Capital One - 10-K annual report

______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

Securities registered pursuant to section 12(g) of the act: None

Capital One Financial Corporation, a Delaware corporation established in 1994 and headquartered in McLean, Virginia, is a diversified financial services holding company with banking and non-banking subsidiaries. Capital One Financial Corporation and its subsidiaries (the “Company”) offer a broad array of financial products and services to consumers, small businesses and commercial clients through branches, the internet and other distribution channels.

We also offer products outside of the United States principally through Capital One (Europe) plc (“COEP”), an indirect subsidiary of COBNA organized and located in the United Kingdom (“U.K.”), and through a branch of COBNA in Canada. Both COEP and our branch of COBNA in Canada have the authority to provide credit card loans.

We regularly explore and evaluate opportunities to acquire financial services and financial assets, including credit card and other loan portfolios, and enter into strategic partnerships as part of our growth strategy. We also explore opportunities to acquire digital companies and related assets to improve our information technology infrastructure and to deliver on our digital strategy. We also regularly consider the potential disposition of certain of our assets, branches, partnership agreements or lines of business. We may issue equity or debt in connection with acquisitions, including public offerings, to fund such acquisitions.

On October 3, 2016, we announced that we have entered into a 10-year program agreement to become the exclusive issuing partner of co-branded credit cards to Cabela’s customers. In connection with this credit card program, we have entered into a definitive agreement under which we will acquire the credit card operations from Cabela’s, including approximately $5.2 billion in credit card receivables and other assets and approximately $5.0 billion in associated funding liabilities. This transaction is subject to the satisfaction of customary closing conditions, including receipt of various regulatory approvals and the approval of the stockholders of Cabela’s. In determining whether to approve the proposed acquisition under the Bank Merger Act (“BMA”), the Office of the Comptroller of the Currency (“OCC”) will consider, among other factors, the convenience and needs of the communities we serve and our effectiveness in combating money laundering, including the acceptability to the OCC of our progress in addressing the

requirements of the consent order with the OCC that we previously disclosed in our Quarterly Report on Form 10-Q for the quarterly period ended June 30, 2015 (the “AML Consent Order”).

On January 28, 2017, Capital One withdrew its BMA application from the OCC and we do not expect to receive regulatory approval of any BMA application for this transaction prior to October 3, 2017. This is the date when any of the parties involved in the agreement can terminate the agreement. We will not be in a position to refile a BMA application until after we have completed our work under the AML Consent Order.

We will continue to work with Cabela’s toward completing the transaction. We cannot be certain when or if, or on what terms and conditions, required regulatory approvals will be granted to complete the acquisition.

Our common stock trades on the New York Stock Exchange (“NYSE”) under the symbol “COF” and is included in the Standard & Poor’s (“S&P”) 100 Index. Our principal executive office is located at 1680 Capital One Drive, McLean, Virginia 22102, telephone number (703) 720-1000. We maintain a website at www.capitalone.com. Documents available on our website include:

These documents also are available in print to any stockholder who requests a copy.

In addition, we make available free of charge through our website our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports as soon as reasonably practicable after electronically filing or furnishing such material to the U.S. Securities and Exchange Commission (“SEC”).

Our consolidated total net revenues are derived primarily from lending to consumer and commercial customers net of funding costs associated with deposits, short-term borrowings and long-term debt. We also earn non-interest income which primarily consists of interchange income net of reward expenses, and service charges and other customer-related fees. Our expenses primarily consist of the provision for credit losses, operating expenses, marketing expenses and income taxes.

Our principal operations are currently organized for management reporting purposes into three primary business segments, which are defined primarily based on the products and services provided or the type of customer served: Credit Card, Consumer Banking and Commercial Banking. The operations of acquired businesses have been integrated into our existing business segments. Certain activities that are not part of a segment, such as management of our corporate investment portfolio and asset/liability management by our centralized Corporate Treasury group, are included in the Other category.

Customer usage and payment patterns, credit quality, levels of marketing expense and operating efficiency all affect our profitability. In our Credit Card business, we experience fluctuations in purchase volume and the level of outstanding loan receivables due to

seasonal variances in consumer spending and payment patterns which, for example, are highest around the winter holiday season. No individual quarter in 2016, 2015 or 2014 accounted for more than 30% of our total revenues in any of these fiscal years. Net charge-off rates in our Credit Card and Consumer Banking businesses also have historically exhibited seasonal patterns and generally tend to be the highest in the first and fourth quarters of the year.

Capital One Financial Corporation is a bank holding company (“BHC”) under Section 3 of the Bank Holding Company Act of 1956, as amended (12 U.S.C. § 1842) (“BHC Act”) and is subject to the requirements of the BHC Act, including its approval requirements for investments in or acquisitions of banking organizations, capital adequacy standards and limitations on our nonbanking activities. We are also subject to supervision, examination and regulation by the Board of Governors of the Federal Reserve System (“Federal Reserve”). Permissible activities for a BHC include those activities that are so closely related to banking as to be a proper incident thereto, such as consumer lending and other activities that have been approved by the Federal Reserve by regulation or order. Certain servicing activities are also permissible for a BHC if conducted for or on behalf of the BHC or any of its affiliates. Impermissible activities for BHCs generally include nonfinancial activities such as sales of commercial products.

On May 27, 2005, we became a “financial holding company” under the BHC Act. In addition to the activities permissible for a BHC, a financial holding company, and the nonbank companies under its control, are permitted to engage in activities considered to be financial in nature (including, for example, insurance underwriting, agency sales and brokerage, securities underwriting and dealing and merchant banking activities), incidental to financial activities or, if the Federal Reserve determines that they pose no risk to the safety or soundness of depository institutions or the financial system in general, activities complementary to financial activities.

To become and remain eligible for financial holding company status, a BHC and its subsidiary depository institutions must meet certain criteria, including capital, management and Community Reinvestment Act (“CRA”) requirements. Failure to meet such criteria could result, depending on which requirements were not met, in the Company facing restrictions on new financial activities or acquisitions or being required to discontinue existing activities that are not generally permissible for BHCs.

The Banks are national associations chartered under the laws of the United States, the deposits of which are insured by the Deposit Insurance Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits. The Banks are subject to comprehensive regulation and periodic examination by the Office of the Comptroller of the Currency (“OCC”), the FDIC and the Consumer Financial Protection Bureau (“CFPB”).

We are also registered as a financial institution holding company under the law of the Commonwealth of Virginia and, as such, we are subject to periodic examination by the Virginia Bureau of Financial Institutions. We also face regulation in the international jurisdictions in which we conduct business (see below under “Regulation of Businesses by Authorities Outside the United States”).

The business activities of the Company and Banks are also subject to regulation and supervision under various laws and regulations.

Regulations of Consumer Lending Activities

The activities of the Banks as consumer lenders are subject to regulation under various federal laws, including the Truth in Lending Act (“TILA”), the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the CRA, the Servicemembers Civil Relief Act and the Military Lending Act, as well as under various state laws. We are also subject to the Credit Card Accountability Responsibility and Disclosure Act, which amended the TILA, and which imposes a number of restrictions on credit card practices impacting rates and fees, requires that a consumer’s ability to pay be taken into account before issuing credit or increasing credit limits, and imposes revised disclosures required for open-end credit.

Depending on the underlying issue and applicable law, regulators may be authorized to impose penalties for violations of these statutes and, in certain cases, to order banks to compensate injured borrowers. Borrowers may also have a private right of action for certain violations. Federal bankruptcy and state debtor relief and collection laws may also affect the ability of a bank, including the Banks, to collect outstanding balances owed by borrowers.

Mortgage Lending

The CFPB has issued several final rules pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) that provide additional disclosure requirements and substantive limitations on our mortgage lending activities. These rules, which include the amendments to the Ability to Repay, Qualified Mortgage Standards and Mortgage Servicing regulations under the TILA (Regulation Z) and the Real Estate Settlement Procedures Act (Regulation X), could impact the type and amount of mortgage loans CONA offers and services.

Debit Interchange Fees

The Dodd-Frank Act requires that the amount of any interchange fee received by a debit card issuer with respect to debit card transactions be reasonable and proportional to the cost incurred by the issuer with respect to the transaction. Final rules adopted by the Federal Reserve to implement these requirements limit interchange fees per debit card transaction to $0.21 plus five basis points of the transaction amount and provide for an additional $0.01 fraud prevention adjustment to the interchange fee for issuers that meet certain fraud prevention requirements.

The Bank Secrecy Act and the USA PATRIOT Act of 2001 (“Patriot Act”) require financial institutions, among other things, to implement a risk-based program reasonably designed to prevent money laundering and to combat the financing of terrorism, including through suspicious activity and currency transaction reporting, compliance, record-keeping and customer due diligence.

In May 2016, the United States Department of the Treasury’s Financial Crimes Enforcement Network issued a final rule making customer due diligence a required, stand-alone part of the anti-money laundering programs financial institutions must maintain under the Bank Secrecy Act. For these purposes, the term “customer due diligence” refers to customer identification and verification, beneficial ownership identification and verification, understanding the nature and purpose of customer relationships to develop a customer risk profile, ongoing monitoring for reporting suspicious transactions and, on a risk-adjusted basis, maintaining and updating customer information. The rule became effective on July 11, 2016 and requires full compliance by May 11, 2018 for Capital One and all other covered financial institutions.

The Patriot Act also contains financial transparency laws and provides enhanced information collection tools and enforcement mechanisms to the United States government, including due diligence and record-keeping requirements for private banking and correspondent accounts; standards for verifying customer identification at account opening; rules to produce certain records upon request of a regulator or law enforcement agency; and rules to promote cooperation among financial institutions, regulators and law enforcement agencies in identifying parties that may be involved in terrorism, money laundering and other crimes.

