What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-02-23 compared with 2022-02-24 · 209 added, 179 removed, 314 unchanged (55% of the section changed)

3 unchanged sentences

Additional discussion of the risks summarized in this risk factor summary, and other risks that we face, can be found below and should be carefully considered, together with other information in this Form 10-K and our other filings with the SEC, before making an investment decision regarding our stock.

• The pandemic caused by COVID-19 and resulting adverse economic conditions have adversely impacted our business and results and, in the future, could have a more material adverse impact on our business, results of operations, financial condition, and/or cash flows.

Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic.

• Our product offerings are primarily concentrated in loan products for higher education and deposit products for online depositors.

5 unchanged sentences

• We are subject to the creditworthiness of third-parties other than borrowers and exposure to those third parties could adversely affect our business, financial condition, results of operations, and/or cash flows.

• Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time.

An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could have a material adverse effect on us.

• In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties.

If those liabilities are significant, they could adversely affect our business and financial condition.

• The levels of or changes in interest rates could adversely affect our results of operations, financial condition, regulatory capital, and/or liquidity.

2 unchanged sentences

• Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings.

• The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations.

• The transition from LIBOR to alternative reference “benchmark” interest rates has no precedent, its impact is uncertain, and it could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations.

An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could have a material adverse effect on us.

If those liabilities are significant, they could adversely affect our business and financial condition.

• The Bank is subject to various regulatory capital requirements, and failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our business, results of operations, and/or financial condition.

22 SLM CORPORATION — 2021 Form 10-K

2022 Form 10-K — SLM CORPORATION 23

• Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position.

4 unchanged sentences

• Proposals of federal and state governments, or of various political candidates, affecting the student loan industry in particular, such as proposals for new federal education spending designed to make higher education “free” or substantially so regardless of financial need, subject us to political risk and could have a material adverse impact on us.

• We are subject to reputational risk, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

• We are subject to reputational risk, including risk arising from environmental, social, and governance matters or other areas or events, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

• Failure or significant interruption of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action or litigation, or damage our reputation.

2 unchanged sentences

• We depend significantly on third parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third parties, could disrupt our business.

• We primarily rely upon Amazon Web Services to deliver our offerings to users on our platform, and any disruption of or interference with our use of Amazon Web Services could adversely impact our business and operations.

• We may face risks from our operations related to litigation or regulatory actions that could result in significant legal expenses and settlement or damage awards.

• We may face risks from our operations related to litigation or regulatory or supervisory actions that could result in significant legal expenses and settlement or damage awards.

• Our internal controls over financial reporting and disclosure controls may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations.

1 unchanged sentence

• Our ability to successfully make acquisitions is subject to significant risks.

Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic.

• Because of Navient’s indemnification obligations, we have significant exposures to risks related to its creditworthiness.

2 unchanged sentences

• Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees.

2021 Form 10-K — SLM CORPORATION 23

24 SLM CORPORATION — 2022 Form 10-K

We face many risks and uncertainties, any one or more of which could have a material adverse effect on our business, financial condition (including capital and liquidity), results of operations, cash flows, and/or stock price.

1 unchanged sentence

These Risk Factors, together with other information in this Form 10-K and our other filings with the SEC, should be carefully considered before making an investment decision regarding our stock.

PANDEMIC RISK

The pandemic caused by a novel coronavirus, or COVID-19 (“COVID-19 pandemic”), and resulting adverse economic conditions have adversely impacted our business and results and, in the future, could have a more material adverse impact on our business, results of operations, financial condition, and/or cash flows.

Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic.

The COVID-19 pandemic has caused significant disruption to the U.S.

and world economies, including the closing of many schools and businesses for extended periods of time, significantly higher unemployment and underemployment at certain times, significantly lower interest rates, volatility in equity market valuations, and extreme volatility in the U.S.

and world financial markets.

Depending upon the success of the distribution, public acceptance, and administration of COVID-19 vaccines or other therapies both in the U.S.

and abroad, the impact of the COVID-19 pandemic on the U.S.

economy may be significant during a large part of 2022 and it may materially adversely affect our operations, our regulatory capital and liquidity position, the credit performance of our Private Education Loans and other assets, the number of borrowers seeking payment relief, our results of operations and financial condition, and/or our cash flows.

As described in Part II, Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Impact of COVID-19 on Sallie Mae — Customers and Credit Performance,” in this annual report on Form 10-K, during 2021 some of our borrowers experienced higher levels of financial hardship, which could lead to increased levels of delinquencies and defaults for those borrowers in the future.

In addition, our employees may have to continue to work from home for portions of 2022.

Unanticipated issues arising from handling personal, confidential, and other information from a less efficient work-from-home environment could adversely impact our operations and lead to greater risk for us.

The extent to which the COVID-19 pandemic impacts our business, results of operations, financial condition, and/or cash flows will depend on future developments, which are highly uncertain and largely beyond our control, including the impact of the pandemic on colleges and universities, student enrollment, and the need for Private Education Loans, and any actions taken by governmental authorities.

There can be no assurance that colleges and universities will return to normal pre-pandemic operations, which could adversely affect enrollments and, consequently, the need for Private Education Loans.

In addition, the impact of the COVID-19 pandemic on our business, results of operations, financial condition, and/or cash flows will depend upon, among other factors:

the scope and duration of the pandemic;

the number of our employees, customers, and vendors adversely affected by the pandemic;

the broader public health and economic dislocations resulting from the pandemic;

the actions taken by governmental authorities to limit the public health, financial, and economic impacts of the COVID-19 pandemic;

any legislative or regulatory changes that suspend or reduce payments or cancel or discharge obligations for education loan borrowers;

any reputational damage related to the broader reception and perception of our response to the COVID-19 pandemic;

and the impact of the COVID-19 pandemic on local, U.S., and world economies.

In particular, any cessation by the federal government in 2022 or afterwards of its payment suspension program for borrowers of federal student loans could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows if borrowers have insufficient funds to make payments on both their federal student loans and our Private Education Loans.

Moreover, we expect that effects of the COVID-19 pandemic will heighten many of the other known risks to our business described below in this Item 1A, and the impact of COVID-19 on our business could be material and adverse.

Any additional COVID-19 outbreaks, spikes, and subsequent waves, new COVID-19 strains, and/or widespread ineffectiveness of the COVID-19 vaccines could have material and adverse impacts on our business.

In addition, any future pandemic could subject our business to the same or greater risks than the COVID-19 pandemic.

24 SLM CORPORATION — 2021 Form 10-K

CONCENTRATION RISK

2 unchanged sentences

At December 31, 2022, approximately 70 percent of our total assets, and 84 percent of our total assets excluding cash and cash equivalents, were comprised of Private Education Loans.

This concentration poses the risk that any disruption, dislocation, or other negative event or trend in the Private Education Loan market or the overall economic environment could disproportionately and adversely affect our business, financial condition, and results of operations.

This concentration poses the risk that any disruption, dislocation, or other negative event or trend in the Private Education Loan market or the overall economic environment, including an inflationary and rising interest rate environment or a recession in the U.S., could disproportionately and adversely affect our business, financial condition, and results of operations.

We compete in the Private Education Loan market with banks and other consumer lending institutions, many with strong consumer brand name recognition and greater financial resources.

Many of those lenders also have a greater level of diversification in their mix of assets, which can enable them to be more competitive in uncertain or challenging economic times.

The use of marketplace lending sites is growing in popularity in the student loan sector.

This new market channel may erode our more traditional lending channels and increase our cost to originate Private Education Loans.

Moreover, our competition will increase as various lending institutions and other competitors, including Navient, through its Earnest subsidiary, enter or re-enter the Private Education Loan market.

9 unchanged sentences

The HEA’s reauthorization is currently pending in the U.S.

Reauthorization, as well as measures to provide relief for COVID-19, could provide a legislative vehicle for changes to student loan programs.

Reauthorization, as well as measures to provide relief for COVID-19 or for borrowers of student loans in general, could provide a legislative vehicle for changes to student loan programs.

