What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-02-23 compared with 2025-02-21 · 221 added, 196 removed, 325 unchanged (56% of the section changed)

4 unchanged sentences

Consumer Bank and Commercial Bank.

As of December 31, 2024, these services were provided across the country through KeyBank’s 944 full-service retail banking branches and a network of 1,182 ATMs in 15 states, as well as additional offices, online and mobile banking capabilities, including our national digital brand, Laurel Road, and a telephone banking call center.

As of December 31, 2025, these services were provided across the country through KeyBank’s 940 full-service retail banking branches and a network of 1,120 ATMs in 15 states, as well as additional offices, online and mobile banking capabilities, and a telephone banking call center.

Additional information pertaining to our two business segments is included in the “Business Segment Results” section in Item 7.

12 unchanged sentences

Note 23 (“Business Segment Reporting”) describes the products and services offered by each of these business segments and provides more detailed financial information pertaining to the segments, including changes in basis of presentation.

The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our Laurel Road digital brand by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services.

The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our digital brand by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services.

In addition, wealth management and investment services are offered to assist non-profit and high-net-worth clients with their banking, trust, portfolio management, charitable giving, and related needs.

The Commercial Bank consists of the Commercial and Institutional operating segments.

The Commercial operating segment is a full-service, commercial banking platform that focuses primarily on serving the borrowing, cash

management, and capital markets needs of middle market clients within Key’s 15-state branch footprint.

The Institutional operating segment operates nationally in providing lending, equipment financing, and banking products and services to large corporate and institutional clients.

The Commercial operating segment is a full-service, commercial banking platform that focuses primarily on serving the borrowing, cash management, and capital markets needs of middle market clients within Key’s 15-state branch footprint.

Institutional operating segment operates nationally in providing lending, equipment financing, and banking products and services to large corporate and institutional clients.

The industry coverage and product teams have established expertise in the following sectors:

14 unchanged sentences

Within the time period required by the SEC and the NYSE, we will post on our website any amendment to the Code of Ethics and any waiver applicable to any senior executive officer or director.

We also make available a summary of filings made with the SEC of statements of beneficial ownership of our equity securities filed by our directors and officers under Section 16 of the Exchange Act.

We also make available a summary of filings made with the SEC of statements of beneficial ownership of our equity securities filed by our directors and officers and persons who own more than 10% of a registered class of our equity securities under Section 16 of the Exchange Act.

The “Regulatory Disclosures & Filings” section under the “Financials” tab of the investor relations section of our website includes public disclosures concerning our historic annual and mid-year stress-testing activities under the Dodd-Frank Act and our quarterly regulatory capital disclosures under the third pillar of Basel III.

19 unchanged sentences

We make investments to hire and retain the people we need to serve our customers and communities and regularly review our pay practices to reflect changing market and economic conditions.

We have steadily increased our starting minimum wage since 2015, and as of December 31, 2024, 93% of employees earned $20 or more per hour.

We have made other compensation adjustments in response to market trends, competitive pressures, and a dynamic market for talent.

As of December 31, 2025, 95% of employees earned $20 or more per hour.

In recent years, we have made other compensation adjustments in response to market trends, competitive pressures, and a dynamic market for talent.

These investments include a comprehensive and competitive total rewards program, representing our investment in our teammates’ collective success and reflecting our commitment to helping them thrive.

22 unchanged sentences

Set forth below are the names and ages of the executive officers of KeyCorp as of December 31, 2025, the positions held by each at KeyCorp during the past five years, and the year each first became an executive officer of KeyCorp.

On January 23, 2025, Mohit (Mo) Ramani became Chief Risk Officer.

Because Mo Ramani and James Waters have been employed at KeyCorp for less than five years, information is being provided concerning their prior business experience.

Because Mohit Ramani and James Waters have been employed at KeyCorp for less than five years, information is being provided concerning their prior business experience.

There are no family relationships among the directors or the executive officers, and there is no arrangement or understanding between any executive officer and any other person pursuant to which the executive officer was selected.

2 unchanged sentences

Prior to that time, he served as the Head of Home Lending from October 2018 to January 2020 and Treasurer from July 2017 to October 2018.

Benhart (59) - On December 31, 2024, Mr.

Benhart was Chief Risk Officer and an executive officer of KeyCorp and had served in such capacity since January 1, 2024.

Prior to that time, he served as Deputy Chief Risk Officer and Head of Enterprise Risk Management from August 2023 to December 2023 and Chief Enterprise Risk Officer from July 2022 to August 2023.

Prior to July 2022, he served as a National Bank Examiner with the OCC from March 1992 to March 2022.

Brady (59) - Ms.

15 unchanged sentences

Gilbert served as Corporate Controller for KeyCorp since August 2023.

She previously served as Assistant Corporate Controller and Senior Director of External Reporting and Accounting Policy.

She first joined the Company in 2002, holding a variety of accounting roles, before leaving to join FirstMerit Corporation in 2008.

She re-joined the Company in 2016.

She previously served as Assistant Corporate Controller and Senior Director of External Reporting and Accounting Policy from April 2021 to August 2023.

Christopher M.

11 unchanged sentences

Kidik (46) - Ms.

Kidik has been the Chief Risk Review Officer and General Auditor and an executive officer of KeyCorp since July 2022.

Kidik has been the Chief Auditor and an executive officer of KeyCorp since July 2022.

Kidik previously served as Senior Deputy General Auditor from 2018 to 2022 and Deputy General Auditor from 2015 to 2018.

9 unchanged sentences

Mohit Ramani (52) - Mr.

Ramani became Chief Risk Officer and an executive officer of KeyCorp on January 23, 2025.

Ramani has served as Chief Risk Officer and an executive officer of KeyCorp since January 2025.

Prior to that time, he served in a variety of roles with Truist Financial Corporation, including Deputy Chief Risk Officer and Chief Credit Officer from January 2023 to January 2025 and Chief Business Unit Risk Officer from 2000 to 2023.

4 unchanged sentences

The regulatory framework applicable to BHCs and banks is intended primarily to protect consumers, the DIF, taxpayers and the banking system as a whole, rather than to protect the security holders and creditors of financial services companies.

Comprehensive reform of the legislative and regulatory environment for financial services companies occurred in 2010 and remains ongoing.

Comprehensive reform of the legislative and regulatory environment for financial services companies remains ongoing.

We cannot predict changes in applicable laws, regulations or regulatory agency policies, but any such changes may materially affect our business, financial condition, results of operations, or access to liquidity or credit.

8 unchanged sentences

Certain specific activities, including traditional bank trust and fiduciary activities, may be conducted in a bank without the bank being deemed a “broker” or a “dealer” in securities for purposes of securities functional regulation.

BHC acquisition rules and permissible activities

Under the BHCA, BHCs generally may not directly or indirectly own or control more than 5% of the voting shares, or substantially all of the assets, of any bank, without prior approval from the Federal Reserve.

4 unchanged sentences

physical commodities trading activities, energy management services, and energy tolling, among others.

Source of strength doctrine

Under federal law, a BHC also must serve as a source of financial strength to its subsidiary depository institution(s) by providing financial assistance in the event of financial distress.

2 unchanged sentences

In addition, federal law provides that in the bankruptcy of a BHC, any commitment by the BHC to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to priority of payment.

Supervisory framework

The Dodd-Frank Act created the FSOC to overlay the U.S.

supervisory framework for BHCs, insured depository institutions, and other financial service providers, by serving as a systemic risk oversight body.

supervisory framework for BHCs, IDIs, and other financial service providers, by serving as a systemic risk oversight body.

Specifically, the FSOC is authorized to:

3 unchanged sentences

government will shield shareholders, creditors, and counterparties from losses in the event of failure;

and (iii) respond to emerging threats

to the stability of the U.S.

and (iii) respond to emerging threats to the stability of the U.S.

financial system.

2 unchanged sentences

designating nonbank financial companies for consolidated supervision by the Federal Reserve;

designating systemic financial market utilities and systemic payment, clearing, and settlement activities requiring prescribed risk management standards and heightened federal regulatory oversight;

systemic financial market utilities and systemic payment, clearing, and settlement activities requiring prescribed risk management standards and heightened federal regulatory oversight;

recommending stricter standards for SIFIs;

8 unchanged sentences

derivatives industry.

Our securities brokerage and asset management subsidiaries are subject to supervision and regulation by the SEC, FINRA, and state securities regulators, and our insurance subsidiaries are subject to regulation by the insurance regulatory authorities of the states in which they operate.

Our securities brokerage and asset management subsidiaries are subject to supervision and regulation by the SEC, FINRA, and state securities regulators, and our insurance agency subsidiary is subject to regulation by the insurance regulatory authorities of the states in which it operates.