Funding

Under the Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”), as discussed in “MD&A—Liquidity Risk Profile,” only well capitalized and adequately capitalized institutions may accept brokered deposits. Adequately capitalized institutions, however, must obtain a waiver from the FDIC before accepting brokered deposits, and such institutions may not pay rates that significantly exceed the rates paid on deposits of similar maturity obtained from the institution’s normal market area or, for deposits obtained from outside the institution’s normal market area, the national rate on deposits of comparable maturity. The FDIC is authorized to terminate a bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance could have a material adverse effect on a bank’s liquidity and earnings.

Nonbank Activities

Certain of our nonbank subsidiaries are subject to supervision and regulation by various other federal and state authorities. Capital One Securities, Inc. and Capital One Investing, LLC are registered broker-dealers regulated by the SEC and the Financial Industry Regulatory Authority. Our broker-dealer subsidiaries are subject, among other things, to net capital rules designed to measure the

general financial condition and liquidity of a broker-dealer. Under these rules, broker-dealers are required to maintain the minimum net capital deemed necessary to meet their continuing commitments to customers and others, and to keep a substantial portion of their assets in relatively liquid form. These rules also limit the ability of a broker-dealer to transfer capital to its parent companies and other affiliates. Broker-dealers are also subject to regulations covering their business operations, including sales and trading practices, public offerings, publication of research reports, use and safekeeping of client funds and securities, capital structure, record-keeping and the conduct of directors, officers and employees.

Capital One Asset Management, LLC and Capital One Advisors, LLC are SEC-registered investment advisers regulated under the Investment Advisers Act of 1940. Capital One Asset Management, LLC, whose sole client is CONA, provides investment advice to CONA’s private banking customers, including trusts, high net worth individuals, institutions, foundations, endowments and other organizations.

Capital One Agency LLC is a licensed insurance agency that provides both personal and business insurance services to retail and commercial clients. It is regulated by state insurance regulatory agencies in the states in which it operates.

Derivatives Activities

The Commodity Futures Trading Commission (“CFTC”) and the SEC have jointly issued final rules further defining the Dodd-Frank Act’s “swap dealer” definitions. Based on these rules, no Capital One entity is currently required to register with the CFTC or SEC as a swap dealer. The Dodd-Frank Act also requires all swap market participants to keep certain swap transaction records and report pertinent information to swap data repositories on a real-time and on-going basis. Further, each swap, group, category, type or class of swap that the CFTC or SEC determines must be cleared through a derivatives clearinghouse (unless the swap is eligible for a clearing exemption) must also be executed on a designated contract market (“DCM”), exchange or swap execution facility (“SEF”), unless no DCM, exchange or SEF has made the swap available for trading.

Volcker Rule

We and each of our subsidiaries, including the Banks, are subject to the “Volcker Rule,” a provision of the Dodd-Frank Act that contains prohibitions on proprietary trading and certain investments in, and relationships with, covered funds (hedge funds, private equity funds and similar funds), subject to certain exemptions, in each case as the applicable terms are defined in the Volcker Rule and the implementing regulations. The implementing regulations also require that we, as a banking entity with $50 billion or more in total assets, establish and maintain an enhanced compliance program designed to ensure that we comply with the requirements of such regulations.

Basel III and United States Capital Rules

In December 2010, the Basel Committee on Banking Supervision (“Basel Committee”) published a framework for additional capital and liquidity requirements (“Basel III”), which included detailed capital ratios and buffers, subject to transition periods. The Federal Reserve, OCC and FDIC (collectively, the “Federal Banking Agencies”) issued a final rule that implemented Basel III and certain Dodd-Frank Act and other capital provisions and updated the prompt corrective action (“PCA”) framework to reflect the new regulatory capital minimums (“Basel III Capital Rule”). The Basel III Capital Rule increased the minimum capital that we and other institutions are required to hold. The Basel III Capital Rule includes the “Basel III Standardized Approach” and the “Basel III Advanced Approaches.” The Basel Committee continues to evaluate further modifications to these and other capital standards which, if finalized, would require rulemaking in the United States prior to their effectiveness for United States banking organizations. There is uncertainty around any final modifications that the Basel Committee might adopt, which of those changes thereafter may be adopted in the United States, and how those changes may impact U.S. capital standards.

The Basel III Advanced Approaches are mandatory for institutions with total consolidated assets of $250 billion or more or total consolidated on-balance-sheet foreign exposure of $10 billion or more. We became subject to the predecessor of these rules at the end of 2012. Prior to full implementation of the Basel III Advanced Approaches, however, a covered organization must complete a qualification period, known as the parallel run, during which it must demonstrate that it meets the requirements of the rule to the

satisfaction of its primary United States banking regulator. We entered parallel run on January 1, 2015. A parallel run must last at least four quarters, but in practice United States banks have taken considerably longer to complete parallel runs.

Notwithstanding the Basel III Advanced Approaches, the Basel III Capital Rule also established a capital floor so that organizations subject to the Basel III Advanced Approaches may not hold less capital than would be required using the Basel III Standardized Approach capital calculations.

The Basel III Capital Rule revised the definition of regulatory capital, established a new common equity Tier 1 capital requirement, set higher minimum capital ratio requirements, introduced a new capital conservation buffer of 2.5%, introduced a new countercyclical capital buffer (currently set at 0.0%) and updated the PCA framework. Compliance with certain aspects of the Basel III Capital Rule went into effect for Capital One as of January 1, 2014 and other provisions have gone or will go into effect according to various start dates and phase-in periods. As of January 1, 2014, the minimum risk-based and leverage capital requirements for Advanced Approaches banking organizations included a common equity Tier 1 capital ratio of at least 4.0%, a Tier 1 risk-based capital ratio of at least 5.5%, a total risk-based capital ratio of at least 8.0% and a Tier 1 leverage capital ratio of at least 4.0%. On January 1, 2015, the minimum risk-based capital ratio requirements increased to 4.5% for the common equity Tier 1 capital ratio and to 6.0% for the Tier 1 risk-based capital ratio, and the minimum requirements for the total risk-based capital ratio and Tier 1 leverage capital ratio remained the same. Both the capital conservation buffer and the countercyclical capital buffer are being phased-in over a transition period of four years that commenced on January 1, 2016. On January 1, 2014, we began to use the Basel III Capital Rule, with transition provisions, to calculate our regulatory capital, including for purposes of calculating our regulatory capital ratios. On January 1, 2015, we began to use the Basel III Standardized Approach for calculating our risk-weighted assets in our regulatory capital ratios.

The Basel III Capital Rule also introduced a new supplementary leverage ratio for all Advanced Approaches banking organizations with a minimum requirement of 3.0%. The supplementary leverage ratio compares Tier 1 capital to total leverage exposure, which includes all on-balance sheet assets and certain off-balance sheet exposures, including derivatives and unused commitments. The supplementary leverage ratio will become effective on January 1, 2018. As an Advanced Approaches banking organization, however, we were required to calculate and publicly disclose our supplementary leverage ratio beginning in the first quarter of 2015. For further information, see “MD&A—Capital Management.”

In July 2015 the Federal Reserve approved a final rule that imposes an additional common equity Tier 1 capital requirement on global systemically important banks (“G-SIBs”) that are based in the United States (“G-SIB Surcharge”). United States BHCs with total consolidated assets of $250 billion or more or total consolidated on-balance-sheet foreign exposure of $10 billion or more are required to determine annually whether they are considered to be a G-SIB for purposes of the G-SIB Surcharge. A BHC whose score using the prescribed methodology equals or exceeds 130 must maintain additional capital in an amount prescribed by the methodologies set out in the G-SIB Surcharge rule. We are not a G-SIB based on the most recent available data and thus we are not subject to a G-SIB Surcharge.

Market Risk Rule

The Market Risk Rule supplements both the Basel III Standardized Approach and the Basel III Advanced Approaches by requiring institutions subject to the Market Risk Rule to adjust their risk-based capital ratios to reflect the market risk in their trading portfolios. The Market Risk Rule applies to institutions with aggregate trading assets and liabilities equal to the lesser of:

See “MD&A—Market Risk Profile” below for additional information. We began reporting risk-based capital ratios, including market risk-weighted assets for the Company and CONA, pursuant to the Market Risk Rule for positions covered by such rule in the third quarter of 2016. The imposition of the rule did not have a material impact on the risk-based capital ratios of these two entities. As of December 31, 2016, COBNA is not subject to the Market Risk Rule.

Basel III and United States Liquidity Rules

The Basel Committee has published a liquidity framework, which includes two standards for liquidity risk supervision, each subject to observation periods and transitional arrangements. One standard, the liquidity coverage ratio (“LCR”), seeks to promote short-term resilience by requiring organizations to hold sufficient high-quality liquid assets to survive a stress scenario lasting for 30

days. The other standard, the net stable funding ratio (“NSFR”), seeks to promote longer-term resilience by requiring sufficient stable funding over a one-year period based on the liquidity characteristics of its assets and activities.

In September 2014, the Federal Banking Agencies issued final rules implementing the LCR in the United States. The rule (“LCR Rule”) applies to institutions with total consolidated assets of $250 billion or more or total consolidated on-balance sheet foreign exposure of $10 billion or more, and their respective consolidated subsidiary depository institutions with $10 billion or more in total consolidated assets. As a result, the Company and the Banks are subject to the LCR Rule. The rule requires the Company and each of the Banks to hold an amount of eligible high-quality, liquid assets that equals or exceeds 100% of their respective projected net cash outflows over a 30-day period, each as calculated in accordance with the LCR Rule. The LCR Rule phases in a minimum LCR standard as follows: 80% by January 1, 2015; 90% by January 1, 2016; and 100% by January 1, 2017 and thereafter. The LCR Rule came into effect in January 2015 and required us to calculate the LCR as of the last business day of each month from January 2015 through June 2016, and daily as of July 1, 2016. Each company subject to the LCR Rule is required to make quarterly public disclosures of its LCR and certain related quantitative liquidity metrics, along with a qualitative discussion of its LCR. The Company is required to comply with these disclosure requirements beginning April 1, 2018.