Possible components that could impact the Private Education Loan market are changes to federal education loan limits, private loan refinancing programs, or Private Education Loan forgiveness.

2 unchanged sentences

Competition also plays a significant role in our online deposit gathering activities.

The market for online deposits is highly competitive, based primarily on a combination of reputation and rate.

The market for online deposits is highly competitive, based primarily on a combination of reputation, rate, and availability of information about our deposit products.

Our new depositor acquisition marketing is partly dependent on search engines, as well as bank deposit information aggregators, to direct a significant amount of traffic to our website via organic ranking and paid search advertising.

Our bank competitors’ paid search activities, such as pay per click marketing, may result in their sites receiving higher paid search results than ours and significantly increasing the cost of such depositor acquisition for us.

In addition, changes to search engines and deposit information aggregators’ methodologies and business practices could result in a decline in our new deposit growth or existing customer

2022 Form 10-K — SLM CORPORATION 25

Increased competition for deposits could cause our cost of funds to increase, which could negatively impact our loan pricing and net interest margin.

9 unchanged sentences

• Direct loans from colleges and universities, as well as income sharing agreements offered by schools and facilitated by private companies.

2021 Form 10-K — SLM CORPORATION 25

In addition, our ability to grow Private Education Loan originations and retain assets at our planned levels could be negatively affected if:

• demographic trends in the United States result in a decrease in college-age individuals;

• demand for higher education decreases;

• demand for higher education decreases (which can occur, among other times, during periods of strong employment in the United States);

• the cost of attendance of higher education decreases;

7 unchanged sentences

Since 2010, there have been a number of bills introduced in the United States Congress to promote federal financing for consolidation or refinancing of existing student loans, as well as an increase in the number of lenders offering consolidation or refinancing products.

Also, on July 31, 2018, the Office of the Comptroller of the Currency (the “OCC”) issued a policy statement announcing that it would consider applications from FinTech companies to become special purpose national banks.

The OCC indicated the special purpose national bank charter would be available to qualifying companies engaged in a limited range of banking activities, including paying checks or lending money, but that do not take deposits.

Although litigation ensued, and may continue, regarding the OCC’s ability to grant special purpose bank charters, receipt by any FinTech companies of a special purpose bank charter could lead to an increase in the consolidation or refinancing of our Private Education Loans.

Defaults on our loans, particularly Private Education Loans, could adversely affect our business, financial position, results of operations, and/or cash flows.

2 unchanged sentences

Delinquencies are an important indicator of the potential future credit performance of our loan portfolios.

Many factors can have an impact on borrower delinquencies, including, without limitation, economic conditions, changes in interest rates, personal circumstances and hardships, risk characteristics such as school type, loan status, loan seasoning, underwriting criteria, presence of a cosigner, changes made in credit administration practices from time to time, changes in loan underwriting criteria made from time to time, regulatory and operational changes, and unforeseen trends.

Many factors can have an

26 SLM CORPORATION — 2022 Form 10-K

impact on borrower delinquencies, including, without limitation, economic conditions (including inflationary, rising interest rate, and recessionary environments), changes in interest rates, personal circumstances and hardships, risk characteristics such as school type, loan status, loan seasoning, underwriting criteria, presence of a cosigner, changes made in credit administration practices from time to time, changes in loan underwriting criteria made from time to time, regulatory and operational changes, servicing and collections staffing challenges, other operational challenges we may encounter, and unforeseen events or trends.

Rising unemployment rates and the failure of our in-school borrowers to graduate are two of the most significant macroeconomic factors that could increase loan delinquencies, defaults, and loan modifications, or otherwise negatively affect performance of our existing education loan portfolios.

5 unchanged sentences

If any of this information is intentionally or negligently misrepresented and is not detected by us before completing the transaction, we may experience increased credit risk.

Higher credit-related losses and weaker credit quality negatively affect our

26 SLM CORPORATION — 2021 Form 10-K

business, financial condition, and results of operations and limit funding options, which could also adversely impact our liquidity position.

Our Private Education Loan delinquencies (loans greater than 30 days past due), as a percentage of Private Education Loans in repayment, were 3.3 percent at December 31, 2021.

Higher credit-related losses and weaker credit quality negatively affect our business, financial condition, and results of operations and limit funding options, which could also adversely impact our liquidity position.

Our Private Education Loan (held for investment) delinquencies (loans greater than 30 days past due), as a percentage of Private Education Loans (held for investment) in repayment, were 3.8 percent at December 31, 2022.

Our allowance for credit losses may not be adequate to cover actual losses, and we may be required to materially increase our allowance, which may adversely affect our capital, financial condition, and/or results of operations.

In June 2016, the Financial Accounting Standards Board (“FASB”) issued Accounting Standards Update (“ASU”) No.

2016-13, “Financial Instruments-Credit Losses (Topic 326):

Measurement of Credit Losses on Financial Instruments,” which became effective for us on January 1, 2020.

Under the guidance, for all loans carried at amortized cost, upon loan origination we are required to measure our allowance for credit losses based on our estimate of all current expected credit losses (“CECL”) over the remaining contractual term of the assets.

The CECL standard resulted in a significant change in how we recognize credit losses and will have a material impact on our financial condition, results of operations, and capital levels.

We are required to measure our allowance for credit losses based on our estimate of all current expected credit losses (“CECL”) over the remaining contractual term of the assets.

The CECL standard resulted in a significant change in how we recognize credit losses and has had a material impact on our financial condition, results of operations, and capital levels.

The evaluation of our allowance for credit losses is inherently subjective, as it requires material estimates that may be subject to significant changes.

The measurement of expected credit losses is based on historical information, current conditions, and reasonable and supportable forecasts to estimate the expected loss over the life of the loan.

This differs significantly from the “incurred loss” model, which was in effect during 2019 and delayed recognition until it was probable a loss had been incurred.

Our models take into account historical loss experience in various economic conditions to estimate expected future losses based upon future economic forecasts over a period of time (“reasonable and supportable period”), at which point we revert expected losses to our historical rates.

Future defaults can be higher than anticipated due to a variety of factors outside of our control, and our models may not accurately estimate future loan loss performance.

(This differs significantly from the “incurred loss” model, which was in effect during 2019 and delayed recognition until it was probable a loss had been incurred.) Our models take into account historical loss experience in various economic conditions to estimate expected future losses based upon future economic forecasts over a period of time (“reasonable and supportable period”), at which point we revert expected losses to our historical rates.

Defaults can be higher than anticipated due to a variety of factors, and our models may not accurately estimate future loan loss performance.

The models used in calculating our CECL estimates include forecasts of future economic conditions, the weighting of economic forecasts, prepayment speeds, and recovery rates.

9 unchanged sentences

Our overall counterparty exposure is more fully discussed in Part II, Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources — Counterparty Exposure.” If our counterparties are unable to perform their obligations, such inability could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital

2022 Form 10-K — SLM CORPORATION 27

LIQUIDITY RISK

Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and, for at least the next few years, sell loans at attractive prices to help fund any share repurchase programs that may be authorized from time to time.

An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could lead to regulatory scrutiny and could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

We must effectively manage the liquidity risk inherent in our business.

We require liquidity to meet cash requirements for such things as day-to-day operating expenses, funding of our Private Education Loan and Credit Card originations, deposit withdrawals and maturities, payment of any declared dividends on our preferred stock and common stock, and payment for any shares of common stock acquired under any common stock repurchase program or otherwise.

Our primary sources of liquidity and funding are customer deposits, payments received on Private Education Loans and FFELP Loans that we hold, and proceeds from loan sales and securitization transactions.

We may maintain too much liquidity, which can be costly, or we may be too illiquid, which could result in financial distress during times of economic stress or capital market disruptions.

We fund Private Education Loan originations through asset-backed securitizations and deposits raised by the Bank, including term and liquid brokered and retail deposits, as well as Educational 529 and Health Savings Account deposits.

Assets funded through deposits result in refinancing risk because the average term of the deposits is shorter than the expected term of the Private Education Loan assets we originate.

