SLM Corp 10-K

Item 1A. Risk Factors SUMMARY OF RISK FACTORS Below is a summary of the principal factors that make an investment in our securities risky. This summary does not address all of the risks that we face. Additional discussion of the risks summarized in this risk factor summary, and other risks that we face, can be found below and should be carefully considered, together with other information in this Form 10-K and our other filings with the SEC, before making an investment decision regarding our stock. • The pandemic caused by COVID-19 and resulting adverse economic conditions have adversely impacted our business and results and, in the future, could have a more material adverse impact on our business, results of operations, financial condition, and/or cash flows. Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic. • Our product offerings are primarily concentrated in loan products for higher education and deposit products for online depositors. Such concentrations and the competitive environment for those products subject us to risks that could adversely affect our financial position. • Consumer access to alternative means of financing the costs of education and other factors may reduce demand for, or adversely affect our ability to retain, Private Education Loans, which could have a material adverse effect us. • Consolidation or refinancing of existing Private Education Loans could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows. • Defaults on our loans, particularly Private Education Loans, could adversely affect our business, financial position, results of operations, and/or cash flows. • Our allowance for credit losses may not be adequate to cover actual losses, which may adversely affect our capital, financial condition, and/or results of operations. • We are subject to the creditworthiness of third-parties other than borrowers and exposure to those third-parties could adversely affect our business, financial condition, results of operations, and/or cash flows. • Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time. An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could have a material adverse effect on us. • In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties. If those liabilities are significant, they could adversely affect our business and financial condition. • The levels of or changes in interest rates could adversely affect our results of operations, financial condition, regulatory capital, and/or liquidity. • The interest rate and maturity characteristics of our earning assets do not fully match the interest rate and maturity characteristics of our funding arrangements, which may negatively impact the level of our net interest income. We are also subject to repayment and prepayment risks, which can increase uncertainty and adversely affect our business. • Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings. • The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations. • The Bank is subject to various regulatory capital requirements, and failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our business, results of operations, and/or financial condition. 22 SLM CORPORATION — 2021 Form 10-K Table of Contents • Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position. • Changes in accounting standards, or incorrect estimates and assumptions by management in connection with the preparation of our consolidated financial statements, could adversely affect our capital levels, results of operation, and/or financial condition. • We operate in a highly regulated environment and the laws and regulations that govern our operations, or changes in these laws and regulations, or our failure to comply with them, may adversely affect us. • Failure to comply with consumer protection, privacy, data protection, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business. • Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss and, if the framework is ineffective, could have a material adverse effect on us and our business. • Proposals of federal and state governments, or of various political candidates, affecting the student loan industry in particular, such as proposals for new federal education spending designed to make higher education “free” or substantially so regardless of financial need, subject us to political risk and could have a material adverse impact on us. • We are subject to reputational risk, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. • Failure or significant interruption of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action or litigation, or damage our reputation. • We could lose market share if we are not able to keep pace with rapid changes in technology. • We depend on secure information technology and a breach of those systems or those of third-party vendors could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure. • We depend significantly on third-parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third-parties, could disrupt our business. • We primarily rely upon Amazon Web Services to deliver our offerings to users on our platform, and any disruption of or interference with our use of Amazon Web Services could adversely impact our business and operations. • We may face risks from our operations related to litigation or regulatory actions that could result in significant legal expenses and settlement or damage awards. • Our internal controls over financial reporting and disclosure controls may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations. • Our business operations and those of our third-party vendors may be adversely impacted by unpredictable catastrophic events. • Our ability to successfully make acquisitions is subject to significant risks. • Because of Navient’s indemnification obligations, we have significant exposures to risks related to its creditworthiness. • The holders of our preferred stock have rights that are senior to those of our common shareholders. • We may be limited in our ability to receive dividends from the Bank, pay dividends on and repurchase our common stock, and make payments on our corporate debt. • Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees. 2021 Form 10-K — SLM CORPORATION 23 Table of Contents RISK FACTORS We face many risks and uncertainties, any one or more of which could have a material adverse effect on our business, financial condition (including capital and liquidity), results of operations, cash flows, and/or stock price. We describe certain of these risk and uncertainties in this section, although we may be adversely affected by other risks or uncertainties that (i) are presently not known to us, (ii) we have failed to identify or appreciate, or (iii) we currently consider immaterial. These Risk Factors, together with other information in this Form 10-K and our other filings with the SEC, should be carefully considered before making an investment decision regarding our stock. PANDEMIC RISK The pandemic caused by a novel coronavirus, or COVID-19 (“COVID-19 pandemic”), and resulting adverse economic conditions have adversely impacted our business and results and, in the future, could have a more material adverse impact on our business, results of operations, financial condition, and/or cash flows. Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic. The COVID-19 pandemic has caused significant disruption to the U.S. and world economies, including the closing of many schools and businesses for extended periods of time, significantly higher unemployment and underemployment at certain times, significantly lower interest rates, volatility in equity market valuations, and extreme volatility in the U.S. and world financial markets. Depending upon the success of the distribution, public acceptance, and administration of COVID-19 vaccines or other therapies both in the U.S. and abroad, the impact of the COVID-19 pandemic on the U.S. economy may be significant during a large part of 2022 and it may materially adversely affect our operations, our regulatory capital and liquidity position, the credit performance of our Private Education Loans and other assets, the number of borrowers seeking payment relief, our results of operations and financial condition, and/or our cash flows. As described in Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Impact of COVID-19 on Sallie Mae — Customers and Credit Performance,” in this annual report on Form 10-K, during 2021 some of our borrowers experienced higher levels of financial hardship, which could lead to increased levels of delinquencies and defaults for those borrowers in the future. In addition, our employees may have to continue to work from home for portions of 2022. Unanticipated issues arising from handling personal, confidential, and other information from a less efficient work-from-home environment could adversely impact our operations and lead to greater risk for us. The extent to which the COVID-19 pandemic impacts our business, results of operations, financial condition, and/or cash flows will depend on future developments, which are highly uncertain and largely beyond our control, including the impact of the pandemic on colleges and universities, student enrollment, and the need for Private Education Loans, and any actions taken by governmental authorities. There can be no assurance that colleges and universities will return to normal pre-pandemic operations, which could adversely affect enrollments and, consequently, the need for Private Education Loans. In addition, the impact of the COVID-19 pandemic on our business, results of operations, financial condition, and/or cash flows will depend upon, among other factors: the scope and duration of the pandemic; the number of our employees, customers, and vendors adversely affected by the pandemic; the broader public health and economic dislocations resulting from the pandemic; the actions taken by governmental authorities to limit the public health, financial, and economic impacts of the COVID-19 pandemic; any legislative or regulatory changes that suspend or reduce payments or cancel or discharge obligations for education loan borrowers; any reputational damage related to the broader reception and perception of our response to the COVID-19 pandemic; and the impact of the COVID-19 pandemic on local, U.S., and world economies. In particular, any cessation by the federal government in 2022 or afterwards of its payment suspension program for borrowers of federal student loans could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows if borrowers have insufficient funds to make payments on both their federal student loans and our Private Education Loans. Moreover, we expect that effects of the COVID-19 pandemic will heighten many of the other known risks to our business described below in this Item 1A, and the impact of COVID-19 on our business could be material and adverse. Any additional COVID-19 outbreaks, spikes, and subsequent waves, new COVID-19 strains, and/or widespread ineffectiveness of the COVID-19 vaccines could have material and adverse impacts on our business. In addition, any future pandemic could subject our business to the same or greater risks than the COVID-19 pandemic. 