In April 2016, the Federal Banking Agencies issued an interagency notice of proposed rulemaking regarding the United States implementation of the Basel III NSFR (the “Proposed NSFR”), which would apply to the same institutions subject to the LCR Rule. The Proposed NSFR would require us to maintain a sufficient amount of stable funding in relation to our assets, derivatives exposures and commitments over a one-year horizon period. The Proposed NSFR would begin to take effect in January 2018. While the Proposed NSFR is generally consistent with the Basel NSFR standard, it is more stringent in certain areas. The financial and operational impact on us of a final NSFR rule remains uncertain until a final rule is published.

In general, United States implementation of the above capital and liquidity rules has increased capital and liquidity requirements for us and other institutions. We will continue to monitor regulators’ implementation of the new capital and liquidity rules and assess the potential impact to us.

FDICIA and Prompt Corrective Action

The FDICIA requires Federal Banking Agencies to take “prompt corrective action” for banks that do not meet minimum capital requirements. The FDICIA establishes five capital ratio levels: well capitalized; adequately capitalized; undercapitalized; significantly undercapitalized; and critically undercapitalized. The three undercapitalized categories are based upon the amount by which a bank falls below the ratios applicable to an adequately capitalized institution. The capital categories are determined solely for purposes of applying the FDICIA’s PCA provisions, and such capital categories may not constitute an accurate representation of the Banks’ overall financial condition or prospects.

As noted above, the Basel III Capital Rule updated the PCA framework to reflect new, higher regulatory capital minimums. For an insured depository institution to be well capitalized, it must maintain a total risk-based capital ratio of 10% or more; a Tier 1 capital ratio of 8% or more; a common equity Tier 1 capital ratio of 6.5% or more; and a leverage ratio of 5% or more. An adequately capitalized depository institution must maintain a total risk-based capital ratio of 8% or more; a Tier 1 capital ratio of 6% or more; a common equity Tier 1 capital ratio of 4.5% or more; a leverage ratio of 4% or more; and, for Basel III Advanced Approaches institutions, a supplementary leverage ratio, which incorporates a broader set of exposures as noted above, of 3% or more. The revised PCA requirements became effective on January 1, 2015, other than the supplementary leverage ratio, which becomes effective on January 1, 2018. As of December 31, 2016, each of the Banks met the requirements for a well capitalized institution.

Under applicable regulations for 2014, an insured depository institution was considered to be well capitalized if it maintained a total risk-based capital ratio of at least 10%, a Tier 1 risk-based capital ratio of at least 6%, a Tier 1 leverage capital ratio of at least 5% and was not subject to any supervisory agreement, order or directive to meet and maintain a specific capital level for any capital measure. An insured depository institution was considered to be adequately capitalized if it maintained a total risk-based capital ratio of at least 8%, a Tier 1 risk-based capital ratio of at least 4% and a Tier 1 leverage capital ratio of at least 4% (3% for certain highly rated institutions), and did not otherwise meet the definition of well capitalized.

As an additional means to identify problems in the financial management of depository institutions, the FDICIA required the Federal Banking Agencies to establish certain non-capital safety and soundness standards. The standards relate generally to operations and management, asset quality, interest rate exposure and executive compensation. The Federal Banking Agencies are authorized to take action against institutions that fail to meet such standards.

As a BHC with total consolidated assets of $50 billion or more (a “covered company”), we are subject under the Dodd-Frank Act to certain enhanced prudential standards, including requirements that may be recommended by the Financial Stability Oversight Council (“Council”) and implemented by the Federal Reserve and other regulators. As a result, we are subject to more stringent standards and requirements than those applicable to smaller institutions. The Council may also issue recommendations to the Federal Reserve or other primary financial regulatory agencies to apply new or heightened standards to risky financial activities or practices.

The Federal Reserve and FDIC have issued rules requiring covered companies to implement resolution planning for orderly resolution in the event the Company faces material financial distress or failure. The FDIC issued similar rules regarding resolution planning applicable to the Banks. In addition, the OCC issued final guidelines in September 2016 that require the Banks to develop recovery plans detailing the actions they would take to remain a going concern when they experience considerable financial or operational stress, but have not deteriorated to the point that resolution is imminent.

The Federal Reserve established a rule that implements the requirement in the Dodd-Frank Act that the Federal Reserve conduct annual stress tests on the capacity of our capital to absorb losses as a result of adverse economic conditions. The stress test rule also implements the requirement that we conduct our own semiannual stress tests and requires us to publish the results of the stress tests on our website or other public forum. The OCC adopted a similar stress test rule to implement the requirement that each of the Banks conduct annual stress tests.

The Federal Reserve has finalized other rules implementing certain other aspects of the enhanced prudential standards under the Dodd-Frank Act, which were applicable to us beginning on January 1, 2015 (“Enhanced Standards Rule”). Under the Enhanced Standards Rule, we must meet liquidity risk management standards, conduct internal liquidity stress tests, and maintain a 30-day buffer of highly liquid assets, in each case, consistent with the requirements of the rule. These requirements are in addition to the LCR, discussed above in “Basel III and United States Liquidity Rules.” The Enhanced Standards Rule also requires that we comply with, and hold capital commensurate with, the requirements of, any regulations adopted by the Federal Reserve relating to capital planning and stress tests. Stress testing and capital planning regulations are discussed further below under “Dividends, Stock Repurchases and Transfers of Funds.” The Enhanced Standards Rule also requires that we establish and maintain an enterprise-wide risk management framework that includes a risk committee and a chief risk officer.

While not a requirement of the Dodd-Frank Act, the OCC established regulatory guidelines (“Heightened Standards Guidelines”) that apply heightened standards for risk management to large institutions subject to its supervision, including the Banks. The Heightened Standards Guidelines establish standards for the development and implementation by the Banks of a risk governance framework.

The Dodd-Frank Act also imposes new, more stringent standards and requirements with respect to bank and nonbank acquisitions and mergers and affiliate transactions. The Dodd-Frank Act also includes provisions related to corporate governance and executive compensation and new fees and assessments, among others.

Certain acquisitions of our capital stock may be subject to regulatory approval or notice under federal or state law. Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of our capital stock in excess of the amount that can be acquired without regulatory approval, including under the BHC Act and the Change in Bank Control Act.

Federal law and regulations prohibit any person or company from acquiring control of the Company or the Banks without, in most cases, prior written approval of the Federal Reserve or the OCC, as applicable. Control exists if, among other things, a person or company acquires more than 25% of any class of our voting stock or otherwise has a controlling influence over us. For a publicly traded BHC like us, a rebuttable presumption of control arises if a person or company acquires more than 10% of any class of our voting stock.

Additionally, COBNA and CONA are “banks” within the meaning of Chapter 13 of Title 6.1 of the Code of Virginia governing the acquisition of interests in Virginia financial institutions (“Financial Institution Holding Company Act”). The Financial Institution Holding Company Act prohibits any person or entity from acquiring, or making any public offer to acquire, control of a Virginia financial institution or its holding company without making application to, and receiving prior approval from, the Virginia Bureau of Financial Institutions.

Under the Federal Reserve’s capital planning rules applicable to large BHCs including us (commonly referred to as Comprehensive Capital Analysis and Review or “CCAR”), a BHC with total consolidated assets of $50 billion or more must submit a capital plan to the Federal Reserve on an annual basis that contains a description of all planned capital actions, including dividends or stock repurchases, over a nine-quarter planning horizon beginning with the fourth quarter of the calendar year prior to the submission of the capital plan (“CCAR cycle”). A covered BHC may take the proposed capital actions if the Federal Reserve does not object to the plan.

Dodd-Frank Act stress testing, described above in “Enhanced Prudential Standards and Other Requirements under the Dodd-Frank Act,” is a complementary exercise to CCAR. It is a forward-looking exercise conducted by the Federal Reserve and covered financial companies to help assess whether a company has sufficient capital to absorb losses and support operations during adverse economic conditions. The supervisory stress test, after incorporating a firm’s planned capital actions, is used for quantitative assessment in CCAR.

As part of its evaluation of a large BHC’s capital plan, the Federal Reserve will consider how comprehensive the plan is, the reasonableness of the assumptions, analysis and methodologies used therein to assess capital adequacy and the ability of the BHC to maintain capital above each minimum regulatory capital ratio on a pro forma basis under expected and stressful conditions throughout a planning horizon of at least nine quarters. The 2017 CCAR cycle will measure our capital levels under the Basel III Standardized Approach, with appropriate phase-in provisions applicable to Capital One. The Federal Reserve has indefinitely delayed incorporation of the Basel III Advanced Approaches into the capital planning and stress testing process. For the 2017 CCAR cycle, the Company must file its capital plan and stress testing results with the Federal Reserve by April 5, 2017, using data as of December 31, 2016. The Federal Reserve is expected to provide its objection or non-objection to the 2017 capital plan in June 2017. The Federal Reserve’s objection or non-objection applies to planned capital actions from the third quarter of 2017 through the end of the second quarter of 2018. The Company, along with other BHCs subject to the supplementary leverage ratio, must incorporate for the first time an estimate of its supplementary leverage ratio into its 2017 capital plan and stress tests.

For annual company-run stress tests, a covered BHC is required to disclose the results within 15 calendar days after the Federal Reserve discloses the results of the BHC’s supervisory stress test, unless that time period is extended by the Federal Reserve. For the mid-cycle company-run stress test, a BHC must disclose the results within 30 calendar days after the BHC submits the results of the test to the Federal Reserve, unless that time period is extended by the Federal Reserve.

The current capital planning and stress testing rules place supervisory focus on quarterly capital issuances and distributions by establishing a cumulative net distribution requirement. With certain limited exceptions, to the extent a BHC does not issue the amount of a given class of regulatory capital instrument that it projected in its capital plan, as measured on an aggregate basis beginning in the third quarter of the planning horizon, the BHC must reduce its capital distributions.