Our other nonbank subsidiaries are subject to laws and regulations of both the federal government and the various states in which they are authorized to do business.

Regulatory capital requirements

Enhanced prudential standards and tailoring rules

The Dodd-Frank Act required the Federal Reserve to impose enhanced prudential standards upon BHCs with at least $50 billion in total consolidated assets (like KeyCorp).

Prudential standards were required to include enhanced risk-based capital requirements and leverage limits, liquidity requirements, risk-management and risk committee requirements, resolution plan requirements, credit exposure report requirements, single counterparty credit limits, supervisory and company-run stress test requirements, and for certain financial companies, a debt-to-equity limit.

The Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) raised the asset threshold above which the Federal Reserve is required to apply enhanced prudential standards to BHCs with at least $250 billion in total consolidated assets and gave the Federal Reserve the authority to apply enhanced prudential standards to BHCs with at least $100 billion in assets but less than $250 billion in assets (like KeyCorp) if it determines that the application of the enhanced prudential standards is appropriate to prevent or mitigate risks to financial stability or to promote the safety and soundness of the BHC or BHCs, taking into consideration the BHC’s or BHCs’ capital structure, riskiness, complexity, financial activities, size, and other relevant factors.

Final rules related to the implementation of EGRRCPA (“Tailoring Rules”) established four risk-based categories of BHCs and their bank subsidiaries with $100 billion or more in total consolidated assets and applied tailored regulatory requirements to each respective category.

KeyCorp and KeyBank fall within the least restrictive of those categories (“Category IV”).

The requirements applicable to Category IV firms pursuant to the Tailoring Rules are discussed below.

Regulatory Capital and Liquidity Requirements

KeyCorp and KeyBank are subject to regulatory capital requirements that are based largely on the work of an international group of supervisors known as the Basel Committee on Banking Supervision (“Basel Committee”).

8 unchanged sentences

Only KeyCorp is subject to the market risk capital rule, as KeyBank does not engage in substantial trading activity.

To address deficiencies in the international regulatory capital standards identified during the 2007-2009 global financial crisis, in 2010 the Basel Committee released comprehensive revisions to the international regulatory capital framework, commonly referred to as “Basel III.” The Basel III revisions are designed to strengthen the quality and quantity of regulatory capital, in part through the introduction of a Common Equity Tier 1 capital requirement;

To address deficiencies in the international regulatory capital standards identified during the 2007-2009 global financial crisis, the Basel Committee in 2010 released comprehensive revisions to the international regulatory capital framework, commonly referred to as “Basel III.” The Basel III revisions are designed to strengthen the quality and quantity of regulatory capital, in part through the introduction of a Common Equity Tier 1 capital requirement;

provide more comprehensive and robust risk coverage, particularly for securitization exposures, equities, and off-balance sheet positions;

and address pro-cyclicality concerns through the implementation of capital

and address pro-cyclicality concerns through the implementation of capital buffers.

The Basel Committee also released a series of revisions to the market risk capital framework to address deficiencies identified during its initial implementation (e.g., arbitrage opportunities between the credit risk-based and market risk capital rules) and in connection with the global financial crisis.

6 unchanged sentences

However, some of those additional requirements will apply to KeyCorp and KeyBank if proposed revisions to the Regulatory Capital Rules are adopted.

The proposed revisions to the Regulatory Capital Rules are discussed below under the heading “Recent regulatory capital-related developments.” For purposes of the Regulatory Capital Rules, KeyCorp and KeyBank are treated as “standardized approach” banking organizations.

The proposed revisions to the Regulatory Capital Rules are discussed below under the heading “Regulatory capital-related developments.” For purposes of the Regulatory Capital Rules, KeyCorp and KeyBank are treated as “standardized approach” banking organizations.

Under the Regulatory Capital Rules, standardized approach banking organizations, such as KeyCorp and KeyBank, are required to meet the minimum capital and leverage ratios set forth in the following table.

At December 31, 2024, KeyCorp’s ratios under the fully phased-in Regulatory Capital Rules are set forth in the following table.

At December 31, 2025, KeyCorp’s ratios under the fully phased-in Regulatory Capital Rules were as set forth in the following table.

Minimum Capital Ratios and KeyCorp Ratios Under Regulatory Capital Rules

Ratios (including stress capital buffer) Regulatory Minimum Requirement Stress Capital Buffer (b)

Regulatory Minimum With Stress Capital Buffer KeyCorp December 31, 2024 (c)

Regulatory Minimum Stress Capital Buffer KeyCorp

December 31, 2025

Common Equity Tier 1 4.50 % 3.20 % 7.70 % 11.78 %

2 unchanged sentences

4.00 N/A 4.00 10.50

(a) As a standardized approach banking organization, KeyCorp is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018.

However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules discussed below are adopted.

(a) As a standardized approach banking organization, KeyCorp is not subject to the 3% supplementary leverage ratio requirement.

However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules are adopted.

(b) Stress capital buffer must consist of Common Equity Tier 1 capital.

As a standardized approach banking organization, KeyCorp is not subject to the countercyclical capital buffer of up to 2.5% imposed upon an advanced approaches banking organization under the Regulatory Capital Rules.

However, KeyCorp will be subject to the countercyclical capital buffer if proposed revisions to the Regulatory Capital Rules discussed below are adopted.

Key elected the CECL phase-in option provided by regulatory guidance which delayed for two years the estimated impact of CECL on regulatory capital and phases it in over three years beginning in 2022.

Effective for the first quarter 2022, Key entered a three-year transition period, and the full impact of the CECL standard was phased-in to regulatory capital through December 31, 2024.

In the first quarter of 2025, CECL will be fully reflected in regulatory capital.

On a fully phased-in basis, Key’s Common Equity Tier 1 ratio would be reduced by five basis points.

However, KeyCorp will be subject to the countercyclical capital buffer if proposed revisions to the Regulatory Capital Rules are adopted.

KeyCorp’s stress capital buffer is 3.20% as of October 1, 2025.

Revised prompt corrective action framework

The federal Prompt Corrective Action (“PCA”) framework under the FDIA groups FDIC-insured depository institutions into one of five prompt corrective action capital categories:

“well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” In addition to implementing the Basel III capital framework in the United States, the Regulatory Capital Rules also revised the PCA capital category threshold ratios applicable to FDIC-insured depository institutions such as KeyBank.

The Revised PCA framework table below identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the Prompt Corrective Action Framework.

threshold ratios applicable to FDIC-insured depository institutions such as KeyBank.

The revised PCA framework table below identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the PCA framework.

“Well Capitalized” and “Adequately Capitalized” Capital Category Ratios under

9 unchanged sentences

(b) As a standardized approach banking organization, KeyBank is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018.

However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules discussed below are adopted.

As of December 31, 2024, KeyBank (consolidated) satisfied the risk-based and leverage capital requirements necessary to be considered “well capitalized” for purposes of the revised prompt corrective action framework.

However, KeyBank will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules are adopted.

As of December 31, 2025, KeyBank (consolidated) satisfied the risk-based and leverage capital requirements necessary to be considered “well capitalized” for purposes of the revised PCA framework.

However, investors should not regard this determination as a representation of the overall financial condition or prospects of KeyBank because the PCA framework is intended to serve a limited supervisory function.

Moreover, it is important to note that the PCA framework does not apply to BHCs, like KeyCorp.

Recent regulatory capital-related developments

Regulatory capital-related developments

On July 27, 2023, the federal banking agencies issued a proposal (the “Capital Proposal”) that would make significant changes to the Regulatory Capital Rules applicable to banking organizations with total assets of $100 billion or more and their depository institution subsidiaries (“Large Banking Organizations”) (including KeyCorp and KeyBank) and banking organizations with significant trading activity.

3 unchanged sentences

It would also include new standardized approaches for measuring market risk and credit valuation adjustment risk but would allow the use of internal models for market risk in certain circumstances with regulatory approval.

Under the Capital Proposal, a Large Banking Organization would be required to calculate its risk-based capital ratios under both the expanded risk-based approach and the current standardized approach and would use the lower of the two.

All capital buffer requirements, including the stress capital buffer requirement, would apply regardless of whether the expanded risk-based approach or the existing standardized approach produces the lower ratio.

The Capital Proposal would also align the calculation of regulatory capital for Category III and IV banking organizations with the calculation of regulatory capital for Category I and II banking organizations.

KeyCorp and KeyBank are Category IV banking organizations.

In addition, the Capital Proposal would also align the calculation of regulatory capital for Category III and IV banking organizations (like KeyCorp and KeyBank) with the calculation of regulatory capital for Category I and II banking organizations.

Under the proposal, Category III and IV banking organizations would be required to include most components of AOCI, including net unrealized gains and losses on available-for-sale securities, in regulatory capital.