24 SLM CORPORATION — 2021 Form 10-K Table of Contents CONCENTRATION RISK Our product offerings are primarily concentrated in loan products for higher education and deposit products for online depositors. Such concentrations and the competitive environment for those products subject us to risks that could adversely affect our financial position. At December 31, 2021, approximately 67 percent of our total assets, and 79 percent of our total assets excluding cash and cash equivalents, were comprised of Private Education Loans. This concentration poses the risk that any disruption, dislocation, or other negative event or trend in the Private Education Loan market or the overall economic environment could disproportionately and adversely affect our business, financial condition, and results of operations. We compete in the Private Education Loan market with banks and other consumer lending institutions, many with strong consumer brand name recognition and greater financial resources. Many of those lenders also have a greater level of diversification in their mix of assets, which can enable them to be more competitive in uncertain or challenging economic times. Moreover, our competition will increase as various lending institutions and other competitors, including Navient, through its Earnest subsidiary, enter or re-enter the Private Education Loan market. We also compete with FinTech companies (as defined below), many of whom have lower return hurdles than more traditional consumer lending institutions. We compete based on our brand products, origination capability, and customer service. To the extent our competitors compete more aggressively or effectively, we could lose market share to them or subject our existing loans to consolidation or refinancing risk. In addition to competition with banks and other consumer lending institutions, the federal government, through the Federal Direct Student Loan Program (the “DSLP”), poses significant competition to our Private Education Loan products. The availability and terms of loans the government originates or guarantees affect the demand for Private Education Loans because students and their families often rely on Private Education Loans to bridge the gap between available funds, including family savings, scholarships, grants, and federal and state loans, and the costs of post-secondary education. The federal government currently places both annual and aggregate limits on the amount of federal loans any student can receive and determines the criteria for student eligibility. Parents and graduate students may obtain additional federal education loans through other programs. These federal education lending programs are generally adjusted in connection with funding authorizations from the U.S. Congress for programs under the Higher Education Act of 1965 (the “HEA”). The HEA’s reauthorization is currently pending in the U.S. Congress. Reauthorization, as well as measures to provide relief for COVID-19, could provide a legislative vehicle for changes to student loan programs. Possible components that could impact the Private Education Loan market are changes to federal education loan limits, private loan refinancing programs, or Private Education Loan forgiveness. Other components of any legislation also could have a negative impact on our business and financial condition. See “— POLITICAL/REPUTATIONAL RISK. ” Competition also plays a significant role in our online deposit gathering activities. The market for online deposits is highly competitive, based primarily on a combination of reputation and rate. Increased competition for deposits could cause our cost of funds to increase, which could negatively impact our loan pricing and net interest margin. See also “- LIQUIDITY RISK.” Consumer access to alternative means of financing the costs of education and other factors may reduce demand for, or adversely affect our ability to retain, Private Education Loans, which could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows. The demand for Private Education Loans could weaken if families and student borrowers use other vehicles to bridge the gap between available funds and costs of post-secondary education. These vehicles include, among others: • Home equity loans or other borrowings available to families to finance their education costs; • Pre-paid tuition plans, which allow students to pay tuition at today’s rates to cover tuition costs in the future; • Section 529 plans, which include both pre-paid tuition plans and college savings plans that allow a family to save funds on a tax-advantaged basis; • Education IRAs, now known as Coverdell Education Savings Accounts, under which a holder can make annual contributions for education savings; • Government education loan programs such as the DSLP; and • Direct loans from colleges and universities, as well as income sharing agreements offered by schools and facilitated by private companies. 2021 Form 10-K — SLM CORPORATION 25 Table of Contents In addition, our ability to grow Private Education Loan originations and retain assets at our planned levels could be negatively affected if: • demographic trends in the United States result in a decrease in college-age individuals; • demand for higher education decreases; • the cost of attendance of higher education decreases; • consumers increase their targeted savings for higher education; • prepayment rates on our Private Education Loans increase or accelerate due to greater market liquidity, availability of alternative means of financing, improved household incomes, increasing consumer confidence, and/or various other factors; • there is broader public resistance to increasing higher education costs; or • proposals for new federal and state education spending described below in “Political/Reputational Risk” gain broader appeal or momentum. Consolidation or refinancing of existing Private Education Loans could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows. We believe the design of our Private Education Loan products, with emphasis on rigorous underwriting, credit-worthy cosigners and variable or fixed interest rates, creates sustainable, competitive loan products. However, increasing amounts of private education consolidation loans at interest rates below those of our existing portfolio - whether from private sources (including financial technology (“FinTech”) companies) or otherwise - can contribute to an increase in the prepayment rates of our existing Private Education Loans and, if prolonged and continuous, could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows. Since 2010, there have been a number of bills introduced in the United States Congress to promote federal financing for consolidation or refinancing of existing student loans, as well as an increase in the number of lenders offering consolidation or refinancing products. Also, on July 31, 2018, the Office of the Comptroller of the Currency (the “OCC”) issued a policy statement announcing that it would consider applications from FinTech companies to become special purpose national banks. The OCC indicated the special purpose national bank charter would be available to qualifying companies engaged in a limited range of banking activities, including paying checks or lending money, but that do not take deposits. Although litigation ensued, and may continue, regarding the OCC’s ability to grant special purpose bank charters, receipt by any FinTech companies of a special purpose bank charter could lead to an increase in the consolidation or refinancing of our Private Education Loans. CREDIT RISK Defaults on our loans, particularly Private Education Loans, could adversely affect our business, financial position, results of operations, and/or cash flows. We bear the full credit exposure on our Private Education Loans and Credit Card loans, which are unsecured loans. If they were to default at rates much higher than anticipated or at speeds faster than anticipated, our business, financial position, results of operations, and/or cash flows could be adversely affected. Delinquencies are an important indicator of the potential future credit performance of our loan portfolios. Many factors can have an impact on borrower delinquencies, including, without limitation, economic conditions, changes in interest rates, personal circumstances and hardships, risk characteristics such as school type, loan status, loan seasoning, underwriting criteria, presence of a cosigner, changes made in credit administration practices from time to time, changes in loan underwriting criteria made from time to time, regulatory and operational changes, and unforeseen trends. Rising unemployment rates and the failure of our in-school borrowers to graduate are two of the most significant macroeconomic factors that could increase loan delinquencies, defaults, and loan modifications, or otherwise negatively affect performance of our existing education loan portfolios. Likewise, high unemployment may impede Private Education Loan originations growth, as loan applicants and cosigners may experience trouble repaying credit obligations or may not meet our credit standards. Additionally, if interest rates rise causing payments on variable-rate loans to increase, borrowers and cosigners could experience trouble repaying loans we have made to them. See Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Financial Condition — Allowance for Credit Losses — Use of Forbearance and Rate Modifications as a Private Education Loan Collection Tool” for a discussion of how items such as changes in credit administration practices can impact the timing and level of delinquencies and defaults on our loans. As part of our underwriting process, we rely heavily upon information supplied by applicants and third parties. If any of this information is intentionally or negligently misrepresented and is not detected by us before completing the transaction, we may experience increased credit risk. Higher credit-related losses and weaker credit quality negatively affect our 26 SLM CORPORATION — 2021 Form 10-K Table of Contents business, financial condition, and results of operations and limit funding options, which could also adversely impact our liquidity position. Our Private Education Loan delinquencies (loans greater than 30 days past due), as a percentage of Private