In December 2015, the Federal Reserve issued guidance on its supervisory expectations for the capital planning process, capital positions and modeling of “large and complex firms” such as the Company in connection with their capital planning and stress testing activities. In January 2017, the Federal Reserve issued revisions to its capital planning and stress testing rules for the 2017 cycle. Among other changes not applicable to Capital One, the revisions decrease the amount of capital a company subject to the quantitative requirements of CCAR can distribute to shareholders outside of an approved capital plan without seeking prior approval from the Federal Reserve (known as the “de minimis exception”). Beginning April 1, 2017, if a company does not receive an objection to its capital plan, it may distribute up to 0.25% of its tier 1 capital above the distributions in its capital plan, a reduction from the 1% of tier 1 capital permitted previously. The revisions also impose a “blackout period,” starting with the 2017 CCAR exercise, during the second calendar quarter on the ability of a firm subject to CCAR to submit prior notice of its intention to rely on the aforementioned de minimis exception or to submit a request for prior approval for a capital distribution that is not reflected in the firm’s capital plan for which it has received a non-objection from the Federal Reserve.

Historically, dividends from the Company’s direct and indirect subsidiaries have represented a major source of the funds we have used to pay dividends on our stock, make payments on corporate debt securities and meet our other obligations. There are various federal law limitations on the extent to which the Banks can finance or otherwise supply funds to us through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, provisions of Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. In general, federal and applicable state banking laws prohibit insured depository institutions, such as

the Banks, from making dividend distributions without first obtaining regulatory approval if such distributions are not paid out of available earnings or would cause the institution to fail to meet applicable capital adequacy standards.

Each of CONA and COBNA, as an insured depository institution, is a member of the DIF maintained by the FDIC. Through the DIF, the FDIC insures the deposits of insured depository institutions up to prescribed limits for each depositor. The FDIC sets a Designated Reserve Ratio (“DRR”) for the DIF. To maintain the DIF, member institutions may be assessed an insurance premium, and the FDIC may take action to increase insurance premiums if the DRR falls below its required level.

The Dodd-Frank Act reformed the management of the DIF in several ways. It raised the minimum DRR to 1.35% (from the former minimum of 1.15%); removed the upper limit on the DRR; required that the reserve ratio reach 1.35% by September 30, 2020; required the FDIC, when setting deposit insurance assessments, to offset the effect on small insured depository institutions of meeting the increased reserve ratio; and eliminated the requirement that the FDIC pay dividends from the DIF when the reserve ratio reached certain levels. The FDIC has set the DRR at 2% and, in lieu of dividends, has established progressively lower assessment rate schedules as the reserve ratio meets certain trigger levels. The Dodd-Frank Act also required the FDIC to change the deposit insurance assessment base from deposits to average total consolidated assets minus average tangible equity.

On March 15, 2016, the FDIC issued a final rule implementing Section 334(e) of the Dodd-Frank Act, which requires the FDIC to offset the effect on community banks of increasing the DIF reserve ratio from 1.15% to 1.35%. The rule imposes a new quarterly deposit insurance surcharge assessment, with an annual rate of 4.5 basis points, on insured depository institutions with assets of $10 billion or more, including the Banks. On August 30, 2016, the FDIC provided notice that the DIF Reserve Ratio exceeded the 1.15% threshold level, which triggered two changes in the deposit insurance assessments of the Banks. First, the initial assessment rates for all insured depository institutions, including the Banks, declined. Second, the surcharge assessment was applied. The FDIC has estimated that the reserve ratio will reach 1.35% by June 2018; however, under the final rule, if the reserve ratio does not reach 1.35% by December 31, 2018, the FDIC will impose a one-time shortfall assessment on March 31, 2019 on depository institutions subject to the surcharge, including the Banks.

Under regulations issued by the Federal Reserve, a BHC must serve as a source of financial and managerial strength to its subsidiary banks (the so-called “source of strength doctrine”). The Dodd-Frank Act codified this doctrine.

Under the “cross-guarantee” provision of the Financial Institutions Reform, Recovery and Enforcement Act of 1989 (“FIRREA”), insured depository institutions such as the Banks may be liable to the FDIC with respect to any loss incurred, or reasonably anticipated to be incurred, by the FDIC in connection with the default of, or FDIC assistance to, any commonly controlled insured depository institution. The Banks are commonly controlled within the meaning of the FIRREA cross-guarantee provision.

The Dodd-Frank Act provides the FDIC with liquidation authority that may be used to liquidate nonbank financial companies and BHCs if the Treasury Secretary, in consultation with the President and based on the recommendation of the Federal Reserve and another federal agency, determines that doing so is necessary, among other criteria, to mitigate serious adverse effects on United States financial stability. Upon such a determination, the FDIC would be appointed receiver and must liquidate the company in a way that mitigates significant risks to financial stability and minimizes moral hazard. The costs of a liquidation of a financial company would be borne by shareholders and unsecured creditors and then, if necessary, by risk-based assessments on large financial companies. The FDIC has issued rules implementing certain provisions of its liquidation authority and may issue additional rules in the future.

In December 2016, the Federal Reserve finalized rules designed to promote United States financial stability and orderly liquidation authority by requiring United States BHCs identified as G-SIBs to maintain outstanding a minimum amount of loss absorbing instruments, including a minimum amount of unsecured long-term debt, and related buffers. Capital One is not subject to this requirement because it is not currently identified as a G-SIB.

COBNA is subject to regulation in foreign jurisdictions where it operates, currently in the United Kingdom and Canada.

United Kingdom

In the United Kingdom, COBNA operates through COEP, which was established in 2000 and is an authorized payment institution regulated by the Financial Conduct Authority (“FCA”) under the Payment Services Regulations 2009 and the Financial Services and Markets Act 2000. COEP’s indirect parent, Capital One Global Corporation, is wholly-owned by COBNA and is subject to regulation by the Federal Reserve as an “agreement corporation” under the Federal Reserve’s Regulation K.

In April 2014, the FCA took over regulation of the U.K. consumer credit regime previously regulated by the Office of Fair Trading. The FCA’s regulatory purview includes credit card lending activities. In addition to enacting a new framework of rules from that date, the FCA only “semi-grandfathered” relevant firms, granting them where appropriate “interim” permissions for consumer credit related activities. COEP, in common with other market participants, was required to apply for “full” permissions for consumer credit related activities; such application was made in October 2015 and approval granted by FCA in September 2016.

Regulatory focus on Payment Protection Insurance (“PPI”) complaint handling has continued as PPI continues to be a key driver of consumer complaints to the Financial Ombudsman Service (“FOS”). In January 2015, the FCA announced it would gather evidence on current trends in PPI complaints to assess whether further interventions were required. In May 2015, the FCA also announced that it was considering whether further rules and/or guidance were required to deal with the impact of the decision in the case of Plevin v. Paragon Personal Finance (“Plevin”) to the effect that failure to disclose the amount of commission included in the price of the single premium PPI sold to the plaintiff created an unfair relationship between the lender and the borrower under section 140A of the Consumer Credit Act 1974. In November 2015, the FCA launched a consultation on proposed new rules relating to PPI complaint handling, including the introduction of a two-year deadline by which consumers would need to make their PPI complaints or else lose their right to have them assessed by firms or by the FOS. In August 2016, the FCA issued an additional consultation paper, providing feedback on responses it received to its November 2015 consultation and seeking views on suggested amendments to its proposed rules. Among other things, the amendments proposed inclusion of profit share in the assessment of whether a relationship is unfair and in any redress calculation. The FCA did not issue the proposed rules by the end of December 2016, but instead stated that it would make a further announcement in the first quarter of 2017.

In July 2016, the FCA published the final findings report for its Credit Card Market Study. The report confirmed that the FCA will seek certain remedies through new rules (subject to consultation).

COEP was a party to the Sentinel Card Protection (“SCP”) redress scheme which enabled customers who bought SCP provided by Affinion International Limited to seek compensation. The redress scheme became effective in August 2015 and closed to all claims on September 18, 2016.

On June 23, 2016 a public referendum was held and the U.K. voted to leave the European Union (“Brexit”). Although COEP has not seen any obvious signs of worsening in portfolio or headline economics as a result of the Brexit vote, this issue may continue to cause uncertainty in the macroeconomic environment affecting COEP.

Canada

In Canada, COBNA operates as an authorized foreign bank pursuant to the Bank Act (Canada) (“Bank Act”) and is permitted to conduct its credit card business in Canada through its Canadian branch, Capital One Bank (Canada Branch) (“Capital One Canada”). The primary regulator of Capital One Canada is the Office of the Superintendent of Financial Institutions Canada. Other regulators include the Financial Consumer Agency of Canada, the Office of the Privacy Commissioner of Canada, and the Financial Transactions and Reports Analysis Centre of Canada. Capital One Canada is subject to regulation under various Canadian federal laws, including the Bank Act and its regulations, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and the Personal Information Protection and Electronic Documents Act.

In September 2014, the Supreme Court of Canada (“Court”) released its decision in Bank of Montreal v. Marcotte. The Court found that certain provisions of Quebec provincial consumer protection legislation apply to credit cards issued by federally chartered banks. In October 2016, amendments to the Bank Act to modernize the financial consumer protection framework and reaffirm the intent to have exclusive national standards applicable to banks were tabled in Parliament, however in December 2016, such proposed amendments were removed from the proposed legislation. It is unclear when these amendments will be reintroduced and/or whether the amendments will be revised.

In April 2015, a voluntary agreement to reduce interchange fees among the Canadian federal government, MasterCard Canada and Visa Canada came into effect. The agreement contains a commitment to reduce interchange fees for consumer credit cards to an average of 1.5% and will remain in effect for 5 years. While the Canadian federal government acknowledges independent audit

findings that Visa and MasterCard have met their commitments to reduce interchange fees, the government will be conducting a further assessment of the fees charged by the networks and reviewing the effects of such fee reduction.