The significant competition for deposits from other banking organizations that are also seeking stable deposits to support their funding needs may affect deposit renewal rates, costs, or availability.

In addition, our ability to maintain existing balances or obtain additional deposits may be affected by factors, including those beyond our control, such as a rising stock market, more attractive returns on alternative investments, perceptions about our existing and future financial strength, quality of deposit servicing or online banking generally, changes in monetary or fiscal policies that influence deposit or other rates, and general economic conditions, including high unemployment and decreased savings rates.

Also, our ability to maintain our current level of deposits or grow our deposit base could be affected by regulatory restrictions, including the possible imposition by our regulators of prior approval requirements or restrictions on our offered rates, brokered deposit growth, or other areas.

Our success also depends on our ability to structure Private Education Loan securitizations or execute other secured funding transactions.

Several factors may have a material adverse effect on both our ability to obtain such funding and the time it takes us to structure and execute these transactions, including the following:

• Persistent and prolonged disruption or volatility in the capital markets or in the education loan ABS sector specifically;

• Degradation of the credit quality or performance of the Private Education Loans we sell or finance through securitization trusts, or adverse rating agency assumptions, rating actions, or conclusions with respect to those trusts or the education loan-backed securitization trusts sponsored by other issuers;

• A material breach of our obligations to purchasers of our Private Education Loans, including securitization trusts;

• The timing, pricing, and size of education loan asset-backed securitizations other parties issue, or the adverse performance of, or other problems with, such securitizations;

• Challenges to the enforceability of Private Education Loans based on violations of, or changes to, federal or state consumer protection or licensing laws and related regulations, or imposition of penalties or liabilities on assignees of Private Education Loans for violation of such laws and regulations;

• Our inability to structure and gain market acceptance for new product features or services to meet new demands of ABS investors, rating agencies, or credit facility providers.

If we require funding beyond that which we may be able to obtain through deposits and proceeds from ABS transactions at attractive prices, we may need to raise additional liquidity through other forms of secured and unsecured debt financing, which, in turn, could increase our funding costs and reduce our net interest margin.

Future downgrades to our credit ratings also could result in higher funding costs and reduce our net interest margin.

Our ability to sell loans at attractive prices, as well as the timing and volume of any sales, will be subject to market conditions, and there can be no guarantee that we will be able to effectuate planned loan sales at the prices, times, or volumes we desire, or at all.

If we are unable to effectuate loan sales at the prices, times, and volumes we

28 SLM CORPORATION — 2021 Form 10-K

desire, we may not be able to fund share repurchase programs that are authorized from time to time or achieve other business goals.

We currently maintain sufficient risk-based capital through adequate retention and reinvestment of earnings from operations.

If our business objectives require capital above and beyond what we generate through retained earnings, we may need to raise capital for our business by issuing additional equity to investors.

Several factors, some of which may be beyond our control, may have a material adverse effect on our ability to raise funding at any given time through any of the channels described above in this Risk Factor in the amounts, at the rates, or within the timeframes we desire or need.

If this occurs, our business, results of operations, financial position, and/or cash flows could be materially and adversely affected.

In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties.

If those liabilities are significant, they could adversely affect our business, financial condition, results of operations, and/or cash flows.

Under applicable state and federal securities laws, if investors incur losses as a result of purchasing ABS issued in connection with our securitization transactions, we could be deemed responsible and could be liable to investors for damages.

We could also be liable to investors or other parties for certain updated performance information that we may provide subsequent to the original issuances.

If we fail to cause the securitization trusts or other transaction parties to disclose adequately all material information regarding an investment in any securities, if we or the trusts make statements that are misleading in any material respect in information delivered to investors in any securities, if we breach any representations or warranties made in connection with securitization of the loans, or if we breach any other duties as the administrator or servicer of the securitization trusts, it is possible we could be sued and ultimately held liable to an investor or other transaction party.

In transactions involving the sale of loans in non-securitized form where we remain the servicer of the loans, it is possible we could be sued and ultimately held liable to the purchaser of the loans or another transaction party for breaches of representations or warranties or breaches of servicing covenants.

Resources — Counterparty Exposure.” If our counterparties are unable to perform their obligations, or the ability of our counterparties to perform their obligations becomes less certain or impaired, the obligations of our counterparties to us or our investments in any counterparties or their securities could become impaired, which could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows.

INTEREST RATE RISK

2 unchanged sentences

Net interest income is significantly affected by market rates of interest, which in turn are influenced by monetary and fiscal policies of governmental agencies, general economic conditions, the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future.

We may be adversely affected by policies or events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), compressing interest rates on our earnings assets closer to interest rates on our deposits and borrowing, increasing the volatility of market rates of interest, or changing the spreads among different interest rate indices.

We may be adversely affected by policies or events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), compressing interest rates on our earnings assets closer to interest rates on our deposits and borrowings, increasing the volatility of market rates of interest, or changing the spreads among different interest rate indices.

Changes in interest rate levels also can lead to other adverse impacts, such as reducing the demand for or increasing the prepayment speeds of our Private Education Loans, increasing the delinquencies or defaults of our borrowers or other counterparties, reducing the value of our assets, or increasing our liabilities.

Many of these adverse impacts can occur in an inflationary and rising interest rate environment, such as that experienced in the United States in 2022 and projected by economists and regulators to continue in 2023.

These adverse impacts may materially adversely affect our operations, our regulatory capital and liquidity position, the credit performance of our Private Education Loans and other assets, the number of borrowers seeking payment relief, our results of operations and financial condition, and/or our cash flows.

The level of and changes in market rates of interest and, as a result, these risks and uncertainties, are beyond our control.

4 unchanged sentences

ABS funding closely mirrors the expected maturities of our education loans and provides a combination of fixed and variable-rate funding.

Deposits are issued with both

2021 Form 10-K — SLM CORPORATION 29

fixed and variable rates, and the average term is typically shorter than the expected term of our combined loan portfolios.

Deposits are issued with both fixed and variable rates, and the average term is typically shorter than the expected term of our combined loan portfolios.

The different interest rate and maturity characteristics of our loan portfolio and the liabilities funding that portfolio result in fluctuations in our net interest income.

5 unchanged sentences

Consolidations and refinancings contribute to increased prepayment rates.

In addition, increases in employment levels, wages, family income, alternative sources of financing, and government support for student loan borrowers during times of crisis, such as during the COVID-19 pandemic, may also contribute to higher-than-expected prepayment rates, which can adversely affect our interest rate and repricing risk and our financial condition and results of operations.

In addition, increases in employment levels, wages, family income, alternative sources of financing, and government support for student loan borrowers during times of crisis or otherwise, such as during the COVID-19 pandemic or the forgiveness for certain borrowers of federal student loan indebtedness, may also contribute to higher-than-expected prepayment rates, which can adversely affect our interest rate and repricing risk and our financial condition and results of operations.

28 SLM CORPORATION — 2022 Form 10-K

Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings.

9 unchanged sentences

Also, see “— We are subject to the creditworthiness of third parties other than borrowers and exposure to those third parties could adversely affect our business, financial condition, results of operations, and/or cash flows.”

The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations.

The interest rates on our variable-rate Private Education Loans issued before April 1, 2021 and certain other assets are indexed to LIBOR, the London interbank offered rate.

Certain of our interest rate swaps, notes issued under our term ABS and our education loan-backed multi-lender secured borrowing facility (the “Secured Borrowing Facility”), brokered and non-brokered deposits, and other obligations also are indexed to LIBOR.

The transition from LIBOR to alternative reference “benchmark” interest rates has no precedent, its impact is uncertain, and it could adversely affect the value of or the interest rates on our assets and obligations indexed to LIBOR, as well as the revenue and expenses associated with those assets and obligations.

Following announcements by the United Kingdom’s Financial Conduct Authority (the “UKFCA”), which regulates LIBOR, the London interbank offered rate, and ICE Benchmark Administration Limited, the administrator of LIBOR, publication of 1-week and 2-month USD LIBOR and all tenors for other currencies ceased after December 31, 2021.