Category III and IV banking organizations would also be required to apply the same capital deductions and minority interest treatments that currently apply to Category I and Category II banking organizations.

In addition, all Large Banking Organizations would be subject to the supplementary leverage ratio and countercyclical capital buffer requirement and would be required to make certain enhanced public disclosures.

The expanded total risk-weighted assets calculation used in the expanded risk-based approach would be phased in over a three-year period.

For Category III and IV banking organizations, the requirement to reflect AOCI in regulatory capital would also be phased in over a three-year period.

All other elements of the calculation of regulatory capital would apply on the effective date of a final rule if the proposal is adopted.

Comments on this proposal were due by January 16, 2024.

Liquidity requirements

banking organizations are subject to regulatory liquidity requirements based on international liquidity standards established by the Basel Committee (the “Basel III liquidity framework”).

The Basel III liquidity framework establishes quantitative standards designed to ensure that a banking organization is appropriately positioned, from a balance sheet perspective, to satisfy its short- and long-term funding needs.

To address short-term liquidity risk, the Basel III liquidity framework established a liquidity coverage ratio (“Basel III LCR”), calculated as the ratio of a banking organization’s high-quality liquid assets to its total net cash outflows over 30 consecutive calendar days.

In addition, to address long-term liquidity risk, the Basel III liquidity framework established a net stable funding ratio (“Basel III NSFR”), calculated as the ratio of the amount of stable funding available to a banking organization to its required amount of stable funding.

Consistent with the Basel III LCR, the final rules implementing the Basel III LCR for U.S.

banking organizations (the “Liquidity Coverage Rules”) established a minimum LCR for certain internationally active bank and nonbank financial companies (excluding KeyCorp), and a modified version of the LCR (“Modified LCR”) for BHCs and other depository institution holding companies with over $50 billion in consolidated assets that are not internationally active (including KeyCorp).

Under the Liquidity Coverage Rules, KeyCorp was required to calculate a Modified LCR on a monthly basis and was required to satisfy a minimum Modified LCR requirement of 100%.

KeyBank was not subject to the LCR or the Modified LCR under the Liquidity Coverage Rules.

Large BHCs, like KeyCorp, are also subject to liquidity requirements contained in regulations adopted pursuant to the Dodd-Frank Act and the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”).

As enacted in 2010, the Dodd-Frank Act required the Federal Reserve to impose enhanced prudential standards and early remediation requirements, including enhanced liquidity standards, upon BHCs (like KeyCorp) with at least $50 billion in total consolidated assets.

EGRRCPA, enacted on May 24, 2018, raised the asset threshold above which the Federal Reserve is required to apply enhanced prudential standards to BHCs from $50 billion to $250 billion.

EGRRCPA gave the Federal Reserve the authority to continue to apply enhanced prudential standards to any BHCs having at least $100 billion but less than $250 billion in total consolidated assets (like KeyCorp) if it determines that the application of the standard is appropriate to prevent or mitigate risks to financial stability or to promote the safety and soundness of the BHC or BHCs, taking into consideration the BHC’s or BHCs’ capital structure, riskiness, complexity, financial activities, size, and other relevant factors.

As a result of the Federal Reserve’s implementation of certain of the enhanced prudential standards, KeyCorp is subject to requirements relating to cash flow projections, a contingency funding plan, liquidity risk limits, the monitoring of liquidity risks (with respect to collateral, legal entities, currencies, business lines, and intraday exposures), liquidity stress testing, a liquidity buffer, and liquidity risk management requirements, including requirements that apply to the board of directors, the risk committee, senior management, and the independent review function.

Final rules related to the implementation of EGRRCPA (“Tailoring Rules”) established four risk-based categories of banking organizations with $100 billion or more in total consolidated assets and applied tailored regulatory requirements to each respective category.

KeyCorp falls within the least restrictive of those categories (“Category IV Firms”).

Under one of the Tailoring Rules, Category IV Firms with weighted short-term wholesale funding of less than $50 billion will not be subject to a modified LCR.

KeyCorp does not meet the $50 billion threshold and is not subject to the modified LCR or an LCR public disclosure requirement.

Under another Tailoring Rule, Category IV Firms (like KeyCorp) are required to conduct internal liquidity stress tests quarterly and are subject to simplified liquidity risk management requirements.

Category IV Firms are still required to maintain a liquidity buffer that is sufficient to meet the projected net stressed cash-flow need over a 30-day planning horizon under the firm’s internal liquidity stress test and remain subject to monthly tailored FR 2052a liquidity reporting requirements.

Under the final rules adopted by the federal banking agencies to implement the Basel III NSFR for U.S.

banking organizations, certain banking organizations with more than $100 billion in total assets must maintain minimum amounts of stable funding to support their assets, commitments, and derivatives exposures over a one-year time horizon.

Under the rules, KeyCorp, as a Category IV firm with average weighted short-term wholesale funding of less than $50 billion, is not subject to an NSFR requirement.

Capital planning and stress testing

The Federal Reserve’s capital plan rule requires each U.S.-domiciled, top-tier BHC with total consolidated assets of at least $100 billion (like KeyCorp) to develop and maintain a written capital plan supported by a robust internal capital adequacy process.

Furthermore, all Large Banking Organizations would be subject to the supplementary leverage ratio and countercyclical capital buffer requirement.

The federal banking agencies have indicated that they will be revising the Capital Proposal that was issued in July 2023, but it is uncertain what changes will be made to the proposal.

Key is monitoring developments regarding this matter.

Capital planning, stress testing, and stress capital buffer

The Federal Reserve’s capital plan rule requires each U.S.-domiciled, top-tier BHC with total consolidated assets of at least $100 billion (like KeyCorp) to develop and maintain on an annual basis a written capital plan supported by a robust internal capital adequacy process.

The capital plan must include, among other things, an assessment of the expected uses and sources of capital over a nine-quarter planning horizon, a description of all planned capital actions over the planning horizon, a detailed description of the BHC’s process for assessing capital adequacy, a discussion of any expected changes to the BHC’s business plan that are likely to have a material impact on its capital adequacy or liquidity, and the BHC’s capital policy.

The capital plan must be submitted to the Federal Reserve for supervisory review in connection with the BHC’s CCAR (described below).

3 unchanged sentences

The Federal Reserve expects BHCs subject to CCAR to have and maintain regulatory capital in an amount that is sufficient to withstand a severely adverse operating environment and, at the same time, be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and provide credit intermediation.

The Federal Reserve has conducted a supervisory stress test on KeyCorp, pursuant to which the Federal Reserve projects revenues, expenses, losses, and resulting post-stress capital levels and regulatory capital ratios under conditions that affect the U.S.

economy or the financial condition of KeyCorp, including supervisory baseline and severely adverse scenarios, that are determined by the Federal Reserve.

KeyCorp and KeyBank have also been required to conduct their own company-run stress tests to assess the impact of stress scenarios (including supervisor-provided baseline, adverse, and severely adverse scenarios and, for KeyCorp, one KeyCorp-defined baseline scenario and at least one KeyCorp-defined stress scenario) on their consolidated earnings, losses, and capital over a nine-quarter planning horizon, taking into account their current condition, risks, exposures, strategies, and activities.

While KeyBank currently only has to conduct an annual stress test, KeyCorp has had to conduct both an annual and a mid-cycle stress test in the past.

KeyCorp and KeyBank have been required to report the results of their annual stress tests to the Federal Reserve and the OCC.

Under one of the Tailoring Rules, KeyCorp is no longer required to conduct and publicly disclose the results of company-run stress tests and is subject to a supervisory stress test conducted by the Federal Reserve every other year rather than every year.

In 2024, KeyCorp was required to participate in the Federal Reserve’s CCAR process and was subject to a supervisory stress test conducted by the Federal Reserve.

Since the adoption of a final rule by the federal banking agencies in October 2019, KeyBank is no longer required to conduct annual company-run stress tests.

Also, this final rule removes the “adverse” scenario as a required scenario for all stress testing requirements applicable to BHCs and federally-regulated banks so that such stress tests will be required to include only “baseline” and “severely adverse” scenarios.

The Federal Reserve conducts a supervisory stress test on BHCs with at least $100 billion in total consolidated assets (including KeyCorp), pursuant to which the Federal Reserve projects revenues, expenses, losses, and resulting post-stress capital levels and regulatory capital ratios under conditions that affect the U.S.

economy under supervisory baseline and severely adverse scenarios that are determined by the Federal Reserve.

The Federal Reserve conducts a supervisory stress test of the largest BHCs on an annual basis.

Under one of the Tailoring Rules, Category IV BHCs (such as KeyCorp) are subject to a supervisory stress test conducted by the Federal Reserve every other year rather than every year.

On March 4, 2020, the Federal Reserve adopted a final rule integrating certain aspects of the Federal Reserve’s Regulatory Capital Rules with CCAR and the stress test rules in order to simplify the overall capital framework that is currently applicable to BHCs that have $100 billion or more in total consolidated assets (including KeyCorp).

1 unchanged sentence

A firm will be subject to limitations on capital distributions and discretionary bonus payments if it does not satisfy all minimum capital requirements and its stress capital buffer requirement.

Under the Tailoring Rules, the portion of the stress capital buffer for a Category IV firm based on the Federal Reserve’s stress test will be calculated biennially.

During a year in which in which a Category IV firm does not undergo a supervisory stress test, the firm will receive an updated stress capital buffer that reflects the firm’s updated planned common stock dividends.

A firm’s stress capital buffer requirement will become effective on October 1 of each year and will remain in effect until September 30 of the following year unless the firm receives an updated stress capital buffer requirement from the Federal Reserve.

On August 26, 2020, the federal banking agencies issued a final rule that revises the definition of eligible retained income as that term is used in the agencies’ Regulatory Capital Rules.

The revised definition applies to all buffer requirements applicable to a banking organization, including the stress capital buffer requirement adopted by the Federal Reserve on March 4, 2020.

The revised definition of eligible retained income will make any automatic limitations on capital distributions that could apply under the agencies’ capital rules more gradual with the objective of promoting continued lending during a period of stress.

On January 19, 2021, the Federal Reserve issued a final rule to make conforming changes to the capital planning, regulatory reporting, and stress capital buffer requirements for firms subject to Category IV standards (including KeyCorp) to make these requirements consistent with the tailored regulatory framework for large banking organizations that the Federal Reserve adopted in an October 2019 rulemaking.

The final rule revised the elements of the capital plan that Category IV firms are required to submit to the Federal Reserve and makes related changes to regulatory reporting requirements.

Also, the final rule updated the frequency for calculating the stress capital buffer for these firms.

On June 26, 2024, the Federal Reserve announced the results of the supervisory stress test that it conducted of 31 BHCs having more than $100 billion in total consolidated assets (including KeyCorp).

The Federal Reserve indicated that all BHCs subject to the stress test maintained capital ratios above the minimum required levels under the severely adverse scenario.

The stress test results for individual BHCs (including KeyCorp) were used by the Federal Reserve to determine a BHC’s updated stress capital buffer requirement.

The Federal Reserve published the updated stress capital buffer requirements on August 28, 2024.

KeyCorp’s updated stress capital buffer is 3.1%.

If a rule change proposed by the Federal Reserve on April 17, 2025 is adopted, a firm’s stress capital buffer requirement will become effective on January 1 rather than October 1 in order to give firms more time to adjust to updated capital requirements.

The adjusted stress capital buffer requirement would then remain in effect until the following December 31 unless the firm receives an updated stress capital buffer requirement from the Federal Reserve.

On June 27, 2025, the Federal Reserve announced the results of the supervisory stress test that it conducted of 22 large BHCs (not including KeyCorp).

As a Category IV banking organization subject to a supervisory stress test every other year, KeyCorp was not required to participate in the Federal Reserve’s supervisory stress test in 2025.

On August 29, 2025, the Federal Reserve published the updated stress capital buffer requirements for large BHCs, including BHCs like KeyCorp that did not participate in the supervisory stress test in 2025.

KeyCorp’s updated stress capital buffer is 3.2% (based on the results of KeyCorp’s 2024 supervisory stress test and adjusted for KeyCorp’s planned common stock dividends as set forth in KeyCorp’s 2025 capital plan).

This stress capital buffer became effective on October 1, 2025, and will remain in effect until September 30, 2026, unless KeyCorp later receives an updated stress capital buffer requirement from the Federal Reserve.

On December 23, 2024, the Federal Reserve announced that it intends to propose changes to its stress testing framework in order to improve the transparency of the stress tests and reduce the volatility of the resulting capital

requirements.

The Federal Reserve said that it plans to, among other things, disclose and seek public comment on the models and scenarios used in the stress tests and to average results over two years to reduce year-over-year changes in capital requirements.

Changes to the stress testing framework would apply to KeyCorp.

On December 24, 2024, five trade associations filed a lawsuit against the Federal Reserve in the United States District Court for the Southern District of Ohio to challenge the stress testing framework on the basis that the current framework violates the Administrative Procedures Act and the Due Process Clause of the United States Constitution.

The parties bringing the lawsuit indicated that they do not object to the use of stress tests to set stress capital buffer requirements but that they want to ensure that the Federal Reserve subjects the stress tests to public notice and comment and complies with other applicable legal requirements.

KeyCorp is monitoring developments in this case.

On October 24, 2025, the Federal Reserve issued a proposal that would codify a process under which the Federal Reserve would be required to annually disclose and seek public comment on the models and scenarios used in the supervisory stress test.

The Federal Reserve indicated that the proposal is intended to enhance the transparency and public accountability of the Federal Reserve’s supervisory stress test framework.

The Federal Reserve also proposed revisions to reporting forms submitted by firms subject to the supervisory stress test to reduce burden and improve risk capture in the stress tests.

Comments on the proposal were due by January 22, 2026.

Liquidity requirements

Under final rules adopted by the federal banking agencies, the largest U.S.

banking organizations are subject to a liquidity coverage ratio (“LCR”), calculated as the ratio of a banking organization’s high-quality liquid assets to its total net cash outflows over 30 consecutive calendar days, and a net stable funding ratio (“NSFR”), calculated as the ratio of the amount of stable funding available to a banking organization to its required amount of stable funding

over a one-year time horizon.

KeyCorp and KeyBank are not subject to an LCR requirement or an NSFR requirement under these rules because KeyCorp and KeyBank are Category IV banking organizations that have average weighted short-term wholesale funding of less than $50 billion.

However, Category IV BHCs, like KeyCorp, are subject to liquidity requirements contained in regulations adopted by the Federal Reserve pursuant to the Dodd-Frank Act and EGRRCPA.

Under these regulations, KeyCorp is subject to requirements involving cash flow projections over short-term and long-term time horizons, a contingency funding plan, liquidity risk limits, the monitoring of liquidity risks (with respect to collateral, legal entities, currencies, business lines, and intraday exposures), quarterly liquidity stress testing, liquidity risk management requirements, monthly liquidity reporting requirements, and a liquidity buffer that is sufficient to meet projected net stressed cash-flow needs over a 30-day planning horizon.

Dividend restrictions

4 unchanged sentences

Under the undivided profits test, a dividend may not be paid in excess of a bank’s undivided profits.

Moreover, under the FDIA, an insured depository institution may not pay a dividend if the payment would cause it to be less than “adequately capitalized” under the prompt corrective action framework or if the institution is in default in the payment of an assessment due to the FDIC.

Moreover, under the FDIA, an IDI may not pay a dividend if the payment would cause it to be less than “adequately capitalized” under the PCA framework or if the institution is in default in the payment of an assessment due to the FDIC.

Similarly, under the Regulatory Capital Rules, a banking organization that fails to satisfy the minimum capital conservation buffer requirement will be subject to certain limitations, which include restrictions on capital distributions.

For more information about the payment of dividends by KeyBank to KeyCorp, please see Note 3 (“Restrictions on Cash, Dividends, and Lending Activities”) in this report.

For more information about the payment of dividends by KeyBank to KeyCorp, please see Note 22 (“Regulatory Matters”) in this report.

FDIA, Resolution Authority and Financial Stability

Deposit insurance and assessments

The DIF provides insurance coverage for domestic deposits funded through assessments on insured depository institutions like KeyBank.

The DIF provides insurance coverage for domestic deposits funded through assessments on IDIs like KeyBank.

The amount of deposit insurance coverage for each depositor’s deposits is $250,000 per depository.

The FDIC must assess the premium based on an insured depository institution’s assessment base, calculated as its average consolidated total assets minus its average tangible equity.

The FDIC must assess the deposit insurance premium based on an IDI’s assessment base, calculated as its average consolidated total assets minus its average tangible equity.

KeyBank’s current annualized premium assessments can range from $.025 to $.45 for each $100 of its assessment base.

The rate charged depends on KeyBank’s performance on the FDIC’s “large and highly complex institution” risk-assessment scorecard, which includes factors such as KeyBank’s regulatory rating, its ability to withstand asset and funding-related stress, and the relative magnitude of potential losses to the FDIC in the event of KeyBank’s failure.

On October 18, 2022, the FDIC adopted a final rule, applicable to all insured depository institutions (including KeyBank), to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022.

On October 18, 2022, the FDIC adopted a final rule, applicable to all IDIs (including KeyBank), to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022.

The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028.

3 unchanged sentences

Under the FDIA, the loss to the DIF arising from the use of the systemic risk exception must be recovered through one or more special assessments.