Each of our business segments operates in a highly competitive environment, and we face competition in all aspects of our business from numerous bank and non-bank providers of financial services.

Our Consumer Banking and Commercial Banking businesses compete with national, state and direct banks for deposits, commercial and auto loans, mortgages and trust accounts, as well as with savings and loan associations and credit unions for loans and deposits. Our competitors also include automotive finance companies, mortgage banking companies and other financial services providers that provide loans, deposits, and other similar services and products. In addition, we compete against non-depository institutions that are able to offer these products and services. Securities firms and insurance companies that elect to become financial holding companies may acquire banks and other financial institutions. Combinations of this type could significantly change the competitive environment in which we conduct business. The financial services industry is also likely to become more competitive as further technological advances enable more companies to provide financial services. These technological advances may diminish the importance of depository institutions and other financial intermediaries in the transfer of funds between parties. In addition, competition among direct banks is intense because online banking provides customers the ability to rapidly deposit and withdraw funds and open and close accounts in favor of products and services offered by competitors.

Technology/Systems

We leverage information technology to achieve our business objectives and to develop and deliver products and services that satisfy our customers’ needs. A key part of our strategic focus is the development and use of efficient, flexible computer and operational systems, such as cloud technology, to support complex marketing and account management strategies, the servicing of our customers, and the development of new and diversified products. We believe that the continued development and integration of these systems is an important part of our efforts to reduce costs, improve quality and provide faster, more flexible technology services. Consequently, we continuously review capabilities and develop or acquire systems, processes and competencies to meet our unique business requirements.

As part of our continuous efforts to review and improve our technologies, we may either develop such capabilities internally or rely on third-party outsourcers who have the ability to deliver technology that is of higher quality, lower cost, or both. We continue to rely on third-party outsourcers to help us deliver systems and operational infrastructure. These relationships include (but are not limited to): Amazon Web Services, Inc. (“AWS”) for our cloud infrastructure, Total System Services, Inc. (“TSYS”) for

processing services for our North American and U.K. portfolios of consumer, commercial and small business credit card accounts, and Fidelity Information Services (“FIS”) for certain of our banking systems.

To protect our systems and technologies, we employ security measures, backup and recovery systems and generally require the same of our third-party service providers. In addition, we perform a variety of vulnerability and penetration testing on the network, platforms, systems and applications used to provide our products and services, conducted internally and by independent third parties, in an effort to ensure the security of the systems and data and mitigate against known vulnerabilities and attacks.

As part of our overall and ongoing strategy to protect and enhance our intellectual property, we rely on a variety of protections, including copyrights, trademarks, trade secrets, patents and certain restrictions on disclosure, solicitation and competition. We also undertake other measures to control access to, or distribution of, our other proprietary information. Despite these precautions, it may be possible for a third party to copy or otherwise obtain and use certain intellectual property or proprietary information without authorization. Our precautions may not prevent misappropriation or infringement of our intellectual property or proprietary information. In addition, our competitors and other third parties also file patent applications for innovations that are used in our industry. The ability of our competitors and other third parties to obtain such patents may adversely affect our ability to compete. Conversely, our ability to obtain such patents may increase our competitive advantage and/or preserve our freedom to operate certain technologies via cross-licenses or other arrangements with third parties. There can be no assurance that we will be successful in such efforts, or that the ability of our competitors to obtain such patents may not adversely impact our financial results.

From time to time, we have made and will make forward-looking statements, including those that discuss, among other things, strategies, goals, outlook or other non-historical matters; projections, revenues, income, returns, expenses, capital measures, accruals for claims in litigation and for other claims against us; earnings per share or other financial measures for us; future financial and operating results; our plans, objectives, expectations and intentions; and the assumptions that underlie these matters.

To the extent that any such information is forward-looking, it is intended to fit within the safe harbor for forward-looking information provided by the Private Securities Litigation Reform Act of 1995.

Numerous factors could cause our actual results to differ materially from those described in such forward-looking statements, including, among other things:

This section highlights specific risks that could affect our business. Although we have tried to discuss all material risks of which we are aware at the time this Report has been filed, other risks may prove to be important in the future, including those that are

not currently ascertainable. In addition to the factors discussed elsewhere in this Report, other factors that could cause actual results to differ materially from our forward looking statements include:

Changes And Instability In The Macroeconomic Environment May Adversely Affect Our Industry, Business, Results Of Operations And Financial Condition.

We offer a broad array of financial products and services to consumers, small businesses and commercial clients. We market our credit card products on a national basis throughout the United States, Canada and the United Kingdom and offer banking and other services in many regions within the United States. A prolonged period of slow economic growth or a significant deterioration in economic conditions in the United States or one of these countries could have a material adverse effect on our financial condition and results of operations as customers default on their loans or maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity.

Although certain economic conditions in the United States have generally recovered in recent years, the macroeconomic environment remains unstable and uneven, and the U.S. economy remains susceptible to global events and volatility. Geopolitical matters, including international political unrest or disturbances, continued concerns over energy prices, and economic instability or recession in certain regions, may impact the stability of financial markets and the U.S. economy.

Some of the risks we may face in connection with adverse changes and instability in macroeconomic environment include the following:

Compliance With New And Existing Laws, Regulations And Regulatory Expectations May Increase Our Costs, Reduce Our Revenue, Limit Our Ability To Pursue Business Opportunities And Increase Compliance Challenges.

Legislation and regulation with respect to the financial services industry has increased in recent years, and we expect that oversight of our business may continue to expand in scope and complexity. A wide and increasing array of banking and consumer lending laws apply to almost every aspect of our business. Failure to comply with these laws and regulations could result in financial, structural and operational penalties, including significant fines and criminal sanctions, and could result in negative publicity or damage to our reputation with regulators or the public. In addition, establishing systems and processes to achieve compliance with these laws and regulations may increase our costs and limit our ability to pursue certain business opportunities.

We are subject to heightened regulatory oversight by the federal banking regulators to ensure that we build systems and processes that are commensurate with the nature of our business and that meet the heightened risk management and enhanced prudential standards issued by our regulators. For example, over the last several years, state and federal regulators have focused on compliance with the Bank Secrecy Act and anti-money laundering laws, data integrity and security, use of service providers, fair lending and other consumer protection issues. In July 2015, Capital One entered into a consent order with the OCC to address concerns about our anti-money laundering (“AML”) program (“AML Program”). Although we are making substantial progress in taking the steps and making the improvements required by the OCC consent order, we expect heightened oversight of our AML Program will continue for the foreseeable future.

We have a large number of customer accounts in our credit card and auto lending businesses and we have made the strategic choice to originate and service subprime credit cards and auto loans which typically have higher delinquencies and charge-offs than prime customers. Accordingly, we have significant involvement with credit bureau reporting and the collection and recovery of delinquent and charged-off debt, primarily through customer communications, the filing of litigation against customers in default, the periodic sale of charged-off debt and vehicle repossession. The banking industry is subject to enhanced legal and regulatory scrutiny regarding credit bureau reporting and debt collection practices from regulators, courts and legislators. Any future changes to our business practices in these areas, including our debt collection practices, whether mandated by regulators, courts, legislators or otherwise, or any legal liabilities resulting from our business practices, including our debt collection practices, could have a material adverse impact on our financial condition.

The legislative and regulatory environment is beyond our control, may change rapidly and unpredictably and may negatively influence our revenue, costs, earnings, growth, liquidity and capital levels. In addition, some rules and regulations may be subject

to litigation or other challenges that delay or modify their implementation and impact on us. Following the November 2016 federal elections, we expect a higher volume of legislative and regulatory activity. These activities may include changes to the corporate tax code and the Dodd-Frank Act, as well as changes in leadership of key bank regulatory agencies that could change the regulatory, supervisory, or enforcement activity of these agencies. For example, legislative changes to the corporate tax code could result in material impacts to our results of operations due to changes to the valuation of our deferred tax assets, the valuation of other tax assets, customer behavior, tax expense and the effective tax rate.

Certain laws and regulations, and any interpretations and applications with respect thereto, may benefit consumers, borrowers and depositors, but not stockholders. Our success depends on our ability to maintain compliance with both existing and new laws and regulations. For a description of the material laws and regulations to which we are subject, please refer to “Part I—Item 1. Business—Supervision and Regulation.”

We May Experience Increased Delinquencies, Credit Losses, Inaccurate Estimates And Inadequate Reserves.

Like other lenders, we face the risk that our customers will not repay their loans. Rising losses or leading indicators of rising losses (such as higher delinquencies, higher rates of non-performing loans, higher bankruptcy rates, lower collateral values or elevated unemployment rates) may require us to increase our allowance for loan and lease losses, which may degrade our profitability if we are unable to raise revenue or reduce costs to compensate for higher losses. In particular, we face the following risks in this area:

We May Experience Increased Losses And Inadequate Reserves Associated With Mortgage Repurchases And Indemnification Obligations.

Certain of our subsidiaries, including GreenPoint Mortgage Funding, Inc. (“GreenPoint”), Capital One Home Loans, LLC and Capital One, N.A., as successor to Chevy Chase Bank (“CCB”), may be required to repurchase mortgage loans that have been sold to investors in the event there are breaches of certain representations and warranties contained within the sales agreements. We may be required to repurchase mortgage loans that we sell to investors in the event that there was improper underwriting or fraud or in the event that the loans become delinquent shortly after they are originated. These subsidiaries also may be required to indemnify certain purchasers and others against losses they incur in the event of breaches of representations and warranties and in various other circumstances, including securities fraud or other public disclosure-related claims, and the amount of such losses could exceed the repurchase amount of the related loans. Consequently, we may be exposed to credit risk associated with sold loans.