While publication of the remaining USD settings is expected to cease after June 30, 2023, U.S.

banking and other global financial services regulators directed regulated institutions to cease entering into new LIBOR-based contracts as soon as practicable and in any event by the end of 2021.

The Alternative Reference Rates Committee (the “ARRC”), a group of market participants that includes both banks and a number of non-banks, was convened by the Federal Reserve Board and the Federal Reserve Bank of New York in 2014 to identify alternative reference rates to LIBOR.

In 2017, the ARRC identified the Secured Overnight Financing Rate (“SOFR”), which is a rate based on overnight U.S.

Treasury repurchase agreement transactions, as its recommended alternative to USD LIBOR.

The interest rates on our variable-rate Private Education Loans issued before April 1, 2021 and certain other assets are indexed to LIBOR.

Certain of our interest rate swaps, notes issued under ABS and our education loan-backed multi-lender secured borrowing facility (the “Secured Borrowing Facility”), brokered and non-brokered deposits, and other obligations also are indexed to LIBOR.

In each case, the terms of the relevant agreements define LIBOR and provide differing methods for how it may be replaced or computed if LIBOR is no longer available as defined.

LIBOR has been used worldwide as a reference for setting interest rates on loans, derivatives, and other assets and obligations.

Following announcements by the United Kingdom’s Financial Conduct Authority (the “UKFCA”), which regulates LIBOR, and ICE Benchmark Administration Limited, the administrator of LIBOR, publication of 1-week and 2-month USD LIBOR and all tenors for other currencies ceased after December 31, 2021.

While publication of the remaining USD settings is expected to cease after June 30, 2023, U.S.

banking and other global financial services regulators have directed regulated institutions to cease entering into new LIBOR-based contracts as soon as practicable and in any event by the end of 2021.

The Federal Reserve Bank of New York currently publishes the Secured Overnight Financing Rate (“SOFR”) based on overnight U.S.

Treasury repurchase agreement transactions, which has been recommended as the alternative to USD LIBOR by the Alternative Reference Rates Committee convened by the Federal Reserve Board and the Federal Reserve Bank of New York.

30 SLM CORPORATION — 2021 Form 10-K

The transition from LIBOR to alternative reference “benchmark” interest rates is uncertain and will be affected by, among other things, the pace of the transition to such rates, the specific terms and parameters for and acceptance of such rates (including, without limitation, by investors, financial markets, and regulators), market conventions for the use of such rates in connection with a particular product, and prices of and the liquidity of trading markets for products based on such rates.

3 unchanged sentences

Changes to the reference rate used could result in dissatisfied customers, lenders, investors, or counterparties, which could result in reputational damage, litigation, or regulatory scrutiny.

2022 Form 10-K — SLM CORPORATION 29

The Company has actively monitored market developments with respect to LIBOR replacement since 2017 and during 2020 launched a formal cross-functional replacement project with the goal of ensuring a smooth transition to a replacement index with minimal negative impact on our customers, investors, and the Company’s business, financial condition, and results of operations.

The Chief Financial Officer and the project team monitor developments, assesses impacts, proposes plans, and, with the approval of an executive committee, implement changes.

The project team reports status regularly to our Board of Directors.

The Chief Financial Officer and the project team monitor developments, assess impacts, propose plans, and, with the approval of an executive committee, implement changes.

The Chief Financial Officer and/or the project team reports status regularly to our Board of Directors.

In 2020, we began accepting certain deposits based on SOFR.

In the second quarter of 2021, we began issuing variable-rate Private Education Loans that are indexed to SOFR.

In 2022, subject to market conditions and investor demand, we expect to begin issuing ABS that are indexed to SOFR and to renew the Secured Borrowing Facility with an index based on SOFR.

In 2022, we began issuing ABS that are indexed to SOFR and renewed the Secured Borrowing Facility with an index based on SOFR.

We plan to significantly reduce the number of contracts that reference LIBOR, either through modification or replacement, by June 2023.

2 unchanged sentences

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — LIBOR Transition” for further details.

LIQUIDITY RISK

We must effectively manage the liquidity risk inherent in our business.

We require liquidity to meet cash requirements for such things as day-to-day operating expenses, funding of our Private Education Loan originations, deposit withdrawals and maturities, payment of any declared dividends on our preferred stock and common stock, and payment for any shares of common stock acquired under any common stock repurchase program or otherwise.

We may maintain too much liquidity, which can be costly, or we may be too illiquid, which could result in financial distress during times of economic stress or capital market disruptions.

Assets funded through deposits result in refinancing risk because the average term of the deposits is shorter than the expected term of the Private Education Loan assets we originate.

At December 31, 2022, our brokered deposits totaled $9.9 billion, which represented 46 percent of our total deposits.

Brokered deposits may be more price sensitive than other types of deposits and may become less available if alternative investments offer higher returns.

In addition, our ability to maintain existing balances of all deposit types or obtain additional deposits of any type may be affected by factors, including those beyond our control, such as a rising stock market, more attractive returns on alternative investments, perceptions about our existing and future financial strength, quality of deposit servicing or online banking generally, changes in monetary or fiscal policies that influence deposit or other rates, and general economic conditions, including high unemployment and decreased savings rates.

Our success also depends on our ability to structure Private Education Loan securitizations or execute other secured funding transactions.

Several factors may have a material adverse effect on both our ability to obtain such funding and the time it takes us to structure and execute these transactions, including the following:

• Persistent and prolonged disruption or volatility in the capital markets (which could occur as a result of, among other things, a government debt default or a government shutdown) or in the education loan ABS sector specifically;

30 SLM CORPORATION — 2022 Form 10-K

• A material breach of our obligations to purchasers of our Private Education Loans, including securitization trusts;

• The timing, pricing, and size of education loan asset-backed securitizations other parties issue, or the adverse performance of, or other problems with, such securitizations;

• Our inability to structure and gain market acceptance for new product features or services to meet new demands of ABS investors, rating agencies, or credit facility providers.

Future downgrades to our credit ratings, or to the credit ratings of our subsidiaries or to the securities issued in our securitization transactions, also could result in higher funding costs and reduce our net interest margin.

If we are unable to effectuate loan sales at the prices, times, and volumes we desire, we may not be able to fund share repurchase programs that are authorized from time to time or achieve other business goals.

We currently maintain sufficient risk-based capital through adequate retention and reinvestment of earnings from operations.

If our business objectives require capital above and beyond what we generate through retained earnings, we may need to raise capital for our business by issuing additional equity to investors.

If this occurs, our business, results of operations, financial position, and/or cash flows could be materially and adversely affected.

If those liabilities are significant, they could adversely affect our business, financial condition, results of operations, and/or cash flows.

We could also be liable to investors or other parties for certain updated performance information that we may provide subsequent to the original issuances.

If any of those liabilities are significant, they could adversely affect our business, financial condition, results of operations, and/or cash flows.

2022 Form 10-K — SLM CORPORATION 31

The Bank is subject to various regulatory capital requirements administered by the FDIC and the UDFI.

1 unchanged sentence

Basel III and the regulatory framework for prompt corrective action, the Bank must meet specific capital standards that involve quantitative measures of its assets, liabilities, and certain off-balance sheet items as calculated under regulatory accounting practices.

The Bank’s capital amounts and its classification under the prompt corrective action framework are also subject to qualitative judgments by the regulators about components of capital, risk weightings, and other factors.

The Bank’s capital adequacy and its classification under the prompt corrective action framework are also subject to qualitative judgments by the regulators about components of capital, risk weightings, and other factors.

Basel III is subject to further revisions and such revisions could affect the Bank’s capital requirements and adversely affect its business, results of operations, and financial condition.

For example, in 2017 the Basel Committee on Banking Supervision published revisions to the international capital standards that it describes as the finalization of the Basel III post-crisis regulatory reforms.

Among other things, these revisions would revise the standardized approach for credit risk and provide a new standardized approach for operational risk capital, with an initial implementation date of January 1, 2023 and a phase-in period for certain revisions extending to January 1, 2028.