On November 16, 2023, the FDIC issued a final rule to impose a special assessment on IDIs to recover the loss to the DIF resulting from the use of the systemic risk exception to protect the uninsured depositors of SVB and Signature.

Under the final rule, the FDIC would collect a special assessment from IDIs at an annual rate of approximately 13.4 basis points over eight quarterly assessment periods, starting with the first quarterly assessment period of 2024.

On November 16, 2023, the FDIC issued a final rule to impose a special assessment on IDIs (including KeyBank) to recover the loss to the DIF resulting from the use of the systemic risk exception to protect the uninsured depositors of SVB and Signature.

Under the final rule, the FDIC would collect a special assessment from IDIs at an annual rate of approximately 13.4 basis points (or 3.36 basis points per quarter) over eight quarterly assessment periods, starting with the first quarterly assessment period of 2024 (i.e., January 1, 2024 through March 31, 2024) with an invoice payment date of June 28, 2024.

The assessment base for the proposed special assessment is equal to an IDI’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion in estimated uninsured deposits held by the IDI.

Because the estimated loss to the DIF from the use of the systemic risk exception will be periodically adjusted and because the total assessments collected may change due to corrective amendments filed by covered IDIs regarding the reported amount of uninsured deposits for the December 31, 2022 reporting period, the FDIC may cease collection of the special assessment early, extend the special assessment collection period, or impose a final shortfall special assessment.

In the final rule, the FDIC indicated that the special assessment is a tax-deductible operating expense for IDIs, and that it assumed that the effect on income of the entire amount of the special assessment would occur in one quarter for the IDIs subject to the assessment.

The initial impact of the special assessment to Key was approximately $190 million in pre-tax expense, which was recognized upon issuance of the final rule in the fourth quarter of 2023.

The FDIC has indicated that the loss estimates to be recovered by the special assessment will be periodically adjusted as the FDIC (as receiver of the failed banks) sells assets, satisfies liabilities, and incurs receivership expenses.

The FDIC said that it will provide any updates regarding the amount and collection period for the special assessment when it sends the quarterly deposit insurance assessment invoices to the IDIs subject to the special assessment.

In the first quarter of 2024, the FDIC announced an increase in its estimate of losses from protecting the uninsured depositors of SVB and Signature and, therefore, increased the amount that it would collect through the special assessment.

Because of this updated estimate, Key incurred an incremental pre-tax expense of $29 million in the first quarter of 2024.

Based on the quarterly invoices Key received from the FDIC in June 2024, September 2024, and December 2024, Key recorded an incremental pre-tax expense of $5 million in the second quarter of 2024, and a reversal of pre-tax expense of $6 million and $3 million in the third and fourth quarter of 2024 , respectively, to true-up initial estimates to invoiced amounts.

The FDIC’s final rule for a special assessment discussed above was not intended to recover the loss to the DIF from the failure of First Republic Bank in May 2023 (initially estimated as a $13 billion loss) or to the DIF from the failures of SVB and Signature that was not related to the protection of uninsured depositors (initially estimated as a $2.7 billion loss).

The FDIC indicated that no further adjustments to assessments are contemplated at this time to recover those losses but that it will re-evaluate this issue in the future when it updates projections for the DIF balance and the reserve ratio in connection with its periodic review of the DIF Restoration Plan that was adopted in 2022.

The FDIC updates these projections at least semiannually.

On December 16, 2025, the FDIC issued an interim final rule to reduce the quarterly rate at which the special assessment will be collected from 3.36 basis points to 2.97 basis points in the eighth collection quarter (with an invoice payment date of March 30, 2026) in order to ensure that the amount collected will be approximately equal to the FDIC’s current estimate of the loss to the DIF from the use of the systemic risk exception.

The interim final rule also provides that the FDIC will provide an offset to IDIs’ regular quarterly deposit insurance assessments if the aggregate amount collected exceeds losses following resolution of litigation between the FDIC and SVB’s parent company.

The interim final rule further provides that upon the final termination of the receiverships, the FDIC will either (1) provide an offset to IDIs’ regular quarterly deposit insurance assessments if the amount collected exceeds losses or (2) collect from IDIs a one-time final shortfall assessment if losses exceed the amount collected.

Comments on the interim final rule were due by January 20, 2026.

Conservatorship and receivership of insured depository institutions

Upon the insolvency of an insured depository institution, the FDIC will be appointed as receiver or, in rare circumstances, conservator for the insolvent institution under the FDIA.

Upon the insolvency of an IDI, the FDIC will be appointed as receiver or, in rare circumstances, conservator for the insolvent institution under the FDIA.

In an insolvency, the FDIC may repudiate or disaffirm any contract to which the institution is a party if the FDIC determines that performance of the contract would be burdensome and that disaffirming or repudiating the contract would promote orderly administration of the institution’s affairs.

If the contractual counterparty made a claim against the receivership (or conservatorship) for breach of contract, the amount paid to the counterparty would depend upon, among other factors, the receivership (or conservatorship) assets available to pay the claim and the priority of the claim relative to others.

If the contractual counterparty makes a claim against the receivership (or conservatorship) for breach of contract, the amount paid to the counterparty would depend upon, among other factors, the receivership (or conservatorship) assets available to pay the claim and the priority of the claim relative to others.

In addition, the FDIC may enforce most contracts entered into by the insolvent institution, notwithstanding any provision that would terminate, cause a default, accelerate or give other rights under the contract solely because of the insolvency, the appointment of the receiver (or conservator), or the exercise of rights or powers by the receiver (or conservator).

The FDIC may also transfer any asset or liability of the insolvent institution without obtaining approval or consent from the institution’s shareholders or creditors.

These provisions would apply to obligations and liabilities of KeyCorp’s insured depository institution subsidiary, KeyBank, including obligations under senior or subordinated debt issued to public investors.

These provisions would apply to obligations and liabilities of KeyCorp’s IDI subsidiary, KeyBank, including obligations under senior or subordinated debt issued to public investors.

Receivership of certain SIFIs

7 unchanged sentences

If the FDIC is appointed as receiver under the OLA, its powers and the rights and obligations of creditors and other relevant parties would be determined exclusively under the OLA.

The powers of a receiver under the OLA are generally based on the FDIC’s powers as receiver for insured depository institutions under the FDIA.

The powers of a receiver under the OLA are generally based on the FDIC’s powers as receiver for IDIs under the FDIA.

Certain provisions of the OLA were modified to reduce disparate treatment of creditors’ claims between the U.S.

4 unchanged sentences

Depositor preference

The FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of its depositors (including claims of its depositors that have subrogated to the FDIC) and certain claims for administrative expenses of the FDIC as receiver have priority over other general unsecured claims.

If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will be placed ahead of unsecured, nondeposit creditors, including the institution’s parent BHC and subordinated creditors, in order of priority of payment.

The FDIA provides that, in the event of the liquidation or other resolution of an IDI, the claims of its depositors (including claims of its depositors that have subrogated to the FDIC) and certain claims for administrative expenses of the FDIC as receiver have priority over other general unsecured claims.

If an IDI fails, insured and uninsured depositors, along with the FDIC, will be placed ahead of unsecured, nondeposit creditors, including the institution’s parent BHC and subordinated creditors, in order of priority of payment.

Resolution and recovery plans

BHCs with at least $50 billion in total consolidated assets, like KeyCorp, have been required to periodically submit to the Federal Reserve and FDIC a plan discussing how the company could be rapidly and orderly resolved if the company failed or experienced material financial distress.

Insured depository institutions with at least $50 billion in total consolidated assets, like KeyBank, have also been required to submit a resolution plan to the FDIC.

These plans have been due annually unless the requirement to submit the plans was deferred by the regulators.

IDIs with at least $50 billion in total consolidated assets, like KeyBank, have also been required to submit a resolution plan to the FDIC.

The Federal Reserve and FDIC make available on their websites the public sections of resolution plans for the companies, including KeyCorp and KeyBank, that submitted plans.

2 unchanged sentences

KeyCorp is no longer required to submit a resolution plan because of the rule change discussed below while KeyBank remains subject to resolution plan requirements as discussed below.

BHCs with less than $250 billion in total consolidated assets are no longer required to submit a resolution plan unless they have $75 billion or more in certain risk-based indicators.

Category IV BHCs with less than $250 billion in total consolidated assets are no longer required to submit a resolution plan unless they have $75 billion or more in certain risk-based indicators.

Under this rule, KeyCorp is no longer subject to resolution planning requirements.

On June 20, 2024, the FDIC adopted a final rule to amend and restate its current resolution plan rule in order to clarify and strengthen resolution plan submission requirements and reflect lessons learned since the adoption of the FDIC’s current resolution plan rule in 2012.

Among other things, the final rule (i) requires IDIs with more than $100 billion in total assets that are affiliated with a U.S.

G-SIB to submit full resolution plans every two years, (ii) requires IDIs with more than $100 billion in total assets that are not affiliated with a U.S.

G-SIB (including KeyBank) to submit full resolution plans every three years, (iii) requires IDIs with total assets between $50 billion and $100 billion to submit informational filings every three years, (iv) requires triennial filers to submit more limited supplements in the off years, (v) enhances and clarifies the requirements for the content of resolution submissions, (vi) codifies certain

aspects of guidance and feedback provided to filers subject to the current rule, (vii) expands expectations regarding engagement and capabilities testing, and (viii) establishes an enhanced credibility standard for the evaluation of resolution submissions.

Among other things, the final rule (i) enhances and clarifies the requirements for the content of resolution plan submissions (ii) requires IDIs with more than $100 billion in total assets that are not affiliated with a U.S.

G-SIB (including KeyBank) to submit full resolution plans every three years and more limited supplements in the off years, and (iii) expands expectations regarding engagement with the FDIC and capabilities testing.

The final rule was effective on October 1, 2024.

KeyBank is required to file its next resolution plan by July 1, 2025, which will be its initial filing under the final rule.

On October 21, 2024, the OCC adopted revisions to its recovery planning guidelines.

The OCC’s recovery planning guidelines require large OCC-regulated banks to develop and maintain a recovery plan that identifies triggers and options for responding to a wide range of severe internal and external stress scenarios so that the bank can be restored to financial strength and viability in a timely manner if it were to experience such stress situations.

The OCC revised these guidelines to (i) expand the applicability of the guidelines to banks with at least $100 billion in average total consolidated assets, (ii) add a requirement for covered banks to test their recovery plans to ensure that their plans will be effective during periods of severe stress, and (iii) clarify that recovery plans should consider non-financial risks (including operational and strategic risks) as well as financial risks.

KeyBank is subject to the OCC’s revised recovery planning guidelines.

KeyBank is required to be in compliance with these guidelines by January 1, 2026 except that KeyBank’s compliance with the testing requirement is delayed until January 1, 2027.

KeyBank was required to file its next resolution plan by July 1, 2025, which was its initial filing under the 2024 rule.

In April 2025, the FDIC issued guidance to further clarify its expectations regarding resolution plan submissions.

On December 31, 2025, the FDIC announced that it will propose changes in 2026 to the resolution plan rule to incorporate guidance it issued in April 2025 and to make additional changes to take into account lessons learned from its review of the 2025 resolution plan submissions.

The FDIC indicated that it wants to focus on resolution plan content requirements that will facilitate the quick resolution of a failed institution.

The OCC has issued recovery planning guidelines that require large OCC-regulated banks to develop and maintain a recovery plan that identifies triggers and options for responding to a wide range of severe internal and external stress scenarios so that the bank can be restored to financial strength and viability in a timely manner if it were to experience such stress situations.

On October 21, 2024, the OCC adopted revisions to its recovery planning guidelines and lowered the threshold for the applicability of these guidelines from banks with at least $250 billion in average total consolidated assets to those with at least $100 billion in average total consolidated assets, including KeyBank.

KeyBank was required to be in compliance with these guidelines by January 1, 2026 except that KeyBank’s compliance with the testing requirement was delayed until January 1, 2027.

On October 27, 2025, the OCC requested public comment on a proposal to rescind its recovery planning guidelines.

In proposing the rescission of these guidelines, the OCC said that the guidelines were overly prescriptive and imposed an unnecessary regulatory burden on the covered institutions.

The OCC said that if the recovery planning guidelines are rescinded, it would still expect all institutions that it regulates to have appropriate risk management processes in place to address all material risks in their operating environment and to maintain a formal contingency funding plan that considers a range of possible stress scenarios, assesses the stability of funding during periods of stress, and provides for a broad range of funding sources under adverse conditions.

Comments on the proposal were due by December 18, 2025.

Other Regulatory Requirements and Developments

3 unchanged sentences

Key has established and maintains an AML program to comply with the BSA’s requirements.

has imposed economic sanctions that affect transactions with designated foreign countries, foreign nationals, and others pursuant to various laws and executive orders.

These sanctions are administered by the Office of Foreign Assets Control (“OFAC”), an office within the U.S.

Department of the Treasury.

Sanctions are imposed to carry out U.S.

foreign policy and national security goals and involve prohibiting trade and various types of commercial and financial transactions with sanctioned countries, individuals, organizations, and groups.

OFAC regulations require the rejection of transactions or the blocking of assets when a sanctioned country, individual, organization, or group is involved.

Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off, or transferred in any manner without a license from OFAC.

Key is required to comply with sanctions administered by OFAC.

Failure to comply with the sanctions could have serious legal consequences, including the imposition of civil and criminal penalties.

Compensation-related rules and regulations

Guidelines adopted by the federal banking agencies prohibit as an unsafe and unsound practice the payment by a banking organization of excessive compensation and describe compensation as “excessive” when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director, or principal shareholder.

The federal banking agencies have also issued guidance to ensure that incentive compensation policies at banking organizations are consistent with safe and sound practices.

This guidance provides that such policies should (1) provide employees incentives that appropriately balance risk and reward, (2) are compatible with effective controls and risk management, and (3) are supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

Section 956 of the Dodd-Frank Act requires six federal agencies to jointly prescribe regulations or guidelines that prohibit any types of incentive-based payment arrangement that the agencies determine encourages inappropriate risks by financial institutions with more than $1 billion in assets (including KeyCorp and KeyBank).

These six agencies issued proposed regulations in 2011 and 2016 to implement this provision, but these regulations have not been finalized.

Also, as mandated by Section 954 of the Dodd-Frank Act, the SEC has adopted rules directing U.S.

stock exchanges to establish listing standards that require listed companies to adopt policies providing for the recovery or clawback of incentive-based compensation received by current or former executive officers where such compensation is based on erroneous financial information which required an accounting restatement.

The NYSE has adopted such clawback listing standards, which are applicable to NYSE-listed companies, including KeyCorp.

Lending standards

The federal banking agencies have adopted interagency guidelines establishing standards for safety and soundness that include standards that apply to banks (including KeyBank) when making loans to borrowers.

These guidelines provide, among other things, that banks should establish and maintain loan documentation practices that enable the bank to make an informed lending decision, assess risk on an ongoing basis, and ensure that any claim against a borrower is legally enforceable.

The guidelines also provide that banks should establish and maintain prudent credit underwriting practices that are commensurate with the type of loans that the bank makes and take adequate account of concentration of credit risk.

The guidelines further provide that banks should establish a system of independent, ongoing credit review, provide for appropriate communication to management and the board of directors, and take appropriate corrective actions to resolve problem assets.

The federal banking agencies have also adopted regulations that apply specifically to extensions of credit made by banks (including KeyBank) that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate.

Under these regulations, a bank is required to adopt and maintain policies that establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures, and documentation, approval, and reporting requirements.

Cybersecurity and data privacy

Federal and state laws and regulations contain extensive data privacy and cybersecurity provisions.

This is an area of considerable legislative and regulatory focus, and the requirements in this area are evolving.

Key monitors these developments on a continual basis and when appropriate, updates its policies, procedures, and practices to reflect any new or revised requirements.

The Gramm-Leach-Bliley Act (“GLBA”) and implementing regulations require a financial institution to provide notice to customers of its privacy policies and practices, describe the conditions under which the financial institution may disclose nonpublic personal information to non-affiliated third parties, and provide consumers with a means to “opt-out” of having that information disclosed in certain circumstances.

Other federal laws and regulations require financial institutions to provide customers with the choice to “opt-out” of having certain information shared among the financial institution’s affiliates while other provisions regulate the use by financial institutions of information from credit bureaus and the provision of information to such bureaus.

Various state statutes and regulations impose additional data privacy protections.

The GLBA and other laws and regulations require financial institutions to adopt and implement a comprehensive written information security program that includes administrative, technical, and physical safeguards that are designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of such information (including cyber threats), protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer, and ensure the proper disposal of customer information.

In addition, a financial institution is expected to have a response program that specifies actions to be taken if it detects that unauthorized individuals have gained access to customer information, including notifying affected customers of the breach.

A financial institution is further expected to develop appropriate processes to recover data and resume business operations if business operations of the institution or a critical service provider are impacted by a cyber-attack.

Also, rules adopted by the federal banking agencies require a financial institution to notify its primary federal regulator within 36 hours of certain computer-security incidents, including an incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, an institution’s operations or activities or its ability to deliver products or services to a material portion of its customer base.

In addition, the SEC has adopted final rules requiring public companies (including KeyCorp) to disclose on Form 8-K material cybersecurity incidents and to disclose annually on Form 10-K information regarding their cybersecurity risk management, strategy, and governance.

Governance standards

In 2014, the OCC adopted guidelines imposing heightened governance and risk management standards (the “Heightened Standards”) on national banks with average total consolidated assets of $50 billion or more (including KeyBank).

The Heightened Standards (1) establish minimum standards for the design and implementation of a bank’s risk governance framework and (2) set forth minimum standards for the board of directors to follow in overseeing the bank’s risk governance framework’s design and implementation.

On December 23, 2025, the OCC issued a proposal to raise the threshold for applying the Heightened Standards to $700 billion in average total consolidated assets.

In proposing to raise this threshold, the OCC noted that the Heightened Standards establish highly prescriptive standards and that the application of the standards may be justified only for the largest and most complex institutions.

The OCC indicated that the institutions that would be excluded from the Heightened Standards under this proposal would still be expected to maintain robust governance frameworks, risk management systems, and processes that are tailored to their individual size, complexity, and risk

If this proposal is adopted, KeyBank will no longer be subject to the Heightened Standards.

Comments on this proposal are due by March 2, 2026.

Regulations adopted by the Federal Reserve to implement enhanced prudential standards under the Dodd-Frank Act and EGRRCPA require a BHC with $100 billion or more in total consolidated assets to have a risk committee of its board of directors that oversees the BHC’s risk management framework.

These regulations set forth detailed requirements applicable to the risk committee and the chief risk officer of such a BHC.

In 2021, the Federal Reserve issued guidance setting forth supervisory expectations for boards of directors of large financial institutions, including BHCs with total consolidated assets of $100 billion or more (like KeyCorp).

This guidance describes attributes of an effective board of directors.

In addition, the Federal Reserve proposed, but has not finalized, guidance that describes core principles for effective senior management, business line management, and independent risk management of large financial institutions.

Consumer Financial Protection Bureau

Title X of the Dodd-Frank Act created the CFPB, a consumer financial services regulator with supervisory authority over banks and their affiliates with assets of more than $10 billion, like Key, to carry out federal consumer protection laws.

The CFPB also regulates financial products and services sold to consumers and has rulemaking authority with respect to federal consumer financial laws.

Any new regulatory requirements promulgated by the CFPB or modifications in the interpretations of existing regulations could require changes to Key’s consumer-facing businesses.

The Dodd-Frank Act also gives the CFPB broad data collecting powers for fair lending for both small business and mortgage loans, as well as extensive authority to prevent unfair, deceptive and abusive practices.

The CFPB, which was created by the Dodd-Frank Act in 2010, was given the authority by that statute to regulate the offer and sale of consumer financial products and services, enforce federal consumer protection laws, and supervise certain providers of consumer financial products and services, including banks with over $10 billion in assets (such as KeyBank).

The current U.S.

presidential administration has announced its intention to close or substantially downsize the CFPB and has taken various actions to accomplish that objective, including issuing a stop work order to CFPB employees, terminating many CFPB employees, placing other CFPB employees on administrative leave, significantly reducing the CFPB’s annual funding through legislation, and refusing to request funding from the Federal Reserve.

A union representing the CFPB’s employees and other interested parties brought a lawsuit in the United States District Court for District of Columbia, seeking a court order to stop the current U.S.

presidential administration from dismantling the CFPB.

On March 25, 2025, the court in that case issued a preliminary injunction, which enjoined the U.S.

presidential administration from taking actions to dismantle the CFPB.

presidential administration has appealed this court order.

On August 15, 2025, a three-judge panel of the United States Court of Appeals for the District of Columbia Circuit vacated the preliminary injunction issued by the District Court.

On December 17, 2025, the District of Columbia Court of Appeals granted the plaintiffs’ request for an en banc rehearing of this decision.

In addition, the refusal of the CFPB to request funds from the Federal Reserve has been challenged in three cases, and the District Court in one of those cases ruled on December 30, 2025 that the CFPB must request and accept new funds from the Federal Reserve to stay operational.

Following the court’s ruling, the CFPB requested additional funding from the Federal Reserve.

Key is monitoring developments in these cases.

While the current U.S.

presidential administration has sought to close or downsize the CFPB, many states have sought to increase their enforcement of existing consumer protection laws and regulations.

In addition, new consumer protection laws and regulations have been adopted or proposed in many states.

Key is monitoring these developments.

Data collection and reporting for small business loans

On March 30, 2023, the CFPB issued a final rule to require certain lenders (including depository institutions such as KeyBank) to report detailed data on applications for credit submitted by small businesses, including those owned by women and minorities.

This rule was issued to implement Section 1071 of the Dodd-Frank Act.

Various lawsuits were brought to challenge this rule.

In one of these lawsuits, the CFPB, on April 3, 2025, asked the court to hold the lawsuit in abeyance because the CFPB planned to issue a new proposed rulemaking on this subject.

In that case and two other cases challenging the 1071 rule, courts stayed compliance with the rule for the parties in those cases.

On October 2, 2025, the CFPB issued a final rule delaying compliance with the 1071 rule for all institutions covered by the rule.

On November 13, 2025, the CFPB issued a proposal to streamline the 1071 rule and to scale back the scope of data collection required under the rule.

Compliance with the revised rule would be delayed until January 1, 2028.

Comments on this proposal were due by December 15, 2025.

Key is monitoring developments regarding this matter.

The Volcker Rule implements Section 619 of the Dodd-Frank Act, which prohibits “banking entities,” such as KeyCorp, KeyBank and their affiliates and subsidiaries, from owning, sponsoring, or having certain relationships with hedge funds and private equity funds (referred to as “covered funds”) and engaging in short-term proprietary trading of financial instruments, including securities, derivatives, commodity futures and options on these instruments.

6 unchanged sentences

Key does not anticipate that the proprietary trading or covered fund restrictions in the Volcker Rule will have a material impact on its business, but it was required to divest certain fund investments.

As of June 30, 2023, Key has completed conforming and/or divesting certain indirect investments subject to the Volcker Rule.

Enhanced prudential standards and early remediation requirements

The Dodd-Frank Act required the Federal Reserve to impose enhanced prudential standards upon BHCs, like KeyCorp, with at least $50 billion in total consolidated assets.

Prudential standards were required to include enhanced risk-based capital requirements and leverage limits, liquidity requirements, risk-management and risk committee requirements, resolution plan requirements, credit exposure report requirements, single counterparty credit limits (“SCCL”), supervisory and company-run stress test requirements and, for certain financial companies, a debt-to-equity limit.

Early remediation requirements were required to include limits on capital distributions, acquisitions, and asset growth in early stages of financial decline and capital restoration plans, capital raising requirements, limits on transactions with affiliates, management changes, and asset sales in later stages of financial decline, which would be triggered by forward-looking indicators including regulatory capital and liquidity measures.

EGRRCPA raised the asset threshold above which the Federal Reserve is required to apply enhanced prudential standards to BHCs from $50 billion to $250 billion and gave the Federal Reserve the authority to apply enhanced prudential standards to BHCs with at least $100 billion in assets.

Please see the discussion under the headings “Regulatory capital requirements - Liquidity requirements” and “Regulatory capital requirements - Capital planning and stress testing” for more information about EGRRCPA and the related Tailoring Rules.

Since 2010, the Federal Rule has implemented the following enhanced prudential standards required under the Dodd-Frank Act:

(i) the resolution plan requirements (through a joint final rule adopted with the FDIC), (ii) stress test requirements, (iii) the incorporation of the Regulatory Capital Rules through the Federal Reserve’s previously finalized rules on capital planning and stress tests;

(iv) liquidity requirements;

(v) the risk management framework, including requirements around the risk committee and the chief risk officer as well as the corporate governance requirements as they relate to liquidity risk management;

and (vi) a 15-to-1 debt-to-equity, limit for companies that the FSOC determines pose a “grave threat” to U.S.

financial stability.

In addition, the Federal Reserve has issued a final rule establishing SCCL requirements, but that rule does not apply to KeyCorp.

The Federal Reserve has yet to implement a final rule on the early remediation requirements.

Key has established monitoring programs to support compliance with the Volcker Rule’s restrictions.

Bank transactions with affiliates

4 unchanged sentences

The Dodd-Frank Act expanded the coverage and scope of these regulations, including by applying them to the credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions.

Supervision and governance

Supervision, examination, and enforcement

KeyCorp is subject to the Federal Reserve’s supervisory rating system for large financial institutions, which includes BHCs with total consolidated assets of $100 billion or more (including KeyCorp) (“LFI Rating System”).

1 unchanged sentence

Ratings issued under the LFI Rating System are confidential.

On November 5, 2025, the Federal Reserve finalized revisions to the LFI Rating System.

These revisions changed the component ratings that a firm must receive to be considered “well managed” for supervisory purposes.

A firm that is not “well managed” faces limitations on certain activities and acquisitions.

The Federal Reserve said that the revisions were intended to provide a more accurate assessment of a BHC’s financial and operational strength and resilience and better align the LFI Rating System with the rating systems used for other banking organizations.

Federal law grants substantial supervisory and enforcement powers to the federal banking agencies.

The federal banking agencies may bring enforcement actions against banking organizations in various situations such as when an agency determines that a banking organization has committed a violation of law or regulation, is engaged in an unsafe or unsound practice, or has engaged in an act or practice that is unfair, deceptive, or abusive.

In such enforcement actions, the federal banking agencies may, among other things, impose restrictions on an institution’s business, assess civil money penalties, or issue cease and desist orders against the banking organization or affiliated parties.

On October 7, 2025, the OCC and the FDIC issued a joint proposal for public comment that would define the term “unsafe or unsound practice” for purposes of the agencies’ supervisory and enforcement authority under Section 8 of the FDIA and would establish uniform standards for when the agencies may issue matters requiring attention (“MRAs”) and other supervisory communications in connection with the examination process.

Under the proposal, the definition of an “unsafe or unsound practice” and the standard for issuing MRAs would focus on whether a practice involves a risk of material harm to the financial condition of a financial institution or a material risk of loss to the DIF.

The OCC and the FDIC said that the proposed rule would promote greater clarity and certainty regarding supervisory and enforcement standards and would ensure that bank supervisors and examiners prioritize concerns related to material financial risks over concerns related to policies, processes, and documentation.

Comments on this proposal were due by December 29, 2025.

On November 18, 2025, the Federal Reserve issued a statement of supervisory operating principles which indicated that MRAs issued by examiners should prioritize deficiencies that could have a material impact on a firm’s financial condition.

The Federal Reserve said that work was underway to provide more specific guidance on this subject as well as guidance on the Federal Reserve’s interpretation of the standard for issuing enforcement actions based on unsafe or unsound practices.

Community Reinvestment Act

1 unchanged sentence

The CRA requires the federal banking agencies to assess the record of each institution that they supervise in meeting the credit needs of its entire community, including LMI neighborhoods.

On October 24, 2023, the federal banking agencies adopted a final rule to strengthen and modernize their regulations implementing the CRA to better achieve the purposes of the law, adapt to changes in the banking industry, and provide clarity and consistency in the application of their regulations.

Among other things, the final rule (1) clarifies what activities constitute eligible community development activities, (2) adopts four new tests under which large banks with more than $2 billion in assets (including KeyBank) will be evaluated, (3) applies a new framework for assigning conclusions and ratings to banks, (4) updates requirements for delineating facility-based assessment areas, (5) provides for the evaluation of certain large banks in retail lending assessment areas as well as facility-based assessment areas, and (6) imposes new data collection and reporting requirements.

The four new tests under which large banks will be evaluated are a retail lending test, a retail services and products test, a community development financing test, and a community development services test.

Various metrics and performance standards will be applied under these tests.

Most provisions of the final rule will be effective on January 1, 2026, while certain reporting requirements will be effective on January 1, 2027.

KeyBank is subject to the final rule.

On October 24, 2023, the federal banking agencies adopted a final rule to substantially revise their regulations implementing the CRA.

Various trade associations filed a lawsuit in the United States District Court for the Northern District of Texas seeking to invalidate the CRA final rule.

In their lawsuit, the trade associations argued that the federal banking agencies exceeded their authority in adopting the CRA final rule.

On March 29, 2024, the court in that case issued a preliminary injunction barring the federal banking agencies from enforcing the CRA final rule against the plaintiffs pending the resolution of this lawsuit.

The court also extended all implementation dates under the CRA final rule, day for day, for each day that the injunction remains in place.

The court concluded that the plaintiffs had demonstrated a substantial likelihood of success on the merits and would suffer irreparable harm if they had to incur costs to prepare to comply with a rule that might later be invalidated.

The court’s decision granting a preliminary injunction is on appeal to the United States Court of Appeals for the Fifth Circuit.

Key is monitoring developments in this case.

Developments relating to climate change

On October 24, 2023, the federal banking agencies issued a set of principles that provide a high-level framework for the safe and sound management of exposures to climate-related financial risks for financial institutions with over $100 billion in total consolidated assets.

These principles are intended to provide large financial institutions with guidance in their efforts to identify, measure, monitor, and mitigate physical and transition risks associated with climate change.

These principles discuss how these risks can be addressed in the following areas:

policies, procedures, and limits;

strategic planning;

risk management;

data, risk measurement, and reporting;

and scenario analysis.

These principles also describe how climate-related financial risks can be addressed in connection with various specific risk categories, including credit risk, liquidity risk, operational risk, and legal/compliance risk.

This interagency guidance applies to KeyCorp and KeyBank.

On March 29, 2024, the court in that case issued a preliminary injunction barring the federal banking agencies from enforcing the CRA final rule pending the resolution of that lawsuit.

The court’s decision is on appeal to the United States Court of Appeals for the Fifth Circuit.

On April 1, 2025, the Fifth Circuit granted a request by the federal banking agencies to stay further proceedings in this case.

On July 16, 2025, the federal banking agencies issued for public comment a proposal to rescind the CRA final rule that was issued in October 2023 and to reinstate the CRA framework that was in place prior to the issuance of that rule with certain technical amendments.

The agencies said that they were doing so to restore certainty in the CRA framework for stakeholders and to limit regulatory burden on banks, while ensuring that banks continue to focus on the purpose of the CRA.

Comments on the proposal were due by August 18, 2025.

KeyBank will be subject to any changes that are made to the CRA regulations.

Long-term debt requirement

7 unchanged sentences

The proposal would provide a three-year transition period with the incremental phase-in of the requirements during this period.

The federal banking agencies indicated that the proposal would improve the resolvability of the covered entities in case of their failure, reduce costs to the DIF, and mitigate contagion and financial stability risks by reducing the risk of loss to uninsured depositors.

The federal banking agencies indicated that the proposal would improve the resolvability of the covered entities in case of their failure,

reduce costs to the DIF, and mitigate contagion and financial stability risks by reducing the risk of loss to uninsured depositors.

Comments on the proposal were due by January 16, 2024.

7 unchanged sentences

Personal financial data rights

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act, which gives individuals the right to obtain data regarding consumer financial products and services they have obtained.

The final rule requires financial institutions (including KeyBank) and other financial service providers (collectively “data providers”) to make available to consumers and authorized third parties, upon request, data in the data provider’s possession or control concerning covered consumer financial products or services (including credit cards, deposit accounts, and other accounts that facilitate payments) in an electronic form usable by the consumers and authorized third parties.

The data that must be provided includes account balance information, at least 24 months of transaction history, pricing information, information on upcoming third-party bill payments, and account verification information.

The data providers are required to create and maintain consumer and developer interfaces that will be able to transfer the data.

A data provider will not be allowed to charge any fees or other charges for making the covered data available or for maintaining the required interfaces.

The CFPB indicated that it adopted this rule in order to foster competition and consumer choice and said that this rule is a step towards bringing about an “open banking” system in the United States.

Compliance with the rule will be phased in over several years with KeyBank required to be in compliance by April 1, 2027.

Following the issuance of this rule, two trade associations and a national bank headquartered in Kentucky filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky.

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act.

The 1033 rule requires financial institutions (including KeyBank) to make available to consumers and authorized third parties data concerning covered consumer financial products or services in an electronic form usable by the consumer and authorized third parties.

In adopting the rule, the CFPB said that the 1033 rule was a step towards bringing about an “open banking” system in the United States.

Following the issuance of this rule, two trade associations and a national bank filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky.

In this lawsuit, the plaintiffs alleged that the CFPB exceeded its statutory authority in adopting the 1033 rule.

Key is monitoring developments in this case.

On May 23, 2025, the CFPB filed a status report with the court saying that it agreed with the plaintiffs.

On May 30, 2025, the parties challenging the rule and the CFPB filed a motion for summary judgment asking the court to invalidate the rule.

In a summary judgment motion filed on June 29, 2025, the Financial Technology Association, which had been allowed to intervene in this case, asked the court to uphold the rule.

Before the court issued a decision on the summary judgment motions, the CFPB asked the court to stay the litigation.

On July 29, 2025, the court granted the CFPB’s request to stay the litigation.

On August 21, 2025, the CFPB issued an advance notice of proposed rulemaking, asking the public to respond to a series of questions related to the 1033 rule.

Comments were due by October 21, 2025.

In a court filing in the case challenging the 1033 rule, the CFPB indicated that it plans to issue a revamped 1033 rule as an interim final rule.

Key is monitoring developments regarding this matter.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business