We have established reserves in our consolidated financial statements for potential losses that are considered to be both probable and reasonably estimable related to the mortgage loans sold by our originating subsidiaries. The adequacy of the reserve and the ultimate amount of losses incurred will depend on, among other things, the actual future mortgage loan performance, the actual level of future repurchase and indemnification requests, the actual success rate of claimants, developments in litigation and the

regulatory environment related to us and the industry, actual recoveries on the collateral, and macroeconomic conditions (including unemployment levels and housing prices). Due to uncertainties relating to these factors, there can be no assurance that our reserves will be adequate or that the total amount of losses incurred will not have a material adverse effect upon our financial condition or results of operations.

In addition to the subsidiaries discussed above, we originate, sell and service commercial mortgage loans that meet underwriting guidelines established by government-sponsored enterprises (“GSEs”). We are required to meet minimum collateral requirements and share a limited portion of the risk of loss during the remaining terms of these loans. The GSEs may change their collateral requirements for these loans in the future and also increase our loss-sharing obligations if the loans do not meet specific underwriting criteria or default within certain time periods following their sale to the GSEs. Our liability associated with these loss-sharing agreements may not be sufficient to cover any future losses from these loans. We may also be required to share additional losses with GSEs if loan defaults increase, which could impact our results of operations and liquidity.

We May Not Be Able To Maintain Adequate Capital Or Liquidity Levels, Which Could Have A Negative Impact On Our Financial Results And Our Ability To Return Capital To Our Shareholders.

As a result of the Dodd-Frank Act and the United States implementation of international accords, financial institutions are subject to new and increased capital and liquidity requirements, and we expect further changes to these regulations. Although United States regulators have finalized regulations for many of these requirements, continued uncertainty remains as to the form additional new requirements will take or how and when they will apply to us. As a result, it is possible that we could be required to increase our capital and/or liquidity levels above the levels assumed in our current financial plans. These new requirements could have a negative impact on our ability to lend, grow deposit balances or make acquisitions and limit our ability to make most capital distributions. Higher capital levels also lower our return on equity.

In addition, as described further above in “Part I—Item 1. Business—Supervision and Regulation,” for regulatory capital purposes we entered parallel run on January 1, 2015. We will become subject to the Basel III Advanced Approaches framework for purposes of determining our regulatory capital requirements once we receive regulatory approval to do so, although the exact timing of when such approval may be granted is uncertain. Although we have current estimates of risk-weighted asset calculations under that framework, there remains uncertainty around future regulatory interpretations of certain aspects of those calculations. Moreover, the so-called Collins Amendment to the Dodd-Frank Act, as implemented in the Basel III Capital Rule, establishes a capital floor so that organizations subject to the Basel III Advanced Approaches may not hold less capital than would be required using the Basel III Standardized Approach capital calculations. Additionally, the Basel Committee on Banking Supervision continues to evaluate modifications to the Standardized and Advanced Approaches which, if finalized by the Basel Committee and thereafter implemented by the United States federal banking agencies, could alter regulatory capital requirements. Therefore, we cannot assure you that our current estimates will be correct, and we may need to hold significantly more regulatory capital in the future than we currently estimate to maintain a given capital ratio.

We consider various factors in the management of capital, including the impact of stress on our capital levels, as determined by both our internal modeling and the Federal Reserve’s modeling of our capital position in CCAR. In recent capital planning and stress testing cycles, we have observed a large difference between our estimates of our capital levels under stress and the Federal Reserve’s estimates of our capital levels under stress. Therefore, although our estimated capital levels under stress suggest that we

have substantial capacity to return capital to shareholders and remain well capitalized under stress, it is possible that the Federal Reserve’s modeling may result in a materially lower capacity to return capital to shareholders than our estimates. This in turn could lead to restrictions on our ability to pay dividends and engage in share repurchase transactions. See “Part I—Item 1. Business—Supervision and Regulation” for additional information.

We Face Risks Related To Our Operational, Technological And Organizational Infrastructure.

Our ability to retain and attract new customers depends on our ability to build or acquire necessary operational, technological and organizational infrastructure or adapt to technological advances involving such infrastructure, which can be a challenge due to the fast pace of digital transformation and advances. We are embedding technology, data and software development deeply into our business model and how we work.

Similar to other large corporations, we are exposed to operational risk that can manifest itself in many ways, such as errors related to failed or inadequate processes, inaccurate models, faulty or disabled computer systems, fraud by employees or persons outside of our company and exposure to external events. In addition, we are heavily dependent on the strength, capability and continuous availability of the technology systems that we use to manage our internal financial and other systems, interface with our customers and develop and implement effective marketing campaigns.

In addition, our businesses are dependent on our ability to process, record and monitor a large number of complex transactions. If any of our financial, accounting or other data processing systems fail or have other significant shortcomings, our business and reputation could be materially adversely affected. We may also be subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control, which may include, for example, computer viruses or electrical or telecommunications outages, cyber-attacks, including Distributed Denial of Service (“DDOS”) attacks discussed below, natural disasters, other damage to property or physical assets or events arising from local or larger scale politics, including terrorist acts. Any of these occurrences could diminish our ability to operate our businesses, service customer accounts and protect customers’ information, or result in potential liability to customers, reputational damage, regulatory intervention and customers’ loss of confidence in our businesses, any of which could result in a material adverse effect.

We also rely on the business infrastructure and systems of third parties with which we do business and to whom we outsource the maintenance and development of operational and technological functionality. For example, we are in the process of migrating a number of our core systems and customer-facing applications to Amazon Web Services, Inc., a third party cloud infrastructure platform. If we do not execute the transition to these new environments in a well-managed, secure and effective manner, we may experience unplanned service disruption or unforeseen costs which may harm our business and operating results. In addition, our cloud infrastructure providers, or other service providers, could experience system breakdowns or failures, outages, downtime, cyber-attacks, adverse changes to financial condition, bankruptcy or other adverse conditions, which could have a material adverse effect on our business and reputation. Thus, our plans to increase the amount of our infrastructure that we outsource to “the cloud” or to other third parties may increase our risk exposure.

Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones and to run our business in compliance with applicable laws and regulations depends on the functionality and reliability of our operational and technology systems. Any disruptions, failures or inaccuracies of our operational and technology systems and models, including those associated with improvements or modifications to such systems and models, could cause us to be unable to market and manage our products and services, manage our risk, meet our regulatory obligations or report our financial results in a timely and accurate manner, all of which could have a negative impact on our results of operations. In addition, our ongoing investments in infrastructure, which are necessary to maintain a competitive business, integrate acquisitions and establish scalable operations, may increase our expenses. As our business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business strategies, management of outsourced services, asset purchases or other acquisitions, structural reorganization, compliance with new laws or regulations or the integration of newly acquired businesses. If we are unable to successfully manage our expenses, our financial results will be negatively affected.

We Could Incur Increased Costs Or Reductions In Revenue Or Suffer Reputational Damage And Business Disruptions In The Event Of The Theft, Loss Or Misuse Of Information, Including As A Result Of A Cyber-Attack.

Our products and services involve the gathering, management, processing, storage and transmission of sensitive and confidential information regarding our customers and their accounts, our employees and other third parties with which we do business. Our ability to provide such products and services, many of which are web-based, depends upon the management and safeguarding of

information, software, methodologies and business secrets. To provide these products and services, we use information systems and infrastructure, including digital technologies, computer and email systems, software, networks and other web-based technologies, that we and third-party service providers operate. We also have arrangements in place with third parties through which we share and receive information about their customers who are or may become our customers.

Like other financial services firms, technologies, systems, networks and devices of Capital One or our customers, employees, service providers or other third parties with whom we interact continue to be the subject of attempted unauthorized access, mishandling or misuse of information, computer viruses or malware, phishing or other forms of social engineering, and other forms of cyber-attacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, denial of service attacks and other events. These threats may derive from human error, fraud or malice on the part of our employees or third parties or may result from accidental technological failure. Any of these parties may also attempt to fraudulently induce employees, customers or other third-party users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or third parties with whom we interact. Further, cyber and information security risks for large financial institutions like us have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other external parties. In addition, to access our products and services, our customers may use computers, smartphones, tablet PCs and other mobile devices that are beyond our security control systems.

If our information systems or infrastructure or those of our customers, partners, service providers or other market participants experience a significant disruption or breach, it could lead, depending on the nature of the disruption or breach, to the unauthorized access to and release, gathering, monitoring, misuse, loss or destruction of our confidential information or personal or confidential information of our customers, employees or other third parties in our possession. Further, such disruption or breach could also result in unauthorized access to our proprietary information, software, methodologies and business secrets and in unauthorized transactions in Capital One accounts or unauthorized access to personal or confidential information maintained by those entities. For example, there has been a significant proliferation of consumer information available on the Internet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. While Capital One was not directly involved in these third-party breach events, the stolen information can create a vulnerability for our customers if their Capital One log-in credentials are the same as or similar to the credentials that have been compromised on other sites. This vulnerability could include the risk of unauthorized account access, data loss and fraud. The use of automation software, or “bots,” can increase the velocity and efficacy of these types of attacks.

As a financial institution, we are subject to and examined for compliance with an array of data protection laws, regulations and guidance, as well as to our own internal privacy and information security policies and programs. However, because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, we and our third-party service providers and partners may be unable to anticipate certain attack methods in order to implement effective preventative measures or mitigate or remediate the damages caused in a timely manner. We may also be unable to hire and develop talent capable of detecting, mitigating or remediating these risks. Although we believe we have a robust suite of authentication and layered information security controls, including our cyber threat analytics, data encryption and tokenization technologies, anti-malware defenses and vulnerability management program, any one or combination of these controls could fail to detect, mitigate or remediate these risks in a timely manner.

A disruption or breach such as those discussed above could result in significant legal and financial exposure, regulatory intervention, remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business. We and other U.S. financial services providers continue to be targeted with evolving and adaptive cybersecurity threats from sophisticated third parties. Although we have not experienced any material losses relating to cyber incidents, there can be no assurance that unauthorized access or cyber incidents will not occur or that we will not suffer such losses in the future. Unauthorized access or cyber incidents could occur more frequently and on a more significant scale. If future attacks like these are successful or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services. In addition, a breach or attack affecting one of our third-party service providers or partners could harm our business even if we do not control the service that is attacked.

In addition, the increasing prevalence and the evolution of cyber-attacks and other efforts to breach or disrupt our systems or those of our partners, retailers or other market participants has led, and will likely continue to lead, to increased costs to us with respect to preventing, mitigating and remediating these risks, as well as any related attempted fraud. We may be required to expend

significant additional resources to continue to modify or strengthen our protective security measures, investigate and remediate any vulnerabilities of our information systems and infrastructure or invest in new technology designed to mitigate security risks. For example, various retailers have continued to be victims of cyber-attacks in which customer data, including debit and credit card information, was obtained. In these situations, we incur a variety of costs, including those associated with replacing the compromised cards and remediating fraudulent transaction activity. Further, successful cyber-attacks at other large financial institutions or other market participants, whether or not we are impacted, could lead to a general loss of customer confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the financial system in general which could result in reduced use of our financial products. Though we have insurance against some cyber-risks and attacks, it may not be sufficient to offset the impact of a material loss event.

Our Businesses Are Subject To The Risk Of Increased Litigation, Government Investigations And Regulatory Enforcement.

Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry, the structure of the credit card industry and business practices in the mortgage lending business. Given the inherent uncertainties involved in litigation, government investigations and regulatory enforcement decisions, and the very large or indeterminate damages sought in some matters asserted against us, there can be significant uncertainty as to the ultimate liability we may incur from these kinds of matters. The finding, or even the assertion, of substantial legal liability against us could have a material adverse effect on our business and financial condition and could cause significant reputational harm to us, which could seriously harm our business.

In addition, financial institutions, including us, have faced significant regulatory scrutiny over the past several years, which has increasingly led to public enforcement actions. We and our subsidiaries are subject to comprehensive regulation and periodic examination by the Federal Reserve, the SEC, OCC, FDIC and CFPB. We have been subject to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including governmental inquiries, investigations and enforcement proceedings, including by the Department of Justice. We expect that regulators and governmental enforcement bodies will continue taking formal enforcement actions against financial institutions in addition to addressing supervisory concerns through non-public supervisory actions or findings, which could involve restrictions on our activities, among other limitations that could adversely affect our business. Litigation, government investigations and other regulatory actions generally could subject us to significant fines, increased expenses, restrictions on our activities and damage to our reputation and our brand, and could adversely affect our business, financial condition and results of operations.

We Face Intense Competition In All Of Our Markets.

We operate in a highly competitive environment, both in making loans and attracting deposits, and we expect competitive conditions to continue to intensify with respect to most of our products. We compete on the basis of the rates we pay on deposits and the rates and other terms we charge on the loans we originate or purchase, as well as the quality and range of our customer service, products, innovation and experience. Price competition for loans might result in origination of fewer loans or earning less on our loans. In our credit card business, competition for rewards customers may result in higher rewards expenses, or we may fail to attract new customers or retain existing rewards customers due to increasing competition for these consumers.

Some of our competitors are substantially larger than we are, which may give those competitors advantages, including a more diversified product and customer base, the ability to reach out to more customers and potential customers, operational efficiencies, more versatile technology platforms, the ability to innovate faster, broad-based local distribution capabilities, lower-cost funding and larger existing branch networks. In addition, some of our competitors, including new and emerging competitors in the digital and mobile payments space and other financial technology providers, are not subject to the same regulatory requirements or legislative scrutiny to which we are subject, which also could place us at a competitive disadvantage. Many of our competitors are also focusing on cross-selling their products and developing new products or technologies, which could affect our ability to maintain or grow existing customer relationships or require us to offer lower interest rates or fees on our lending products or higher interest rates on deposits. This increasingly competitive environment is primarily a result of changes in regulation, changes in technology and product delivery systems, as well as the consolidation of financial service providers, all of which may affect our customers’ expectations and demands.

We have expanded our credit card partnership business over the past several years with the additions of a number of credit card partnerships. The market for key business partners, especially in the credit card business, is very competitive, and we may not be able to grow or maintain these partner relationships. We face the risk that we could lose partner relationships, even after we have invested significant resources, time and expense into acquiring and developing the relationships. The loss of any of our key business partners could have a negative impact on our results of operations, including lower returns, excess operating expense and excess funding capacity.

In addition, the global payments industry is highly competitive and is rapidly changing and increasingly subject to regulatory scrutiny. We compete with all forms of payments, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital currencies, prepaid systems and payment services targeting users of social networks and online gaming (including those offering billing to the consumer’s mobile phone account). If we are unable to continue to keep pace with innovation, our business and results of operations could be adversely affected.

In such a competitive environment, we may lose entire accounts or may lose account balances to competing firms, or we may find it more costly to maintain our existing customer base. Customer attrition from any or all of our lending products, together with any lowering of interest rates or fees that we might implement to retain customers, could reduce our revenues and therefore our earnings. Similarly, unexpected customer attrition from our deposit products, in addition to an increase in rates or services that we may offer to retain those deposits, may increase our expenses and therefore reduce our earnings.

Our Business, Financial Condition And Results Of Operations May Be Adversely Affected By Merchants’ Increasing Focus On The Fees Charged By Credit Card Networks And By Regulation And Legislation Impacting Such Fees.

Credit card interchange fees are generally one of the largest components of the costs that merchants pay in connection with the acceptance of credit cards and are a meaningful source of revenue for our credit card businesses. Interchange fees are the subject of significant and intense global legal, regulatory and legislative focus, and the resulting decisions, regulations and legislation may have a material adverse impact on our overall business, financial condition and results of operations.

Regulators and legislative bodies in a number of countries are seeking to reduce credit card interchange fees through legislation, competition-related regulatory proceedings, central bank regulation and or litigation. Interchange reimbursement rates in the United States are set by credit card networks such as MasterCard and Visa. In some jurisdictions, such as Canada and certain countries in the European Union, interchange fees and related practices are subject to regulatory activity that have limited the ability of certain networks to establish default rates, including in some cases imposing caps on permissible interchange fees. We have already experienced these impacts in our international credit card portfolio. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the payments industry. Consequently, a development in one country, state or region may influence regulatory approaches in another, such as our primary market, the United States.

Some major retailers may have sufficient bargaining power to independently negotiate lower interchange fees with MasterCard and Visa, which could, in turn, result in lower interchange fees for us when our cardholders undertake purchase transactions with these retailers. In 2016, some of the largest merchants individually negotiated lower interchange rates with MasterCard and/or Visa. These and other merchants also continue to lobby aggressively for caps and restrictions on interchange fees and there can be no assurance that their efforts will not be successful or that they will not in the future bring legal proceedings against us or other credit card and debit card issuers and networks.

Beyond pursuing litigation, legislation and regulation, merchants may also promote forms of payment with lower fees, such as ACH-based payments, or seek to impose surcharges at the point of sale for use of credit or debit cards. New payment systems, particularly mobile-based payment technologies, could also gain widespread adoption and lead to issuer transaction fees or the displacement of credit card accounts as a payment method.

If We Are Not Able To Invest Successfully In And Introduce Digital And Other Technological Developments Across All Our Businesses, Our Financial Performance May Suffer.

Our industry is subject to rapid and significant technological changes and our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings. We expect digital technologies to have a significant impact on banking over time. Consumers increasingly expect robust digital experiences from their financial services providers. The ability for customers to access their accounts and conduct financial transactions using digital technology, including mobile applications, is an increasingly important aspect of the financial services industry and it impacts our ability to deliver products and services to our customers. To that end, financial institutions are rapidly introducing new digital and other technology-driven products and services, which aim to offer a better customer experience and to reduce costs. We continue to invest in digital technology designed to attract new customers, facilitate the ability of existing customers to conduct financial transactions and enhance the customer experience related to our products and services.

We May Fail To Realize All Of The Anticipated Benefits Of Our Mergers, Acquisitions And Strategic Partnerships.

We have engaged in merger and acquisition activity and entered into strategic partnerships over the past several years and may continue to engage in such activity in the future. We continue to evaluate and anticipate engaging in, among other merger and acquisition activity, additional strategic partnerships and selected acquisitions of financial institutions and other financial assets, including credit card and other loan portfolios.

Any merger, acquisition or strategic partnership we undertake entails certain risks, which may materially and adversely affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our existing operations or are not able to achieve the anticipated benefits of any merger, acquisition or strategic partnership, including cost savings and

other synergies, our business could be negatively affected. In addition, it is possible that the ongoing integration processes could result in the loss of key employees, errors or delays in systems implementation, the disruption of our ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect our ability to maintain relationships with partners, clients, customers, depositors and employees or to achieve the anticipated benefits of any merger, acquisition or strategic partnership. Integration efforts also may divert management attention and resources. These integration matters may have an adverse effect on us during any transition period.

In addition, we may face the following risks in connection with any merger, acquisition or strategic partnership:

Reputational Risk And Social Factors May Impact Our Results And Damage Our Brand.

Our ability to originate and maintain accounts is highly dependent upon the perceptions of consumer and commercial borrowers and deposit holders and other external perceptions of our business and compliance practices or our financial health. In addition, our brand has historically been, and we expect it to continue to be, very important to us. Maintaining and enhancing our brand will depend largely on our ability to continue to provide high-quality products and services. Adverse perceptions regarding our reputation in the consumer, commercial and funding markets could lead to difficulties in generating and maintaining accounts as well as in financing them. In particular, negative public perceptions regarding our reputation could lead to decreases in the levels of deposits that consumer and commercial customers and potential customers choose to maintain with us or significantly increase the costs of attracting and retaining customers. In addition, negative perceptions regarding certain industries or clients could also prompt us to cease business activities associated with those industries or clients.