The impact of these revisions on the Bank will depend on how and to what extent they are implemented in the United States.

The federal banking agencies have not yet proposed a rule to implement these revisions in the United States.

If the Bank fails to satisfy regulatory risk-based or leverage capital requirements, it may be subject to serious regulatory consequences, including restrictions on our ability to make dividend payments or share repurchases, that could prevent us from successfully executing our business plan and may have a material adverse effect on our business, results of operations, financial position, and/or cash flows.

If the Bank fails to satisfy regulatory risk-based or leverage capital requirements, it would be subject to serious regulatory consequences, including restrictions on the ability to make dividend payments or share repurchases, that could prevent us from successfully executing our business plan and may have a material adverse effect on our business, results of operations, financial position, and/or cash flows.

“Business — Supervision and Regulation — Regulation of Sallie Mae Bank — Regulatory Capital Requirements.”

2021 Form 10-K — SLM CORPORATION 31

Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position.

7 unchanged sentences

Any such capital raises, if required, may also be dilutive to our existing stockholders.

Our regulators may also update their supervisory expectations applicable to the Bank’s stress tests, which could change how the Bank conducts stress tests or how senior management uses the results of the stress tests to inform business plans and capital targets.

We also conduct quarterly liquidity stress tests to evaluate the adequacy of our liquidity sources under several stress scenarios, including a severely adverse macroeconomic scenario.

2 unchanged sentences

We are subject to the requirements of entities that set and interpret the accounting standards governing the preparation of our financial statements and other financial reports.

These entities, which include the FASB, the SEC, and banking regulators, may add new requirements or change their interpretations of how those standards should be applied.

These entities, which include the Financial Accounting Standards Board (the “FASB”), the SEC, and banking regulators, may add new requirements or change their interpretations of how those standards should be applied.

Changes in our accounting policies or in accounting standards could materially affect how we report our financial condition and/or results of operations.

As a result of changes to financial accounting or reporting standards, whether promulgated or required by the FASB or other regulators, we could be required to change certain of the assumptions or estimates we have previously used in preparing our financial statements, which could negatively impact how we record and report our financial condition, results of operations, and capital levels.

As a result of

32 SLM CORPORATION — 2022 Form 10-K

changes to financial accounting or reporting standards, whether promulgated or required by the FASB or other regulators, we could be required to change certain of the assumptions or estimates we have previously used in preparing our financial statements, which could negatively impact how we record and report our financial condition, results of operations, and capital levels.

The preparation of our consolidated financial statements requires us to make critical accounting estimates and assumptions that affect the reported amounts of assets, liabilities, income, and expenses during the reporting periods.

7 unchanged sentences

Intended to protect clients, depositors, the DIF, and the overall financial system, these laws, regulations, and supervisory actions may, among other matters:

• prescribe minimum capital requirements;

• increase minimum capital requirements;

• reclassify the types of assets we hold for regulatory capital purposes, including for risk-weightings;

• limit the rates of growth of our business;

2 unchanged sentences

• limit share repurchases;

32 SLM CORPORATION — 2021 Form 10-K

• restrict the payment of discretionary bonuses to executive officers;

2 unchanged sentences

• impose certain specific accounting requirements on us that may be more restrictive;

• result in changes from time to time in our practices, policies, procedures, and personnel in various areas of our business;

• result in changes from time to time in our practices, policies, procedures, and personnel in various areas of our business (including, without limitation, practices and policies regarding the dischargeability of certain Private Education Loans in the event of a borrower’s bankruptcy);

• result in greater or earlier charges to earnings or reductions in our capital.

1 unchanged sentence

There can be no assurance that limitations will not be imposed in the future, however.

Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in supervision, often impose additional compliance costs.

The scope of the laws and regulations and the intensity of the supervision to which we are subject have increased in recent years, initially in response to the financial crisis, and more recently in light of other factors such as technological and market changes.

Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in supervision, often impose additional costs and could result in additional charge-offs.

The scope of the laws and regulations and the intensity of the supervision to which we are subject have increased in recent years.

Regulatory enforcement and fines have also increased across the banking and financial services sector.

Further, the scope of regulation and the intensity of supervision will likely become higher under the current presidential administration, including increased scrutiny, supervisory discouragement, or even possible denials, of bank mergers and acquisitions by federal bank regulators.

We expect that we, like the rest of the banking sector, will remain subject to increased regulation and supervision of our industry by bank regulatory agencies and that there may be additional and changing requirements and conditions imposed on us, any of which could increase our costs, require increased management attention, and adversely impact our results of operations.

We expect that we will remain subject to increased regulation and more intense supervision by bank regulatory agencies and that there may be additional and changing requirements and conditions imposed on us, any of which could increase our costs and levels of charge-offs, require increased management attention, and adversely impact our results of operations.

2022 Form 10-K — SLM CORPORATION 33

In connection with their continuous supervision and examinations of us, the FDIC, the UDFI, the CFPB, or other regulatory agencies may require changes in our business or operations.

2 unchanged sentences

Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence.

We could be required as well to dispose of specified assets and liabilities within a prescribed period of time.

We could be required as well to dispose of specified assets and liabilities or to increase our level of charge-offs within a prescribed period of time.

As a result, any enforcement or other supervisory action could have an adverse effect on our business, financial condition, results of operations, and prospects.

Restrictions or limitations on our operations, or other directives, imposed by our regulators may be confidential and thus, in some instances, we may not be permitted to publicly disclose the actions.

In addition, changes in the regulatory and supervisory environments could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, restricting our ability to make acquisitions or pursue other profitable opportunities, and negatively impacting our financial condition and results of operations.

3 unchanged sentences

We are subject to a broad range of federal and state consumer protection laws applicable to our lending and retail banking activities, including laws governing fair lending, unfair, deceptive and abusive acts and practices, service member protections, interest rates and loan fees, disclosures of loan terms, marketing, servicing, and collections.

2021 Form 10-K — SLM CORPORATION 33

The CFPB is the Bank’s primary consumer compliance supervisor, with exclusive authority to conduct examinations for the purposes of assessing compliance with the requirements of federal consumer financial laws and with primary consumer compliance enforcement authority.

6 unchanged sentences

We are also subject to a dynamically changing landscape of privacy, data protection, and cybersecurity laws, regulations, and requirements.

For example, the CCPA took effect on January 1, 2020, and is broad, sweeping legislation that gives California consumers certain rights similar to those provided by the European General Data Protection Regulation.

Various federal and state regulators, including governmental agencies, have adopted, or are considering adopting, laws and regulations regarding personal information and data privacy and security.

This patchwork of legislation and regulation may lead to conflicts or differing views of personal privacy rights.

As an example, certain state laws regarding personal information may be broader in scope or more stringent than federal laws or the laws of other states regarding personal information.

As an illustration of that point, the CCPA took effect on January 1, 2020, and is broad, sweeping legislation that gives California consumers certain

34 SLM CORPORATION — 2022 Form 10-K

rights similar to those provided by the European General Data Protection Regulation.

Among other things, the CCPA provides for enhanced regulatory penalties and potential statutory damages in relation to certain types of data breaches.

The passage of the CPRA, which expands upon the CCPA, may necessitate additional compliance obligations regarding the processing of personal information of California residents once many of the provisions amending the CCPA become effective on January 1, 2023.

Additionally, numerous other states have enacted or are in the process of enacting state-level data privacy and security laws and regulations.

The enactment of new federal data protection and privacy laws also is possible and could impact us and our business.

“Business — Supervision and Regulation —Regulation of Sallie Mae Bank — Privacy Laws” for additional information.

In addition, in November 2021, the FDIC, OCC, and FRB adopted a new regulation that takes effect in early 2022 and imposes new requirements on banking organizations to report certain covered cybersecurity events.

In addition, in November 2021, the FDIC, OCC, and the Federal Reserve Board adopted a regulation that took effect in early 2022 and imposes requirements on banking organizations to report certain covered cybersecurity events.