Education Loans in repayment, were 3.3 percent at December 31, 2021. Our allowance for credit losses may not be adequate to cover actual losses, and we may be required to materially increase our allowance, which may adversely affect our capital, financial condition, and/or results of operations. In June 2016, the Financial Accounting Standards Board (“FASB”) issued Accounting Standards Update (“ASU”) No. 2016-13, “Financial Instruments-Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments,” which became effective for us on January 1, 2020. Under the guidance, for all loans carried at amortized cost, upon loan origination we are required to measure our allowance for credit losses based on our estimate of all current expected credit losses (“CECL”) over the remaining contractual term of the assets. The CECL standard resulted in a significant change in how we recognize credit losses and will have a material impact on our financial condition, results of operations, and capital levels. The evaluation of our allowance for credit losses is inherently subjective, as it requires material estimates that may be subject to significant changes. The measurement of expected credit losses is based on historical information, current conditions, and reasonable and supportable forecasts to estimate the expected loss over the life of the loan. This differs significantly from the “incurred loss” model, which was in effect during 2019 and delayed recognition until it was probable a loss had been incurred. Our models take into account historical loss experience in various economic conditions to estimate expected future losses based upon future economic forecasts over a period of time (“reasonable and supportable period”), at which point we revert expected losses to our historical rates. Future defaults can be higher than anticipated due to a variety of factors outside of our control, and our models may not accurately estimate future loan loss performance. The models used in calculating our CECL estimates include forecasts of future economic conditions, the weighting of economic forecasts, prepayment speeds, and recovery rates. If these forecasts prove to be inaccurate, or our models were not designed properly, our allowance for credit losses may not be sufficient to cover future losses, which could negatively impact our financial condition, results of operations, and capital levels. In addition, the amount of losses recorded under CECL is very sensitive to the inputs described above. As such, changes to these inputs could significantly change the amount of allowance necessary, which could have a negative impact on our financial results and capital levels. Additionally, regulatory agencies may periodically review our allowance for credit losses, including our methodology and models used in calculating the allowance, and could insist on an increase in the allowance or recognition of additional charge-offs based on judgments different than those used by our management. If these differences in judgment are significant, our allowance could increase significantly and result in sizable decreases in our net income and capital. See Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Policies and Estimates — Allowance for Credit Losses” for further details regarding our allowance for credit losses . We are subject to the creditworthiness of third-parties other than borrowers and exposure to those third-parties could adversely affect our business, financial condition, results of operations, and/or cash flows. We are also subject to the creditworthiness of third-parties, including various lending, investment, and derivative counterparties. Our overall counterparty exposure is more fully discussed in Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources — Counterparty Exposure.” If our counterparties are unable to perform their obligations, such inability could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows. 2021 Form 10-K — SLM CORPORATION 27 Table of Contents LIQUIDITY RISK Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time. An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could lead to regulatory scrutiny and could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows. We must effectively manage the liquidity risk inherent in our business. We require liquidity to meet cash requirements for such things as day-to-day operating expenses, funding of our Private Education Loan and Credit Card originations, deposit withdrawals and maturities, payment of any declared dividends on our preferred stock and common stock, and payment for any shares of common stock acquired under any common stock repurchase program or otherwise. Our primary sources of liquidity and funding are customer deposits, payments received on Private Education Loans and FFELP Loans that we hold, and proceeds from loan sales and securitization transactions. We may maintain too much liquidity, which can be costly, or we may be too illiquid, which could result in financial distress during times of economic stress or capital market disruptions. We fund Private Education Loan originations through asset-backed securitizations and deposits raised by the Bank, including term and liquid brokered and retail deposits, as well as Educational 529 and Health Savings Account deposits. Assets funded through deposits result in refinancing risk because the average term of the deposits is shorter than the expected term of the Private Education Loan assets we originate. The significant competition for deposits from other banking organizations that are also seeking stable deposits to support their funding needs may affect deposit renewal rates, costs, or availability. In addition, our ability to maintain existing balances or obtain additional deposits may be affected by factors, including those beyond our control, such as a rising stock market, more attractive returns on alternative investments, perceptions about our existing and future financial strength, quality of deposit servicing or online banking generally, changes in monetary or fiscal policies that influence deposit or other rates, and general economic conditions, including high unemployment and decreased savings rates. Also, our ability to maintain our current level of deposits or grow our deposit base could be affected by regulatory restrictions, including the possible imposition by our regulators of prior approval requirements or restrictions on our offered rates, brokered deposit growth, or other areas. Our success also depends on our ability to structure Private Education Loan securitizations or execute other secured funding transactions. Several factors may have a material adverse effect on both our ability to obtain such funding and the time it takes us to structure and execute these transactions, including the following: • Persistent and prolonged disruption or volatility in the capital markets or in the education loan ABS sector specifically; • Degradation of the credit quality or performance of the Private Education Loans we sell or finance through securitization trusts, or adverse rating agency assumptions, rating actions, or conclusions with respect to those trusts or the education loan-backed securitization trusts sponsored by other issuers; • A material breach of our obligations to purchasers of our Private Education Loans, including securitization trusts; • The timing, pricing, and size of education loan asset-backed securitizations other parties issue, or the adverse performance of, or other problems with, such securitizations; • Challenges to the enforceability of Private Education Loans based on violations of, or changes to, federal or state consumer protection or licensing laws and related regulations, or imposition of penalties or liabilities on assignees of Private Education Loans for violation of such laws and regulations; and • Our inability to structure and gain market acceptance for new product features or services to meet new demands of ABS investors, rating agencies, or credit facility providers. If we require funding beyond that which we may be able to obtain through deposits and proceeds from ABS transactions at attractive prices, we may need to raise additional liquidity through other forms of secured and unsecured debt financing, which, in turn, could increase our funding costs and reduce our net interest margin. Future downgrades to our credit ratings also could result in higher funding costs and reduce our net interest margin. Our ability to sell loans at attractive prices, as well as the timing and volume of any sales, will be subject to market conditions, and there can be no guarantee that we will be able to effectuate planned loan sales at the prices, times, or volumes we desire, or at all. If we are unable to effectuate loan sales at the prices, times, and volumes we 28 SLM CORPORATION — 2021 Form 10-K Table of Contents desire, we may not be able to fund share repurchase programs that are authorized from time to time or achieve other business goals. We currently maintain sufficient risk-based capital through adequate retention and reinvestment of earnings from operations. If our business objectives require capital above and beyond what we generate through retained earnings, we may need to raise capital for our business by issuing additional equity to investors. Several factors, some of which may be beyond our control, may have a material adverse effect on our ability to raise funding at any given time through any of the channels described above in this Risk Factor in the amounts, at the rates, or within the timeframes we desire or need. If this occurs, our business, results of operations, financial position, and/or cash flows could be materially and adversely affected. In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties. If those liabilities are significant, they could adversely affect our business, financial condition, results of operations, and/or cash flows. Under applicable state and federal securities laws, if investors incur losses as a result of purchasing ABS issued in connection with our securitization transactions, we could be deemed responsible and could be liable to investors for damages. We could also be liable to investors or other parties for certain updated performance information that we may provide subsequent to the original issuances. If we fail to cause the securitization trusts or other transaction parties to disclose adequately all material information regarding an investment in any securities, if we or the trusts make statements that are misleading in any material respect in information delivered to investors in any securities, if we breach any representations or warranties made in connection with securitization of the loans, or if we breach any other duties