Negative public opinion or damage to our brand could also result from actual or alleged conduct in any number of activities or circumstances, including lending practices, regulatory compliance, security breaches (including the use and protection of customer information), corporate governance, and sales and marketing, and from actions taken by regulators or other persons in response to such conduct. Such conduct could fall short of our customers’ and the public’s heightened expectations of companies of our size with rigorous data, privacy and compliance practices, and could further harm our reputation. In addition, third parties with whom we have important relationships may take actions over which we have limited control that could negatively impact perceptions about us or the financial services industry. The proliferation of social media may increase the likelihood that negative public opinion from any of the events discussed above will impact our reputation and business.

In addition, a variety of social factors may cause changes in borrowing activity, including credit card use, payment patterns and the rate of defaults by accountholders and borrowers domestically and internationally. These social factors include changes in consumer confidence levels, the public’s perception regarding consumer debt, including credit card use, and changing attitudes about the stigma of bankruptcy. If consumers develop or maintain negative attitudes about incurring debt, or if consumption trends decline or if we fail to maintain and enhance our brand, or we incur significant expenses in this effort, our business and financial results could be materially and negatively affected.

If We Are Not Able To Protect Our Intellectual Property, Our Revenue And Profitability Could Be Negatively Affected.

We rely on a variety of measures to protect and enhance our intellectual property, including copyrights, trademarks, trade secrets, patents and certain restrictions on disclosure, solicitation and competition. We also undertake other measures to control access to and distribution of our other proprietary information. These measures may not prevent misappropriation of our proprietary information or infringement of our intellectual property rights and a resulting loss of competitive advantage. In addition, our competitors or other third parties may file patent applications for innovations that are used in our industry or allege that our systems, processes or technologies infringe on their intellectual property rights. If our competitors or other third parties are successful in obtaining such patents or prevail in intellectual property-related litigation against us, we could lose significant revenues, incur significant license, royalty or technology development expenses, or pay significant damages.

There Are Risks Resulting From The Extensive Use Of Models In Our Business.

We rely on quantitative models to aggregate and assess our various risk exposures and to estimate certain financial values. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as to estimate the value of financial instruments and balance sheet items. Poorly designed or implemented models present the risk that our business decisions based on information incorporating models will be adversely affected due to the inadequacy of modeled results. Also, information we provide to the public or to our regulators based on poorly designed or implemented models could be inaccurate or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our shareholders, could be affected adversely due to the perception that the quality of the models used to generate the relevant information is insufficient. Any issues with the quality or effectiveness of our data aggregation and validation procedures, as well as the quality and integrity of data inputs, could result in ineffective risk management practices or inaccurate risk reporting. If our risk management framework proves ineffective, we could suffer unexpected losses which could materially adversely affect our results of operation or financial condition.

Our Risk Management Strategies May Not Be Fully Effective In Mitigating Our Risk Exposures In All Market Environments Or Against All Types Of Risk.

Management of risk, including market, credit, liquidity, compliance and strategic risks, requires, among other things, policies and procedures to record properly and verify a large number of transactions and events. See “MD&A—Risk Management” for further details. We have devoted significant resources to developing our risk management policies and procedures and expect to continue to do so in the future. Nonetheless, our risk management strategies may not be fully effective in identifying and mitigating our risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if our models for assessing risk are properly designed and implemented.

Some of our methods of managing risk are based upon our use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than the historical measures indicate. For example, market conditions during the financial crisis involved unprecedented dislocations and highlight the limitations inherent in using historical information to manage risk. In addition, credit risk is inherent in the financial services business and results from, among other things, extending credit to customers. Our ability to assess the creditworthiness of our customers may be impaired if the models and approaches we use to select, manage and underwrite our consumer and commercial customers become less predictive of future charge-offs (due, for example, to rapid changes in the economy, including the unemployment rate).

While we employ a broad and diversified set of risk monitoring and risk mitigation techniques, those techniques and the judgments that accompany their application cannot anticipate every economic and financial outcome or the timing of such outcomes. For example, our ability to implement our risk management strategies may be hindered by adverse changes in the volatility or liquidity conditions in certain markets and as a result, may limit our ability to distribute such risks (for instance, when we seek to syndicate

exposure in bridge financing transactions we have underwritten). We may, therefore, incur losses in the course of our risk management or investing activities.

Changes In Consumer Behavior And Their Adoption of Digital Technology May Change Retail Distribution Strategies And May Adversely Impact Our Investments In Our Bank Premises And Equipment And Other Retail Distribution Assets, Lead To Increased Expenditures And Expose Us To Additional Risk.

We have significant investments in bank premises and equipment for our branch network and other branch banking assets including our full service banking centers, parcels of land held for the development of future banking centers and our retail work force. Advances in technology such as digital and mobile banking, in-branch self-service technologies, proximity or remote payment technologies, as well as progressively changing customer preferences for these other methods of banking, could decrease the value of our branch network or other retail distribution assets. As a result, we may need to further change our retail distribution strategy and close, sell and/or renovate additional branches or parcels of land held for development and restructure or reduce our remaining branches and work force. These actions could lead to losses on these assets or could adversely impact the carrying value of other long-lived assets, reduce our revenues, increase our expenditures, dilute our brand and/or reduce customer demand for our products and services.

Fluctuations In Market Interest Rates Or Volatility In The Capital Markets Could Adversely Affect Our Income And Expense, The Value Of Assets And Obligations, Our Regulatory Capital, Cost Of Capital Or Our Liquidity.

We assess our interest rate risk by estimating the effect on our earnings under various scenarios that differ based on assumptions about the direction and the magnitude of interest rate changes. We take risk mitigation actions based on those assessments. We face the risk that changes in interest rates could materially reduce our net interest income and our earnings, especially if actual conditions turn out to be materially different than those we assumed. See “MD&A—Market Risk Management” for additional information.

Our Business Could Be Negatively Affected If We Are Unable To Attract, Retain And Motivate Skilled Senior Leaders.

Our success depends, in large part, on our ability to retain key senior leaders, and competition for such senior leaders is intense. The executive compensation provisions of the Dodd-Frank Act and the regulations issued thereunder, and any further legislation, regulation or regulatory guidance restricting executive compensation, may limit the types of compensation arrangements that we may enter into with our most senior leaders and could have a negative impact on our ability to attract, retain and motivate such leaders in support of our long-term strategy. These laws and regulations may not apply in the same manner to all financial institutions, and we therefore may face more restrictions than other institutions and companies with which we compete for talent. These laws

and regulations may also hinder our ability to compete for talent from other industries. If we are unable to retain talented senior leadership, our business could be negatively affected.

We Face Risks From Unpredictable Catastrophic Events.

Despite our substantial business contingency plans, the impact from natural disasters and other catastrophic events, including terrorist attacks, may have a negative effect on our business and infrastructure, including our information technology systems. In addition, if a natural disaster or other catastrophic event occurs in certain regions where our business and customers are concentrated, such as the mid-Atlantic and New York metropolitan area, we could be disproportionately impacted as compared to our competitors. The impact of such events and other catastrophes on the overall economy may also adversely affect our financial condition and results of operations.

We Face Risks From The Use Of Or Changes To Assumptions Or Estimates In Our Financial Statements.

Limitations On Our Ability To Receive Dividends From Our Subsidiaries Could Affect Our Liquidity And Ability To Pay Dividends And Repurchase Common Stock.

We are a separate and distinct legal entity from our subsidiaries, including the Banks. Dividends to us from our direct and indirect subsidiaries, including the Banks, have represented a major source of funds for us to pay dividends on our common and preferred stock, repurchase common stock, make payments on corporate debt securities and meet other obligations. There are various federal law limitations on the extent to which the Banks can finance or otherwise supply funds to us through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. If our subsidiaries’ earnings are not sufficient to make dividend payments to us while maintaining adequate capital levels, our liquidity may be affected and we may not be able to make dividend payments to our common or preferred stockholders, repurchase our common stock, make payments on outstanding corporate debt securities or meet other obligations, each and any of which could have a material adverse impact on our results of operations, financial position or perception of financial health.

The Soundness Of Other Financial Institutions And Other Third Parties Could Adversely Affect Us.

Our ability to engage in routine funding and other transactions could be adversely affected by the stability and actions of other financial services institutions. Financial services institutions are interrelated as a result of trading, clearing, servicing, counterparty and other relationships. We have exposure to an increasing number of financial institutions and counterparties. These counterparties include institutions that may be exposed to various risks over which we have little or no control, including European or U.S. sovereign debt that is currently or may become in the future subject to significant price pressure, rating agency downgrade or default risk.

In addition, we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients, resulting in a significant credit concentration with respect to the financial services industry overall. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions.

Likewise, adverse developments affecting the overall strength and soundness of our competitors, the financial services industry as a whole and the general economic climate or sovereign debt could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. In addition, adverse developments with respect to third parties with whom we have important relationships also could negatively impact perceptions about us. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face.

None.

Our corporate and banking real estate portfolio consists of approximately 14.9 million square feet of owned or leased office and retail space, used to support our business. Of this overall portfolio, approximately 10.8 million square feet of space is dedicated for various corporate office uses and approximately 4.1 million square feet of space is for bank branches and related offices.

Our 10.8 million square feet of corporate office space consists of approximately 6.1 million square feet of leased space and 4.7 million square feet of owned space. Our headquarters is located in McLean, Virginia, and is included in our corporate office space. We maintain corporate office space primarily in Virginia, Illinois, Texas, New York, Delaware, Louisiana and Maryland.

Not applicable.

The following graph shows the cumulative total stockholder return on our common stock compared to an overall stock market index, the S&P Composite 500 Stock Index (“S&P 500 Index”), and a published industry index, the S&P Financial Composite Index (“S&P Financial Index”), over the five-year period commencing December 31, 2011 and ending December 31, 2016. The stock performance graph assumes that $100 was invested in our common stock and each index and that all dividends were reinvested. The stock price performance on the graph below is not necessarily indicative of future performance.