New regulations from the SEC regarding the public reporting of certain cybersecurity events also are expected to be finalized in 2023.

Violations of, or changes in, federal or state consumer protection, privacy, data protection, or cybersecurity laws or related regulations, or in the prevailing interpretations thereof, may expose us to litigation, administrative fines, penalties and restitution, result in greater compliance costs, constrain the marketing and origination of Private Education Loans or other products, adversely affect the collection of balances due on the loan assets held by us or by securitization trusts, or otherwise adversely affect our business.

11 unchanged sentences

An ineffective risk-management framework or function also could give rise to enforcement and other supervisory actions, damage our reputation, and result in litigation.

34 SLM CORPORATION — 2021 Form 10-K

POLITICAL/REPUTATIONAL RISK

1 unchanged sentence

We operate in an environment of heightened political and regulatory scrutiny of education loan lending, servicing, and originations.

The rising cost of higher education, questions regarding the quality of education provided, particularly among for-profit institutions, and the increasing amount of student loan debt outstanding in the United States have prompted this heightened and ongoing scrutiny.

2022 Form 10-K — SLM CORPORATION 35

United States have prompted this heightened and ongoing scrutiny.

This environment could lead to further proposals by political candidates and state and federal legislators and regulators, and to the enactment of laws and regulations, applicable to, or limiting, our business.

1 unchanged sentence

Some proposals have included the potential forgiveness of substantial amounts of existing outstanding student loan indebtedness.

In 2022, the Biden Administration proposed to forgive up to $20,000 in federal student loan indebtedness for certain borrowers.

Also, various states have proposed and/or enacted legislation providing for “free” or “substantially free” higher education to residents of the state having incomes below a certain level and who attend publicly-funded universities in the state.

3 unchanged sentences

In addition, the continued ongoing publicity regarding these various proposals, even if they are not enacted, could negatively impact the market price of our common stock.

We are subject to reputational risk, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

We are subject to reputational risk, including risk arising from environmental, social, and governance matters or other areas or events, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

Our brand is very important to us and our business.

Our reputation as an originator, servicer, and securitizer of high-quality Private Education Loans and as a depository for online deposits is very dependent upon how our customers, our regulators, legislators, the education community, our employees, and the broader market perceive our business practices, financial heath, and integrity, and the business practices, financial health, and integrity of the overall student loan market, other loan markets, or the market for online deposits, as applicable.

Negative publicity, including as a result of our culture, actual or alleged conduct by us, our employees, or our vendors, or public opinion of the student loan industry or other relevant industries generally, or as a result of achieving lower environmental, social, and governance, or “sustainability,” scores or ratings than those desired by certain investors, could damage our reputation and business and adversely impact the price of our common stock.

Additionally, as described above, proposals of political candidates or legislators that may affect the financial industry, or the student loan industry in particular, could damage our reputation and business and adversely impact the price of our common stock.

Negative publicity, including as a result of our culture, actual or alleged conduct by us, our employees, or our vendors, or public opinion of the student loan industry or other relevant industries generally, could damage our reputation and business and adversely impact the price of our common stock or other securities.

Environmental, social, and governance matters, or “ESG,” include, but are not limited to, climate risk, hiring practices, the diversity of our work force, community impact issues, and our overall governance environment.

We may be exposed to negative publicity based on the identity and activities of those with whom we do business and the public’s view of our approach and performance, and that of our business partners, regarding ESG matters.

Any such negative publicity could arise from adverse news coverage in traditional media and could also spread through the use of social media platforms.

Our relationships and reputation with our existing and prospective customers and third parties with whom we do business could be damaged if we were to become the subject of any such negative publicity.

This, in turn, could have an adverse effect on our ability to attract and retain customers and employees and could have a negative impact on the market price for our securities.

Investors have begun to consider the steps taken and resources allocated by financial institutions and other commercial organizations to address ESG matters when making investment and operational decisions.

Certain investors are beginning to incorporate the business risks of climate change and the adequacy of companies’ responses to the risks posed by climate change and other ESG topics into their investment theses.

These shifts in investing priorities could result in adverse effects on the price of our common stock or other securities to the extent investors determine that we have not made sufficient progress on ESG matters.

Additionally, as described above, proposals of political candidates, administrations, or legislators that may affect the financial industry, or the student loan industry in particular, could damage our reputation and business and adversely impact the price of our common stock.

Any internal, market, or other developments, including those relating to our competitors or our business, that result in a negative impact on our brand or reputation or the reputation of the student loan industry or other relevant industries could have an adverse effect on our ability to originate, service, securitize, and retain Private Education Loans or other loans, as applicable, result in greater regulatory, legislative, and media scrutiny, increase our risk of litigation and regulatory sanctions or other actions, and have a material adverse effect on our financial condition and/or results of operations.

36 SLM CORPORATION — 2022 Form 10-K

OPERATIONAL RISKS

1 unchanged sentence

Our business is dependent on our ability to process and monitor large numbers of transactions in compliance with legal and regulatory standards and our product specifications.

As processing demands change and our loan portfolios grow in both volume and differing terms and conditions, developing and maintaining our operating

2021 Form 10-K — SLM CORPORATION 35

systems and infrastructure become increasingly challenging.

As processing demands change and our loan portfolios grow in both volume and differing terms and conditions, developing and maintaining our operating systems and infrastructure become increasingly challenging.

There is no assurance we can adequately or efficiently develop, maintain, or acquire access to such systems and infrastructure.

Our loan originations and deposits and the servicing, financial, accounting, data processing, communications, or other operating systems and facilities that support them may fail to operate properly, become disabled as a result of events beyond our control, or be unable to be rapidly configured to timely address regulatory changes, in each case potentially adversely affecting our ability to process these transactions.

Our loan originations and deposits and the servicing, financial, accounting, data processing, communications, or other operating systems, processes, and facilities that support them may fail to operate properly, become disabled as a result of events beyond our control, or be unable to be rapidly configured to timely address regulatory changes or other business requirements, in each case potentially adversely affecting our ability to process these transactions adequately.

Any such failure could adversely affect our ability to service our customers, result in financial loss or liability to our customers and investors, disrupt our business, result in regulatory action or litigation, or cause reputational damage.

Despite the plans we have in place, our ability to operate may be adversely affected by a disruption in the infrastructure that supports our businesses.

Notwithstanding our efforts to maintain business continuity, a disruptive event impacting our processing locations could adversely affect our business, financial condition, results of operations, and/or cash flows.

Despite the plans we have in place from time to time, our ability to operate may be adversely affected by a disruption in the infrastructure that supports our businesses.

Notwithstanding our efforts to maintain business continuity, a disruptive event impacting our processing locations, a failure to adequately anticipate the level of staffing or effort needed to efficiently and effectively communicate with and service our customers or to service and collect on our loans, or another similar operational event could adversely affect our business, financial condition, results of operations, and/or cash flows.

Our business processes are becoming increasingly dependent upon technological advancement, and we could lose market share if we are not able to keep pace with rapid changes in technology.

4 unchanged sentences

We may not be successful in anticipating or responding to these developments in a timely manner.

We have made, and need to continue to make, investments in our technology platform to provide competitive products and services.

We have made, and need to continue to make, investments in our technology platform to provide competitive products and services and to reduce the number of manual processes we employ.

We may be required to expend significant funds to develop or acquire new technologies.

4 unchanged sentences

Information security risks for financial institutions and third-party service providers have increased in recent years and continue to evolve in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, including foreign state-sponsored actors.

These parties also may fraudulently induce employees, customers, and others who use our or our service providers’ systems or have access to our or our customers’ data, to gain access to our and our customers’ data or our assets.

These parties also may fraudulently

2022 Form 10-K — SLM CORPORATION 37

induce employees, customers, and others who use our or our service providers’ systems or have access to our or our customers’ data, to gain access to our and our customers’ data or our assets.

We and our service providers face constant threats to our systems and data and from time-to-time experience cyberattacks and other security incidents.