as the administrator or servicer of the securitization trusts, it is possible we could be sued and ultimately held liable to an investor or other transaction party. In transactions involving the sale of loans in non-securitized form where we remain the servicer of the loans, it is possible we could be sued and ultimately held liable to the purchaser of the loans or another transaction party for breaches of representations or warranties or breaches of servicing covenants. INTEREST RATE RISK The levels of or changes in interest rates could adversely affect our results of operations, financial condition, regulatory capital, and/or liquidity. We are highly dependent on net interest income, which is the difference between interest income on earning assets (such as loans and investments) and interest expense on deposits and borrowings. Net interest income is significantly affected by market rates of interest, which in turn are influenced by monetary and fiscal policies of governmental agencies, general economic conditions, the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future. We may be adversely affected by policies or events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), compressing interest rates on our earnings assets closer to interest rates on our deposits and borrowing, increasing the volatility of market rates of interest, or changing the spreads among different interest rate indices. Changes in interest rate levels also can lead to other adverse impacts, such as reducing the demand for or increasing the prepayment speeds of our Private Education Loans, increasing the delinquencies or defaults of our borrowers or other counterparties, reducing the value of our assets, or increasing our liabilities. The level of and changes in market rates of interest and, as a result, these risks and uncertainties, are beyond our control. The interest rate and maturity characteristics of our earning assets do not fully match the interest rate and maturity characteristics of our funding arrangements, which may negatively impact the level of our net interest income. We are also subject to repayment and prepayment risks, which can increase uncertainty as we manage our interest rate risk and can adversely affect our business, financial condition, results of operations, and/or cash flows. Net interest income is the primary source of cash flow generated by our loan portfolios. Interest earned on our Private Education Loans and FFELP Loans is either fixed-rate or indexed to a short-term variable rate, and these loans are originated with relatively long repayment periods. ABS funding closely mirrors the expected maturities of our education loans and provides a combination of fixed and variable-rate funding. Deposits are issued with both 2021 Form 10-K — SLM CORPORATION 29 Table of Contents fixed and variable rates, and the average term is typically shorter than the expected term of our combined loan portfolios. The different interest rate and maturity characteristics of our loan portfolio and the liabilities funding that portfolio result in fluctuations in our net interest income. In certain interest rate environments, this mismatch may reduce our net interest margin (the interest yield earned on our portfolio less the rate paid on our interest-bearing liabilities) and net interest income. While we actively monitor and manage mismatches in the interest rate and maturity characteristics of our assets and liabilities, using derivative transactions where necessary to avoid excessive levels of repricing and refunding risk, it is not possible to hedge all of our exposure to such risks. While the assets, liabilities, and related hedging derivative contract re-pricing indices are typically highly correlated, there can be no assurance that the historically high correlation will not be disrupted by capital market dislocations or other factors outside our control. In these circumstances, our earnings could be materially adversely affected. We are also subject to risks associated with changes in repayment and prepayment rates on Private Education Loans, which can increase uncertainty as we manage our interest rate risk. Consolidations and refinancings contribute to increased prepayment rates. In addition, increases in employment levels, wages, family income, alternative sources of financing, and government support for student loan borrowers during times of crisis, such as during the COVID-19 pandemic, may also contribute to higher-than-expected prepayment rates, which can adversely affect our interest rate and repricing risk and our financial condition and results of operations. Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings. We maintain an overall interest rate strategy that uses derivatives to reduce the economic effect of interest rate changes. Developing an effective hedging strategy for dealing with movements in interest rates is complex, and no strategy can completely avoid the risks associated with these fluctuations. For example, our education loan portfolios remain subject to prepayment risk that could cause them to be under- or over-hedged, which could result in material losses. In addition, some of our interest rate risk management activities expose us to mark-to-market losses if interest rates move in a materially different way than was expected when we entered into the related derivative contracts. Our use of derivatives also exposes us to market risk and credit risk. Market risk is the chance of financial loss resulting from changes in interest rates and market liquidity. Some of the interest rate swaps we use to economically hedge interest rate risk between our assets and liabilities do not qualify for hedge accounting treatment. Therefore, the change in fair value, called the “mark-to-market,” of the swaps that do not qualify as accounting hedges is included in our statement of income. A decline in the fair value of those derivatives could have a material adverse effect on our reported earnings. Also, see “— We are subject to the creditworthiness of third-parties other than borrowers and exposure to those third-parties could adversely affect our business, financial condition, results of operations, and/or cash flows” . The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations. The interest rates on our variable-rate Private Education Loans issued before April 1, 2021 and certain other assets are indexed to LIBOR, the London interbank offered rate. Certain of our interest rate swaps, notes issued under our term ABS and our education loan-backed multi-lender secured borrowing facility (the “Secured Borrowing Facility”), brokered and non-brokered deposits, and other obligations also are indexed to LIBOR. In each case, the terms of the relevant agreements define LIBOR and provide differing methods for how it may be replaced or computed if LIBOR is no longer available as defined. LIBOR has been used worldwide as a reference for setting interest rates on loans, derivatives, and other assets and obligations. Following announcements by the United Kingdom’s Financial Conduct Authority (the “UKFCA”), which regulates LIBOR, and ICE Benchmark Administration Limited, the administrator of LIBOR, publication of 1-week and 2-month USD LIBOR and all tenors for other currencies ceased after December 31, 2021. While publication of the remaining USD settings is expected to cease after June 30, 2023, U.S. banking and other global financial services regulators have directed regulated institutions to cease entering into new LIBOR-based contracts as soon as practicable and in any event by the end of 2021. The Federal Reserve Bank of New York currently publishes the Secured Overnight Financing Rate (“SOFR”) based on overnight U.S. Treasury repurchase agreement transactions, which has been recommended as the alternative to USD LIBOR by the Alternative Reference Rates Committee convened by the Federal Reserve Board and the Federal Reserve Bank of New York. 30 SLM CORPORATION — 2021 Form 10-K Table of Contents The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and will be affected by, among other things, the pace of the transition to such rates, the specific terms and parameters for and acceptance of such rates (including, without limitation, by investors, financial markets, and regulators), market conventions for the use of such rates in connection with a particular product, and prices of and the liquidity of trading markets for products based on such rates. Certain of our existing assets and obligations do not include provisions clearly specifying a method for transitioning from LIBOR to an alternative benchmark rate. Given this situation, it is unclear what consents or approvals, if any, will be required to replace LIBOR under our various agreements. As a result of these potential changes and related uncertainties, the interest rates on and value of our assets and obligations indexed to LIBOR, and the revenue and expenses associated with those assets and obligations, could be affected in disparate ways at disparate times, creating basis risk and potential adverse effects on our business and results of operations. Changes to the reference rate used could result in dissatisfied customers, lenders, investors, or counterparties, which could result in reputational damage, litigation, or regulatory scrutiny. The Company has actively monitored market developments with respect to LIBOR replacement since 2017 and during 2020 launched a formal cross-functional replacement project with the goal of ensuring a smooth transition to a replacement index with minimal negative impact on our customers, investors, and the Company’s business, financial condition, and results of operations. The Chief Financial Officer and the project team monitor developments, assesses impacts, proposes plans, and, with the approval of an executive committee, implement changes. The project team reports status regularly to our Board of Directors. In 2020, we began accepting certain deposits based on SOFR. In the second quarter of 2021, we began issuing variable-rate Private Education Loans that are indexed to SOFR. In 2022, subject to market conditions and investor demand, we expect to begin issuing ABS that are indexed to SOFR and to renew the Secured Borrowing Facility with an index based on SOFR. We plan to significantly reduce the number of contracts that reference LIBOR, either through modification or replacement, by June 2023. There can be no guarantee our reference rate replacement plan will occur as expected, however, and failure to implement the plan effectively or changes in how LIBOR transition occurs could have a material adverse effect on our business, results of operations, financial position, and/or cash flows. See Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — LIBOR