Credit Officer from January 2023 to January 2025 and Chief Business Unit Risk Officer from 2000 to 2023. James L. Waters (58) - Mr. Waters became the General Counsel and Secretary and an executive officer of KeyCorp in July 2021. From 2018 to 2021, he served as General Counsel and Corporate Secretary of Cullen/Frost Bankers, Inc., a financial holding company. Supervision and Regulation The regulatory framework applicable to BHCs and banks is intended primarily to protect consumers, the DIF, taxpayers and the banking system as a whole, rather than to protect the security holders and creditors of financial services companies. Comprehensive reform of the legislative and regulatory environment for financial services companies occurred in 2010 and remains ongoing. We cannot predict changes in applicable laws, regulations or regulatory agency policies, but any such changes may materially affect our business, financial condition, results of operations, or access to liquidity or credit. Overview Federal law establishes a system of regulation under which the Federal Reserve is the umbrella regulator for BHCs, while their subsidiaries are principally regulated by prudential or functional regulators: (i) the OCC for national banks and federal savings associations; (ii) the FDIC for state non-member banks and savings associations; (iii) the Federal Reserve for state member banks; (iv) the CFPB for consumer financial products or services; (v) the SEC and FINRA for securities broker/dealer activities; (vi) the SEC, CFTC, and NFA for swaps and other derivatives; and (vii) state insurance regulators for insurance activities. Certain specific activities, including traditional bank trust and fiduciary activities, may be conducted in a bank without the bank being deemed a “broker” or a “dealer” in securities for purposes of securities functional regulation. Under the BHCA, BHCs generally may not directly or indirectly own or control more than 5% of the voting shares, or substantially all of the assets, of any bank, without prior approval from the Federal Reserve. In addition, BHCs are generally prohibited from engaging in commercial or industrial activities. However, a BHC that satisfies certain requirements regarding management, capital adequacy, and Community Reinvestment Act performance may elect to be treated as a Financial Holding Company (“FHC”) for purposes of federal law, and as a result may engage in a substantially broader scope of activities that are considered to be financial in nature or complementary to those activities. KeyCorp has elected to be treated as a FHC and, as such, is authorized to engage in securities underwriting and dealing, insurance agency and underwriting, and merchant banking activities. In addition, the Federal Reserve has permitted FHCs, like KeyCorp, to engage in the following activities, under the view that such activities are complementary to a financial activity: physical commodities trading activities, energy management services, and energy tolling, among others. Under federal law, a BHC also must serve as a source of financial strength to its subsidiary depository institution(s) by providing financial assistance in the event of financial distress. This support may be required when the BHC does not have the resources to, or would prefer not to, provide it. Certain loans by a BHC to a subsidiary bank are subordinate in right of payment to deposits in, and certain other indebtedness of, the subsidiary bank. In addition, federal law provides that in the bankruptcy of a BHC, any commitment by the BHC to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment. The Dodd-Frank Act created the FSOC to overlay the U.S. supervisory framework for BHCs, insured depository institutions, and other financial service providers, by serving as a systemic risk oversight body. Specifically, the FSOC is authorized to: (i) identify risks to U.S. financial stability that could arise from the material financial distress or failure, or ongoing activities, of large, interconnected SIFIs, or that could arise outside the financial services marketplace; (ii) promote market discipline by eliminating expectations that the U.S. government will shield shareholders, creditors, and counterparties from losses in the event of failure; and (iii) respond to emerging threats 11 Table of contents to the stability of the U.S. financial system. The FSOC is responsible for facilitating regulatory coordination; information collection and sharing; designating nonbank financial companies for consolidated supervision by the Federal Reserve; designating systemic financial market utilities and systemic payment, clearing, and settlement activities requiring prescribed risk management standards and heightened federal regulatory oversight; recommending stricter standards for SIFIs; and, together with the Federal Reserve, determining whether action should be taken to break up firms that pose a grave threat to U.S. financial stability. As an FHC, KeyCorp is subject to regulation, supervision, and examination by the Federal Reserve under the BHCA. Our national bank subsidiaries and their subsidiaries are subject to regulation, supervision, and examination by the OCC. At December 31, 2024, we operated one full-service, FDIC-insured national bank subsidiary, KeyBank, and one national bank subsidiary that is limited to fiduciary activities. The FDIC also has certain, more limited regulatory, supervisory, and examination authority over KeyBank and KeyCorp under the FDIA and the Dodd-Frank Act. We have other financial services subsidiaries that are subject to regulation, supervision, and examination by the Federal Reserve, as well as other state and federal regulatory agencies and self-regulatory organizations. Because KeyBank engages in derivative transactions, in 2013 it provisionally registered as a swap dealer with the CFTC and became a member of the NFA, the self-regulatory organization for participants in the U.S. derivatives industry. Our securities brokerage and asset management subsidiaries are subject to supervision and regulation by the SEC, FINRA, and state securities regulators, and our insurance subsidiaries are subject to regulation by the insurance regulatory authorities of the states in which they operate. Our other nonbank subsidiaries are subject to laws and regulations of both the federal government and the various states in which they are authorized to do business. Regulatory capital requirements Background KeyCorp and KeyBank are subject to regulatory capital requirements that are based largely on the work of an international group of supervisors known as the Basel Committee on Banking Supervision (“Basel Committee”). The Basel Committee is responsible for establishing international bank supervisory standards for implementation in member jurisdictions, to enhance and align bank regulation on a global scale, and to promote financial stability. The regulatory capital framework developed by the Basel Committee and implemented in the United States is a predominately risk-based capital framework that establishes minimum capital requirements based on the amount of regulatory capital a banking organization maintains relative to the amount of its total assets, adjusted to reflect credit risk (“risk-weighted assets”). Each banking organization subject to this regulatory capital framework is required to satisfy certain minimum risk-based capital measures (e.g., a tier 1 risk-based capital ratio requirement of tier 1 capital to total risk-weighted assets), and in the United States, a minimum leverage ratio requirement of tier 1 capital to average total on-balance sheet assets, which serves as a backstop to the risk-based measures. A capital instrument is assigned to one of two tiers based on