SLM Corp 10-K

Item 1A. Risk Factors PANDEMIC RISK The pandemic caused by a novel coronavirus, or COVID-19 (“COVID-19 pandemic”), and resulting adverse economic conditions have adversely impacted our business and results and, in the future, could have a more material adverse impact on our business, results of operations, financial condition, and/or cash flows. Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic. The COVID-19 pandemic has caused significant disruption to the U.S. and world economies, including the closing of many schools and businesses for extended periods of time, significantly higher unemployment and underemployment, significantly lower interest rates, volatility in equity market valuations, and extreme volatility in the U.S. and world financial markets. Depending upon the success of the distribution, public acceptance, and administration of COVID-19 vaccines or other therapies, we expect the impact of the COVID-19 pandemic on the U.S. economy may be significant during a large part of 2021 and that it could materially adversely affect our operations, our regulatory capital and liquidity position, the credit performance of our Private Education Loans and other assets, the number of borrowers seeking payment relief, our results of operations and financial condition, and/or our cash flows. As described in Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Impact of COVID-19 on Sallie Mae — Customers and Credit Performance,” in this annual report on Form 10-K, during 2020 we experienced a significant increase in disaster forbearance grants, and our borrowers experienced higher levels of financial hardship, which could lead to increased levels of delinquencies and defaults in the future. Also, our loan application volumes decreased and we had lower Private Education Loan origination volumes in 2020 than we had anticipated. In addition, our employees may have to continue to work from home for a significant portion of 2021. Unanticipated issues arising from handling personal, confidential, and other information from a less efficient work-from-home environment could adversely impact our operations and lead to greater risk for us. The extent to which the COVID-19 pandemic impacts our business, results of operations, financial condition, and/or cash flows will depend on future developments, which are highly uncertain and largely beyond our control, including the impact of the pandemic on colleges and universities, student enrollment, and the need for Private Education Loans. There can be no assurance that colleges and universities will return to normal pre-pandemic operations, which could adversely affect enrollments and, consequently, the need for Private Education Loans. In addition, the impact of the COVID-19 pandemic on our business, results of operations, financial condition, and/or cash flows will depend upon, among other factors: the scope and duration of the pandemic; the number of our employees, customers, and vendors adversely affected by the pandemic; the broader public health and economic dislocations resulting from the pandemic; the actions taken by governmental authorities to limit the public health, financial, and economic impacts of the COVID-19 pandemic; any legislative or regulatory changes that suspend or reduce payments or cancel or discharge obligations for education loan borrowers; any reputational damage related to the broader reception and perception of our response to the COVID-19 pandemic; and the impact of the COVID-19 pandemic on local, U.S., and world economies. Moreover, we expect that effects of the COVID-19 pandemic will heighten many of the other known risks to our business described below in this Item 1A, and the impact of COVID-19 on our business could be material and adverse. Any future pandemic could subject our business to the same or greater risks than the COVID-19 pandemic. CONCENTRATION RISK Our product offerings are primarily concentrated in loan products for higher education and deposit products for online depositors. Such concentrations and the competitive environment for those products subject us to risks that could adversely affect our financial position. At December 31, 2020, approximately 60 percent of our total assets, and 70 percent of our total assets excluding cash and cash equivalents, were comprised of Private Education Loans. This concentration poses the risk that any disruption, dislocation, or other negative event or trend in the Private Education Loan market or the overall economic environment could disproportionately and adversely affect our business, financial condition, and results of operations. We compete in the Private Education Loan market with banks and other consumer lending institutions, many with strong consumer brand name 22 recognition and greater financial resources. Many of those lenders also have a greater level of diversification in their mix of assets, which can enable them to be more competitive in uncertain or challenging economic times. Moreover, our competition will increase as various lending institutions and other competitors, including Navient, through its Earnest subsidiary, enter or re-enter the Private Education Loan market. We also compete with FinTech companies (as defined below), many of whom have lower return hurdles than more traditional consumer lending institutions. We compete based on our brand products, origination capability, and customer service. To the extent our competitors compete more aggressively or effectively, we could lose market share to them or subject our existing loans to consolidation or refinancing risk. Competition plays a significant role in our online deposit gathering activities. The market for online deposits is highly competitive, based primarily on a combination of reputation and rate. Increased competition for deposits could cause our cost of funds to increase, which could negatively impact our loan pricing and net interest margin. In addition to competition with banks and other consumer lending institutions, the federal government, through the Federal Direct Student Loan Program (the “DSLP”), poses significant competition to our Private Education Loan products. The availability and terms of loans the government originates or guarantees affect the demand for Private Education Loans because students and their families often rely on Private Education Loans to bridge the gap between available funds, including family savings, scholarships, grants, and federal and state loans, and the costs of post-secondary education. The federal government currently places both annual and aggregate limits on the amount of federal loans any student can receive and determines the criteria for student eligibility. Parents and graduate students may obtain additional federal education loans through other programs. These federal education lending programs are generally adjusted in connection with funding authorizations from the U.S. Congress for programs under the Higher Education Act of 1965 (the “HEA”). The HEA’s reauthorization is currently pending in the U.S. Congress. Reauthorization, as well as measures to provide relief for COVID-19, could provide a legislative vehicle for changes to student loan programs. Possible components that could impact the Private Education Loan market are changes to federal education loan limits, private loan refinancing programs, or Private Education Loan forgiveness. Other components of any legislation also could have a negative impact on our business and financial condition. See “— POLITICAL/REPUTATIONAL RISK. ” Consumer access to alternative means of financing the costs of education and other factors may reduce demand for, or adversely affect our ability to retain, Private Education Loans, which could have a material adverse effect on our business, financial condition, results of operations and/or cash flows. The demand for Private Education Loans could weaken if families and student borrowers use other vehicles to bridge the gap between available funds and costs of post-secondary education. These vehicles include, among others: • Home equity loans or other borrowings available to families to finance their education costs; • Pre-paid tuition plans, which allow students to pay tuition at today’s rates to cover tuition costs in the future; • Section 529 plans, which include both pre-paid tuition plans and college savings plans that allow a family to save funds on a tax-advantaged basis; • Education IRAs, now known as Coverdell Education Savings Accounts, under which a holder can make annual contributions for education savings; • Government education loan programs such as the DSLP; and • Direct loans from colleges and universities, as well as income sharing agreements offered by schools and facilitated by private companies. In addition, our ability to grow Private Education Loan originations and retain assets at our planned levels could be negatively affected if: 23 • demographic trends in the United States result in a decrease in college-age individuals; • demand for higher education decreases; • the cost of attendance of higher education decreases; • consumers increase their targeted savings for higher education; • prepayment rates on our Private Education Loans increase or accelerate due to greater market liquidity, availability of alternative means of financing, improved household incomes, increasing consumer confidence, and/or various other factors; • there is broader public resistance to increasing higher education costs; or • proposals for new federal and state education spending described below in “Political/Reputational Risk” gain broader appeal or momentum. Consolidation or refinancing of existing Private Education Loans could have a material adverse effect on our business, financial condition, results of operations and/or cash flows. We believe the design of our Private Education Loan products, with emphasis on rigorous underwriting, credit-worthy cosigners and variable or fixed interest rates, creates sustainable, competitive loan products. However, increasing amounts of private education consolidation loans at interest rates below those of our existing portfolio - whether from private sources (including financial technology (“FinTech”) companies) or otherwise - can contribute to an increase in the prepayment rates of our existing Private Education Loans and, if prolonged and continuous, could have a material adverse effect on our business, financial condition, results of operations and/or cash flows. Since 2010, there have been a number of bills introduced in the United States Congress to promote federal financing for consolidation or refinancing of existing student loans, as well as an increase in the number of lenders offering similar products. Also, on July 31, 2018, the Office of the Comptroller of the Currency (the “OCC”) issued a policy statement announcing that it would consider applications from FinTech companies to become special purpose national banks. The special purpose national bank charter is available to qualifying companies engaged in a limited range of banking activities, including paying checks or lending money, but that do not take deposits. CREDIT RISK Defaults on our loans, particularly Private Education Loans, could adversely affect our business, financial position, results of operations, and/or cash flows. We bear the full credit exposure on our Private Education Loans and Credit Card loans, which are unsecured loans. If they were to default at rates much higher than anticipated or at speeds faster than anticipated, our business, financial position, results of operations, and/or cash flows could be adversely affected. Delinquencies are an important indicator of the potential future credit performance of those loan portfolios. Many factors can have an impact on borrower delinquencies. But rising unemployment rates and the failure of our in-school borrowers to graduate are two of the most significant macroeconomic factors that could increase loan delinquencies, defaults and loan modifications, or otherwise negatively affect performance of our existing education loan portfolios. Likewise, high unemployment may impede Private Education Loan originations growth, as loan applicants and cosigners may experience trouble repaying credit obligations or may not meet our credit standards. Additionally, if interest rates rise causing payments on variable-rate loans to increase, borrowers and cosigners could experience trouble repaying loans we have made to them. See Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Financial Condition — Allowance for Credit Losses — Use of Forbearance and Rate Modifications as a Private Education Loan Collection Tool” for a discussion of how items such as changes in credit administration practices can impact the timing and level of delinquencies and defaults on our loans. Higher credit-related losses and weaker credit quality negatively affect our business, financial condition, and results of operations and limit funding options, which could also adversely impact our liquidity position. Our Private Education Loan delinquencies (loans greater than 30 days past due), as a percentage of Private Education Loans in repayment, were 2.8 percent at December 31, 2020. Our allowance for credit losses may not be adequate to cover actual losses, and we may be required to materially increase our allowance, which may adversely affect our capital, financial condition, and/or results of operations. In June 2016, the Financial Accounting Standards Board (“FASB”) issued Accounting Standards Update (“ASU”) No. 2016-13, “Financial Instruments-Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments,” which became effective for us on January 1, 2020. Under the new guidance, for all loans carried at amortized cost, upon loan 24 origination we are required to measure our allowance for credit losses based on our estimate of all current expected credit losses (“CECL”) over the remaining contractual term of the assets. The CECL standard resulted in a significant change in how we recognize credit losses and will have a material impact on our financial condition, results of operations, and capital levels. The evaluation of our allowance for credit losses is inherently subjective, as it requires material estimates that may be subject to significant changes. The measurement of expected credit losses is based on historical information, current conditions, and reasonable and supportable forecasts to estimate the expected loss over the life of the loan. This differs significantly from the “incurred loss” model, which was in effect during 2019 and delays recognition until it is probable a loss has been incurred. Our models take into account historical loss experience in various economic conditions to estimate expected future losses based upon future economic forecasts over a period of time, at which point we revert expected losses to our historical rates. Future defaults can be higher than anticipated due to a variety of factors outside of our control, and our models may not accurately estimate future loan loss performance. The models used in calculating our CECL estimates include forecasts of future economic conditions, loss rates, prepayment rates, and recovery rates. If these forecasts prove to be inaccurate, or our models were not designed properly, our allowance for credit losses may not be sufficient to cover future losses, which could negatively impact our financial condition, results of operations, and capital levels. In addition, the amount of losses recorded under CECL is very sensitive to the inputs described above. As such, changes to these inputs could significantly change the amount of allowance necessary, which could have a negative impact on our financial results and capital levels. See Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Policies and Estimates — Allowance for Credit Losses 2020 ” for further details. LIQUIDITY RISK Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain financing through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time. An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could lead to regulatory scrutiny and could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows. We must effectively manage the liquidity risk inherent in our business. We require liquidity to meet cash requirements for such things as day-to-day operating expenses, funding of our Private Education Loan and Credit Card originations, deposit withdrawals and maturities, payment of any declared dividends on our preferred stock and common stock, and payment for any shares of common stock acquired under any common stock repurchase program or otherwise. Our primary sources of liquidity and funding are customer deposits, payments received on Private Education Loans and FFELP Loans that we hold, and proceeds from loan sales and securitization transactions. We may maintain too much liquidity, which can be costly, or we may be too illiquid, which could result in financial distress during times of economic stress or capital market disruptions. We fund Private Education Loan originations through asset-backed securitizations and deposits raised by the Bank, including term and liquid brokered and retail deposits, as well as Educational 529 and Health Savings Account deposits. Assets funded through deposits result in refinancing risk because the average term of the deposits is shorter than the expected term of the Private Education Loan assets we originate. The significant competition for deposits from other banking organizations that are also seeking stable deposits to support their funding needs may affect deposit renewal rates, costs, or availability. In addition, our ability to maintain existing balances or obtain additional deposits may be affected by factors, including those beyond our control, such as a rising stock market, perceptions about our financial strength, quality of deposit servicing or online banking generally, and general economic conditions, including high unemployment and decreased savings rates. Also, our ability to maintain our current level of deposits or grow our deposit base could be affected by regulatory restrictions, including the possible imposition by our regulators of prior approval requirements or restrictions. Our short-term success also depends on our ability to structure Private Education Loan securitizations or execute other secured funding transactions. Several factors may have a material adverse effect on both our ability to obtain such funding and the time it takes us to structure and execute these transactions, including the following: • Persistent and prolonged disruption or volatility in the capital markets or in the education loan ABS sector specifically; • Degradation of the credit quality or performance of the Private Education Loans we sell or finance through securitization trusts, or adverse rating agency assumptions, rating actions, or conclusions with respect to those trusts or the education loan-backed securitization trusts sponsored by other issuers; • A material breach of our obligations to purchasers of our Private Education Loans, including securitization trusts; 25 • The timing, pricing, and size of education loan asset-backed securitizations other parties issue, or the adverse performance of, or other problems with, such securitizations; • Challenges to the enforceability of Private Education Loans based on violations of, or changes to, federal or state consumer protection or licensing laws and related regulations, or imposition of penalties or liabilities on assignees of Private Education Loans for violation of such laws and regulations; and • Our inability to structure and gain market acceptance for new product features or services to meet new demands of ABS investors, rating agencies, or credit facility providers. If we require funding beyond that which we may be able to obtain through deposits and proceeds from ABS transactions at attractive prices, we may need to raise additional liquidity through other forms of secured and unsecured debt financing, which, in turn, could increase our funding costs and reduce our net interest margin. Our ability to sell loans at attractive prices, as well as the timing and volume of any sales, will be subject to market conditions, and there can be no guarantee that we will be able to effectuate planned loan sales at the prices, times, or volumes we desire, or at all. If we are unable to effectuate loan sales at the prices, times, and volumes we desire, we may not be able to fund share repurchase programs that are authorized from time to time or achieve other business goals. We currently maintain sufficient risk-based capital through adequate retention and reinvestment of earnings from operations. If our business objectives require capital above and beyond what we generate through retained earnings, we may need to raise capital for our business by issuing additional equity to investors. Several factors, some of which may be beyond our control, may have a material adverse effect on our ability to raise funding at any given time through any of the channels described above in this Risk Factor in the amounts, at the rates, or within the timeframes we desire or need. If this occurs, our business, results of operations, financial position, and/or cash flow could be materially and adversely affected. In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties. Under applicable state and federal securities laws, if investors incur losses as a result of purchasing ABS issued in connection with our securitization transactions, we could be deemed responsible and could be liable to investors for damages. We could also be liable to investors or other parties for certain updated performance information that we may provide subsequent to the original issuances. If we fail to cause the securitization trusts or other transaction parties to disclose adequately all material information regarding an investment in any securities, if we or the trusts make statements that are misleading in any material respect in information delivered to investors in any securities, if we breach any representations or warranties made in connection with securitization of the loans, or if we breach any other duties as the administrator or servicer of the securitization trusts, it is possible we could be sued and ultimately held liable to an investor or other transaction party. In transactions involving the sale of loans in non-securitized form where we remain the servicer of the loans, it is possible we could be sued and ultimately held liable to the purchaser of the loans or another transaction party for breaches or representations of warranties or breaches of servicing covenants. INTEREST RATE RISK The interest rate and maturity characteristics of our earning assets do not fully match the interest rate and maturity characteristics of our funding arrangements, which may negatively impact the level of our net interest income. We are also subject to repayment and prepayment risks, which can increase uncertainty as we manage our interest rate risk and can adversely affect our business, financial condition, results of operations, and/or cash flows. Net interest income is the primary source of cash flow generated by our loan portfolios. Interest earned on our Private Education Loans and FFELP Loans is either fixed-rate or indexed to a short-term variable rate, and these loans are originated with relatively long repayment periods. ABS funding closely mirrors the expected maturities of our education loans and provides a combination of fixed and variable-rate funding. Deposits are issued with both fixed and variable rates, and the average term is typically shorter than the expected term of our combined loan portfolios. The different interest rate and maturity characteristics of our loan portfolio and the liabilities funding that portfolio result in fluctuations in our net interest income. In certain interest rate environments, this mismatch may reduce our net interest margin (the interest yield earned on our portfolio less the rate paid on our interest-bearing liabilities) and net interest income. While we actively monitor and manage mismatches in the interest rate and maturity characteristics of our assets and liabilities, 26 using derivative transactions where necessary to avoid excessive levels of repricing and refunding risk, it is not possible to hedge all of our exposure to such risks. While the assets, liabilities, and related hedging derivative contract re-pricing indices are typically highly correlated, there can be no assurance that the historically high correlation will not be disrupted by capital market dislocations or other factors outside our control. In these circumstances, our earnings could be materially adversely affected. We are also subject to risks associated with changes in repayment and prepayment rates on Private Education Loans, which can increase uncertainty as we manage our interest rate risk. Consolidations and refinancings contribute to increased prepayment rates. In addition, increases in employment levels, wages, family income, alternative sources of financing, and government support for student loan borrowers during times of crisis, such as during the COVID-19 pandemic, may also contribute to higher than expected prepayment rates, which can adversely affect our interest rate and repricing risk and our financial condition and results of operations. Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings. We maintain an overall interest rate strategy that uses derivatives to reduce the economic effect of interest rate changes. Developing an effective hedging strategy for dealing with movements in interest rates is complex, and no strategy can completely avoid the risks associated with these fluctuations. For example, our education loan portfolios remain subject to prepayment risk that could cause them to be under- or over-hedged, which could result in material losses. In addition, some of our interest rate risk management activities expose us to mark-to-market losses if interest rates move in a materially different way than was expected when we entered into the related derivative contracts. Our use of derivatives also exposes us to market risk and credit risk. Market risk is the chance of financial loss resulting from changes in interest rates and market liquidity. Some of the interest rate swaps we use to economically hedge interest rate risk between our assets and liabilities do not qualify for hedge accounting treatment. Therefore, the change in fair value, called the “mark-to-market,” of the swaps that do not qualify as accounting hedges is included in our statement of income. A decline in the fair value of those derivatives could have a material adverse effect on our reported earnings. We are also subject to the creditworthiness of third-parties, including various lending, investment, and derivative counterparties. Our overall counterparty exposure is more fully discussed in Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources — Counterparty Exposure.” If our counterparties are unable to perform their obligations, such inability could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows. The transition from LIBOR to an alternative reference “benchmark” interest rate is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations. The interest rates on our variable-rate Private Education Loans and certain other assets are indexed to LIBOR, the London interbank offered rate. Certain of our interest rate swaps, notes issued under our term ABS and our education loan-backed multi-lender secured borrowing facility (the “Secured Borrowing Facility”), brokered and non-brokered deposits and other obligations also are indexed to LIBOR. In each case, the terms of the relevant agreements define LIBOR and provide differing methods for how it may be replaced or computed if LIBOR is no longer available as defined. LIBOR is used worldwide as a reference for setting interest rates on loans, derivatives, and other assets and obligations. On July 27, 2017, the United Kingdom's Financial Conduct Authority, which regulates LIBOR, publicly announced that it intends to stop persuading or compelling banks on the London interbank market to submit LIBOR rates after 2021. On December 4, 2020, the administrator of LIBOR, the ICE Benchmark Administration, published a consultation on its intention to extend the date on which the rates on most tenors of U.S. dollar LIBOR would cease being published from December 31, 2021 to June 30, 2023. Any publication beyond December 31, 2021 will need to comply with applicable regulations, including as to representativeness. U.S. banking regulators have encouraged banks to stop entering into new LIBOR-based contracts as soon as practicable and in any event by the end of 2021. It is unclear at this time, and we are not able to predict, whether or when LIBOR will cease to exist, whether or when new methods of calculating LIBOR will be established such that it continues to exist after 2021, or whether or when alternative benchmark or reference rates will be available, either through regulatory action or financial market developments, as viable alternatives to LIBOR. If one or more replacement benchmark or reference rates is available, it is unknown at this time, and we are unable to predict, whether any such alternatives will be acceptable to investors, 27 financial markets or regulators, or applied consistently and concurrently to various assets, obligations, or financial instruments. Certain of our existing assets and obligations do not include provisions clearly specifying a method for transitioning from LIBOR to an alternative benchmark rate. Given this situation, it is unclear what consents or approvals, if any, will be required to replace LIBOR under our various agreements. As a result of these potential changes and related uncertainties, the interest rates on and value of our assets and obligations indexed to LIBOR, and the revenue and expenses associated with those assets and obligations, could be affected in disparate ways at disparate times, creating basis risk and potential adverse effects on our business and results of operations. Changes to the reference rate used could result in dissatisfied customers, lenders, investors, or counterparties, which could result in reputational damage, litigation or regulatory scrutiny. The Company has actively monitored market developments with respect to LIBOR replacement since 2017 and during 2020 launched a formal cross-functional replacement project with the goal of ensuring a smooth transition to a replacement index with minimal negative impact on our customers, investors, and the Company’s business, financial condition, and results of operations. The project team monitors developments, assesses impacts, proposes plans and, with the approval of an executive committee, implements changes. The project team reports status regularly to our Board of Directors. In 2020 we began issuing certain deposits based on the Secured Overnight Financing Rate (“SOFR”). We expect to begin to issue variable-rate Private Education Loans that do not use LIBOR as a reference rate in 2021. We plan to significantly reduce the number of contracts that reference LIBOR, either through modification or replacement, by June 2023. There can be no guarantee our reference rate replacement plan will occur as expected, however, and failure to implement the plan effectively or changes in how LIBOR transition occurs could have a material adverse effect on our business, results of operations, financial position, and/or cash flows. CAPITAL RISK The Bank is subject to various regulatory capital requirements administered by the FDIC and the UDFI. Failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our business, results of operations and/or financial condition. Under U.S. Basel III and the regulatory framework for prompt corrective action, the Bank must meet specific capital standards that involve quantitative measures of its assets, liabilities, and certain off-balance sheet items as calculated under regulatory accounting practices. The Bank’s capital amounts and its classification under the prompt corrective action framework are also subject to qualitative judgments by the regulators about components of capital, risk weightings, and other factors. If the Bank fails to satisfy regulatory risk-based or leverage capital requirements, it may be subject to serious regulatory sanctions that could prevent us from successfully executing our business plan and may have a material adverse effect on our business, results of operations, financial position, and/or cash flows. See Item 1. “Business — Supervision and Regulation — Regulation of Sallie Mae Bank — Regulatory Capital Requirements.” Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position. Pursuant to regulatory guidance, the Bank conducts annual capital stress tests, modeling systemic and company-specific stress scenarios. In 2020, as the Bank responded to the macroeconomic and humanitarian challenges of the COVID-19 pandemic, the Bank selected as its primary stress scenario its current forecast, reflecting the severe stresses anticipated due to the impact of the pandemic on our customers and the U.S. economy (including the impacts of disaster forbearance practices designed to alleviate the severity of the pandemic on our borrowers). The results of this analysis were presented to and reviewed by the Bank’s senior management, the Bank’s Board of Directors and the Board’s Risk Committee. In addition, the Bank made the results of the stress tests (its current business forecast) available to its prudential regulators - the FDIC and the UDFI. The process we utilized in 2020 was a pragmatic departure from our standard testing practices, dictated by the severity of the pandemic. Generally, the stress test results include certain measures that evaluate the Bank’s ability to absorb losses in severely adverse economic and financial conditions; the 2020 scenario analysis tested the Bank’s resources and resiliency in real time. Typically, on the basis of a stress analysis, senior management may elect to adjust its business plans or capital targets to reduce risks identified by the analysis. Our regulators may also require the Bank to raise additional capital or take other actions, or may impose restrictions on our business, based on the results of the stress tests. We may not be able to raise additional capital if required to do so, or may not be able to do so on terms that are advantageous to us. Any such capital raises, if required, may also be dilutive to our existing stockholders. 28 We also conduct quarterly liquidity stress tests to evaluate the adequacy of our liquidity sources under several stress scenarios, including a severely adverse macroeconomic scenario. In 2020, the forecast of business operations through the pandemic served as the severely adverse scenario. The results of these scenarios may lead management to determine, or regulators to demand, that higher levels of liquidity be maintained at significant incremental expense to the Bank. Changes in accounting standards, or incorrect estimates and assumptions by management in connection with the preparation of our consolidated financial statements, could adversely affect our capital levels, results of operation, and/or financial condition. We are subject to the requirements of entities that set and interpret the accounting standards governing the preparation of our financial statements and other financial reports. These entities, which include the FASB, the SEC and banking regulators, may add new requirements or change their interpretations of how those standards should be applied. Changes in our accounting policies or in accounting standards could materially affect how we report our financial condition and/or results of operations. As a result of changes to financial accounting or reporting standards, whether promulgated or required by the FASB or other regulators, we could be required to change certain of the assumptions or estimates we have previously used in preparing our financial statements, which could negatively impact how we record and report our financial condition, results of operations, and capital levels. The preparation of our consolidated financial statements requires us to make critical accounting estimates and assumptions that affect the reported amounts of assets, liabilities, income, and expenses during the reporting periods. Incorrect estimates and assumptions by us in connection with the preparation of our consolidated financial statements could adversely affect the reported amounts of assets, liabilities, income, and expenses. If we make incorrect assumptions or estimates, we may under- or overstate reported financial results, which could materially and adversely affect our business, financial condition, and/or results of operations. For additional information on the key areas for which assumptions and estimates are used in preparing our financial statements, see Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Policies and Estimates” and Notes to Consolidated Financial Statements, Note 2, “Significant Accounting Policies.” REGULATORY RISK Failure to comply with consumer protection, privacy, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business. We are subject to a broad range of federal and state consumer protection laws applicable to our lending and retail banking activities, including laws governing fair lending, unfair, deceptive and abusive acts and practices, service member protections, interest rates and loan fees, disclosures of loan terms, marketing, servicing and collections. We are also subject to a dynamically changing landscape of privacy and cybersecurity laws, regulations, and requirements. For example, the CCPA took effect on January 1, 2020, and is broad, sweeping legislation that gives California consumers certain rights similar to those provided by the European General Data Protection Regulation. Among other things, the CCPA provides for enhanced regulatory penalties and potential statutory damages in relation to certain types of data breaches. See Item 1. “Business — Supervision and Regulation — Regulation of Sallie Mae Bank — Privacy Laws” for additional information. Violations of, or changes in, federal or state consumer protection, privacy or cybersecurity laws or related regulations, or in the prevailing interpretations thereof, may expose us to litigation, administrative fines, penalties and restitution, result in greater compliance costs, constrain the marketing and origination of Private Education Loans or other products, adversely affect the collection of balances due on the loan assets held by us or by securitization trusts or otherwise adversely affect our business. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in compliance and supervision activities, often impose additional compliance costs. Accordingly, we could incur substantial additional expense complying with these requirements and may be required to create new processes and information systems. Moreover, changes in federal or state consumer protection laws and related regulations, or in the prevailing interpretations thereof, could invalidate or call into question the legality of certain of our services and business practices. The CFPB is the Bank’s primary consumer compliance supervisor, with exclusive authority to conduct examinations for the purposes of assessing compliance with the requirements of Federal consumer financial laws and with primary consumer compliance enforcement authority. CFPB jurisdiction could result in additional regulation and supervision, which could 29 increase our costs and limit our ability to pursue business opportunities. The CFPB/DOE MOU could lead to additional complaints received by the CFPB regarding us, which could lead to additional scrutiny of us and increase our costs. Consent orders, decrees or settlements entered into with governmental agencies may also increase our compliance costs or restrict certain of our activities. The CFPB and the FDIC have issued guidance to supervised banks with respect to increased responsibilities to supervise the activities of service providers to ensure compliance with federal consumer protection laws. The issuance of regulatory guidance and the enforcement of the enhanced vendor management standards via examination and investigation of us or any third-party with whom we do business may increase our costs, require increased management attention and adversely impact our operations. In the event we should fail to meet the heightened standards for management of service providers, we could be subject to supervisory orders to cease and desist, civil monetary penalties, or other actions due to claimed noncompliance, which could have an adverse effect on our business, financial condition, operating results, and/or cash flows. We operate in a highly regulated environment and the laws and regulations that govern our operations, or changes in these laws and regulations, or our failure to comply with them, may adversely affect us. In addition to consumer protection laws, we are also subject to extensive regulation and supervision that govern almost all aspects of our operations. Intended to protect clients, depositors, the DIF, and the overall financial system, these laws and regulations may, among other matters: • prescribe minimum capital requirements; • limit the rates of growth of our business; • impose limitations on the business activities in which we can engage; • limit the dividends or distributions the Bank can pay to us; • limit share repurchases; • restrict the payment of discretionary bonuses to executive officers; • restrict the ability of institutions to guarantee our debt; • limit proprietary trading and investments in certain private funds; • impose certain specific accounting requirements on us that may be more restrictive; • result in changes from time to time in our practices, policies, and procedures in various areas of our business; and • result in greater or earlier charges to earnings or reductions in our capital. The FDIC has the authority to limit the Bank’s annual total balance sheet growth, but no such limitations were imposed in recent years. There can be no assurance that limitations will not be imposed in the future, however. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in supervision, often impose additional compliance costs. We, like the rest of the banking sector, are facing increased regulation and supervision of our industry by bank regulatory agencies and expect there may be additional and changing requirements and conditions imposed on us, any of which could increase our costs, require increased management attention and adversely impact our results of operations. Our failure to comply with these laws and regulations, even if the failure is inadvertent or reflects a difference in interpretation, could subject us to fines, other penalties and restrictions on our business activities, any of which could adversely affect our business, financial condition, cash flows, results of operations, capital base and/or the price of our securities. POLITICAL/REPUTATIONAL RISK Proposals of federal and state governments, or of various political candidates, affecting the student loan industry in particular, such as proposals for new federal education spending designed to make higher education “free” or substantially so regardless of financial need, or to create new federally funded programs to refinance private student loans, subject us to political risk and could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. We operate in an environment of heightened political and regulatory scrutiny of education loan lending, servicing, and originations. The rising cost of higher education, questions regarding the quality of education provided, particularly among for- 30 profit institutions, and the increasing amount of student loan debt outstanding in the United States have prompted this heightened and ongoing scrutiny. This environment could lead to further proposals by political candidates and state and federal legislators and regulators, and to the enactment of laws and regulations, applicable to, or limiting, our business. For instance, over the last several years, numerous proposals for new federal spending have been discussed by political candidates and/or introduced by legislators to make higher education “free” or substantially so. Some proposals have included the potential forgiveness of substantial amounts of existing outstanding student loan indebtedness. Also, various states have proposed and/or enacted legislation providing for “free” or “substantially free” higher education to residents of the state having incomes below a certain level and who attend publicly-funded universities in the state. Moreover, since 2010, a number of bills have been introduced in the United States Congress to promote federal financing for consolidation or refinancing of existing student loans. The regulatory environment at the state level has shifted such that many states recently have enacted new legislation specifically restricting the conduct and practices of student loan servicers. The enactment of any of the proposed legislation or policies described above, even if they do not apply specifically to private education loans, could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. In addition, the continued ongoing publicity regarding these various proposals, even if they are not enacted, could negatively impact the market price of our common stock. We are subject to reputational risk, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. Our reputation as an originator and servicer of high-quality Private Education Loans is very dependent upon how our customers, our regulators, legislators, the education community, and the broader market perceive our business practices, financial heath, and integrity, and the business practices, financial health, and integrity of the overall student loan market or other loan markets, as applicable. Negative publicity, including as a result of our actual or alleged conduct or public opinion of the student loan industry or other relevant industries generally, or as a result of achieving lower environmental, social, and governance, or “sustainability,” scores or ratings than those desired by certain investors, could damage our reputation and business and adversely impact the price of our common stock. Additionally, as described above, proposals of political candidates or legislators that may affect the financial industry, or the student loan industry in particular, could damage our reputation and business and adversely impact the price of our common stock. Any internal, market, or other developments, including those relating to our competitors or our business, that result in a negative impact on our reputation or the reputation of the student loan industry or other relevant industries could have an adverse effect on our ability to originate, service, and retain Private Education Loans or other loans, as applicable, result in greater regulatory, legislative, and media scrutiny, increase our risk of litigation and regulatory sanctions or other actions, and have a material adverse effect on our financial condition and/or results of operations. OPERATIONAL RISKS Failure of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action, or damage our reputation. Our business is dependent on our ability to process and monitor large numbers of transactions in compliance with legal and regulatory standards and our product specifications. As processing demands change and our loan portfolios grow in both volume and differing terms and conditions, developing and maintaining our operating systems and infrastructure become increasingly challenging. There is no assurance we can adequately or efficiently develop, maintain or acquire access to such systems and infrastructure. Our loan originations and the servicing, financial, accounting, data processing or other operating systems and facilities that support them may fail to operate properly, become disabled as a result of events beyond our control or be unable to be rapidly configured to timely address regulatory changes, in each case potentially adversely affecting our ability to process these transactions. Any such failure could adversely affect our ability to service our customers, result in financial loss or liability to our customers and investors, disrupt our business, result in regulatory action or cause reputational damage. Despite the plans we have in place, our ability to operate may be adversely affected by a disruption in the infrastructure that supports our businesses. Notwithstanding our efforts to maintain business continuity, a disruptive event impacting our processing locations could adversely affect our business, financial condition, results of operations and/or cash flows. 31 Our business processes are becoming increasingly dependent upon technological advancement, and we could lose market share if we are not able to keep pace with rapid changes in technology. Our future success depends, in part, on our ability to underwrite and approve loans, process loan applications and payments and provide other customer services, in a safe, automated manner with high-quality service standards. The volume of loan originations we are able to process is reliant on the systems and processes we have implemented and developed. These systems and processes are becoming increasingly dependent upon technological advancement, such as the ability to process loans and payments over the internet or mobile applications, accept electronic signatures and provide initial decisions instantly. Our future success also depends, in part, on our ability to develop and implement technology solutions that keep pace with continuing changes in technology, industry standards and client preferences, including FinTech developments. We may not be successful in anticipating or responding to these developments in a timely manner. We have made, and need to continue to make, investments in our technology platform to provide competitive products and services. We may be required to expend significant funds to develop or acquire new technologies. If competitors introduce products, services, and systems that are better than ours or that are more cost-effective or that gain greater market acceptance, we could lose market share. Any one of these circumstances could have a material adverse effect on our business reputation and ability to obtain and retain clients and, therefore, could materially adversely affect our business, financial condition and/or results of operations. We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information and reputational damage, which could materially adversely affect our business, financial condition and/or results of operations and could lead to significant financial and legal exposure. Our operations rely on the secure collection, processing, storage and transmission of personal, confidential and other information in a significant number of customer transactions on a continuous basis through our computer systems and networks and those of our third-party service providers. Information security risks for financial institutions and third-party service providers have increased in recent years and continue to evolve in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists and other external parties, including foreign state-sponsored actors. These parties also may fraudulently induce employees, customers and others who use our or our service providers’ systems or have access to our or our customers’ data, to gain access to our and our customers’ data or our assets. While we have not been materially impacted by cyber incidents, we continue to evolve our security controls to effectively prevent, detect and respond to the continually changing threats, and we may be required to expend significant additional resources in the future to enhance our security controls in response to new or more sophisticated threats, as well as new regulations related to cybersecurity. Additionally, while we, and our third-party service providers, commit resources to the design, implementation, maintenance, security and monitoring of our networks and systems, there is no guarantee that our security controls, or those of our third-party service providers, will protect against all threats. Despite the measures we and our third-party service providers implement to protect our systems and our or our customers’ data, we may not be able to anticipate, prevent or detect cyber-attacks, particularly because the techniques used by attackers change frequently or are not recognized until launched, and because cyber-attacks can originate from a wide variety of sources, including third parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments. Such third parties may seek to gain unauthorized access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users of our systems or those of our third-party service providers. Or, they may seek to disrupt or disable our or our service providers’ services through attacks such as denial-of-service and ransomware attacks. In addition, we or our service providers may be unable to identify, or may be significantly delayed in identifying, cyber-attacks and incidents due to the increasing use of techniques and tools that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic artifacts. As a result, our computer systems, software and networks, as well as those of third-party vendors we utilize, may be vulnerable to unauthorized access, computer viruses, malicious attacks and other events that could have a security impact beyond our control. We also routinely transmit and receive personal, confidential and proprietary information, some through third parties, which may be vulnerable to interception, misuse or mishandling. If one or more of such events occur, personal, confidential and other information processed by, stored in, or transmitted through our computer systems and networks, or those of third-party vendors, could be compromised or could cause interruptions or malfunctions in our or our customers’ or service providers’ operations that could result in significant losses, 32 loss of business by us and loss of confidence in us, customer dissatisfaction, significant litigation, regulatory exposures, and harm to our reputation and brand. In addition, we may be required to expend significant resources to modify our protective measures, to investigate the circumstances surrounding the event and implement mitigation and remediation measures. We also may be subject to fines, penalties, litigation (including securities fraud class action lawsuits) and regulatory investigation costs and settlements and financial losses that are either not insured against or not fully covered through any insurance maintained by us. If one or more of such events occur, our business, financial condition and/or results of operations could be significantly and adversely affected. While we seek to mitigate cyber and related risks associated with outsourcing to third-party service providers, including through our vendor management processes, both operational and technological cyber risks remain and certain risks are beyond our security and control systems. Cyber-attacks targeted at our service providers may result in unauthorized interception, misuse, mishandling, access, acquisition, loss or destruction of our or our customers’ data, or other cyber incidents, that may affect the availability of our services, and impose costs and other liabilities that significantly and adversely affect us in the ways discussed above. We depend significantly on third-parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third-parties, could disrupt our business or provide our competitors with an opportunity to enhance their position at our expense. We depend significantly on third-parties for a wide array of our operations and customer services and key components of our information technology and security infrastructures. Third-party vendors are significantly involved in aspects of our servicing for Private Education Loans, FFELP Loans, Bank deposit-taking activities, payroll software and systems development, data center and operations, including the timely and secure transmission of information across our data communication network, and for other telecommunications, email, processing, storage, remittance and technology-related services in connection with our business. If a service provider fails to provide the services we require or expect, or fails to meet applicable regulatory or contractual requirements, such as service levels, protection of our customers’ personal and confidential information, or compliance with applicable laws, that failure could negatively impact our business by adversely affecting our ability to process customers’ transactions in a timely and accurate manner, otherwise hampering our ability to serve our customers and investors, or subjecting us to litigation and regulatory risk for matters as diverse as poor vendor oversight, improper release or protection of personal information, or release of incorrect information. Such a failure could adversely affect the perception of the reliability of our networks and services, and the quality of our brand, and could materially adversely affect our business, financial condition and/or results of operations. We primarily rely upon Amazon Web Services to deliver our offerings to users on our platform, and any disruption of or interference with our use of Amazon Web Services could adversely impact our business and operations. Amazon Web Services (“AWS”) provides a distributed computing infrastructure platform for business operations, which is commonly referred to as “cloud” computing services. In 2019, we completed the migration of our computing infrastructure over to AWS. We currently run the majority of computing to power our websites, mobile applications, and other technology products and services on AWS, and we store a significant amount of our users’ information and our confidential business information on AWS. We have limited control over the AWS operations and facilities that we use to store our data. While we’ve implemented contingencies for disaster recovery and business continuity, those operations and facilities are susceptible to damage and/or service interruptions. AWS’ continuing and uninterrupted performance is critical to our continuing and uninterrupted operations. Given the nature of the outsourcing of these services, along with the fact that we cannot easily switch our AWS operations to another cloud provider, any disruption of or interference with our use of AWS could adversely impact our operations and business. Any negative publicity arising from these disruptions could also harm our reputation and brand and may affect the usage of our offerings. We may face risks from our operations related to litigation or regulatory actions that could result in significant legal expenses and settlement or damage awards. Defending against litigation may require significant attention and resources of management and, regardless of the outcome, such actions could result in significant expenses. If we are a party to material litigation and if the defenses we assert are ultimately unsuccessful, or if we are unable to achieve a favorable settlement, we could be liable for large damages and that could have a material adverse effect on our business, results of operations and/or financial condition. 33 Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss. Our risk management framework seeks to mitigate risk and appropriately balance risk and return. We have established processes and procedures intended to identify, measure, monitor, control and report the types of risk to which we are subject. We seek to monitor and control our risk exposure through a framework of policies, procedures, limits and reporting requirements. We also rely on quantitative models to measure and manage risks and estimate certain financial values. Models may be used in such processes as product pricing, extending credit, measuring interest rate and other market risk, estimating losses, calculating and assessing capital levels, estimating the value of financial instruments and balance sheet items, and various other processes. If the models that we use to measure and/or mitigate these risks and values are poorly designed, based upon incorrect or incomplete information, poorly implemented, or are otherwise inadequate, or our governance surrounding the management of data we use in our models and other aspects of our business is poorly designed or implemented, or otherwise is inadequate, our business decisions may be adversely affected, we may provide inaccurate information to the public or regulators, and/or we may incur increased losses. In addition, there may be existing or developing risks that we have not appropriately anticipated, identified or mitigated. If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and our business, financial condition and/or results of operations could be materially adversely affected. Our internal controls over financial reporting and disclosure controls may be ineffective. Our management is responsible for maintaining, regularly assessing and, as necessary, making changes to our internal controls over financial reporting and our disclosure controls. Nevertheless, our internal controls over financial reporting and our disclosure controls can provide only reasonable assurances regarding the reliability of our financial reporting and the preparation of our financial statements for external purposes in accordance with generally accepted accounting principles in the United States (“GAAP”) and may not prevent or detect misstatements. Any failure or circumvention of our internal controls over financial reporting or our disclosure controls, failure to comply with rules and regulations related to such controls, or failure to make sound and appropriate application of the criteria established in the framework set forth in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission could have a material adverse effect on our financial condition and/or results of operations. RISKS RELATED TO SPIN-OFF Because of Navient’s indemnification obligations, we have significant exposures to risks related to its creditworthiness. If we are unable to obtain indemnification payments from Navient, we could experience higher than expected costs and operating expenses and our results of operations, cash flows and/or financial condition could be materially and adversely affected. Pursuant to the terms of the Separation and Distribution Agreement, and as contemplated by the structure of the Spin-Off, Navient is legally obligated to indemnify the Bank against all claims, actions, damages, losses or expenses that may arise from the conduct of all activities of pre-Spin-Off SLM occurring prior to the Spin-Off, except for certain liabilities specifically assumed by the Bank in the agreement as to which the Bank would be obligated to indemnify Navient. The Separation and Distribution Agreement provides specific processes and procedures pursuant to which we may submit claims for indemnification to Navient. If for any reason Navient is unable or unwilling to pay claims made against it, our costs, operating expenses, cash flows and/or financial condition could be materially and adversely affected over time. GENERAL RISKS The holders of our preferred stock have rights that are senior to those of our common shareholders. At December 31, 2020, we had issued and outstanding 2.5 million shares of our Series B Preferred Stock. Our Series B Preferred Stock is senior to our shares of common stock in right of payment of dividends and other distributions. Generally, we must be current on dividends payable to holders of our Series B Preferred Stock before any dividends can be paid on our common stock. We also must comply with certain provisions that are protective of the Series B Preferred Stock in order to effectuate any repurchases under our common stock share repurchase program. In the event of our 34 bankruptcy, dissolution or liquidation, the holders of our Series B Preferred Stock must be satisfied before any distributions can be made to our common shareholders. We may be limited in our ability to pay dividends on, and repurchase, our common stock. The declaration and payment of future common stock dividends, as well as the amount thereof, are subject to determination by, and the discretion of, our Board of Directors. In addition, we may change our policy regarding the payment of dividends and reduce or eliminate our common stock dividend in the future, which could adversely affect the market price of our common stock. Our share repurchase programs permit us to repurchase from time to time shares of our common stock up to an aggregate repurchase price not to exceed the authorized limits described in this Form 10-K. We may not be able to sell loans at prices, in volumes, or on a schedule, that will provide us with sufficient funds to effect share repurchases under our share repurchase programs. The timing and volume of any repurchases will be subject to market conditions, and there can be no guarantee that we will repurchase up to the limit of any program or at all, which could adversely affect the market price of our common stock. We are dependent on funds obtained from the Bank to fund dividend payments and any share repurchases. Regulatory and other legal restrictions may limit our ability to transfer funds freely, either to or from our subsidiaries. In particular, the Bank is subject to laws and regulations that authorize regulatory bodies to block or reduce the flow of funds to us, or that prohibit such transfers altogether in certain circumstances. These laws, regulations and rules may hinder our ability to access funds that we may need to make payments in respect of our stock or to satisfy our other responsibilities. The FDIC has the authority to prohibit or limit the payment of dividends by the Bank and SLM Corporation. 35 Item 1B. Unresolved Staff Comments None.