Transition” for further details. CAPITAL RISK The Bank is subject to various regulatory capital requirements administered by the FDIC and the UDFI. Failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our business, results of operations, and/or financial condition. Under U.S. Basel III and the regulatory framework for prompt corrective action, the Bank must meet specific capital standards that involve quantitative measures of its assets, liabilities, and certain off-balance sheet items as calculated under regulatory accounting practices. The Bank’s capital amounts and its classification under the prompt corrective action framework are also subject to qualitative judgments by the regulators about components of capital, risk weightings, and other factors. U.S. Basel III is subject to further revisions and such revisions could affect the Bank’s capital requirements and adversely affect its business, results of operations, and financial condition. For example, in 2017 the Basel Committee on Banking Supervision published revisions to the international capital standards that it describes as the finalization of the Basel III post-crisis regulatory reforms. Among other things, these revisions would revise the standardized approach for credit risk and provide a new standardized approach for operational risk capital, with an initial implementation date of January 1, 2023 and a phase-in period for certain revisions extending to January 1, 2028. The impact of these revisions on the Bank will depend on how and to what extent they are implemented in the United States. The federal banking agencies have not yet proposed a rule to implement these revisions in the United States. If the Bank fails to satisfy regulatory risk-based or leverage capital requirements, it may be subject to serious regulatory consequences, including restrictions on our ability to make dividend payments or share repurchases, that could prevent us from successfully executing our business plan and may have a material adverse effect on our business, results of operations, financial position, and/or cash flows. See Item 1. “Business — Supervision and Regulation — Regulation of Sallie Mae Bank — Regulatory Capital Requirements.” 2021 Form 10-K — SLM CORPORATION 31 Table of Contents Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position. Pursuant to regulatory guidance, the Bank conducts annual capital stress tests, modeling systemic and company-specific stress scenarios. In 2021, the Bank conducted its annual capital stress tests and the results of these tests were presented to and reviewed by the Bank’s senior management, the Bank’s Board of Directors, and the Board’s Financial Risk Committee. In addition, the Bank made the results of the stress tests (its current business forecast) available to its prudential regulators - the FDIC and the UDFI. Generally, the stress test results include certain measures that evaluate the Bank’s ability to absorb losses in severely adverse economic and financial conditions. On the basis of a stress analysis, senior management may elect to adjust its business plans or capital targets to reduce risks identified by the analysis. Our regulators may also require the Bank to raise additional capital or take other actions, or may impose restrictions on our business, based on the results of the stress tests. We may not be able to raise additional capital if required to do so or may not be able to do so on terms that are advantageous to us. Any such capital raises, if required, may also be dilutive to our existing stockholders. We also conduct quarterly liquidity stress tests to evaluate the adequacy of our liquidity sources under several stress scenarios, including a severely adverse macroeconomic scenario. The results of these scenarios may lead management to determine, or regulators to demand, that higher levels of liquidity be maintained at significant incremental expense to the Bank. Changes in accounting standards, or incorrect estimates and assumptions by management in connection with the preparation of our consolidated financial statements, could adversely affect our capital levels, results of operation, and/or financial condition. We are subject to the requirements of entities that set and interpret the accounting standards governing the preparation of our financial statements and other financial reports. These entities, which include the FASB, the SEC, and banking regulators, may add new requirements or change their interpretations of how those standards should be applied. Changes in our accounting policies or in accounting standards could materially affect how we report our financial condition and/or results of operations. As a result of changes to financial accounting or reporting standards, whether promulgated or required by the FASB or other regulators, we could be required to change certain of the assumptions or estimates we have previously used in preparing our financial statements, which could negatively impact how we record and report our financial condition, results of operations, and capital levels. The preparation of our consolidated financial statements requires us to make critical accounting estimates and assumptions that affect the reported amounts of assets, liabilities, income, and expenses during the reporting periods. Incorrect estimates and assumptions by us in connection with the preparation of our consolidated financial statements could adversely affect the reported amounts of assets, liabilities, income, and expenses. If we make incorrect assumptions or estimates, we may under- or overstate reported financial results, which could materially and adversely affect our business, financial condition, results of operations, and/or capital levels. For additional information on the key areas for which assumptions and estimates are used in preparing our financial statements, see Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Policies and Estimates” and Notes to Consolidated Financial Statements, Note 2, “Significant Accounting Policies.” REGULATORY RISK We operate in a highly regulated environment and the laws and regulations that govern our operations, or changes in these laws and regulations, or our failure to comply with them, may adversely affect us. We are subject to extensive regulation and supervision that govern almost all aspects of our operations. Intended to protect clients, depositors, the DIF, and the overall financial system, these laws, regulations, and supervisory actions may, among other matters: • prescribe minimum capital requirements; • limit the rates of growth of our business; • impose limitations on the business activities in which we can engage; • limit the dividends or distributions the Bank can pay to us; • limit share repurchases; 32 SLM CORPORATION — 2021 Form 10-K Table of Contents • restrict the payment of discretionary bonuses to executive officers; • restrict the ability of institutions to guarantee our debt; • limit proprietary trading and investments in certain private funds; • impose certain specific accounting requirements on us that may be more restrictive; • result in changes from time to time in our practices, policies, procedures, and personnel in various areas of our business; and • result in greater or earlier charges to earnings or reductions in our capital. The FDIC has the authority to limit the Bank’s annual total balance sheet growth, but no such limitations were imposed in recent years. There can be no assurance that limitations will not be imposed in the future, however. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in supervision, often impose additional compliance costs. The scope of the laws and regulations and the intensity of the supervision to which we are subject have increased in recent years, initially in response to the financial crisis, and more recently in light of other factors such as technological and market changes. Regulatory enforcement and fines have also increased across the banking and financial services sector. Further, the scope of regulation and the intensity of supervision will likely become higher under the current presidential administration, including increased scrutiny, supervisory discouragement, or even possible denials, of bank mergers and acquisitions by federal bank regulators. We expect that we, like the rest of the banking sector, will remain subject to increased regulation and supervision of our industry by bank regulatory agencies and that there may be additional and changing requirements and conditions imposed on us, any of which could increase our costs, require increased management attention, and adversely impact our results of operations. In connection with their continuous supervision and examinations of us, the FDIC, the UDFI, the CFPB, or other regulatory agencies may require changes in our business or operations. Such a requirement may be judicially enforceable or impractical for us to contest, and we could become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives. Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business, our flexibility in conducting operations, and our ability to pay dividends or utilize capital. Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence. We could be required as well to dispose of specified assets and liabilities within a prescribed period of time. As a result, any enforcement or other supervisory action could have an adverse effect on our business, financial condition, results of operations, and prospects. In addition, changes in the regulatory and supervisory environments could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, restricting our ability to make acquisitions or pursue other profitable opportunities, and negatively impacting our financial condition and results of operations. Changes in the prevailing interpretations of federal or state laws and related regulations could also invalidate or call into question the legality of certain of our services and business practices. Our failure to comply with the laws, regulations, and supervisory actions to which we are subject, even if the failure is inadvertent or reflects a difference in interpretation, could subject us to fines, other penalties, and restrictions on our business activities, any of which could adversely affect our business, financial condition, cash flows, results of operations, capital base, and/or the price of our securities. Failure to comply with consumer protection, privacy, data protection, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business. We are subject to a broad range of federal and state consumer protection laws applicable to our lending and retail banking activities, including laws governing fair lending, unfair, deceptive and abusive acts and practices, service member protections, interest rates and loan fees, disclosures of loan terms, marketing, servicing, and collections. 2021 Form 10-K — SLM CORPORATION 33 Table of Contents The CFPB is the Bank’s primary consumer compliance supervisor, with exclusive authority to conduct examinations for the purposes of assessing compliance with the requirements of federal consumer financial laws and with primary consumer compliance enforcement authority. CFPB jurisdiction could result in additional regulation and supervision, which could increase our costs and limit our ability to pursue business opportunities. The CFPB/ DOE MOU could lead to additional complaints received by the CFPB regarding us, which could lead to additional scrutiny of us and increase our costs. Consent orders, decrees, or settlements entered into with governmental agencies may also increase our compliance costs or restrict certain of our activities. The CFPB and the FDIC issued guidance to supervised banks with respect to increased responsibilities to supervise the activities of service providers to ensure compliance with federal consumer protection laws. The issuance of regulatory guidance and the enforcement of the enhanced vendor management standards via examination and investigation of us or any third-party with whom we do business may increase our costs, require increased management attention, and adversely impact our operations. In the event we should fail to meet the heightened standards for management of service providers, we could be subject to supervisory orders to cease and desist, civil monetary penalties, or other actions due to claimed noncompliance, which could have an adverse effect on our business, financial condition, operating results, and/or cash flows. We are also subject to a dynamically changing landscape of privacy, data protection, and cybersecurity laws, regulations, and requirements. For example, the CCPA took effect on January 1, 2020, and is broad, sweeping legislation that gives California consumers certain rights similar to those provided by the European General Data Protection Regulation. Among other things, the CCPA provides for enhanced regulatory penalties and potential statutory damages in relation to certain types of data breaches. See Item 1. “Business — Supervision and Regulation —Regulation of Sallie Mae Bank — Privacy Laws” for additional information. In addition, in November 2021, the FDIC, OCC, and FRB adopted a new regulation that takes effect in early 2022 and imposes new requirements on banking organizations to report certain covered cybersecurity events. Violations of, or changes in, federal or state consumer protection, privacy, data protection, or cybersecurity laws or related regulations, or in the prevailing interpretations thereof, may expose us to litigation, administrative fines, penalties and restitution, result in greater compliance costs, constrain the marketing and origination of Private Education Loans or other products, adversely affect the collection of balances due on the loan assets held by us or by securitization trusts, or otherwise adversely affect our business. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in compliance and supervision activities, often impose additional compliance costs. Accordingly, we could incur substantial additional expense complying with these requirements and may be required to create new processes and information systems. Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss and, if the framework is ineffective, could have a material adverse effect on us and our business. Our risk management framework seeks to mitigate risk and appropriately balance risk and return. We continue to evolve our risk management framework to consider changes in business and regulatory expectations and to refine established processes and procedures intended to identify, measure, monitor, test, control, report, escalate, and mitigate the types of risk to which we are subject. We seek to monitor and control our risk exposure through a framework of policies, procedures, limits, and reporting requirements. We also rely on quantitative models to measure and manage risks and estimate certain financial values. Models may be used in such processes as product pricing, extending credit, measuring interest rate and other market risk, estimating losses, calculating and assessing capital levels, estimating the value of financial instruments and balance sheet items, and various other processes. If the models that we use to measure and/or mitigate these risks and values are poorly designed, based upon incorrect or incomplete information, poorly implemented, or are otherwise inadequate, or our governance surrounding the management of data we use in our models and other aspects of our business is poorly designed or implemented, or otherwise is inadequate, our business decisions may be adversely affected, we may provide inaccurate information to the public or regulators, and/or we may incur increased losses. In addition, there may be existing or developing risks that we have not appropriately anticipated, identified, or mitigated. If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and our business, financial condition, and/or results of operations could be materially adversely affected. An ineffective risk-management framework or function also could give rise to enforcement and other supervisory actions, damage our reputation, and result in litigation. 34 SLM CORPORATION — 2021 Form 10-K Table of Contents POLITICAL/REPUTATIONAL RISK Proposals of federal and state governments, or of various political candidates, affecting the student loan industry in particular, such as proposals for new federal education spending designed to make higher education “free” or substantially so regardless of financial need, or to create new federally funded programs to refinance private student loans, subject us to political risk and could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. We operate in an environment of heightened political and regulatory scrutiny of education loan lending, servicing, and originations. The rising cost of higher education, questions regarding the quality of education provided, particularly among for-profit institutions, and the increasing amount of student loan debt outstanding in the United States have prompted this heightened and ongoing scrutiny. This environment could lead to further proposals by political candidates and state and federal legislators and regulators, and to the enactment of laws and regulations, applicable to, or limiting, our business. For instance, over the last several years, numerous proposals for new federal spending have been discussed by political candidates and/or introduced by legislators to make higher education “free” or substantially so. Some proposals have included the potential forgiveness of substantial amounts of existing outstanding student loan indebtedness. Also, various states have proposed and/or enacted legislation providing for “free” or “substantially free” higher education to residents of the state having incomes below a certain level and who attend publicly-funded universities in the state. Moreover, since 2010, a number of bills have been introduced in the United States Congress to promote federal financing for consolidation or refinancing of existing student loans. The regulatory environment at the state level has shifted such that many states recently have enacted new legislation specifically restricting the conduct and practices of student loan servicers. The enactment of any of the proposed legislation or policies described above, even if they do not apply specifically to Private Education Loans, could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. In addition, the continued ongoing publicity regarding these various proposals, even if they are not enacted, could negatively impact the market price of our common stock. We are subject to reputational risk, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. Our brand is very important to us and our business. Our reputation as an originator, servicer, and securitizer of high-quality Private Education Loans and as a depository for online deposits is very dependent upon how our customers, our regulators, legislators, the education community, our employees, and the broader market perceive our business practices, financial heath, and integrity, and the business practices, financial health, and integrity of the overall student loan market, other loan markets, or the market for online deposits, as applicable. Negative publicity, including as a result of our culture, actual or alleged conduct by us, our employees, or our vendors, or public opinion of the student loan industry or other relevant industries generally, or as a result of achieving lower environmental, social, and governance, or “sustainability,” scores or ratings than those desired by certain investors, could damage our reputation and business and adversely impact the price of our common stock. Additionally, as described above, proposals of political candidates or legislators that may affect the financial industry, or the student loan industry in particular, could damage our reputation and business and adversely impact the price of our common stock. Any internal, market, or other developments, including those relating to our competitors or our business, that result in a negative impact on our brand or reputation or the reputation of the student loan industry or other relevant industries could have an adverse effect on our ability to originate, service, securitize, and retain Private Education Loans or other loans, as applicable, result in greater regulatory, legislative, and media scrutiny, increase our risk of litigation and regulatory sanctions or other actions, and have a material adverse effect on our financial condition and/or results of operations. OPERATIONAL RISKS Failure or significant interruption of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action or litigation, or damage our reputation. Our business is dependent on our ability to process and monitor large numbers of transactions in compliance with legal and regulatory standards and our product specifications. As processing demands change and our loan portfolios grow in both volume and differing terms and conditions, developing and maintaining our operating 2021 Form 10-K — SLM CORPORATION 35 Table of Contents systems and infrastructure become increasingly challenging. There is no assurance we can adequately or efficiently develop, maintain, or acquire access to such systems and infrastructure. Our loan originations and deposits and the servicing, financial, accounting, data processing, communications, or other operating systems and facilities that support them may fail to operate properly, become disabled as a result of events beyond our control, or be unable to be rapidly configured to timely address regulatory changes, in each case potentially adversely affecting our ability to process these transactions. Any such failure could adversely affect our ability to service our customers, result in financial loss or liability to our customers and investors, disrupt our business, result in regulatory action or litigation, or cause reputational damage. Despite the plans we have in place, our ability to operate may be adversely affected by a disruption in the infrastructure that supports our businesses. Notwithstanding our efforts to maintain business continuity, a disruptive event impacting our processing locations could adversely affect our business, financial condition, results of operations, and/or cash flows. Our business processes are becoming increasingly dependent upon technological advancement, and we could lose market share if we are not able to keep pace with rapid changes in technology. Our future success depends, in part, on our ability to underwrite and approve loans, process loan applications and payments, and provide other customer services, in a safe, automated manner with high-quality service standards. The volume of loan originations we are able to process is reliant on the systems and processes we have implemented and developed. These systems and processes are becoming increasingly dependent upon technological advancement, such as the ability to process loans and payments over the internet or mobile applications, accept electronic signatures, and provide initial decisions instantly. Our future success also depends, in part, on our ability to develop and implement technology solutions that keep pace with continuing changes in technology, industry standards, and client preferences, including FinTech developments. We may not be successful in anticipating or responding to these developments in a timely manner. We have made, and need to continue to make, investments in our technology platform to provide competitive products and services. We may be required to expend significant funds to develop or acquire new technologies. If competitors introduce products, services, and systems that are better than ours or that are more cost-effective or that gain greater market acceptance, we could lose market share. Any one of these circumstances could have a material adverse effect on our business reputation and ability to obtain and retain clients and, therefore, could materially adversely affect our business, financial condition, and/or results of operations. We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure. Our operations rely on the secure collection, processing, storage, and transmission of personal, confidential and other information in a significant number of customer transactions on a continuous basis through our computer systems and networks and those of our third-party service providers. Information security risks for financial institutions and third-party service providers have increased in recent years and continue to evolve in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, including foreign state-sponsored actors. These parties also may fraudulently induce employees, customers, and others who use our or our service providers’ systems or have access to our or our customers’ data, to gain access to our and our customers’ data or our assets. We and our service providers face constant threats to our systems and data and from time-to-time experience cyberattacks and other security incidents. While we have not been materially impacted by cyber incidents, we continue to evolve our security controls to improve our ability to prevent, detect, and respond to the continually changing threats, and we may be required to expend significant additional resources in the future to enhance our security controls in response to new or more sophisticated threats, as well as new regulations related to cybersecurity. Additionally, while we, and our third-party service providers, commit resources to the design, implementation, maintenance, security, and monitoring of our networks and systems, there is no guarantee that our security controls, or those of our third-party service providers, will protect against all threats. Despite the measures we and our third-party service providers implement to protect our systems and our or our customers’ data, we may not be able to anticipate, prevent, or detect cyber-attacks, particularly because the techniques used by attackers change frequently or are not recognized until launched, and because cyber-attacks can originate from a wide variety of sources, including third-parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments. Such third parties may seek to gain unauthorized 36 SLM CORPORATION — 2021 Form 10-K Table of Contents access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers, or other users of our systems or those of our third-party service providers. Or, they may seek to disrupt or disable our or our service providers’ services through attacks such as denial-of-service and ransomware attacks. In addition, we or our service providers may be unable to identify, or may be significantly delayed in identifying, cyber-attacks and incidents due to the increasing use of techniques and tools that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic artifacts. As a result, our computer systems, software, and networks, as well as those of third-party vendors we utilize, may be vulnerable to unauthorized access, computer viruses, malicious attacks, and other events that could have a security impact beyond our control. We also routinely transmit and receive personal, confidential, and proprietary information, some through third parties, which may be vulnerable to interception, misuse, or mishandling. If one or more of such events occur, personal, confidential and other information processed by, stored in, or transmitted through our computer systems and networks, or those of third-party vendors, could be compromised or could cause interruptions or malfunctions in our or our customers’ or service providers’ operations that could result in significant losses, loss of business by us and loss of confidence in us, customer dissatisfaction, significant litigation, regulatory exposures, and harm to our reputation and brand. In addition, we may be required to expend significant resources to modify our protective measures, to investigate the circumstances surrounding the event, and implement mitigation and remediation measures. We also may be subject to fines, penalties, litigation (including securities fraud class action lawsuits) and regulatory investigation costs and settlements and other financial losses. If one or more of such events occur, our business, financial condition, and/or results of operations could be significantly and adversely affected. While we seek to mitigate cyber and related risks associated with outsourcing to third-party service providers, including through our vendor management processes, both operational and technological cyber risks remain, and certain risks are beyond our security and control systems. Cyber-attacks targeted at our service providers or in other areas of the supply chain may result in unauthorized interception, misuse, mishandling, access, acquisition, loss, or destruction of our or our customers’ data, or other cyber incidents, that may affect the availability of our services, and impose costs and other liabilities that significantly and adversely affect us in the ways discussed above. While we maintain insurance coverage that may apply to various cybersecurity risks and liabilities, there is no guarantee that any or all costs or losses incurred would be partially or fully covered. We depend significantly on third-parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third-parties, could disrupt our business or provide our competitors with an opportunity to enhance their position at our expense. We depend significantly on third-parties for a wide array of our operations and customer services and key components of our information technology and security infrastructures. Third-party vendors are significantly involved in aspects of our servicing for Private Education Loans, FFELP Loans, Bank deposit-taking activities, payroll software and systems development, data center and operations, including the timely and secure transmission of information across our data communication network, and for other telecommunications, email, processing, storage, remittance, and technology-related services in connection with our business. If a service provider fails to provide the services we require or expect, or fails to meet applicable regulatory or contractual requirements, such as service levels, protection of our customers’ personal and confidential information, or compliance with applicable laws, that failure could negatively impact our business by adversely affecting our ability to process customers’ transactions in a timely and accurate manner, otherwise hampering our ability to serve our customers and investors, or subjecting us to litigation and regulatory risk for matters as diverse as poor vendor oversight, improper release or protection of personal information, or release of incorrect information. Such a failure could adversely affect the perception of the reliability of our networks and services, and the quality of our brand, and could materially adversely affect our business, financial condition, and/or results of operations. We primarily rely upon Amazon Web Services to deliver our offerings to users on our platform, and any disruption of or interference with our use of Amazon Web Services could adversely impact our business and operations. Amazon Web Services (“AWS”) provides a distributed computing infrastructure platform for business operations, which is commonly referred to as “cloud” computing services. In 2019, we completed the migration of our computing infrastructure over to AWS. We currently run the majority of computing to power our websites, 2021 Form 10-K — SLM CORPORATION 37 Table of Contents mobile applications, and other technology products and services on AWS, and we store a significant amount of our users’ information and our confidential business information on AWS. We have limited control over the AWS operations and facilities that we use to store our data. While we’ve implemented contingencies for disaster recovery and business continuity, those operations and facilities are susceptible to damage and/or service interruptions. AWS’ continuing and uninterrupted performance is critical to our continuing and uninterrupted operations. Given the nature of the outsourcing of these services, along with the fact that we cannot easily switch our AWS operations to another cloud provider, any disruption of or interference with our use of AWS could adversely impact our operations and business. Any negative publicity arising from these disruptions could also harm our reputation and brand and may affect the usage of our offerings. We may face risks from our operations related to litigation or regulatory actions that could result in significant legal expenses and settlement or damage awards. Defending against litigation or regulatory actions may require significant attention and resources of management and, regardless of the outcome, such actions could result in significant expenses. If we are a party to material litigation or regulatory actions and if the defenses we assert are ultimately unsuccessful, or if we are unable to achieve a favorable settlement, we could be liable for large damages, penalties, or other amounts and that could have a material adverse effect on our business, results of operations, and/or financial condition. Our internal controls over financial reporting and disclosure controls may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations. Our management is responsible for maintaining, regularly assessing and, as necessary, making changes to our internal controls over financial reporting and our disclosure controls. Nevertheless, our internal controls over financial reporting and our disclosure controls can provide only reasonable assurances regarding the reliability of our financial reporting and the preparation of our financial statements for external purposes in accordance with generally accepted accounting principles in the United States (“GAAP”) and may not prevent or detect misstatements. Any failure or circumvention of our internal controls over financial reporting or our disclosure controls, failure to comply with rules and regulations related to such controls, or failure to make sound and appropriate application of the criteria established in the framework set forth in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission could have a material adverse effect on our financial condition and/or results of operations. Our business operations and those of our third-party vendors may be adversely impacted by political events, terrorism, cyberattacks, public health issues, natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, business interruptions, and other unpredictable catastrophic events. Our business operations and those of our third-party vendors are subject to interruption by, among other things, political events, terrorism, cyber-attacks, public health issues, natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, and other unpredictable catastrophic events, which could decrease demand for our products and services or make it difficult or impossible for us to deliver a satisfactory experience to our customers. Such events could affect the stability of our deposit base, impair the ability of our borrowers to repay their outstanding loans, cause significant property damage, and result in loss of revenue and/or cause us to incur additional expenses. The occurrence of any such event could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows. Our ability to successfully make acquisitions is subject to significant risks, including the risk that governmental authorities may not provide any requisite approvals, the risk that integrating acquisitions may be more difficult, costly, or time consuming than expected, and the risk that the value of acquisitions may be less than anticipated. We may from time to time seek to acquire other financial services companies or businesses that complement our business strategy. These acquisitions may be subject to regulatory approval in some instances, and no assurance can be provided that we will be able to obtain that approval in a timely manner or at all or that approval may not be subject to burdensome conditions. Even if we are able to obtain any required regulatory approval, the failure of other closing conditions to be satisfied or waived could delay the completion of an acquisition for a significant period of time or prevent it from occurring altogether. Any failure or delay in closing an acquisition could adversely affect our reputation, business, and performance. Acquisitions involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower-than-expected performance, higher-than-expected costs, 38 SLM CORPORATION — 2021 Form 10-K Table of Contents difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with customers or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes. An acquisition also could be dilutive to our existing stockholders if we were to issue common stock to fully or partially pay or fund the purchase price. Moreover, we may not be successful in identifying appropriate acquisition candidates, integrating acquired businesses or companies, or realizing expected value from acquisitions. Significant competition exists for valuable acquisition targets, and we may not be able to acquire other businesses or companies on attractive terms. No assurance can be given that we will pursue future acquisitions, and our ability to grow and successfully compete may be impaired if we choose not to pursue or are unable to successfully make acquisitions. RISKS RELATED TO SPIN-OFF Because of Navient’s indemnification obligations, we have significant exposures to risks related to its creditworthiness. If we are unable to obtain indemnification payments from Navient, we could experience higher than expected costs and operating expenses and our results of operations, cash flows, and/or financial condition could be materially and adversely affected. Pursuant to the terms of the Separation and Distribution Agreement, and as contemplated by the structure of the Spin-Off, Navient is legally obligated to indemnify the Bank against all claims, actions, damages, losses, or expenses that may arise from the conduct of all activities of pre-Spin-Off SLM occurring prior to the Spin-Off, except for certain liabilities specifically assumed by the Bank in the agreement as to which the Bank would be obligated to indemnify Navient. The Separation and Distribution Agreement provides specific processes and procedures pursuant to which we may submit claims for indemnification to Navient. If for any reason Navient is unable or unwilling to pay claims made against it, our costs, operating expenses, cash flows, and/or financial condition could be materially and adversely affected over time. GENERAL RISKS The holders of our preferred stock have rights that are senior to those of our common shareholders. At December 31, 2021, we had issued and outstanding 2.5 million shares of our Series B Preferred Stock. Our Series B Preferred Stock is senior to our shares of common stock in right of payment of dividends and other distributions. Generally, we must be current on dividends payable to holders of our Series B Preferred Stock before any dividends can be paid on our common stock. We also must comply with certain provisions that are protective of the Series B Preferred Stock in order to effectuate any repurchases under our common stock share repurchase program. In the event of our bankruptcy, dissolution, or liquidation, the holders of our Series B Preferred Stock must be satisfied before any distributions can be made to our common shareholders. We may be limited in our ability to receive dividends from the Bank, pay dividends on and repurchase our common stock, and make payments on our corporate debt. The declaration and payment of future common stock dividends, as well as the amount thereof, are subject to determination by, and the discretion of, our Board of Directors. In addition, we may change our policy regarding the payment of dividends and reduce or eliminate our common stock dividend in the future, which could adversely affect the market price of our common stock. Our share repurchase programs permit us to repurchase from time-to-time shares of our common stock up to an aggregate repurchase price not to exceed the authorized limits described in this Form 10-K. We may not be able to sell loans at prices, in volumes, or on a schedule, that will provide us with sufficient funds to effect share repurchases under our share repurchase programs. The timing and volume of any repurchases will be subject to market conditions, and there can be no guarantee that we will repurchase up to the limit of any program or at all, which could adversely affect the market price of our common stock. We are dependent on funds obtained from the Bank to fund corporate debt payments, dividend payments, and any share repurchases. Regulatory and other legal restrictions may limit our ability to transfer funds freely, either to or from our subsidiaries. In particular, the Bank is subject to laws and regulations that authorize regulatory bodies to block or reduce the flow of funds to us, or that prohibit such transfers altogether in certain circumstances. These laws, regulations, and rules may hinder our ability to access funds that we may need to make payments in respect of our stock or to satisfy our other responsibilities. The FDIC has the authority to prohibit or limit the payment of dividends by the Bank and SLM Corporation. 2021 Form 10-K — SLM CORPORATION 39 Table of Contents Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees. Our success depends, in large part, on our ability to retain key senior leaders and to attract and retain skilled employees. We depend on our senior leaders and skilled employees to oversee initiatives across the enterprise and execute on our business plans in an efficient and effective manner. Competition for such senior leaders and employees, and the cost associated with attracting and retaining them, is high. Recent scrutiny of compensation in the financial services industry has introduced additional challenges in this area. Our ability to attract and retain qualified employees also is affected by perceptions of our culture and management, our profile in the regions where we have offices, and the professional opportunities we offer. We rely upon our senior leaders not only for business success, but also to lead with integrity. To the extent our senior leaders behave in a manner that does not comport with our values, the consequences to our brand and reputation could be severe and could adversely affect our financial condition and results of operations. If we are unable to attract, develop, and retain talented senior leadership and employees, or to implement appropriate succession plans for our senior leadership, our business could be negatively affected. 40 SLM CORPORATION — 2021 Form 10-K Table of Contents Item 1B. Unresolved Staff Comments None.