the relative strength and ability of that instrument to absorb credit losses on a going concern basis. Capital instruments with relatively robust loss-absorption capacity are assigned to tier 1, while other capital instruments with relatively less loss-absorption capacity are assigned to tier 2. A banking organization’s total capital equals the sum of its tier 1 and tier 2 capital. The Basel Committee also developed a market risk capital framework (that also has been implemented in the United States) to address the substantial exposure to market risk faced by banking organizations with significant trading activity and augment the credit risk-based capital requirements described above. For example, the minimum total risk-based capital ratio requirement for a banking organization subject to the market risk capital rule equals the ratio of the banking organization’s total capital to the sum of its credit risk-weighted assets and market risk-weighted assets. Only KeyCorp is subject to the market risk capital rule, as KeyBank does not engage in substantial trading activity. Basel III To address deficiencies in the international regulatory capital standards identified during the 2007-2009 global financial crisis, in 2010 the Basel Committee released comprehensive revisions to the international regulatory capital framework, commonly referred to as “Basel III.” The Basel III revisions are designed to strengthen the quality and quantity of regulatory capital, in part through the introduction of a Common Equity Tier 1 capital requirement; provide more comprehensive and robust risk coverage, particularly for securitization exposures, equities, and off-balance sheet positions; and address pro-cyclicality concerns through the implementation of capital 12 Table of contents buffers. The Basel Committee also released a series of revisions to the market risk capital framework to address deficiencies identified during its initial implementation (e.g., arbitrage opportunities between the credit risk-based and market risk capital rules) and in connection with the global financial crisis. KeyCorp and KeyBank are subject to regulatory capital requirements implemented by the U.S. banking agencies that are based largely on Basel III (“Regulatory Capital Rules”). Consistent with the international framework, the Regulatory Capital Rules further restrict the type of instruments that may be recognized in tier 1 and tier 2 capital; establish a minimum Common Equity Tier 1 capital ratio requirement of 4.5% and capital buffers to absorb losses during periods of financial stress while allowing an institution to provide credit intermediation as it would during a normal economic environment; and refine several of the methodologies used for determining risk-weighted assets. The Regulatory Capital Rules provide additional requirements for large banking organizations with over $250 billion in total consolidated assets or $10 billion in foreign exposure, but those additional requirements do not apply to KeyCorp or KeyBank. However, some of those additional requirements will apply to KeyCorp and KeyBank if proposed revisions to the Regulatory Capital Rules are adopted. The proposed revisions to the Regulatory Capital Rules are discussed below under the heading “Recent regulatory capital-related developments.” For purposes of the Regulatory Capital Rules, KeyCorp and KeyBank are treated as “standardized approach” banking organizations. Under the Regulatory Capital Rules, standardized approach banking organizations, such as KeyCorp and KeyBank, are required to meet the minimum capital and leverage ratios set forth in the following table. At December 31, 2024, KeyCorp’s ratios under the fully phased-in Regulatory Capital Rules are set forth in the following table. Minimum Capital Ratios and KeyCorp Ratios Under Regulatory Capital Rules Ratios (including stress capital buffer) Regulatory Minimum Requirement Stress Capital Buffer (b) Regulatory Minimum With Stress Capital Buffer KeyCorp December 31, 2024 (c) Common Equity Tier 1 4.50 % 3.10 % 7.60 % 11.92 % Tier 1 Capital 6.00 3.10 9.10 13.69 Total Capital 8.00 3.10 11.10 16.15 Leverage (a) 4.00 N/A 4.00 10.03 (a) As a standardized approach banking organization, KeyCorp is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018. However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules discussed below are adopted. (b) Stress capital buffer must consist of Common Equity Tier 1 capital. As a standardized approach banking organization, KeyCorp is not subject to the countercyclical capital buffer of up to 2.5% imposed upon an advanced approaches banking organization under the Regulatory Capital Rules. However, KeyCorp will be subject to the countercyclical capital buffer if proposed revisions to the Regulatory Capital Rules discussed below are adopted. (c) Ratios reflect the five-year transition of CECL impacts on regulatory ratios. Key elected the CECL phase-in option provided by regulatory guidance which delayed for two years the estimated impact of CECL on regulatory capital and phases it in over three years beginning in 2022. Effective for the first quarter 2022, Key entered a three-year transition period, and the full impact of the CECL standard was phased-in to regulatory capital through December 31, 2024. In the first quarter of 2025, CECL will be fully reflected in regulatory capital. On a fully phased-in basis, Key’s Common Equity Tier 1 ratio would be reduced by five basis points. Revised prompt corrective action framework The federal prompt corrective action (“PCA”) framework under the FDIA groups FDIC-insured depository institutions into one of five prompt corrective action capital categories: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” In addition to implementing the Basel III capital framework in the United States, the Regulatory Capital Rules also revised the PCA capital category threshold ratios applicable to FDIC-insured depository institutions such as KeyBank. The Revised PCA framework table below identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the Prompt Corrective Action Framework. “Well Capitalized” and “Adequately Capitalized” Capital Category Ratios under Revised Prompt Corrective Action Framework Prompt Corrective Action Capital Category Ratio Well Capitalized (a) Adequately Capitalized Common Equity Tier 1 Risk-Based 6.5 % 4.5 % Tier 1 Risk-Based 8.0 6.0 Total Risk-Based 10.0 8.0 Tier 1 Leverage (b) 5.0 4.0 (a) A “well capitalized” institution also must not be subject to any written agreement, order or directive to meet and maintain a specific capital level for any capital measure. (b) As a standardized approach banking organization, KeyBank is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018. However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules discussed below are adopted. 13 Table of contents As of December 31, 2024, KeyBank (consolidated) satisfied the risk-based and leverage capital requirements necessary to be considered “well capitalized” for purposes of the revised prompt corrective action framework. However, investors should not regard this determination as a representation of the overall financial condition or prospects of KeyBank because the PCA framework is intended to serve a limited supervisory function. Moreover, it is important to note that the PCA framework does not apply to BHCs, like KeyCorp. Recent regulatory capital-related developments On July 27, 2023, the federal banking agencies issued a proposal (the “Capital Proposal”) that would make significant changes to the Regulatory Capital Rules applicable to banking organizations with total assets of $100 billion or more and their depository institution subsidiaries (“Large Banking Organizations”) (including KeyCorp and KeyBank) and banking organizations with significant trading activity. This proposal would implement the final elements of the Basel III capital framework and make other changes to the Regulatory Capital Rules in response to the bank failures that occurred in 2023. The Capital Proposal would establish a new framework for calculating risk-weighted assets (the “expanded risk-based approach”) that would apply to Large Banking Organizations. The expanded risk-based approach would include a new more risk-sensitive standardized approach for measuring credit risk and operational risk. It would also include new standardized approaches for measuring market risk and credit valuation adjustment risk but would allow the use of internal models for market risk in certain circumstances with regulatory approval. Under the Capital Proposal, a Large Banking Organization would be required to calculate its risk-based capital ratios under both the expanded risk-based approach and the current standardized approach and would use the lower of the two. All capital buffer requirements, including the stress capital buffer requirement, would apply regardless of whether the expanded risk-based approach or the existing standardized approach produces the lower ratio. The Capital Proposal would also align the calculation of regulatory capital for Category III and IV banking organizations with the calculation of regulatory capital for Category I and II banking organizations. KeyCorp and KeyBank are Category IV banking organizations. Under the proposal, Category III and IV banking organizations would be required to include most components of AOCI, including net unrealized gains and losses on available-for-sale securities, in regulatory capital. Category III and IV banking organizations would also be required to apply the same capital deductions and minority interest treatments that currently apply to Category I and Category II banking organizations. In addition, all Large Banking Organizations would be subject to the supplementary leverage ratio and countercyclical capital buffer requirement and would be required to make certain enhanced public disclosures. The expanded total risk-weighted assets calculation used in the expanded risk-based approach would be phased in over a three-year period. For Category III and IV banking organizations, the requirement to reflect AOCI in regulatory capital would also be phased in over a three-year period. All other elements of the calculation of regulatory capital would apply on the effective date of a final rule if the proposal is adopted. Comments on this proposal were due by January 16, 2024. Liquidity requirements U.S. banking organizations are subject to regulatory liquidity requirements based on international liquidity standards established by the Basel Committee (the “Basel III liquidity framework”). The Basel III liquidity framework establishes quantitative standards designed to ensure that a banking organization is appropriately positioned, from a balance sheet perspective, to satisfy its short- and long-term funding needs. To address short-term liquidity risk, the Basel III liquidity framework established a liquidity coverage ratio (“Basel III LCR”), calculated as the ratio of a banking organization’s high-quality liquid assets to its total net cash outflows over 30 consecutive calendar days. In addition, to address long-term liquidity risk, the Basel III liquidity framework established a net stable funding ratio (“Basel III NSFR”), calculated as the ratio of the amount of stable funding available to a banking organization to its required amount of stable funding. Consistent with the Basel III LCR, the final rules implementing the Basel III LCR for U.S. banking organizations (the “Liquidity Coverage Rules”) established a minimum LCR for certain internationally active bank and nonbank financial companies (excluding KeyCorp), and a modified version of the LCR (“Modified LCR”) for BHCs and other depository institution holding companies with over $50 billion in consolidated assets that are not internationally active (including KeyCorp). Under the Liquidity Coverage Rules, KeyCorp was required to calculate a Modified LCR on a monthly basis and was required to satisfy a minimum Modified LCR requirement of 100%. KeyBank was not subject to the LCR or the Modified LCR under the Liquidity Coverage Rules. 14 Table of contents Large BHCs, like KeyCorp, are also subject to liquidity requirements contained in regulations adopted pursuant to the Dodd-Frank Act and the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”). As enacted in 2010, the Dodd-Frank Act required the Federal Reserve to impose enhanced prudential standards and early remediation requirements, including enhanced liquidity standards, upon BHCs (like KeyCorp) with at least $50 billion in total consolidated assets. EGRRCPA, enacted on May 24, 2018, raised the asset threshold above which the Federal Reserve is required to apply enhanced prudential standards to BHCs from $50 billion to $250 billion. EGRRCPA gave the Federal Reserve the authority to continue to apply enhanced prudential standards to any BHCs having at least $100 billion but less than $250 billion in total consolidated assets (like KeyCorp) if it determines that the application of the standard is appropriate to prevent or mitigate risks to financial stability or to promote the safety and soundness of the BHC or BHCs, taking into consideration the BHC’s or BHCs’ capital structure, riskiness, complexity, financial activities, size, and other relevant factors. As a result of the Federal Reserve’s implementation of certain of the enhanced prudential standards, KeyCorp is subject to requirements relating to cash flow projections, a contingency funding plan, liquidity risk limits, the monitoring of liquidity risks (with respect to collateral, legal entities, currencies, business lines, and intraday exposures), liquidity stress testing, a liquidity buffer, and liquidity risk management requirements, including requirements that apply to the board of directors, the risk committee, senior management, and the independent review function. Final rules related to the implementation of EGRRCPA (“Tailoring Rules”) established four risk-based categories of banking organizations with $100 billion or more in total consolidated assets and applied tailored regulatory requirements to each respective category. KeyCorp falls within the least restrictive of those categories (“Category IV Firms”). Under one of the Tailoring Rules, Category IV Firms with weighted short-term wholesale funding of less than $50 billion will not be subject to a modified LCR. KeyCorp does not meet the $50 billion threshold and is not subject to the modified LCR or an LCR public disclosure requirement. Under another Tailoring Rule, Category IV Firms (like KeyCorp) are required to conduct internal liquidity stress tests quarterly and are subject to simplified liquidity risk management requirements. Category IV Firms are still required to maintain a liquidity buffer that is sufficient to meet the projected net stressed cash-flow need over a 30-day planning horizon under the firm’s internal liquidity stress test and remain subject to monthly tailored FR 2052a liquidity reporting requirements. Under the final rules adopted by the federal banking agencies to implement the Basel III NSFR for U.S. banking organizations, certain banking organizations with more than $100 billion in total assets must maintain minimum amounts of stable funding to support their assets, commitments, and derivatives exposures over a one-year time horizon. Under the rules, KeyCorp, as a Category IV firm with average weighted short-term wholesale funding of less than $50 billion, is not subject to an NSFR requirement. Capital planning and stress testing The Federal Reserve’s capital plan rule requires each U.S.-domiciled, top-tier BHC with total consolidated assets of at least $100 billion (like KeyCorp) to develop and maintain a written capital plan supported by a robust internal capital adequacy process. The capital plan must be submitted to the Federal Reserve for supervisory review in connection with the BHC’s CCAR (described below). The supervisory review includes an assessment of many factors, including KeyCorp’s ability to maintain capital above each minimum regulatory capital ratio on a pro forma basis under expected and stressful conditions throughout the planning horizon. The Federal Reserve’s CCAR is an intensive assessment of the capital adequacy of large U.S. BHCs and of the practices these BHCs use to assess their capital needs. The Federal Reserve expects BHCs subject to CCAR to have and maintain regulatory capital in an amount that is sufficient to withstand a severely adverse operating environment and, at the same time, be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and provide credit intermediation. 15 Table of contents The Federal Reserve has conducted a supervisory stress test on KeyCorp, pursuant to which the Federal Reserve projects revenues, expenses, losses, and resulting post-stress capital levels and regulatory capital ratios under conditions that affect the U.S. economy or the financial condition of KeyCorp, including supervisory baseline and severely adverse scenarios, that are determined by the Federal Reserve. KeyCorp and KeyBank have also been required to conduct their own company-run stress tests to assess the impact of stress scenarios (including supervisor-provided baseline, adverse, and severely adverse scenarios and, for KeyCorp, one KeyCorp-defined baseline scenario and at least one KeyCorp-defined stress scenario) on their consolidated earnings, losses, and capital over a nine-quarter planning horizon, taking into account their current condition, risks, exposures, strategies, and activities. While KeyBank currently only has to conduct an annual stress test, KeyCorp has had to conduct both an annual and a mid-cycle stress test in the past. KeyCorp and KeyBank have been required to report the results of their annual stress tests to the Federal Reserve and the OCC. Under one of the Tailoring Rules, KeyCorp is no longer required to conduct and publicly disclose the results of company-run stress tests and is subject to a supervisory stress test conducted by the Federal Reserve every other year rather than every year. In 2024, KeyCorp was required to participate in the Federal Reserve’s CCAR process and was subject to a supervisory stress test conducted by the Federal Reserve. Since the adoption of a final rule by the federal banking agencies in October 2019, KeyBank is no longer required to conduct annual company-run stress tests. Also, this final rule removes the “adverse” scenario as a required scenario for all stress testing requirements applicable to BHCs and federally-regulated banks so that such stress tests will be required to include only “baseline” and “severely adverse” scenarios. On March 4, 2020, the Federal Reserve adopted a final rule integrating certain aspects of the Federal Reserve’s Regulatory Capital Rules with CCAR and the stress test rules in order to simplify the overall capital framework that is currently applicable to BHCs that have $100 billion or more in total consolidated assets (including KeyCorp). The final rule amended the capital conservation buffer requirement under the Regulatory Capital Rules by replacing the static risk-weighted assets component of the buffer with a new measure, the stress capital buffer, which will be based on the results of an individual BHC’s supervisory stress test and cannot be less than 2.5 percent of risk-weighted assets. A firm will be subject to limitations on capital distributions and discretionary bonus payments if it does not satisfy all minimum capital requirements and its stress capital buffer requirement. A firm’s stress capital buffer requirement will become effective on October 1 of each year and will remain in effect until September 30 of the following year unless the firm receives an updated stress capital buffer requirement from the Federal Reserve. On August 26, 2020, the federal banking agencies issued a final rule that revises the definition of eligible retained income as that term is used in the agencies’ Regulatory Capital Rules. The revised definition applies to all buffer requirements applicable to a banking organization, including the stress capital buffer requirement adopted by the Federal Reserve on March 4, 2020. The revised definition of eligible retained income will make any automatic limitations on capital distributions that could apply under the agencies’ capital rules more gradual with the objective of promoting continued lending during a period of stress. On January 19, 2021, the Federal Reserve issued a final rule to make conforming changes to the capital planning, regulatory reporting, and stress capital buffer requirements for firms subject to Category IV standards (including KeyCorp) to make these requirements consistent with the tailored regulatory framework for large banking organizations that the Federal Reserve adopted in an October 2019 rulemaking. The final rule revised the elements of the capital plan that Category IV firms are required to submit to the Federal Reserve and makes related changes to regulatory reporting requirements. Also, the final rule updated the frequency for calculating the stress capital buffer for these firms. On June 26, 2024, the Federal Reserve announced the results of the supervisory stress test that it conducted of 31 BHCs having more than $100 billion in total consolidated assets (including KeyCorp). The Federal Reserve indicated that all BHCs subject to the stress test maintained capital ratios above the minimum required levels under the severely adverse scenario. The stress test results for individual BHCs (including KeyCorp) were used by the Federal Reserve to determine a BHC’s updated stress capital buffer requirement. The Federal Reserve published the updated stress capital buffer requirements on August 28, 2024. KeyCorp’s updated stress capital buffer is 3.1%. This stress capital buffer became effective on October 1, 2024 and will remain in effect until September 30, 2025, unless KeyCorp later receives an updated stress capital buffer requirement from the Federal Reserve. On December 23, 2024, the Federal Reserve announced that it intends to propose changes to its stress testing framework in order to improve the transparency of the stress tests and reduce the volatility of the resulting capital 16 Table of contents requirements. The Federal Reserve said that it plans to, among other things, disclose and seek public comment on the models and scenarios used in the stress tests and to average results over two years to reduce year-over-year changes in capital requirements. Changes to the stress testing framework would apply to KeyCorp. On December 24, 2024, five trade associations filed a lawsuit against the Federal Reserve in the United States District Court for the Southern District of Ohio to challenge the stress testing framework on the basis that the current framework violates the Administrative Procedures Act and the Due Process Clause of the United States Constitution. The parties bringing the lawsuit indicated that they do not object to the use of stress tests to set stress capital buffer requirements but that they want to ensure that the Federal Reserve subjects the stress tests to public notice and comment and complies with other applicable legal requirements. KeyCorp is monitoring developments in this case. Dividend restrictions Federal law and regulation impose limitations on the payment of dividends by our national bank subsidiaries, like KeyBank. Historically, dividends paid by KeyBank have been an important source of cash flow for KeyCorp to pay dividends on its equity securities and interest on its debt. Dividends by our national bank subsidiaries are limited to the lesser of the amounts calculated under an earnings retention test and an undivided profits test. Under the earnings retention test, without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year’s net income combined with the retained net income of the two preceding years. Under the undivided profits test, a dividend may not be paid in excess of a bank’s undivided profits. Moreover, under the FDIA, an insured depository institution may not pay a dividend if the payment would cause it to be less than “adequately capitalized” under the prompt corrective action framework or if the institution is in default in the payment of an assessment due to the FDIC. Similarly, under the Regulatory Capital Rules, a banking organization that fails to satisfy the minimum capital conservation buffer requirement will be subject to certain limitations, which include restrictions on capital distributions. For more information about the payment of dividends by KeyBank to KeyCorp, please see Note 3 (“Restrictions on Cash, Dividends, and Lending Activities”) in this report. FDIA, Resolution Authority and Financial Stability Deposit insurance and assessments The DIF provides insurance coverage for domestic deposits funded through assessments on insured depository institutions like KeyBank. The amount of deposit insurance coverage for each depositor’s deposits is $250,000 per depository. The FDIC must assess the premium based on an insured depository institution’s assessment base, calculated as its average consolidated total assets minus its average tangible equity. KeyBank’s current annualized premium assessments can range from $.025 to $.45 for each $100 of its assessment base. The rate charged depends on KeyBank’s performance on the FDIC’s “large and highly complex institution” risk-assessment scorecard, which includes factors such as KeyBank’s regulatory rating, its ability to withstand asset and funding-related stress, and the relative magnitude of potential losses to the FDIC in the event of KeyBank’s failure. On October 18, 2022, the FDIC adopted a final rule, applicable to all insured depository institutions (including KeyBank), to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028. Under the final rule, the increase in rates began with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% reserve ratio. On March 10, 2023, and March 12, 2023, Silicon Valley Bank (“SVB”) and Signature Bank (“Signature”) were closed by the state banking authorities in California and New York, respectively, and the FDIC was appointed as receiver of SVB and Signature. All deposits of SVB and Signature were transferred to bridge banks established by the FDIC under the systemic risk exception to the least cost test in the FDIA so that the uninsured deposits as well as the insured deposits of both banks were protected by the FDIC. Under the FDIA, the loss to the DIF arising from the use of the systemic risk exception must be recovered through one or more special assessments. 17 Table of contents On November 16, 2023, the FDIC issued a final rule to impose a special assessment on IDIs to recover the loss to the DIF resulting from the use of the systemic risk exception to protect the uninsured depositors of SVB and Signature. Under the final rule, the FDIC would collect a special assessment from IDIs at an annual rate of approximately 13.4 basis points over eight quarterly assessment periods, starting with the first quarterly assessment period of 2024. The assessment base for the proposed special assessment is equal to an IDI’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits held by the IDI. Because the estimated loss to the DIF from the use of the systemic risk exception will be periodically adjusted and because the total assessments collected may change due to corrective amendments filed by covered IDIs regarding the reported amount of uninsured deposits for the December 31, 2022 reporting period, the FDIC may cease collection of the special assessment early, extend the special assessment collection period, or impose a final shortfall special assessment. In the final rule, the FDIC indicated that the special assessment is a tax-deductible operating expense for IDIs, and that it assumed that the effect on income of the entire amount of the special assessment would occur in one quarter for the IDIs subject to the assessment. The initial impact of the special assessment to Key was approximately $190 million in pre-tax expense, which was recognized upon issuance of the final rule in the fourth quarter of 2023. The FDIC has indicated that the loss estimates to be recovered by the special assessment will be periodically adjusted as the FDIC (as receiver of the failed banks) sells assets, satisfies liabilities, and incurs receivership expenses. The FDIC said that it will provide any updates regarding the amount and collection period for the special assessment when it sends the quarterly deposit insurance assessment invoices to the IDIs subject to the special assessment. In the first quarter of 2024, the FDIC announced an increase in its estimate of losses from protecting the uninsured depositors of SVB and Signature and, therefore, increased the amount that it would collect through the special assessment. Because of this updated estimate, Key incurred an incremental pre-tax expense of $29 million in the first quarter of 2024. Based on the quarterly invoices Key received from the FDIC in June 2024, September 2024, and December 2024, Key recorded an incremental pre-tax expense of $5 million in the second quarter of 2024, and a reversal of pre-tax expense of $6 million and $3 million in the third and fourth quarter of 2024 , respectively, to true-up initial estimates to invoiced amounts. The FDIC’s final rule for a special assessment discussed above was not intended to recover the loss to the DIF from the failure of First Republic Bank in May 2023 (initially estimated as a $13 billion loss) or to the DIF from the failures of SVB and Signature that was not related to the protection of uninsured depositors (initially estimated as a $2.7 billion loss). The FDIC indicated that no further adjustments to assessments are contemplated at this time to recover those losses but that it will re-evaluate this issue in the future when it updates projections for the DIF balance and the reserve ratio in connection with its periodic review of the DIF Restoration Plan that was adopted in 2022. The FDIC updates these projections at least semiannually. Conservatorship and receivership of insured depository institutions Upon the insolvency of an insured depository institution, the FDIC will be appointed as receiver or, in rare circumstances, conservator for the insolvent institution under the FDIA. In an insolvency, the FDIC may repudiate or disaffirm any contract to which the institution is a party if the FDIC determines that performance of the contract would be burdensome and that disaffirming or repudiating the contract would promote orderly administration of the institution’s affairs. If the contractual counterparty made a claim against the receivership (or conservatorship) for breach of contract, the amount paid to the counterparty would depend upon, among other factors, the receivership (or conservatorship) assets available to pay the claim and the priority of the claim relative to others. In addition, the FDIC may enforce most contracts entered into by the insolvent institution, notwithstanding any provision that would terminate, cause a default, accelerate or give other rights under the contract solely because of the insolvency, the appointment of the receiver (or conservator), or the exercise of rights or powers by the receiver (or conservator). The FDIC may also transfer any asset or liability of the insolvent institution without obtaining approval or consent from the institution’s shareholders or creditors. These provisions would apply to obligations and liabilities of KeyCorp’s insured depository institution subsidiary, KeyBank, including obligations under senior or subordinated debt issued to public investors. 18 Table of contents Receivership of certain SIFIs The Dodd-Frank Act created a new resolution regime, as an alternative to bankruptcy, known as the “orderly liquidation authority” (“OLA”) for certain SIFIs, including BHCs and their affiliates. Under the OLA, the FDIC would generally be appointed as receiver to liquidate and wind down a failing SIFI. The determination that a SIFI should be placed into OLA receivership is made by the U.S. Treasury Secretary, who must conclude that the SIFI is in default or in danger of default and that the SIFI’s failure poses a risk to the stability of the U.S. financial system. This determination must come after supermajority recommendations by the Federal Reserve and the FDIC, and consultation between the U.S. Treasury Secretary and the President. If the FDIC is appointed as receiver under the OLA, its powers and the rights and obligations of creditors and other relevant parties would be determined exclusively under the OLA. The powers of a receiver under the OLA are generally based on the FDIC’s powers as receiver for insured depository institutions under the FDIA. Certain provisions of the OLA were modified to reduce disparate treatment of creditors’ claims between the U.S. Bankruptcy Code and the OLA. However, substantial differences between the two regimes remain, including the FDIC’s right to disregard claim priority in some circumstances, the use of an administrative claims procedure under OLA to determine creditors’ claims (rather than a judicial procedure in bankruptcy), the FDIC’s right to transfer claims to a bridge entity, and limitations on the ability of creditors to enforce contractual cross-defaults against potentially viable affiliates of the entity in receivership. OLA liquidity would be provided through credit support from the U.S. Treasury and assessments made, first, on claimants against the receivership that received more in the OLA resolution than they would have received in ordinary liquidation (to the full extent of the excess), and second, if necessary, on SIFIs like KeyCorp utilizing a risk-based methodology. Depositor preference The FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of its depositors (including claims of its depositors that have subrogated to the FDIC) and certain claims for administrative expenses of the FDIC as receiver have priority over other general unsecured claims. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will be placed ahead of unsecured, nondeposit creditors, including the institution’s parent BHC and subordinated creditors, in order of priority of payment. Resolution and recovery plans BHCs with at least $50 billion in total consolidated assets, like KeyCorp, have been required to periodically submit to the Federal Reserve and FDIC a plan discussing how the company could be rapidly and orderly resolved if the company failed or experienced material financial distress. Insured depository institutions with at least $50 billion in total consolidated assets, like KeyBank, have also been required to submit a resolution plan to the FDIC. These plans have been due annually unless the requirement to submit the plans was deferred by the regulators. The Federal Reserve and FDIC make available on their websites the public sections of resolution plans for the companies, including KeyCorp and KeyBank, that submitted plans. The public sections of the resolution plans of KeyCorp and KeyBank are available at http://www.federalreserve.gov/supervisionreg/resolution-plans.htm and https://www.fdic.gov/resolutions/fdic-and-financial-regulatory-reform-title-i-and-idi-resolution-planning/. KeyCorp’s last resolution plan was submitted in 2017, and KeyBank’s last resolution plan was submitted in 2022. KeyCorp is no longer required to submit a resolution plan because of the rule change discussed below while KeyBank remains subject to resolution plan requirements as discussed below. BHCs with less than $250 billion in total consolidated assets are no longer required to submit a resolution plan unless they have $75 billion or more in certain risk-based indicators. Under this rule, KeyCorp is no longer subject to resolution planning requirements. On June 20, 2024, the FDIC adopted a final rule to amend and restate its current resolution plan rule in order to clarify and strengthen resolution plan submission requirements and reflect lessons learned since the adoption of the FDIC’s current resolution plan rule in 2012. Among other things, the final rule (i) requires IDIs with more than $100 billion in total assets that are affiliated with a U.S. G-SIB to submit full resolution plans every two years, (ii) requires IDIs with more than $100 billion in total assets that are not affiliated with a U.S. G-SIB (including KeyBank) to submit full resolution plans every three years, (iii) requires IDIs with total assets between $50 billion and $100 billion to submit informational filings every three years, (iv) requires triennial filers to submit more limited supplements in the off years, (v) enhances and clarifies the requirements for the content of resolution submissions, (vi) codifies certain 19 Table of contents aspects of guidance and feedback provided to filers subject to the current rule, (vii) expands expectations regarding engagement and capabilities testing, and (viii) establishes an enhanced credibility standard for the evaluation of resolution submissions. The final rule was effective on October 1, 2024. KeyBank is required to file its next resolution plan by July 1, 2025, which will be its initial filing under the final rule. On October 21, 2024, the OCC adopted revisions to its recovery planning guidelines. The OCC’s recovery planning guidelines require large OCC-regulated banks to develop and maintain a recovery plan that identifies triggers and options for responding to a wide range of severe internal and external stress scenarios so that the bank can be restored to financial strength and viability in a timely manner if it were to experience such stress situations. The OCC revised these guidelines to (i) expand the applicability of the guidelines to banks with at least $100 billion in average total consolidated assets, (ii) add a requirement for covered banks to test their recovery plans to ensure that their plans will be effective during periods of severe stress, and (iii) clarify that recovery plans should consider non-financial risks (including operational and strategic risks) as well as financial risks. KeyBank is subject to the OCC’s revised recovery planning guidelines. KeyBank is required to be in compliance with these guidelines by January 1, 2026 except that KeyBank’s compliance with the testing requirement is delayed until January 1, 2027. Other Regulatory Requirements and Developments The Bank Secrecy Act The BSA requires all financial institutions (including banks and securities broker-dealers) to, among other things, maintain a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. It includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting) as well as due diligence and know-your-customer documentation requirements. Key has established and maintains an AML program to comply with the BSA’s requirements. Consumer Financial Protection Bureau Title X of the Dodd-Frank Act created the CFPB, a consumer financial services regulator with supervisory authority over banks and their affiliates with assets of more than $10 billion, like Key, to carry out federal consumer protection laws. The CFPB also regulates financial products and services sold to consumers and has rulemaking authority with respect to federal consumer financial laws. Any new regulatory requirements promulgated by the CFPB or modifications in the interpretations of existing regulations could require changes to Key’s consumer-facing businesses. The Dodd-Frank Act also gives the CFPB broad data collecting powers for fair lending for both small business and mortgage loans, as well as extensive authority to prevent unfair, deceptive and abusive practices. Volcker Rule The Volcker Rule implements Section 619 of the Dodd-Frank Act, which prohibits “banking entities,” such as KeyCorp, KeyBank and their affiliates and subsidiaries, from owning, sponsoring, or having certain relationships with hedge funds and private equity funds (referred to as “covered funds”) and engaging in short-term proprietary trading of financial instruments, including securities, derivatives, commodity futures and options on these instruments. The Volcker Rule excepts certain transactions from the general prohibition against proprietary trading, including transactions in government securities (e.g., U.S. Treasuries or any instruments issued by the GNMA, FNMA, FHLMC, a Federal Home Loan Bank, or any state or a political division of any state, among others); transactions in connection with underwriting or market-making activities; and transactions as a fiduciary on behalf of customers. A banking entity may also engage in risk-mitigating hedging activity if it can demonstrate that the hedge reduces or mitigates a specific, identifiable risk or aggregate risk position of the entity. The banking entity is required to conduct an analysis supporting its hedging strategy and the effectiveness of the hedges must be monitored and, if necessary, adjusted on an ongoing basis. Key does not anticipate that the proprietary trading or covered fund restrictions in the Volcker Rule will have a material impact on its business, but it was required to divest certain fund investments. As of June 30, 2023, Key has completed conforming and/or divesting certain indirect investments subject to the Volcker Rule. 20 Table of contents Enhanced prudential standards and early remediation requirements The Dodd-Frank Act required the Federal Reserve to impose enhanced prudential standards upon BHCs, like KeyCorp, with at least $50 billion in total consolidated assets. Prudential standards were required to include enhanced risk-based capital requirements and leverage limits, liquidity requirements, risk-management and risk committee requirements, resolution plan requirements, credit exposure report requirements, single counterparty credit limits (“SCCL”), supervisory and company-run stress test requirements and, for certain financial companies, a debt-to-equity limit. Early remediation requirements were required to include limits on capital distributions, acquisitions, and asset growth in early stages of financial decline and capital restoration plans, capital raising requirements, limits on transactions with affiliates, management changes, and asset sales in later stages of financial decline, which would be triggered by forward-looking indicators including regulatory capital and liquidity measures. EGRRCPA raised the asset threshold above which the Federal Reserve is required to apply enhanced prudential standards to BHCs from $50 billion to $250 billion and gave the Federal Reserve the authority to apply enhanced prudential standards to BHCs with at least $100 billion in assets. Please see the discussion under the headings “Regulatory capital requirements - Liquidity requirements” and “Regulatory capital requirements - Capital planning and stress testing” for more information about EGRRCPA and the related Tailoring Rules. Since 2010, the Federal Rule has implemented the following enhanced prudential standards required under the Dodd-Frank Act: (i) the resolution plan requirements (through a joint final rule adopted with the FDIC), (ii) stress test requirements, (iii) the incorporation of the Regulatory Capital Rules through the Federal Reserve’s previously finalized rules on capital planning and stress tests; (iv) liquidity requirements; (v) the risk management framework, including requirements around the risk committee and the chief risk officer as well as the corporate governance requirements as they relate to liquidity risk management; and (vi) a 15-to-1 debt-to-equity, limit for companies that the FSOC determines pose a “grave threat” to U.S. financial stability. In addition, the Federal Reserve has issued a final rule establishing SCCL requirements, but that rule does not apply to KeyCorp. The Federal Reserve has yet to implement a final rule on the early remediation requirements. Bank transactions with affiliates Federal banking law and regulation imposes qualitative standards and quantitative limitations upon certain transactions by a bank with its affiliates, including the bank’s parent BHC and certain companies the parent BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms, and cannot exceed certain amounts that are determined with reference to the bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. These provisions significantly restrict the ability of KeyBank to fund its affiliates, including KeyCorp, KBCM, and KeyCorp’s nonbanking subsidiaries engaged in making merchant banking investments (and certain companies in which these subsidiaries have invested). The Dodd-Frank Act expanded the coverage and scope of these regulations, including by applying them to the credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions. Supervision and governance KeyCorp is subject to the Federal Reserve’s supervisory rating system for large financial institutions, which includes BHCs with total consolidated assets of $100 billion or more (including KeyCorp) (“LFI Rating System”). The LFI Rating System provides a supervisory evaluation of whether an institution possesses sufficient operational strength and resilience to maintain safe and sound operations through a range of conditions and assesses an institution’s capital planning and positions, liquidity risk management and positions, and governance and controls. Ratings issued under the LFI Rating System are confidential. Community Reinvestment Act The Community Reinvestment Act (“CRA”) was enacted in 1977 to encourage depository institutions to help meet the credit needs of the communities that they serve, including low- and moderate-income (“LMI”) neighborhoods, consistent with the institutions’ safe and sound operations. The CRA requires the federal banking agencies to assess the record of each institution that they supervise in meeting the credit needs of its entire community, including LMI neighborhoods. 21 Table of contents On October 24, 2023, the federal banking agencies adopted a final rule to strengthen and modernize their regulations implementing the CRA to better achieve the purposes of the law, adapt to changes in the banking industry, and provide clarity and consistency in the application of their regulations. Among other things, the final rule (1) clarifies what activities constitute eligible community development activities, (2) adopts four new tests under which large banks with more than $2 billion in assets (including KeyBank) will be evaluated, (3) applies a new framework for assigning conclusions and ratings to banks, (4) updates requirements for delineating facility-based assessment areas, (5) provides for the evaluation of certain large banks in retail lending assessment areas as well as facility-based assessment areas, and (6) imposes new data collection and reporting requirements. The four new tests under which large banks will be evaluated are a retail lending test, a retail services and products test, a community development financing test, and a community development services test. Various metrics and performance standards will be applied under these tests. Most provisions of the final rule will be effective on January 1, 2026, while certain reporting requirements will be effective on January 1, 2027. KeyBank is subject to the final rule. Various trade associations filed a lawsuit in the United States District Court for the Northern District of Texas seeking to invalidate the CRA final rule. In their lawsuit, the trade associations argued that the federal banking agencies exceeded their authority in adopting the CRA final rule. On March 29, 2024, the court in that case issued a preliminary injunction barring the federal banking agencies from enforcing the CRA final rule against the plaintiffs pending the resolution of this lawsuit. The court also extended all implementation dates under the CRA final rule, day for day, for each day that the injunction remains in place. The court concluded that the plaintiffs had demonstrated a substantial likelihood of success on the merits and would suffer irreparable harm if they had to incur costs to prepare to comply with a rule that might later be invalidated. The court’s decision granting a preliminary injunction is on appeal to the United States Court of Appeals for the Fifth Circuit. Key is monitoring developments in this case. Developments relating to climate change On October 24, 2023, the federal banking agencies issued a set of principles that provide a high-level framework for the safe and sound management of exposures to climate-related financial risks for financial institutions with over $100 billion in total consolidated assets. These principles are intended to provide large financial institutions with guidance in their efforts to identify, measure, monitor, and mitigate physical and transition risks associated with climate change. These principles discuss how these risks can be addressed in the following areas: governance; policies, procedures, and limits; strategic planning; risk management; data, risk measurement, and reporting; and scenario analysis. These principles also describe how climate-related financial risks can be addressed in connection with various specific risk categories, including credit risk, liquidity risk, operational risk, and legal/compliance risk. This interagency guidance applies to KeyCorp and KeyBank. Long-term debt requirement On August 29, 2023, the federal banking agencies issued for public comment a proposal that would require certain large BHCs and certain large IDIs to issue and maintain minimum amounts of long-term debt (“LTD”). This proposal would apply to Category II, III, and IV BHCs (including KeyCorp) and IDIs that (i) are not consolidated subsidiaries of U.S. global systemically important banks and (ii) have at least $100 billion in total assets (including KeyBank) or are affiliated with an IDI that has at least $100 billion in total assets. Under the proposal, the required minimum amount of LTD would be the greater of 6 percent of an entity’s total risk-weighted assets, 3.5 percent of an entity’s average total consolidated assets, and 2.5 percent of an entity’s total leverage exposure if it is subject to the supplementary leverage ratio. IDIs that are consolidated subsidiaries of BHCs would be required to issue the LTD to their parent company or another entity that consolidates the IDI. Debt instruments issued to satisfy the minimum LTD requirement would have to meet certain criteria including, among other things, being unsecured, have a remaining maturity of more than one year, and not provide the holder with acceleration rights except in limited circumstances. BHCs subject to the proposal would also have to comply with certain “clean holding-company” requirements such as a cap on liabilities other than eligible LTD and a prohibition on entering into most qualified financial contracts with third parties. The proposal would provide a three-year transition period with the incremental phase-in of the requirements during this period. The federal banking agencies indicated that the proposal would improve the resolvability of the covered entities in case of their failure, reduce costs to the DIF, and mitigate contagion and financial stability risks by reducing the risk of loss to uninsured depositors. Comments on the proposal were due by January 16, 2024. 22 Table of contents Debit card interchange fee cap On October 25, 2023, the Federal Reserve issued for public comment a proposal to lower the maximum interchange fee that a debit card issuer with $10 billion or more in total consolidated assets (including KeyBank) can receive for a debit card transaction. The interchange fee cap is currently set at the sum of 21 cents for each transaction plus an amount equal to 0.05% of the value of the transaction and a one cent fraud prevention adjustment for issuers that satisfy certain criteria. In the new proposal, the Federal Reserve proposed to lower the cap to the sum of 14.4 cents for each transaction plus an amount equal to 0.04% of the value of the transaction and a 1.3 cent fraud prevention adjustment. The Federal Reserve indicated that it was proposing this revision to the fee cap to reflect changes in issuer costs. The Federal Reserve also proposed to update the amount of the fee cap every other year going forward by using data it collects in a biennial survey of large debit card issuers. Comments on the proposal were due by May 12, 2024. Personal financial data rights On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act, which gives individuals the right to obtain data regarding consumer financial products and services they have obtained. The final rule requires financial institutions (including KeyBank) and other financial service providers (collectively “data providers”) to make available to consumers and authorized third parties, upon request, data in the data provider’s possession or control concerning covered consumer financial products or services (including credit cards, deposit accounts, and other accounts that facilitate payments) in an electronic form usable by the consumers and authorized third parties. The data that must be provided includes account balance information, at least 24 months of transaction history, pricing information, information on upcoming third-party bill payments, and account verification information. The data providers are required to create and maintain consumer and developer interfaces that will be able to transfer the data. A data provider will not be allowed to charge any fees or other charges for making the covered data available or for maintaining the required interfaces. The CFPB indicated that it adopted this rule in order to foster competition and consumer choice and said that this rule is a step towards bringing about an “open banking” system in the United States. Compliance with the rule will be phased in over several years with KeyBank required to be in compliance by April 1, 2027. Following the issuance of this rule, two trade associations and a national bank headquartered in Kentucky filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky. In this lawsuit, the plaintiffs alleged that the CFPB exceeded its statutory authority in adopting the rule. Key is monitoring developments in this case. 23 Table of contents