1 unchanged sentence

Additionally, while we, and our third-party service providers, commit resources to the design, implementation, maintenance, security, and monitoring of our networks and systems, there is no guarantee that our security controls, or those of our third-party service providers, will protect against all threats.

Despite the measures we and our third-party service providers implement to protect our systems and our or our customers’ data, we may not be able to anticipate, prevent, or detect cyber-attacks, particularly because the techniques used by attackers change frequently or are not recognized until launched, and because cyber-attacks can originate from a wide variety of sources, including third-parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments.

Such third parties may seek to gain unauthorized

36 SLM CORPORATION — 2021 Form 10-K

access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers, or other users of our systems or those of our third-party service providers.

Despite the measures we and our third-party service providers implement to protect our systems and our or our customers’ data, we may not be able to anticipate, prevent, or detect cyberattacks, particularly because the techniques used by attackers change frequently or are not recognized until launched, and because cyberattacks can originate from a wide variety of sources, including third parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments.

Such third parties may seek to gain unauthorized access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers, or other users of our systems or those of our third-party service providers.

Or, they may seek to disrupt or disable our or our service providers’ services through attacks such as denial-of-service and ransomware attacks.

In addition, we or our service providers may be unable to identify, or may be significantly delayed in identifying, cyber-attacks and incidents due to the increasing use of techniques and tools that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic artifacts.

As a result, our computer systems, software, and networks, as well as those of third-party vendors we utilize, may be vulnerable to unauthorized access, computer viruses, malicious attacks, and other events that could have a security impact beyond our control.

In addition, we or our service providers may be unable to identify, or may be significantly delayed in identifying, cyberattacks and incidents due to the increasing use of techniques and tools that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic artifacts.

As a result, our computer systems, software, and networks, as well as those of third-party vendors we utilize, may be vulnerable to unauthorized access, computer viruses, malware attacks, and other events that could have a security impact beyond our control.

We also routinely transmit and receive personal, confidential, and proprietary information, some through third parties, which may be vulnerable to interception, misuse, or mishandling.

4 unchanged sentences

While we seek to mitigate cyber and related risks associated with outsourcing to third-party service providers, including through our vendor management processes, both operational and technological cyber risks remain, and certain risks are beyond our security and control systems.

Cyber-attacks targeted at our service providers or in other areas of the supply chain may result in unauthorized interception, misuse, mishandling, access, acquisition, loss, or destruction of our or our customers’ data, or other cyber incidents, that may affect the availability of our services, and impose costs and other liabilities that significantly and adversely affect us in the ways discussed above.

Cyberattacks targeted at our service providers or in other areas of the supply chain may result in unauthorized interception, misuse, mishandling, access, acquisition, loss, or destruction of our or our customers’ data, or other cyber incidents that may affect the availability of our services, and impose costs and other liabilities that significantly and adversely affect us in the ways discussed above.

While we maintain insurance coverage that may apply to various cybersecurity risks and liabilities, there is no guarantee that any or all costs or losses incurred would be partially or fully covered.

1 unchanged sentence

We depend significantly on third parties for a wide array of our operations and customer services and key components of our information technology and security infrastructures.

Third-party vendors are significantly involved in aspects of our servicing for Private Education Loans, FFELP Loans, Bank deposit-taking activities, payroll software and systems development, data center and operations, including the timely and secure transmission of information across our data communication network, and for other telecommunications, email, processing, storage, remittance, and technology-related services in connection with our business.

38 SLM CORPORATION — 2022 Form 10-K

telecommunications, email, processing, storage, remittance, and technology-related services in connection with our business.

If a service provider fails to provide the services we require or expect, or fails to meet applicable regulatory or contractual requirements, such as service levels, protection of our customers’ personal and confidential information, or compliance with applicable laws, that failure could negatively impact our business by adversely affecting our ability to process customers’ transactions in a timely and accurate manner, otherwise hampering our ability to serve our customers and investors, or subjecting us to litigation and regulatory risk for matters as diverse as poor vendor oversight, improper release or protection of personal information, or release of incorrect information.

Such a failure could adversely affect the perception of the reliability of our networks and services, and the quality of our brand, and could materially adversely affect our business, financial condition, and/or results of operations.

We primarily rely upon Amazon Web Services to deliver our offerings to users on our platform, and any disruption of or interference with our use of Amazon Web Services could adversely impact our business and operations.

Amazon Web Services (“AWS”) provides a distributed computing infrastructure platform for business operations, which is commonly referred to as “cloud” computing services.

In 2019, we completed the migration of our computing infrastructure over to AWS.

We currently run the majority of computing to power our websites,

2021 Form 10-K — SLM CORPORATION 37

mobile applications, and other technology products and services on AWS, and we store a significant amount of our users’ information and our confidential business information on AWS.

We have limited control over the AWS operations and facilities that we use to store our data.

While we’ve implemented contingencies for disaster recovery and business continuity, those operations and facilities are susceptible to damage and/or service interruptions.

AWS’ continuing and uninterrupted performance is critical to our continuing and uninterrupted operations.

Given the nature of the outsourcing of these services, along with the fact that we cannot easily switch our AWS operations to another cloud provider, any disruption of or interference with our use of AWS could adversely impact our operations and business.

Any negative publicity arising from these disruptions could also harm our reputation and brand and may affect the usage of our offerings.

We may face risks from our operations related to litigation or regulatory actions that could result in significant legal expenses and settlement or damage awards.

Defending against litigation or regulatory actions may require significant attention and resources of management and, regardless of the outcome, such actions could result in significant expenses.

If we are a party to material litigation or regulatory actions and if the defenses we assert are ultimately unsuccessful, or if we are unable to achieve a favorable settlement, we could be liable for large damages, penalties, or other amounts and that could have a material adverse effect on our business, results of operations, and/or financial condition.

We may face risks from our operations related to litigation or regulatory or supervisory actions that could result in significant legal expenses and settlement or damage awards.

Defending against litigation or regulatory or supervisory actions may require significant attention and resources of management and, regardless of the outcome, such actions could result in significant expenses.

If we are a party to material litigation or regulatory or supervisory actions and if the defenses we assert are ultimately unsuccessful, or if we are unable to achieve a favorable outcome, we could be liable for large damages, penalties, or other costs or charge-offs and that could have a material adverse effect on our business, results of operations, and/or financial condition.

Our internal controls over financial reporting and disclosure controls may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations.

3 unchanged sentences

Our business operations and those of our third-party vendors may be adversely impacted by political events, terrorism, cyberattacks, public health issues, natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, business interruptions, and other unpredictable catastrophic events .

Our business operations and those of our third-party vendors are subject to interruption by, among other things, political events, terrorism, cyber-attacks, public health issues, natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, and other unpredictable catastrophic events, which could decrease demand for our products and services or make it difficult or impossible for us to deliver a satisfactory experience to our customers.

Such events could affect the stability of our deposit base, impair the ability of our borrowers to repay their outstanding loans, cause significant property damage, and result in loss of revenue and/or cause us to incur additional expenses.

Our business operations and those of our third-party vendors are subject to interruption by, among other things, geopolitical events, terrorism, cyberattacks, public health issues, natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, and other unpredictable catastrophic events, which could decrease demand for our products and services or make it difficult or impossible for us to deliver a satisfactory experience to our customers.

For instance, collateral impacts of the war between Russia and Ukraine, and the imposition of sanctions on Russia by the United States, could include potential retaliatory action by Russia in the form of cyberattacks and sanctions against other countries, as well as escalation or further spread of the conflict, which could adversely affect the global economy and markets in the United States.

The current and anticipated effects of climate change are creating an increasing level of concern for the state of the global environment.

As a result, political and social attention to the issue of climate change has increased.

In recent years, governments across the world have entered into international agreements to attempt to reduce global temperatures, in part by limiting greenhouse gas emissions.

The United States Congress, state legislatures, and federal and state regulatory agencies have continued to propose and advance numerous legislative and regulatory initiatives seeking to mitigate the effects of climate change.

Such initiatives have been pursued with rigor under the current presidential administration.

In March 2022, the FDIC published proposed principles for climate risk management by “large financial institutions.” Although the Bank currently does not meet the definition of a “large financial institution” with over $100 billion in total consolidated assets, if it were ever to become subject to final principles in the future, such measures could result in the implementation of significant operational changes and

2022 Form 10-K — SLM CORPORATION 39

increased costs.

We also might voluntarily choose to follow some of the principles for climate risk management in the future.

Required or voluntary compliance with such principles could lead us to expend significant capital and incur compliance, operating, maintenance, and remediation costs.

Given the lack of empirical data on the credit and other financial risks posed by climate change, it is impossible to predict how climate change may impact our financial condition and operations.

Any of the unpredictable catastrophic events discussed above could affect the stability of our deposit base, impair the ability of our borrowers to repay their outstanding loans, cause significant property damage, and result in loss of revenue and/or cause us to incur additional expenses.

The occurrence of any such event could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows.

4 unchanged sentences

Any failure or delay in closing an acquisition could adversely affect our reputation, business, and performance.

38 SLM CORPORATION — 2021 Form 10-K

difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with customers or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes.

Acquisitions involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower-than-expected performance, higher-than-expected costs, difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with customers or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes.

An acquisition also could be dilutive to our existing stockholders if we were to issue common stock to fully or partially pay or fund the purchase price.

2 unchanged sentences

No assurance can be given that we will pursue future acquisitions, and our ability to grow and successfully compete may be impaired if we choose not to pursue or are unable to successfully make acquisitions.

PANDEMIC RISK

Any future pandemics could subject our business to the same or greater risks than the COVID-19 pandemic.

The COVID-19 pandemic has caused significant disruption to the U.S.

and world economies.

As the distribution, public acceptance, and administration of COVID-19 vaccines and other therapies became more successful in 2021 and 2022, certain impacts of the pandemic on the U.S.

and world economies lessened, yet other impacts persisted and new impacts continued to arise.

For instance, many schools and businesses were open throughout 2022, certain supply chain disruptions lessened to some extent, yet extreme volatility in equity market valuations and the U.S.

and world financial markets persisted.

An environment of rapid and high economic inflation developed in the U.

and many other countries throughout 2022, reaching the highest level in four decades, in part due to the ongoing effects of the pandemic such as supply chain shocks.

This inflationary environment has had a significant adverse impact on consumers, businesses, governments, financial markets, and economies.

In its effort to reduce inflationary pressures on the U.S.

economy, the Federal Reserve Board increased interest rates numerous times and by significant amounts in 2022, which has led to interest rates equaling their highest levels in over a decade.

As described in Part II, Item 7.

“Management’s Discussion and Analysis of Financial Condition and Results of Operations — Impact of COVID-19 on Sallie Mae — Customers and Credit Performance,” in this annual report on

40 SLM CORPORATION — 2022 Form 10-K

Form 10-K, during 2022 some of our borrowers experienced higher levels of financial hardship, which could lead to increased levels of delinquencies and defaults for those borrowers in the future.

In addition, we adopted a hybrid work environment during 2022 pursuant to which our employees are able to work from home for portions of the regular work week.

The extent to which the COVID-19 pandemic, including related inflationary and rising interest rate pressures, impacts our business, results of operations, financial condition, and/or cash flows will depend on future developments, which are highly uncertain and largely beyond our control, including the further impact of the pandemic and related inflationary and interest rate pressures on colleges and universities, student enrollment, and the need for Private Education Loans, and any actions taken by governmental authorities.

There can be no assurance that colleges and universities will fully return to or remain at normal pre-pandemic operational levels, which could adversely affect enrollments and, consequently, the need for Private Education Loans.

In addition, the impact of the COVID-19 pandemic and related inflationary and rising interest rate environment on our business, results of operations, financial condition, and/or cash flows will depend upon, among other factors:

the scope and duration of the pandemic and related inflationary and rising interest rate environment;

the number of our employees, customers, and vendors adversely affected by the pandemic and rising interest rate environment;

the broader public health and economic dislocations resulting from the pandemic;

the actions taken by governmental authorities to limit the public health, financial, and economic impacts of the COVID-19 pandemic and related inflationary and rising interest rate pressures;

any legislative, regulatory, or executive changes that suspend or reduce payments or cancel or discharge obligations for education loan borrowers;

any reputational damage related to the broader reception and perception of our response to the COVID-19 pandemic;

and the impact of the COVID-19 pandemic and related inflationary and rising interest rate pressures on local, U.S., and world economies.

In particular, any cessation by the federal government in 2023 or afterwards of its payment suspension program for borrowers of federal student loans, or the invalidation or failure of the Biden Administration’s effort to forgive up to $20,000 in federal student loan indebtedness for certain borrowers, could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows if borrowers have insufficient funds to make payments on both their federal student loans and our Private Education Loans.

Moreover, we expect that effects of the COVID-19 pandemic will heighten many of the other known risks to our business described in this Item 1A, and the impact of COVID-19 and related inflationary and rising interest rate pressures on our business could be material and adverse.

Any additional COVID-19 outbreaks, spikes, and subsequent waves, new COVID-19 strains, and/or widespread ineffectiveness of the COVID-19 vaccines in the future could have material and adverse impacts on our business.

In addition, any future pandemic could subject our business to the same or greater risks than the COVID-19 pandemic.

RISKS RELATED TO SPIN-OFF

Because of Navient’s indemnification obligations, we have significant exposures to risks related to its creditworthiness.

Because of Navient’s indemnification obligations, we have exposures to risks related to its creditworthiness.

If we are unable to obtain indemnification payments from Navient, we could experience higher-than-expected costs and operating expenses and our results of operations, cash flows, and/or financial condition could be materially and adversely affected.

6 unchanged sentences

Our Series B Preferred Stock is senior to our shares of common stock in right of payment of dividends and other distributions.

Generally, we must be current on dividends payable to holders of our Series B Preferred Stock before any dividends can be paid on our common stock.

Generally, we must be current on dividends payable to holders of our Series B Preferred Stock before

2022 Form 10-K — SLM CORPORATION 41

any dividends can be paid on our common stock.

We also must comply with certain provisions that are protective of the Series B Preferred Stock in order to effectuate any repurchases under our common stock share repurchase program.

5 unchanged sentences

We may not be able to sell loans at prices, in volumes, or on a schedule, that will provide us with sufficient funds to effect share repurchases under our share repurchase programs.

Additionally, we may pause or discontinue our share repurchase programs for other reasons, such as legal or regulatory considerations, or because we decide to allocate available funds for other corporate priorities.

The timing and volume of any repurchases will be subject to market conditions, and there can be no guarantee that we will repurchase up to the limit of any program or at all, which could adversely affect the market price of our common stock.

4 unchanged sentences

The FDIC has the authority to prohibit or limit the payment of dividends by the Bank and SLM Corporation.

2021 Form 10-K — SLM CORPORATION 39

Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees.

Our success depends, in large part, on our ability to retain key senior leaders and to attract and retain skilled employees.

We depend on our senior leaders and skilled employees to oversee initiatives across the enterprise and execute on our business plans in an efficient and effective manner.

Our success depends, in large part, on our ability to retain key senior leaders and to attract and retain skilled employees and subject matter experts.

We depend on our senior leaders and skilled employees and subject matter experts to oversee initiatives across the enterprise and execute on our business plans in an efficient and effective manner.

Competition for such senior leaders and employees, and the cost associated with attracting and retaining them, is high.

3 unchanged sentences

To the extent our senior leaders behave in a manner that does not comport with our values, the consequences to our brand and reputation could be severe and could adversely affect our financial condition and results of operations.

If we are unable to attract, develop, and retain talented senior leadership and employees, or to implement appropriate succession plans for our senior leadership, our business could be negatively affected.

40 SLM CORPORATION — 2021 Form 10-K

Unresolved Staff Comments

If we are unable to attract, develop, and retain talented senior leadership and employees, or to implement appropriate succession plans for our senior leadership and subject matter experts, our business could be negatively affected.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors