What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-02-24 compared with 2021-02-25 · 239 added, 117 removed, 254 unchanged (58% of the section changed)

SUMMARY OF RISK FACTORS

Below is a summary of the principal factors that make an investment in our securities risky.

This summary does not address all of the risks that we face.

Additional discussion of the risks summarized in this risk factor summary, and other risks that we face, can be found below and should be carefully considered, together with other information in this Form 10-K and our other filings with the SEC, before making an investment decision regarding our stock.

• The pandemic caused by COVID-19 and resulting adverse economic conditions have adversely impacted our business and results and, in the future, could have a more material adverse impact on our business, results of operations, financial condition, and/or cash flows.

Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic.

• Our product offerings are primarily concentrated in loan products for higher education and deposit products for online depositors.

Such concentrations and the competitive environment for those products subject us to risks that could adversely affect our financial position.

• Consumer access to alternative means of financing the costs of education and other factors may reduce demand for, or adversely affect our ability to retain, Private Education Loans, which could have a material adverse effect us.

• Consolidation or refinancing of existing Private Education Loans could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

• Defaults on our loans, particularly Private Education Loans, could adversely affect our business, financial position, results of operations, and/or cash flows.

• Our allowance for credit losses may not be adequate to cover actual losses, which may adversely affect our capital, financial condition, and/or results of operations.

• We are subject to the creditworthiness of third-parties other than borrowers and exposure to those third-parties could adversely affect our business, financial condition, results of operations, and/or cash flows.

• Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time.

An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could have a material adverse effect on us.

• In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties.

If those liabilities are significant, they could adversely affect our business and financial condition.

• The levels of or changes in interest rates could adversely affect our results of operations, financial condition, regulatory capital, and/or liquidity.

• The interest rate and maturity characteristics of our earning assets do not fully match the interest rate and maturity characteristics of our funding arrangements, which may negatively impact the level of our net interest income.

We are also subject to repayment and prepayment risks, which can increase uncertainty and adversely affect our business.

• Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings.

• The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations.

• The Bank is subject to various regulatory capital requirements, and failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our business, results of operations, and/or financial condition.

22 SLM CORPORATION — 2021 Form 10-K

• Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position.

• Changes in accounting standards, or incorrect estimates and assumptions by management in connection with the preparation of our consolidated financial statements, could adversely affect our capital levels, results of operation, and/or financial condition.

• We operate in a highly regulated environment and the laws and regulations that govern our operations, or changes in these laws and regulations, or our failure to comply with them, may adversely affect us.

• Failure to comply with consumer protection, privacy, data protection, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business.

• Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss and, if the framework is ineffective, could have a material adverse effect on us and our business.

• Proposals of federal and state governments, or of various political candidates, affecting the student loan industry in particular, such as proposals for new federal education spending designed to make higher education “free” or substantially so regardless of financial need, subject us to political risk and could have a material adverse impact on us.

• We are subject to reputational risk, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

• Failure or significant interruption of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action or litigation, or damage our reputation.

• We could lose market share if we are not able to keep pace with rapid changes in technology.

• We depend on secure information technology and a breach of those systems or those of third-party vendors could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure.

• We depend significantly on third-parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third-parties, could disrupt our business.

• We primarily rely upon Amazon Web Services to deliver our offerings to users on our platform, and any disruption of or interference with our use of Amazon Web Services could adversely impact our business and operations.

• We may face risks from our operations related to litigation or regulatory actions that could result in significant legal expenses and settlement or damage awards.

• Our internal controls over financial reporting and disclosure controls may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations.

• Our business operations and those of our third-party vendors may be adversely impacted by unpredictable catastrophic events.

• Our ability to successfully make acquisitions is subject to significant risks.

• Because of Navient’s indemnification obligations, we have significant exposures to risks related to its creditworthiness.

• The holders of our preferred stock have rights that are senior to those of our common shareholders.

• We may be limited in our ability to receive dividends from the Bank, pay dividends on and repurchase our common stock, and make payments on our corporate debt.

• Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees.

2021 Form 10-K — SLM CORPORATION 23

We face many risks and uncertainties, any one or more of which could have a material adverse effect on our business, financial condition (including capital and liquidity), results of operations, cash flows, and/or stock price.

We describe certain of these risk and uncertainties in this section, although we may be adversely affected by other risks or uncertainties that (i) are presently not known to us, (ii) we have failed to identify or appreciate, or (iii) we currently consider immaterial.

These Risk Factors, together with other information in this Form 10-K and our other filings with the SEC, should be carefully considered before making an investment decision regarding our stock.

PANDEMIC RISK

2 unchanged sentences

The COVID-19 pandemic has caused significant disruption to the U.S.

and world economies, including the closing of many schools and businesses for extended periods of time, significantly higher unemployment and underemployment, significantly lower interest rates, volatility in equity market valuations, and extreme volatility in the U.S.

and world economies, including the closing of many schools and businesses for extended periods of time, significantly higher unemployment and underemployment at certain times, significantly lower interest rates, volatility in equity market valuations, and extreme volatility in the U.S.

and world financial markets.

Depending upon the success of the distribution, public acceptance, and administration of COVID-19 vaccines or other therapies, we expect the impact of the COVID-19 pandemic on the U.S.

economy may be significant during a large part of 2021 and that it could materially adversely affect our operations, our regulatory capital and liquidity position, the credit performance of our Private Education Loans and other assets, the number of borrowers seeking payment relief, our results of operations and financial condition, and/or our cash flows.

Depending upon the success of the distribution, public acceptance, and administration of COVID-19 vaccines or other therapies both in the U.S.

and abroad, the impact of the COVID-19 pandemic on the U.S.

economy may be significant during a large part of 2022 and it may materially adversely affect our operations, our regulatory capital and liquidity position, the credit performance of our Private Education Loans and other assets, the number of borrowers seeking payment relief, our results of operations and financial condition, and/or our cash flows.

As described in Part II, Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Impact of COVID-19 on Sallie Mae — Customers and Credit Performance,” in this annual report on Form 10-K, during 2020 we experienced a significant increase in disaster forbearance grants, and our borrowers experienced higher levels of financial hardship, which could lead to increased levels of delinquencies and defaults in the future.

Also, our loan application volumes decreased and we had lower Private Education Loan origination volumes in 2020 than we had anticipated.

In addition, our employees may have to continue to work from home for a significant portion of 2021.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Impact of COVID-19 on Sallie Mae — Customers and Credit Performance,” in this annual report on Form 10-K, during 2021 some of our borrowers experienced higher levels of financial hardship, which could lead to increased levels of delinquencies and defaults for those borrowers in the future.

In addition, our employees may have to continue to work from home for portions of 2022.

Unanticipated issues arising from handling personal, confidential, and other information from a less efficient work-from-home environment could adversely impact our operations and lead to greater risk for us.

The extent to which the COVID-19 pandemic impacts our business, results of operations, financial condition, and/or cash flows will depend on future developments, which are highly uncertain and largely beyond our control, including the impact of the pandemic on colleges and universities, student enrollment, and the need for Private Education Loans.

There can be no assurance that colleges and universities will return to normal pre-pandemic operations, which could adversely affect enrollments and, consequently, the need for Private Education Loans.

7 unchanged sentences

and the impact of the COVID-19 pandemic on local, U.S., and world economies.

In particular, any cessation by the federal government in 2022 or afterwards of its payment suspension program for borrowers of federal student loans could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows if borrowers have insufficient funds to make payments on both their federal student loans and our Private Education Loans.

Moreover, we expect that effects of the COVID-19 pandemic will heighten many of the other known risks to our business described below in this Item 1A, and the impact of COVID-19 on our business could be material and adverse.

Any future pandemic could subject our business to the same or greater risks than the COVID-19 pandemic.

Any additional COVID-19 outbreaks, spikes, and subsequent waves, new COVID-19 strains, and/or widespread ineffectiveness of the COVID-19 vaccines could have material and adverse impacts on our business.

In addition, any future pandemic could subject our business to the same or greater risks than the COVID-19 pandemic.

24 SLM CORPORATION — 2021 Form 10-K

CONCENTRATION RISK

3 unchanged sentences

This concentration poses the risk that any disruption, dislocation, or other negative event or trend in the Private Education Loan market or the overall economic environment could disproportionately and adversely affect our business, financial condition, and results of operations.

We compete in the Private Education Loan market with banks and other consumer lending institutions, many with strong consumer brand name

recognition and greater financial resources.

We compete in the Private Education Loan market with banks and other consumer lending institutions, many with strong consumer brand name recognition and greater financial resources.

Many of those lenders also have a greater level of diversification in their mix of assets, which can enable them to be more competitive in uncertain or challenging economic times.

3 unchanged sentences

To the extent our competitors compete more aggressively or effectively, we could lose market share to them or subject our existing loans to consolidation or refinancing risk.

Competition plays a significant role in our online deposit gathering activities.

The market for online deposits is highly competitive, based primarily on a combination of reputation and rate.

Increased competition for deposits could cause our cost of funds to increase, which could negatively impact our loan pricing and net interest margin.

In addition to competition with banks and other consumer lending institutions, the federal government, through the Federal Direct Student Loan Program (the “DSLP”), poses significant competition to our Private Education Loan products.

9 unchanged sentences

See “— POLITICAL/REPUTATIONAL RISK.

Competition also plays a significant role in our online deposit gathering activities.

The market for online deposits is highly competitive, based primarily on a combination of reputation and rate.

Increased competition for deposits could cause our cost of funds to increase, which could negatively impact our loan pricing and net interest margin.

See also “- LIQUIDITY RISK.”

Consumer access to alternative means of financing the costs of education and other factors may reduce demand for, or adversely affect our ability to retain, Private Education Loans, which could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

7 unchanged sentences

• Direct loans from colleges and universities, as well as income sharing agreements offered by schools and facilitated by private companies.

2021 Form 10-K — SLM CORPORATION 25

In addition, our ability to grow Private Education Loan originations and retain assets at our planned levels could be negatively affected if:

9 unchanged sentences

However, increasing amounts of private education consolidation loans at interest rates below those of our existing portfolio - whether from private sources (including financial technology (“FinTech”) companies) or otherwise - can contribute to an increase in the prepayment rates of our existing Private Education Loans and, if prolonged and continuous, could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

Since 2010, there have been a number of bills introduced in the United States Congress to promote federal financing for consolidation or refinancing of existing student loans, as well as an increase in the number of lenders offering similar products.

Also, on July 31, 2018, the Office of the Comptroller of the Currency (the “OCC”) issued a policy statement announcing that it would consider applications from FinTech companies to become special purpose national banks.

The special purpose national bank charter is available to qualifying companies engaged in a limited range of banking activities, including paying checks or lending money, but that do not take deposits.

The OCC indicated the special purpose national bank charter would be available to qualifying companies engaged in a limited range of banking activities, including paying checks or lending money, but that do not take deposits.

Although litigation ensued, and may continue, regarding the OCC’s ability to grant special purpose bank charters, receipt by any FinTech companies of a special purpose bank charter could lead to an increase in the consolidation or refinancing of our Private Education Loans.

Defaults on our loans, particularly Private Education Loans, could adversely affect our business, financial position, results of operations, and/or cash flows.

1 unchanged sentence

If they were to default at rates much higher than anticipated or at speeds faster than anticipated, our business, financial position, results of operations, and/or cash flows could be adversely affected.

Delinquencies are an important indicator of the potential future credit performance of those loan portfolios.

Many factors can have an impact on borrower delinquencies.

But rising unemployment rates and the failure of our in-school borrowers to graduate are two of the most significant macroeconomic factors that could increase loan delinquencies, defaults and loan modifications, or otherwise negatively affect performance of our existing education loan portfolios.

Delinquencies are an important indicator of the potential future credit performance of our loan portfolios.

Many factors can have an impact on borrower delinquencies, including, without limitation, economic conditions, changes in interest rates, personal circumstances and hardships, risk characteristics such as school type, loan status, loan seasoning, underwriting criteria, presence of a cosigner, changes made in credit administration practices from time to time, changes in loan underwriting criteria made from time to time, regulatory and operational changes, and unforeseen trends.

Rising unemployment rates and the failure of our in-school borrowers to graduate are two of the most significant macroeconomic factors that could increase loan delinquencies, defaults, and loan modifications, or otherwise negatively affect performance of our existing education loan portfolios.

Likewise, high unemployment may impede Private Education Loan originations growth, as loan applicants and cosigners may experience trouble repaying credit obligations or may not meet our credit standards.

2 unchanged sentences

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Financial Condition — Allowance for Credit Losses — Use of Forbearance and Rate Modifications as a Private Education Loan Collection Tool” for a discussion of how items such as changes in credit administration practices can impact the timing and level of delinquencies and defaults on our loans.

Higher credit-related losses and weaker credit quality negatively affect our business, financial condition, and results of operations and limit funding options, which could also adversely impact our liquidity position.

As part of our underwriting process, we rely heavily upon information supplied by applicants and third parties.

If any of this information is intentionally or negligently misrepresented and is not detected by us before completing the transaction, we may experience increased credit risk.

Higher credit-related losses and weaker credit quality negatively affect our

26 SLM CORPORATION — 2021 Form 10-K

business, financial condition, and results of operations and limit funding options, which could also adversely impact our liquidity position.

Our Private Education Loan delinquencies (loans greater than 30 days past due), as a percentage of Private Education Loans in repayment, were 3.3 percent at December 31, 2021.

3 unchanged sentences

Measurement of Credit Losses on Financial Instruments,” which became effective for us on January 1, 2020.

Under the new guidance, for all loans carried at amortized cost, upon loan

origination we are required to measure our allowance for credit losses based on our estimate of all current expected credit losses (“CECL”) over the remaining contractual term of the assets.

Under the guidance, for all loans carried at amortized cost, upon loan origination we are required to measure our allowance for credit losses based on our estimate of all current expected credit losses (“CECL”) over the remaining contractual term of the assets.

The CECL standard resulted in a significant change in how we recognize credit losses and will have a material impact on our financial condition, results of operations, and capital levels.

1 unchanged sentence

The measurement of expected credit losses is based on historical information, current conditions, and reasonable and supportable forecasts to estimate the expected loss over the life of the loan.

This differs significantly from the “incurred loss” model, which was in effect during 2019 and delays recognition until it is probable a loss has been incurred.

Our models take into account historical loss experience in various economic conditions to estimate expected future losses based upon future economic forecasts over a period of time, at which point we revert expected losses to our historical rates.

This differs significantly from the “incurred loss” model, which was in effect during 2019 and delayed recognition until it was probable a loss had been incurred.

Our models take into account historical loss experience in various economic conditions to estimate expected future losses based upon future economic forecasts over a period of time (“reasonable and supportable period”), at which point we revert expected losses to our historical rates.

Future defaults can be higher than anticipated due to a variety of factors outside of our control, and our models may not accurately estimate future loan loss performance.

The models used in calculating our CECL estimates include forecasts of future economic conditions, loss rates, prepayment rates, and recovery rates.

The models used in calculating our CECL estimates include forecasts of future economic conditions, the weighting of economic forecasts, prepayment speeds, and recovery rates.

If these forecasts prove to be inaccurate, or our models were not designed properly, our allowance for credit losses may not be sufficient to cover future losses, which could negatively impact our financial condition, results of operations, and capital levels.

1 unchanged sentence

As such, changes to these inputs could significantly change the amount of allowance necessary, which could have a negative impact on our financial results and capital levels.

Additionally, regulatory agencies may periodically review our allowance for credit losses, including our methodology and models used in calculating the allowance, and could insist on an increase in the allowance or recognition of additional charge-offs based on judgments different than those used by our management.

If these differences in judgment are significant, our allowance could increase significantly and result in sizable decreases in our net income and capital.

See Part II, Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Policies and Estimates — Allowance for Credit Losses 2020 ” for further details.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Policies and Estimates — Allowance for Credit Losses” for further details regarding our allowance for credit losses .

We are subject to the creditworthiness of third-parties other than borrowers and exposure to those third-parties could adversely affect our business, financial condition, results of operations, and/or cash flows.

We are also subject to the creditworthiness of third-parties, including various lending, investment, and derivative counterparties.

Our overall counterparty exposure is more fully discussed in Part II, Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources — Counterparty Exposure.” If our counterparties are unable to perform their obligations, such inability could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows.

2021 Form 10-K — SLM CORPORATION 27

LIQUIDITY RISK

Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain financing through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time.

Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time.

An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could lead to regulatory scrutiny and could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

6 unchanged sentences

The significant competition for deposits from other banking organizations that are also seeking stable deposits to support their funding needs may affect deposit renewal rates, costs, or availability.

In addition, our ability to maintain existing balances or obtain additional deposits may be affected by factors, including those beyond our control, such as a rising stock market, perceptions about our financial strength, quality of deposit servicing or online banking generally, and general economic conditions, including high unemployment and decreased savings rates.

Also, our ability to maintain our current level of deposits or grow our deposit base could be affected by regulatory restrictions, including the possible imposition by our regulators of prior approval requirements or restrictions.

Our short-term success also depends on our ability to structure Private Education Loan securitizations or execute other secured funding transactions.

In addition, our ability to maintain existing balances or obtain additional deposits may be affected by factors, including those beyond our control, such as a rising stock market, more attractive returns on alternative investments, perceptions about our existing and future financial strength, quality of deposit servicing or online banking generally, changes in monetary or fiscal policies that influence deposit or other rates, and general economic conditions, including high unemployment and decreased savings rates.

Our success also depends on our ability to structure Private Education Loan securitizations or execute other secured funding transactions.

Several factors may have a material adverse effect on both our ability to obtain such funding and the time it takes us to structure and execute these transactions, including the following:

6 unchanged sentences

If we require funding beyond that which we may be able to obtain through deposits and proceeds from ABS transactions at attractive prices, we may need to raise additional liquidity through other forms of secured and unsecured debt financing, which, in turn, could increase our funding costs and reduce our net interest margin.

Future downgrades to our credit ratings also could result in higher funding costs and reduce our net interest margin.

Our ability to sell loans at attractive prices, as well as the timing and volume of any sales, will be subject to market conditions, and there can be no guarantee that we will be able to effectuate planned loan sales at the prices, times, or volumes we desire, or at all.

If we are unable to effectuate loan sales at the prices, times, and volumes we desire, we may not be able to fund share repurchase programs that are authorized from time to time or achieve other business goals.

If we are unable to effectuate loan sales at the prices, times, and volumes we

28 SLM CORPORATION — 2021 Form 10-K

desire, we may not be able to fund share repurchase programs that are authorized from time to time or achieve other business goals.

We currently maintain sufficient risk-based capital through adequate retention and reinvestment of earnings from operations.

1 unchanged sentence

Several factors, some of which may be beyond our control, may have a material adverse effect on our ability to raise funding at any given time through any of the channels described above in this Risk Factor in the amounts, at the rates, or within the timeframes we desire or need.

If this occurs, our business, results of operations, financial position, and/or cash flow could be materially and adversely affected.

If this occurs, our business, results of operations, financial position, and/or cash flows could be materially and adversely affected.

In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties.

If those liabilities are significant, they could adversely affect our business, financial condition, results of operations, and/or cash flows.

Under applicable state and federal securities laws, if investors incur losses as a result of purchasing ABS issued in connection with our securitization transactions, we could be deemed responsible and could be liable to investors for damages.

1 unchanged sentence

If we fail to cause the securitization trusts or other transaction parties to disclose adequately all material information regarding an investment in any securities, if we or the trusts make statements that are misleading in any material respect in information delivered to investors in any securities, if we breach any representations or warranties made in connection with securitization of the loans, or if we breach any other duties as the administrator or servicer of the securitization trusts, it is possible we could be sued and ultimately held liable to an investor or other transaction party.

In transactions involving the sale of loans in non-securitized form where we remain the servicer of the loans, it is possible we could be sued and ultimately held liable to the purchaser of the loans or another transaction party for breaches or representations of warranties or breaches of servicing covenants.

In transactions involving the sale of loans in non-securitized form where we remain the servicer of the loans, it is possible we could be sued and ultimately held liable to the purchaser of the loans or another transaction party for breaches of representations or warranties or breaches of servicing covenants.

INTEREST RATE RISK

The levels of or changes in interest rates could adversely affect our results of operations, financial condition, regulatory capital, and/or liquidity.

We are highly dependent on net interest income, which is the difference between interest income on earning assets (such as loans and investments) and interest expense on deposits and borrowings.

Net interest income is significantly affected by market rates of interest, which in turn are influenced by monetary and fiscal policies of governmental agencies, general economic conditions, the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future.

We may be adversely affected by policies or events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), compressing interest rates on our earnings assets closer to interest rates on our deposits and borrowing, increasing the volatility of market rates of interest, or changing the spreads among different interest rate indices.

Changes in interest rate levels also can lead to other adverse impacts, such as reducing the demand for or increasing the prepayment speeds of our Private Education Loans, increasing the delinquencies or defaults of our borrowers or other counterparties, reducing the value of our assets, or increasing our liabilities.

The level of and changes in market rates of interest and, as a result, these risks and uncertainties, are beyond our control.

The interest rate and maturity characteristics of our earning assets do not fully match the interest rate and maturity characteristics of our funding arrangements, which may negatively impact the level of our net interest income.

3 unchanged sentences

ABS funding closely mirrors the expected maturities of our education loans and provides a combination of fixed and variable-rate funding.

Deposits are issued with both fixed and variable rates, and the average term is typically shorter than the expected term of our combined loan portfolios.

Deposits are issued with both

2021 Form 10-K — SLM CORPORATION 29

fixed and variable rates, and the average term is typically shorter than the expected term of our combined loan portfolios.

The different interest rate and maturity characteristics of our loan portfolio and the liabilities funding that portfolio result in fluctuations in our net interest income.

In certain interest rate environments, this mismatch may reduce our net interest margin (the interest yield earned on our portfolio less the rate paid on our interest-bearing liabilities) and net interest income.

While we actively monitor and manage mismatches in the interest rate and maturity characteristics of our assets and liabilities,

using derivative transactions where necessary to avoid excessive levels of repricing and refunding risk, it is not possible to hedge all of our exposure to such risks.

While we actively monitor and manage mismatches in the interest rate and maturity characteristics of our assets and liabilities, using derivative transactions where necessary to avoid excessive levels of repricing and refunding risk, it is not possible to hedge all of our exposure to such risks.

While the assets, liabilities, and related hedging derivative contract re-pricing indices are typically highly correlated, there can be no assurance that the historically high correlation will not be disrupted by capital market dislocations or other factors outside our control.

13 unchanged sentences

A decline in the fair value of those derivatives could have a material adverse effect on our reported earnings.

We are also subject to the creditworthiness of third-parties, including various lending, investment, and derivative counterparties.

Our overall counterparty exposure is more fully discussed in Part II, Item 7.

The transition from LIBOR to an alternative reference “benchmark” interest rate is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations.

The interest rates on our variable-rate Private Education Loans and certain other assets are indexed to LIBOR, the London interbank offered rate.

Also, see “— We are subject to the creditworthiness of third-parties other than borrowers and exposure to those third-parties could adversely affect our business, financial condition, results of operations, and/or cash flows” .

The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations.

The interest rates on our variable-rate Private Education Loans issued before April 1, 2021 and certain other assets are indexed to LIBOR, the London interbank offered rate.

Certain of our interest rate swaps, notes issued under our term ABS and our education loan-backed multi-lender secured borrowing facility (the “Secured Borrowing Facility”), brokered and non-brokered deposits, and other obligations also are indexed to LIBOR.

In each case, the terms of the relevant agreements define LIBOR and provide differing methods for how it may be replaced or computed if LIBOR is no longer available as defined.

LIBOR is used worldwide as a reference for setting interest rates on loans, derivatives, and other assets and obligations.

On July 27, 2017, the United Kingdom's Financial Conduct Authority, which regulates LIBOR, publicly announced that it intends to stop persuading or compelling banks on the London interbank market to submit LIBOR rates after 2021.

On December 4, 2020, the administrator of LIBOR, the ICE Benchmark Administration, published a consultation on its intention to extend the date on which the rates on most tenors of U.S.

dollar LIBOR would cease being published from December 31, 2021 to June 30, 2023.

Any publication beyond December 31, 2021 will need to comply with applicable regulations, including as to representativeness.

banking regulators have encouraged banks to stop entering into new LIBOR-based contracts as soon as practicable and in any event by the end of 2021.

It is unclear at this time, and we are not able to predict, whether or when LIBOR will cease to exist, whether or when new methods of calculating LIBOR will be established such that it continues to exist after 2021, or whether or when alternative benchmark or reference rates will be available, either through regulatory action or financial market developments, as viable alternatives to LIBOR.

If one or more replacement benchmark or reference rates is available, it is unknown at this time, and we are unable to predict, whether any such alternatives will be acceptable to investors,

financial markets or regulators, or applied consistently and concurrently to various assets, obligations, or financial instruments.

LIBOR has been used worldwide as a reference for setting interest rates on loans, derivatives, and other assets and obligations.

Following announcements by the United Kingdom’s Financial Conduct Authority (the “UKFCA”), which regulates LIBOR, and ICE Benchmark Administration Limited, the administrator of LIBOR, publication of 1-week and 2-month USD LIBOR and all tenors for other currencies ceased after December 31, 2021.

While publication of the remaining USD settings is expected to cease after June 30, 2023, U.S.

banking and other global financial services regulators have directed regulated institutions to cease entering into new LIBOR-based contracts as soon as practicable and in any event by the end of 2021.

The Federal Reserve Bank of New York currently publishes the Secured Overnight Financing Rate (“SOFR”) based on overnight U.S.

Treasury repurchase agreement transactions, which has been recommended as the alternative to USD LIBOR by the Alternative Reference Rates Committee convened by the Federal Reserve Board and the Federal Reserve Bank of New York.

30 SLM CORPORATION — 2021 Form 10-K

The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and will be affected by, among other things, the pace of the transition to such rates, the specific terms and parameters for and acceptance of such rates (including, without limitation, by investors, financial markets, and regulators), market conventions for the use of such rates in connection with a particular product, and prices of and the liquidity of trading markets for products based on such rates.

Certain of our existing assets and obligations do not include provisions clearly specifying a method for transitioning from LIBOR to an alternative benchmark rate.

3 unchanged sentences

The Company has actively monitored market developments with respect to LIBOR replacement since 2017 and during 2020 launched a formal cross-functional replacement project with the goal of ensuring a smooth transition to a replacement index with minimal negative impact on our customers, investors, and the Company’s business, financial condition, and results of operations.

The project team monitors developments, assesses impacts, proposes plans and, with the approval of an executive committee, implements changes.

The Chief Financial Officer and the project team monitor developments, assesses impacts, proposes plans, and, with the approval of an executive committee, implement changes.

The project team reports status regularly to our Board of Directors.

In 2020 we began issuing certain deposits based on the Secured Overnight Financing Rate (“SOFR”).

We expect to begin to issue variable-rate Private Education Loans that do not use LIBOR as a reference rate in 2021.

In 2020, we began accepting certain deposits based on SOFR.

In the second quarter of 2021, we began issuing variable-rate Private Education Loans that are indexed to SOFR.

In 2022, subject to market conditions and investor demand, we expect to begin issuing ABS that are indexed to SOFR and to renew the Secured Borrowing Facility with an index based on SOFR.

We plan to significantly reduce the number of contracts that reference LIBOR, either through modification or replacement, by June 2023.

There can be no guarantee our reference rate replacement plan will occur as expected, however, and failure to implement the plan effectively or changes in how LIBOR transition occurs could have a material adverse effect on our business, results of operations, financial position, and/or cash flows.

See Part II, Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — LIBOR Transition” for further details.

The Bank is subject to various regulatory capital requirements administered by the FDIC and the UDFI.

2 unchanged sentences

The Bank’s capital amounts and its classification under the prompt corrective action framework are also subject to qualitative judgments by the regulators about components of capital, risk weightings, and other factors.

If the Bank fails to satisfy regulatory risk-based or leverage capital requirements, it may be subject to serious regulatory sanctions that could prevent us from successfully executing our business plan and may have a material adverse effect on our business, results of operations, financial position, and/or cash flows.

Basel III is subject to further revisions and such revisions could affect the Bank’s capital requirements and adversely affect its business, results of operations, and financial condition.

For example, in 2017 the Basel Committee on Banking Supervision published revisions to the international capital standards that it describes as the finalization of the Basel III post-crisis regulatory reforms.

Among other things, these revisions would revise the standardized approach for credit risk and provide a new standardized approach for operational risk capital, with an initial implementation date of January 1, 2023 and a phase-in period for certain revisions extending to January 1, 2028.

The impact of these revisions on the Bank will depend on how and to what extent they are implemented in the United States.

The federal banking agencies have not yet proposed a rule to implement these revisions in the United States.

If the Bank fails to satisfy regulatory risk-based or leverage capital requirements, it may be subject to serious regulatory consequences, including restrictions on our ability to make dividend payments or share repurchases, that could prevent us from successfully executing our business plan and may have a material adverse effect on our business, results of operations, financial position, and/or cash flows.

“Business — Supervision and Regulation — Regulation of Sallie Mae Bank — Regulatory Capital Requirements.”

2021 Form 10-K — SLM CORPORATION 31

Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position.

Pursuant to regulatory guidance, the Bank conducts annual capital stress tests, modeling systemic and company-specific stress scenarios.

In 2020, as the Bank responded to the macroeconomic and humanitarian challenges of the COVID-19 pandemic, the Bank selected as its primary stress scenario its current forecast, reflecting the severe stresses anticipated due to the impact of the pandemic on our customers and the U.S.

economy (including the impacts of disaster forbearance practices designed to alleviate the severity of the pandemic on our borrowers).

The results of this analysis were presented to and reviewed by the Bank’s senior management, the Bank’s Board of Directors and the Board’s Risk Committee.

In 2021, the Bank conducted its annual capital stress tests and the results of these tests were presented to and reviewed by the Bank’s senior management, the Bank’s Board of Directors, and the Board’s Financial Risk Committee.

In addition, the Bank made the results of the stress tests (its current business forecast) available to its prudential regulators - the FDIC and the UDFI.

The process we utilized in 2020 was a pragmatic departure from our standard testing practices, dictated by the severity of the pandemic.

Generally, the stress test results include certain measures that evaluate the Bank’s ability to absorb losses in severely adverse economic and financial conditions.

the 2020 scenario analysis tested the Bank’s resources and resiliency in real time.

Typically, on the basis of a stress analysis, senior management may elect to adjust its business plans or capital targets to reduce risks identified by the analysis.

On the basis of a stress analysis, senior management may elect to adjust its business plans or capital targets to reduce risks identified by the analysis.

Our regulators may also require the Bank to raise additional capital or take other actions, or may impose restrictions on our business, based on the results of the stress tests.

2 unchanged sentences

We also conduct quarterly liquidity stress tests to evaluate the adequacy of our liquidity sources under several stress scenarios, including a severely adverse macroeconomic scenario.

In 2020, the forecast of business operations through the pandemic served as the severely adverse scenario.

The results of these scenarios may lead management to determine, or regulators to demand, that higher levels of liquidity be maintained at significant incremental expense to the Bank.

6 unchanged sentences

Incorrect estimates and assumptions by us in connection with the preparation of our consolidated financial statements could adversely affect the reported amounts of assets, liabilities, income, and expenses.

If we make incorrect assumptions or estimates, we may under- or overstate reported financial results, which could materially and adversely affect our business, financial condition, and/or results of operations.

For additional information on the key areas for which assumptions and estimates are used in preparing our financial statements, see Part II, Item 7.

1 unchanged sentence

REGULATORY RISK

Failure to comply with consumer protection, privacy, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business.

We are subject to a broad range of federal and state consumer protection laws applicable to our lending and retail banking activities, including laws governing fair lending, unfair, deceptive and abusive acts and practices, service member protections, interest rates and loan fees, disclosures of loan terms, marketing, servicing and collections.

We are also subject to a dynamically changing landscape of privacy and cybersecurity laws, regulations, and requirements.

For example, the CCPA took effect on January 1, 2020, and is broad, sweeping legislation that gives California consumers certain rights similar to those provided by the European General Data Protection Regulation.

Among other things, the CCPA provides for enhanced regulatory penalties and potential statutory damages in relation to certain types of data breaches.

“Business — Supervision and Regulation — Regulation of Sallie Mae Bank — Privacy Laws” for additional information.

Violations of, or changes in, federal or state consumer protection, privacy or cybersecurity laws or related regulations, or in the prevailing interpretations thereof, may expose us to litigation, administrative fines, penalties and restitution, result in greater compliance costs, constrain the marketing and origination of Private Education Loans or other products, adversely affect the collection of balances due on the loan assets held by us or by securitization trusts or otherwise adversely affect our business.

Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in compliance and supervision activities, often impose additional compliance costs.

Accordingly, we could incur substantial additional expense complying with these requirements and may be required to create new processes and information systems.

Moreover, changes in federal or state consumer protection laws and related regulations, or in the prevailing interpretations thereof, could invalidate or call into question the legality of certain of our services and business practices.

The CFPB is the Bank’s primary consumer compliance supervisor, with exclusive authority to conduct examinations for the purposes of assessing compliance with the requirements of Federal consumer financial laws and with primary consumer compliance enforcement authority.

CFPB jurisdiction could result in additional regulation and supervision, which could

increase our costs and limit our ability to pursue business opportunities.

The CFPB/DOE MOU could lead to additional complaints received by the CFPB regarding us, which could lead to additional scrutiny of us and increase our costs.

Consent orders, decrees or settlements entered into with governmental agencies may also increase our compliance costs or restrict certain of our activities.

The CFPB and the FDIC have issued guidance to supervised banks with respect to increased responsibilities to supervise the activities of service providers to ensure compliance with federal consumer protection laws.

The issuance of regulatory guidance and the enforcement of the enhanced vendor management standards via examination and investigation of us or any third-party with whom we do business may increase our costs, require increased management attention and adversely impact our operations.

In the event we should fail to meet the heightened standards for management of service providers, we could be subject to supervisory orders to cease and desist, civil monetary penalties, or other actions due to claimed noncompliance, which could have an adverse effect on our business, financial condition, operating results, and/or cash flows.

We operate in a highly regulated environment and the laws and regulations that govern our operations, or changes in these laws and regulations, or our failure to comply with them, may adversely affect us.

In addition to consumer protection laws, we are also subject to extensive regulation and supervision that govern almost all aspects of our operations.

Intended to protect clients, depositors, the DIF, and the overall financial system, these laws and regulations may, among other matters:

We are subject to extensive regulation and supervision that govern almost all aspects of our operations.

Intended to protect clients, depositors, the DIF, and the overall financial system, these laws, regulations, and supervisory actions may, among other matters:

• prescribe minimum capital requirements;

3 unchanged sentences

• limit share repurchases;

32 SLM CORPORATION — 2021 Form 10-K

• restrict the payment of discretionary bonuses to executive officers;

2 unchanged sentences

• impose certain specific accounting requirements on us that may be more restrictive;

• result in changes from time to time in our practices, policies, and procedures in various areas of our business;

• result in changes from time to time in our practices, policies, procedures, and personnel in various areas of our business;

• result in greater or earlier charges to earnings or reductions in our capital.

2 unchanged sentences

Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in supervision, often impose additional compliance costs.

We, like the rest of the banking sector, are facing increased regulation and supervision of our industry by bank regulatory agencies and expect there may be additional and changing requirements and conditions imposed on us, any of which could increase our costs, require increased management attention and adversely impact our results of operations.

Our failure to comply with these laws and regulations, even if the failure is inadvertent or reflects a difference in interpretation, could subject us to fines, other penalties and restrictions on our business activities, any of which could adversely affect our business, financial condition, cash flows, results of operations, capital base and/or the price of our securities.

The scope of the laws and regulations and the intensity of the supervision to which we are subject have increased in recent years, initially in response to the financial crisis, and more recently in light of other factors such as technological and market changes.

Regulatory enforcement and fines have also increased across the banking and financial services sector.

Further, the scope of regulation and the intensity of supervision will likely become higher under the current presidential administration, including increased scrutiny, supervisory discouragement, or even possible denials, of bank mergers and acquisitions by federal bank regulators.

We expect that we, like the rest of the banking sector, will remain subject to increased regulation and supervision of our industry by bank regulatory agencies and that there may be additional and changing requirements and conditions imposed on us, any of which could increase our costs, require increased management attention, and adversely impact our results of operations.

In connection with their continuous supervision and examinations of us, the FDIC, the UDFI, the CFPB, or other regulatory agencies may require changes in our business or operations.

Such a requirement may be judicially enforceable or impractical for us to contest, and we could become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives.

Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business, our flexibility in conducting operations, and our ability to pay dividends or utilize capital.

Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence.

We could be required as well to dispose of specified assets and liabilities within a prescribed period of time.

As a result, any enforcement or other supervisory action could have an adverse effect on our business, financial condition, results of operations, and prospects.

In addition, changes in the regulatory and supervisory environments could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, restricting our ability to make acquisitions or pursue other profitable opportunities, and negatively impacting our financial condition and results of operations.

Changes in the prevailing interpretations of federal or state laws and related regulations could also invalidate or call into question the legality of certain of our services and business practices.

Our failure to comply with the laws, regulations, and supervisory actions to which we are subject, even if the failure is inadvertent or reflects a difference in interpretation, could subject us to fines, other penalties, and restrictions on our business activities, any of which could adversely affect our business, financial condition, cash flows, results of operations, capital base, and/or the price of our securities.

Failure to comply with consumer protection, privacy, data protection, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business.

2021 Form 10-K — SLM CORPORATION 33

The CFPB is the Bank’s primary consumer compliance supervisor, with exclusive authority to conduct examinations for the purposes of assessing compliance with the requirements of federal consumer financial laws and with primary consumer compliance enforcement authority.

CFPB jurisdiction could result in additional regulation and supervision, which could increase our costs and limit our ability to pursue business opportunities.

The CFPB/ DOE MOU could lead to additional complaints received by the CFPB regarding us, which could lead to additional scrutiny of us and increase our costs.

Consent orders, decrees, or settlements entered into with governmental agencies may also increase our compliance costs or restrict certain of our activities.

The CFPB and the FDIC issued guidance to supervised banks with respect to increased responsibilities to supervise the activities of service providers to ensure compliance with federal consumer protection laws.

We are also subject to a dynamically changing landscape of privacy, data protection, and cybersecurity laws, regulations, and requirements.

Among other things, the CCPA provides for enhanced regulatory penalties and potential statutory damages in relation to certain types of data breaches.

“Business — Supervision and Regulation —Regulation of Sallie Mae Bank — Privacy Laws” for additional information.

In addition, in November 2021, the FDIC, OCC, and FRB adopted a new regulation that takes effect in early 2022 and imposes new requirements on banking organizations to report certain covered cybersecurity events.

Violations of, or changes in, federal or state consumer protection, privacy, data protection, or cybersecurity laws or related regulations, or in the prevailing interpretations thereof, may expose us to litigation, administrative fines, penalties and restitution, result in greater compliance costs, constrain the marketing and origination of Private Education Loans or other products, adversely affect the collection of balances due on the loan assets held by us or by securitization trusts, or otherwise adversely affect our business.

Accordingly, we could incur substantial additional expense complying with these requirements and may be required to create new processes and information systems.

Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss and, if the framework is ineffective, could have a material adverse effect on us and our business.

Our risk management framework seeks to mitigate risk and appropriately balance risk and return.

We continue to evolve our risk management framework to consider changes in business and regulatory expectations and to refine established processes and procedures intended to identify, measure, monitor, test, control, report, escalate, and mitigate the types of risk to which we are subject.

We seek to monitor and control our risk exposure through a framework of policies, procedures, limits, and reporting requirements.

We also rely on quantitative models to measure and manage risks and estimate certain financial values.

Models may be used in such processes as product pricing, extending credit, measuring interest rate and other market risk, estimating losses, calculating and assessing capital levels, estimating the value of financial instruments and balance sheet items, and various other processes.

If the models that we use to measure and/or mitigate these risks and values are poorly designed, based upon incorrect or incomplete information, poorly implemented, or are otherwise inadequate, or our governance surrounding the management of data we use in our models and other aspects of our business is poorly designed or implemented, or otherwise is inadequate, our business decisions may be adversely affected, we may provide inaccurate information to the public or regulators, and/or we may incur increased losses.

In addition, there may be existing or developing risks that we have not appropriately anticipated, identified, or mitigated.

If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and our business, financial condition, and/or results of operations could be materially adversely affected.

An ineffective risk-management framework or function also could give rise to enforcement and other supervisory actions, damage our reputation, and result in litigation.

34 SLM CORPORATION — 2021 Form 10-K

POLITICAL/REPUTATIONAL RISK

1 unchanged sentence

We operate in an environment of heightened political and regulatory scrutiny of education loan lending, servicing, and originations.

The rising cost of higher education, questions regarding the quality of education provided, particularly among for-

profit institutions, and the increasing amount of student loan debt outstanding in the United States have prompted this heightened and ongoing scrutiny.

The rising cost of higher education, questions regarding the quality of education provided, particularly among for-profit institutions, and the increasing amount of student loan debt outstanding in the United States have prompted this heightened and ongoing scrutiny.

This environment could lead to further proposals by political candidates and state and federal legislators and regulators, and to the enactment of laws and regulations, applicable to, or limiting, our business.

7 unchanged sentences

We are subject to reputational risk, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

Our reputation as an originator and servicer of high-quality Private Education Loans is very dependent upon how our customers, our regulators, legislators, the education community, and the broader market perceive our business practices, financial heath, and integrity, and the business practices, financial health, and integrity of the overall student loan market or other loan markets, as applicable.

Negative publicity, including as a result of our actual or alleged conduct or public opinion of the student loan industry or other relevant industries generally, or as a result of achieving lower environmental, social, and governance, or “sustainability,” scores or ratings than those desired by certain investors, could damage our reputation and business and adversely impact the price of our common stock.

Our brand is very important to us and our business.

Our reputation as an originator, servicer, and securitizer of high-quality Private Education Loans and as a depository for online deposits is very dependent upon how our customers, our regulators, legislators, the education community, our employees, and the broader market perceive our business practices, financial heath, and integrity, and the business practices, financial health, and integrity of the overall student loan market, other loan markets, or the market for online deposits, as applicable.

Negative publicity, including as a result of our culture, actual or alleged conduct by us, our employees, or our vendors, or public opinion of the student loan industry or other relevant industries generally, or as a result of achieving lower environmental, social, and governance, or “sustainability,” scores or ratings than those desired by certain investors, could damage our reputation and business and adversely impact the price of our common stock.

Additionally, as described above, proposals of political candidates or legislators that may affect the financial industry, or the student loan industry in particular, could damage our reputation and business and adversely impact the price of our common stock.

Any internal, market, or other developments, including those relating to our competitors or our business, that result in a negative impact on our reputation or the reputation of the student loan industry or other relevant industries could have an adverse effect on our ability to originate, service, and retain Private Education Loans or other loans, as applicable, result in greater regulatory, legislative, and media scrutiny, increase our risk of litigation and regulatory sanctions or other actions, and have a material adverse effect on our financial condition and/or results of operations.

Any internal, market, or other developments, including those relating to our competitors or our business, that result in a negative impact on our brand or reputation or the reputation of the student loan industry or other relevant industries could have an adverse effect on our ability to originate, service, securitize, and retain Private Education Loans or other loans, as applicable, result in greater regulatory, legislative, and media scrutiny, increase our risk of litigation and regulatory sanctions or other actions, and have a material adverse effect on our financial condition and/or results of operations.

OPERATIONAL RISKS

Failure of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action, or damage our reputation.

Failure or significant interruption of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action or litigation, or damage our reputation.

Our business is dependent on our ability to process and monitor large numbers of transactions in compliance with legal and regulatory standards and our product specifications.

As processing demands change and our loan portfolios grow in both volume and differing terms and conditions, developing and maintaining our operating systems and infrastructure become increasingly challenging.

As processing demands change and our loan portfolios grow in both volume and differing terms and conditions, developing and maintaining our operating

2021 Form 10-K — SLM CORPORATION 35

systems and infrastructure become increasingly challenging.

There is no assurance we can adequately or efficiently develop, maintain, or acquire access to such systems and infrastructure.

Our loan originations and the servicing, financial, accounting, data processing or other operating systems and facilities that support them may fail to operate properly, become disabled as a result of events beyond our control or be unable to be rapidly configured to timely address regulatory changes, in each case potentially adversely affecting our ability to process these transactions.

Any such failure could adversely affect our ability to service our customers, result in financial loss or liability to our customers and investors, disrupt our business, result in regulatory action or cause reputational damage.

Our loan originations and deposits and the servicing, financial, accounting, data processing, communications, or other operating systems and facilities that support them may fail to operate properly, become disabled as a result of events beyond our control, or be unable to be rapidly configured to timely address regulatory changes, in each case potentially adversely affecting our ability to process these transactions.

Despite the plans we have in place, our ability to operate may be adversely affected by a disruption in the infrastructure that supports our businesses.

10 unchanged sentences

Any one of these circumstances could have a material adverse effect on our business reputation and ability to obtain and retain clients and, therefore, could materially adversely affect our business, financial condition, and/or results of operations.

We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information and reputational damage, which could materially adversely affect our business, financial condition and/or results of operations and could lead to significant financial and legal exposure.

We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure.

Our operations rely on the secure collection, processing, storage, and transmission of personal, confidential and other information in a significant number of customer transactions on a continuous basis through our computer systems and networks and those of our third-party service providers.

1 unchanged sentence

These parties also may fraudulently induce employees, customers, and others who use our or our service providers’ systems or have access to our or our customers’ data, to gain access to our and our customers’ data or our assets.

While we have not been materially impacted by cyber incidents, we continue to evolve our security controls to effectively prevent, detect and respond to the continually changing threats, and we may be required to expend significant additional resources in the future to enhance our security controls in response to new or more sophisticated threats, as well as new regulations related to cybersecurity.

We and our service providers face constant threats to our systems and data and from time-to-time experience cyberattacks and other security incidents.

While we have not been materially impacted by cyber incidents, we continue to evolve our security controls to improve our ability to prevent, detect, and respond to the continually changing threats, and we may be required to expend significant additional resources in the future to enhance our security controls in response to new or more sophisticated threats, as well as new regulations related to cybersecurity.

Additionally, while we, and our third-party service providers, commit resources to the design, implementation, maintenance, security, and monitoring of our networks and systems, there is no guarantee that our security controls, or those of our third-party service providers, will protect against all threats.

Despite the measures we and our third-party service providers implement to protect our systems and our or our customers’ data, we may not be able to anticipate, prevent, or detect cyber-attacks, particularly because the techniques used by attackers change frequently or are not recognized until launched, and because cyber-attacks can originate from a wide variety of sources, including third-parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments.

Such third parties may seek to gain unauthorized access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers or other users of our systems or those of our third-party service providers.

Such third parties may seek to gain unauthorized

36 SLM CORPORATION — 2021 Form 10-K

access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers, or other users of our systems or those of our third-party service providers.

Or, they may seek to disrupt or disable our or our service providers’ services through attacks such as denial-of-service and ransomware attacks.

2 unchanged sentences

We also routinely transmit and receive personal, confidential, and proprietary information, some through third parties, which may be vulnerable to interception, misuse, or mishandling.

loss of business by us and loss of confidence in us, customer dissatisfaction, significant litigation, regulatory exposures, and harm to our reputation and brand.

If one or more of such events occur, personal, confidential and other information processed by, stored in, or transmitted through our computer systems and networks, or those of third-party vendors, could be compromised or could cause interruptions or malfunctions in our or our customers’ or service providers’ operations that could result in significant losses, loss of business by us and loss of confidence in us, customer dissatisfaction, significant litigation, regulatory exposures, and harm to our reputation and brand.

In addition, we may be required to expend significant resources to modify our protective measures, to investigate the circumstances surrounding the event, and implement mitigation and remediation measures.

We also may be subject to fines, penalties, litigation (including securities fraud class action lawsuits) and regulatory investigation costs and settlements and financial losses that are either not insured against or not fully covered through any insurance maintained by us.

We also may be subject to fines, penalties, litigation (including securities fraud class action lawsuits) and regulatory investigation costs and settlements and other financial losses.

If one or more of such events occur, our business, financial condition, and/or results of operations could be significantly and adversely affected.

While we seek to mitigate cyber and related risks associated with outsourcing to third-party service providers, including through our vendor management processes, both operational and technological cyber risks remain, and certain risks are beyond our security and control systems.

Cyber-attacks targeted at our service providers may result in unauthorized interception, misuse, mishandling, access, acquisition, loss or destruction of our or our customers’ data, or other cyber incidents, that may affect the availability of our services, and impose costs and other liabilities that significantly and adversely affect us in the ways discussed above.

Cyber-attacks targeted at our service providers or in other areas of the supply chain may result in unauthorized interception, misuse, mishandling, access, acquisition, loss, or destruction of our or our customers’ data, or other cyber incidents, that may affect the availability of our services, and impose costs and other liabilities that significantly and adversely affect us in the ways discussed above.

While we maintain insurance coverage that may apply to various cybersecurity risks and liabilities, there is no guarantee that any or all costs or losses incurred would be partially or fully covered.

We depend significantly on third-parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third-parties, could disrupt our business or provide our competitors with an opportunity to enhance their position at our expense.

6 unchanged sentences

In 2019, we completed the migration of our computing infrastructure over to AWS.

We currently run the majority of computing to power our websites, mobile applications, and other technology products and services on AWS, and we store a significant amount of our users’ information and our confidential business information on AWS.

We currently run the majority of computing to power our websites,

2021 Form 10-K — SLM CORPORATION 37

mobile applications, and other technology products and services on AWS, and we store a significant amount of our users’ information and our confidential business information on AWS.

We have limited control over the AWS operations and facilities that we use to store our data.

4 unchanged sentences

We may face risks from our operations related to litigation or regulatory actions that could result in significant legal expenses and settlement or damage awards.

Defending against litigation may require significant attention and resources of management and, regardless of the outcome, such actions could result in significant expenses.

If we are a party to material litigation and if the defenses we assert are ultimately unsuccessful, or if we are unable to achieve a favorable settlement, we could be liable for large damages and that could have a material adverse effect on our business, results of operations and/or financial condition.

Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss.

Our risk management framework seeks to mitigate risk and appropriately balance risk and return.

We have established processes and procedures intended to identify, measure, monitor, control and report the types of risk to which we are subject.

We seek to monitor and control our risk exposure through a framework of policies, procedures, limits and reporting requirements.

We also rely on quantitative models to measure and manage risks and estimate certain financial values.

In addition, there may be existing or developing risks that we have not appropriately anticipated, identified or mitigated.

If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and our business, financial condition and/or results of operations could be materially adversely affected.

Our internal controls over financial reporting and disclosure controls may be ineffective.

Defending against litigation or regulatory actions may require significant attention and resources of management and, regardless of the outcome, such actions could result in significant expenses.

If we are a party to material litigation or regulatory actions and if the defenses we assert are ultimately unsuccessful, or if we are unable to achieve a favorable settlement, we could be liable for large damages, penalties, or other amounts and that could have a material adverse effect on our business, results of operations, and/or financial condition.

Our internal controls over financial reporting and disclosure controls may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations.

Our management is responsible for maintaining, regularly assessing and, as necessary, making changes to our internal controls over financial reporting and our disclosure controls.

1 unchanged sentence

Any failure or circumvention of our internal controls over financial reporting or our disclosure controls, failure to comply with rules and regulations related to such controls, or failure to make sound and appropriate application of the criteria established in the framework set forth in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission could have a material adverse effect on our financial condition and/or results of operations.

Our business operations and those of our third-party vendors may be adversely impacted by political events, terrorism, cyberattacks, public health issues, natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, business interruptions, and other unpredictable catastrophic events.

Our business operations and those of our third-party vendors are subject to interruption by, among other things, political events, terrorism, cyber-attacks, public health issues, natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, and other unpredictable catastrophic events, which could decrease demand for our products and services or make it difficult or impossible for us to deliver a satisfactory experience to our customers.

Such events could affect the stability of our deposit base, impair the ability of our borrowers to repay their outstanding loans, cause significant property damage, and result in loss of revenue and/or cause us to incur additional expenses.

The occurrence of any such event could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows.

Our ability to successfully make acquisitions is subject to significant risks, including the risk that governmental authorities may not provide any requisite approvals, the risk that integrating acquisitions may be more difficult, costly, or time consuming than expected, and the risk that the value of acquisitions may be less than anticipated.

We may from time to time seek to acquire other financial services companies or businesses that complement our business strategy.

These acquisitions may be subject to regulatory approval in some instances, and no assurance can be provided that we will be able to obtain that approval in a timely manner or at all or that approval may not be subject to burdensome conditions.

Even if we are able to obtain any required regulatory approval, the failure of other closing conditions to be satisfied or waived could delay the completion of an acquisition for a significant period of time or prevent it from occurring altogether.

Any failure or delay in closing an acquisition could adversely affect our reputation, business, and performance.

Acquisitions involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower-than-expected performance, higher-than-expected costs,

38 SLM CORPORATION — 2021 Form 10-K

difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with customers or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes.

An acquisition also could be dilutive to our existing stockholders if we were to issue common stock to fully or partially pay or fund the purchase price.

Moreover, we may not be successful in identifying appropriate acquisition candidates, integrating acquired businesses or companies, or realizing expected value from acquisitions.

Significant competition exists for valuable acquisition targets, and we may not be able to acquire other businesses or companies on attractive terms.

No assurance can be given that we will pursue future acquisitions, and our ability to grow and successfully compete may be impaired if we choose not to pursue or are unable to successfully make acquisitions.

RISKS RELATED TO SPIN-OFF

10 unchanged sentences

We also must comply with certain provisions that are protective of the Series B Preferred Stock in order to effectuate any repurchases under our common stock share repurchase program.

In the event of our

bankruptcy, dissolution or liquidation, the holders of our Series B Preferred Stock must be satisfied before any distributions can be made to our common shareholders.

We may be limited in our ability to pay dividends on, and repurchase, our common stock.

In the event of our bankruptcy, dissolution, or liquidation, the holders of our Series B Preferred Stock must be satisfied before any distributions can be made to our common shareholders.

We may be limited in our ability to receive dividends from the Bank, pay dividends on and repurchase our common stock, and make payments on our corporate debt.

The declaration and payment of future common stock dividends, as well as the amount thereof, are subject to determination by, and the discretion of, our Board of Directors.

3 unchanged sentences

The timing and volume of any repurchases will be subject to market conditions, and there can be no guarantee that we will repurchase up to the limit of any program or at all, which could adversely affect the market price of our common stock.

We are dependent on funds obtained from the Bank to fund dividend payments and any share repurchases.

We are dependent on funds obtained from the Bank to fund corporate debt payments, dividend payments, and any share repurchases.

Regulatory and other legal restrictions may limit our ability to transfer funds freely, either to or from our subsidiaries.

2 unchanged sentences

The FDIC has the authority to prohibit or limit the payment of dividends by the Bank and SLM Corporation.

2021 Form 10-K — SLM CORPORATION 39

Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees.

Our success depends, in large part, on our ability to retain key senior leaders and to attract and retain skilled employees.

We depend on our senior leaders and skilled employees to oversee initiatives across the enterprise and execute on our business plans in an efficient and effective manner.

Competition for such senior leaders and employees, and the cost associated with attracting and retaining them, is high.

Recent scrutiny of compensation in the financial services industry has introduced additional challenges in this area.

Our ability to attract and retain qualified employees also is affected by perceptions of our culture and management, our profile in the regions where we have offices, and the professional opportunities we offer.

We rely upon our senior leaders not only for business success, but also to lead with integrity.

To the extent our senior leaders behave in a manner that does not comport with our values, the consequences to our brand and reputation could be severe and could adversely affect our financial condition and results of operations.

If we are unable to attract, develop, and retain talented senior leadership and employees, or to implement appropriate succession plans for our senior leadership, our business could be negatively affected.

40 SLM CORPORATION — 2021 Form 10-K

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors