Citizens Financial (CFG) 10-K2020 FY Annual report

The coronavirus pandemic and resulting reactions, such as lockdowns, safety protocols, unprecedented government measures to shore up the economy and drastic changes to daily life have been unique and remarkable. These stresses have required a new level of resilience and adaptability and Citizens has risen to meet these challenges so we can do more for our customers, communities, colleagues, and shareholders.

For our customers, we continued to provide support, advice and guidance during a time of tremendous need. Our Consumer Banking business has provided vital branch services safely and with minimal disruption and has offered loan forbearance to customers. Beginning in March 2020 and through December 31, 2020, we granted payment forbearance relief to approximately 159,000 retail customers representing approximately 8% of the retail loan portfolio. At December 31, 2020, loans remaining in forbearance had decreased to approximately 2.3% of the retail loan portfolio.

Our Commercial Banking team has worked with clients on loan modifications and securing additional liquidity, while maintaining top-of-peer satisfaction ratings. Beginning in March 2020 and through December 31, 2020, we granted payment deferrals to approximately 490 commercial clients on loans totaling approximately $3.2 billion. As of December 31, 2020, this decreased to 19 commercial clients with deferrals on approximately $290 million of loans.

We also took action to provide relief through the SBA’s Paycheck Protection Program (“PPP”), delivering approximately $4.8 billion of loans to small and medium-sized business clients with an average loan size of approximately $98,000. Approximately 84% of the loans were under $100,000, and 93% of the loans were to businesses with fewer than 25 employees supporting over 540,000 jobs. As of December 31, 2020, approximately $565 million of those loans have been forgiven by the SBA. We are building on this success to deliver more relief

Beginning June 30, 2020, we allowed colleagues to return to our offices in 10 states and portions of three others. Approximately 6,500 non-branch colleagues are normally assigned to offices in these states, and approximately 10% of these are considered essential and work consistently in the office. Return to office for our other colleagues is voluntary at this time.

You should carefully consider the following risk factors that may affect our business, financial condition and results of operations. Other factors that could affect our business, financial condition and results of operation are discussed in the “Forward-Looking Statements” section above. However, there may be additional risks that are not presently material or known, and factors besides those discussed below, or in this or other reports that we file or furnish with the SEC, that could also adversely affect us.

Our operations are subject to extensive regulation, supervision and examination by the federal banking agencies (the FRB, the OCC and the FDIC), as well as the CFPB. As part of the supervisory and examination process, if we are unsuccessful in meeting the supervisory requirements and expectations that apply to us, regulatory agencies may from time to time take supervisory actions against us that may not be publicly disclosed. Such actions may include restrictions on our activities or the activities of our subsidiaries, informal (nonpublic) or formal (public) supervisory actions or public enforcement actions, including the payment of civil money penalties, which could increase our costs and limit our ability to implement our strategic plans and expand our business, and as a result could have a material adverse effect on our business, financial condition or results of operations. See the “Regulation and Supervision” section in Item 1 for further information.

Net interest income historically has been, and we anticipate that it will remain, a significant component of our total revenue. This is due to the fact that a high percentage of our assets and liabilities have been and will likely continue to be in the form of interest-bearing or interest-related instruments. Changes in interest rates can have a material effect on many areas of our business, including net interest income, deposit costs, loan volume and delinquency, and the value of our mortgage servicing rights. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions and policies of various governmental and regulatory agencies and, in particular, the Federal Open Market Committee. Changes in monetary policy, including changes in interest rates, could influence not only the interest we receive on loans and securities and the amount of interest we pay on deposits and borrowings, but such changes could also affect our ability to originate loans and obtain deposits and the fair value of our financial assets and liabilities. If the interest rates on our interest-bearing liabilities increase at a faster pace than the interest rates on our interest earning assets, our net interest income may decline and, with it, a decline in our earnings may occur. Our net interest income and our earnings would be similarly affected if the interest rates on our interest earning assets declined at a faster pace than the interest rates on our interest-bearing liabilities.

We cannot control or predict with certainty changes in interest rates. Global, national, regional and local economic conditions, competitive pressures and the policies of regulatory authorities, including monetary policies of the FRB, affect interest income and interest expense. Although we have policies and procedures designed to manage the risks associated with changes in market interest rates, as further discussed under the “Risk Governance” section in Item 7, changes in interest rates still may have an adverse effect on our profitability.

If our ongoing assumptions regarding borrower or depositor behavior or overall economic conditions are significantly different than we anticipate, then our risk mitigation may be insufficient to protect against interest rate risk and our net income would be adversely affected.

Liquidity risk is the risk that we will not be able to meet our obligations, including funding commitments, as they come due. This risk is inherent in our operations and can be heightened by a number of factors, including an over-reliance on a particular source of funding (including, for example, secured FHLB advances), changes in credit ratings or market-wide phenomena such as market dislocation and major disasters. Like many banking groups, our reliance on customer deposits to meet a considerable portion of our funding has grown over recent years, and we continue to seek to increase the proportion of our funding represented by customer deposits. However, these deposits are subject to fluctuation due to certain factors outside our control, such as increasing competitive pressures for retail or corporate customer deposits, changes in interest rates and returns on other investment classes, or a loss of confidence by customers in us or in the banking sector generally which could result in a significant outflow of deposits within a short period of time. To the extent there is heightened competition among U.S. banks for retail customer deposits, this competition may increase the cost of procuring new deposits and/or retaining existing deposits, and otherwise negatively affect our ability to grow our deposit base. An inability to grow, or any material decrease in, our deposits could have a material adverse effect on our ability to satisfy our liquidity needs.

Maintaining a diverse and appropriate funding strategy for our assets consistent with our wider strategic risk appetite and plan remains challenging, and any tightening of credit markets could have a material adverse impact on us. In particular, there is a risk that corporate and financial institution counterparties may seek to reduce their credit exposures to banks and other financial institutions (for example, reductions in unsecured deposits supplied by these counterparties), which may cause funding from these sources to no longer be available. Under these circumstances, we may need to seek funds from alternative sources, potentially at higher costs than has previously been the case, or may be required to consider disposals of other assets not previously identified for disposal, in order to reduce our funding commitments.

Credit ratings affect the cost and other terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, and their ratings are based on a number of factors, including our financial strength. Other factors considered by rating agencies include conditions affecting the financial services industry generally. Any downgrade in our ratings would likely increase our borrowing costs, could limit our access to capital markets, and otherwise adversely affect our business. For example, a ratings downgrade could adversely affect our ability to sell or market certain of our securities, including long-term debt, engage in certain longer-term derivatives transactions and retain our customers, particularly corporate customers who may require a minimum rating threshold in order to place funds with us. In addition, under the terms of certain of our derivatives contracts, we may be required to maintain a minimum credit rating or have to post additional collateral or terminate such contracts. Any of these results of a rating downgrade could increase our cost of funding, reduce our liquidity and have adverse effects on our business, financial condition and results of operations.

Our risk management framework is made up of various processes and strategies to manage our risk exposure. The framework to manage risk, including the framework’s underlying assumptions, may not be effective under all conditions and circumstances. If the risk management framework proves ineffective, we could suffer unexpected losses and could be materially adversely affected.

One of the main types of risks inherent in our business is credit risk. An important feature of our credit risk management system is to employ an internal credit risk control system through which we identify, measure, monitor and mitigate existing and emerging credit risk of our customers. As this process involves detailed analyses of the customer or credit risk, taking into account both quantitative and qualitative factors, it is subject to human error. In exercising their judgment, our employees may not always be able to assign an accurate credit rating to a customer or credit risk, which may result in our exposure to higher credit risks than indicated by our risk rating system.

In addition, we have undertaken certain actions to enhance our credit policies and guidelines to address potential risks associated with particular industries or types of customers, as discussed in more detail under the “Risk Governance” and “Market Risk” sections in Item 7. However, we may not be able to effectively implement these initiatives, or consistently follow and refine our credit risk management system. If any of the foregoing were to occur, it may result in an increase in the level of nonperforming loans and a higher risk exposure for us, which could have a material adverse effect on us.

The processes we use to estimate our inherent loan losses and to measure the fair value of financial instruments, as well as the processes used to estimate the effects of changing interest rates and other market measures on our financial condition and results of operations, depends upon the use of analytical and forecasting models. Some of our tools and metrics for managing risk are based upon our use of observed historical market behavior. We rely on quantitative models to measure risks and to estimate certain financial values. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting losses, assessing capital adequacy and calculating regulatory capital levels, as well as estimating the value of financial instruments and balance sheet items. Poorly designed or implemented models present the risk that our business decisions based on information incorporating such models will be adversely affected due to the inadequacy of that information. Moreover, our models may fail to predict future risk exposures if the information used in the model is incorrect, obsolete or not sufficiently comparable to actual events as they occur. We seek to incorporate appropriate historical data in our models, but the range of market values and behaviors reflected in any period of historical data is not at all times predictive of future developments in any particular period and the period of data we incorporate into our models may turn out to be inappropriate for the future period being modeled. In such case, our ability to manage risk would be limited and our risk exposure and losses could be significantly greater than our models indicated. In addition, if existing or potential customers believe our risk management is inadequate, they could take their business elsewhere. This could harm our reputation as well as our revenues and profits. Finally, information we provide to

The preparation of audited Consolidated Financial Statements in conformity with GAAP requires management to make significant estimates that affect the financial statements. Our most critical accounting estimate is the ACL. The ACL is a reserve established through a provision for credit losses charged to expense and represents our estimate of expected credit losses within the existing loan and lease portfolio and unfunded lending commitments. The level of the ACL is based on periodic evaluation of the loan and lease portfolios and unfunded lending commitments that are not unconditionally cancellable considering a number of relevant underlying factors, including key assumptions and evaluation of quantitative and qualitative information.

The determination of the appropriate level of the ACL inherently involves a degree of subjectivity and requires that we make significant estimates of current credit risks and future trends, all of which may undergo material changes. Changes in economic conditions affecting borrowers, the stagnation of certain economic indicators that we are more susceptible to, such as unemployment and real estate values, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside our control, may require an increase in the ACL. In addition, bank regulatory agencies periodically review our ACL and may require an increase in the ACL or the recognition of further loan charge-offs, based on judgments that can differ from those of our own management. In addition, if charge-offs in future periods exceed the ACL—that is, if the ACL is inadequate—we will need to recognize additional provision for credit losses. Should such additional provision expense become necessary, it would result in a decrease in net income and capital and may have a material adverse effect on us. For more information regarding our use of estimates in preparation of financial statements, see Note 1 in Item 8 and the “Critical Accounting Estimates” section in Item 7.

Our operations depend on our ability to process a very large number of transactions efficiently and accurately while complying with applicable laws and regulations. Operational risk and losses can result from internal and external fraud; improper conduct or errors by employees or third parties; failure to document transactions properly or to obtain proper authorization; failure to comply with applicable regulatory requirements and conduct of business rules; equipment failures, including those caused by natural disasters or by electrical, telecommunications or other essential utility outages; business continuity and data security system failures, including those caused by computer viruses, cyber-attacks against us or our vendors, or unforeseen problems encountered while implementing major new computer systems or upgrades to existing systems; or the inadequacy or failure of systems and controls, including those of our suppliers or counterparties. Although we have implemented risk controls and loss mitigation actions, and substantial resources are devoted to developing efficient procedures, identifying and rectifying weaknesses in existing procedures and training staff, it is not possible to be certain that such actions have been or will be effective in controlling each of the operational risks faced by us. Any weakness in these systems or controls, or any breaches or alleged breaches of such laws or regulations, could result in increased regulatory supervision, enforcement actions and other disciplinary action, and have an adverse impact on our business, applicable authorizations and licenses, reputation and results of operations.

The financial services industry, including the banking sector, is continually undergoing rapid technological change with frequent introductions of new technology-driven products and services. In addition, new, unexpected technological changes could have a disruptive effect on the way banks offer products and services. We believe our success depends, to a great extent, on our ability to address customer needs by using technology to offer products and services that provide convenience to customers and to create additional efficiencies in our operations. However, we may not be able to, among other things, keep up with the rapid pace of technological changes, effectively implement new technology-driven products and services or be successful in marketing these products and services to our customers. As a result, our ability to compete effectively to attract

In addition, changes in the legal and regulatory framework under which we operate require us to update our information systems to ensure compliance. Our need to review and evaluate the impact of ongoing rule proposals, final rules and implementation guidance from regulators further complicates the development and implementation of new information systems for our business. Also, recent regulatory guidance has focused on the need for financial institutions to perform increased due diligence and ongoing monitoring of third-party vendor relationships, thus increasing the scope of management involvement and decreasing the efficiency otherwise resulting from our relationships with third-party technology providers. Given the significant number of ongoing regulatory reform initiatives, it is possible that we incur higher than expected information technology costs in order to comply with current and impending regulations. See “—Supervisory requirements and expectations on us as a financial holding company and a bank holding company and any regulator-imposed limits on our activities could adversely affect our ability to implement our strategic plan, expand our business, continue to improve our financial performance and make capital distributions to our stockholders.”

Information security risks for large financial institutions such as us have increased significantly in recent years in part because of the proliferation of new technologies, such as Internet and mobile banking to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties. Third parties with whom we or our customers do business also present operational and information security risks to us, including security breaches or failures of their own systems. The possibility of employee error, failure to follow security procedures, or malfeasance also presents these risks, particularly given the recent trend towards remote work arrangements. Our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. In addition, to access our products and services, our customers may use personal computers, smartphones, tablets, and other mobile devices that are beyond our control environment. Although we believe that we have appropriate information security procedures and controls, our technologies, systems, networks and our customers’ devices may be the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, theft, sale or loss or destruction of the confidential, and/or proprietary information of CFG, our customers, our vendors, our counterparties, or our employees. We are under continuous threat of loss or network degradation due to cyber-attacks, such as computer viruses, malicious or destructive code, phishing attacks, ransomware, and Distributed Denial of Service (“DDoS”) attacks. This is especially true as we continue to expand customer capabilities to utilize the Internet and other remote channels to transact business. Two of the most significant cyber-attack risks that we face are e-fraud and loss of sensitive customer data. Loss from e-fraud occurs when cybercriminals extract funds directly from customers’ or our accounts using fraudulent schemes that may include Internet-based funds transfers. We have been subject to a number of e-fraud incidents historically. We have also been subject to attempts to steal sensitive customer data, such as account numbers and social security numbers, through unauthorized access to our computer systems including computer hacking. Such attacks are less frequent but could present significant reputational, legal and regulatory costs to us if successful. We have implemented certain technology protections such as Customer Profiling and Set-Up Authentication to be in compliance with the FFIEC Authentication in Internet Banking Environment (“AIBE”) guidelines.

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate any information security vulnerabilities. System enhancements and updates may also create risks associated with implementing new systems and integrating them with existing ones. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our layers of defense can itself create a risk of systems disruptions and security issues. In addition, addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. Cyber-attacks against the patches themselves have also proven to be a significant risk that companies will have to address going forward.

Despite our efforts to prevent a cyber-attack, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, it could take considerable time for us to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised.  During the course of an investigation, we may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident.

The techniques used by cyber criminals change frequently, may not be recognized until launched and can be initiated from a variety of sources, including terrorist organizations and hostile foreign governments. These actors may attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to data or our systems. In the event that a cyber-attack is successful, our business, financial condition or results of operations may be adversely affected. For a discussion of the guidance that federal banking regulators have released regarding cybersecurity and cyber risk management standards, see the “Regulation and Supervision” section of Item 1.

We rely heavily on communications and information systems to conduct our business. Any failure, interruption or breach in security of these systems, including due to hacking or other similar attempts to breach information technology security protocols, could result in failures or disruptions in our customer relationship management, general ledger, deposit, loan and other systems. Although we have established policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of our information systems, there can be no assurance that these policies and procedures will be successful and that any such failure, interruption or security breach will not occur or, if they do occur, that they will be adequately addressed. The occurrence of any failure, interruption or security breach of our information systems could require us to devote substantial resources (including management time and attention) to recovery and response efforts, damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability. Although we maintain insurance coverage for information security events, we may incur losses as a result of such events that are not insured against or not fully covered by our insurance.

We rely on third parties for the performance of a significant portion of our information technology functions and the provision of information technology and business process services. For example, (i) unaffiliated third parties operate data communications networks on which certain components and services relating to our online banking system rely, (ii) third parties host or maintain many of our applications, including our Commercial Loan System, which is hosted and maintained by Automated Financial Systems, Inc., and our Mobile Digital Banking Application, which is hosted and maintained by Amazon Web Services, Inc., (iii) Fidelity National Information Services, Inc. maintains our core deposits system, (iv) Infosys Limited provides us with a wide range of information technology support services, including service desk, end user, servicer, and private cloud support, and (v) IBM Corporation provides us with mainframe support services. The success of our business depends in part on the continuing ability of these (and other) third parties to perform these functions and services in a timely and satisfactory manner, which performance could be disrupted or otherwise adversely affected due to failures or other information security events originating at the third parties or at the third parties’ suppliers or vendors (so-called “fourth party risk”). We may not be able to effectively monitor or mitigate fourth-party risk, in particular as it relates to the use of common suppliers or vendors by the third parties that perform functions and services for us. If we experience a disruption in the provision of any functions or services performed by third parties, we may have difficulty in finding alternate providers on terms favorable to us and in reasonable time frames. If these services are not performed in a satisfactory manner, we would not be able to serve our customers well. In either situation, our business could incur significant costs and be adversely affected.

Our success and results depend, in part, on our reputation and the strength of our brands. We are vulnerable to adverse market perception as we operate in an industry where integrity, customer trust and confidence are paramount. We are exposed to the risk that litigation, employee misconduct, operational failures, the outcome of regulatory or other investigations or actions, press speculation and negative publicity, among other factors, could damage our brands or reputation. Our brands and reputation could also be harmed if we sell

The occurrence of catastrophic events such as hurricanes, tropical storms, tornadoes and other large-scale catastrophes and terrorist attacks could adversely affect our business, financial condition or results of operations if a catastrophe rendered both our production data center in Rhode Island and our recovery data center in North Carolina unusable. Although we enhanced our disaster recovery capabilities in 2016 through the completion of the new, out-of-region backup data center in North Carolina, there can be no assurance that our current disaster recovery plans and capabilities will adequately protect us from serious disaster.

Our business is affected by national economic conditions, as well as perceptions of those conditions and future economic prospects. Changes in such economic conditions are not predictable and cannot be controlled. Adverse economic conditions could require us to charge off a higher percentage of loans and increase the provision for credit losses, which would reduce our net income and otherwise have a material adverse effect on our business, financial condition and results of operations. For example, our business was significantly affected by the global economic and financial crisis that began in 2008. The falling home prices, increased rate of foreclosure and high levels of unemployment in the United States triggered significant write-downs by us and other financial institutions. These write-downs adversely impacted our financial results in material respects. Although the U.S. economy has made a significant recovery, an interruption or reversal of this recovery would adversely affect the financial services industry and banking sector.

We operate in a highly competitive industry. The industry could become even more competitive as a result of reform of the financial services industry resulting from the Dodd-Frank Act and other legislative, regulatory and technological changes, as well as continued consolidation. We face aggressive competition from other domestic and foreign lending institutions and from numerous other providers of financial services, including non-banking financial institutions that are not subject to the same regulatory restrictions as banks and bank holding companies, securities firms and insurance companies, and competitors that may have greater financial resources.

With respect to non-banking financial institutions, technology and other changes have lowered barriers to entry and made it possible for non-banks to offer products and services traditionally provided by banks. For example, consumers can maintain funds that would have historically been held as bank deposits in brokerage accounts or mutual funds. Consumers can also complete transactions such as paying bills and/or transferring funds directly without the assistance of banks. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. Some of our non-bank competitors are not subject to the same extensive regulations we are and, therefore, may have greater flexibility in competing for business. As a result of these and other sources of competition, we could lose business to competitors or be forced to price products and services on less advantageous terms to retain or attract clients, either of which would adversely affect our profitability.

Financial services institutions are typically interconnected as a result of trading, investment, liquidity management, clearing, counterparty and other relationships. Within the financial services industry, the default by any one institution could lead to defaults by other institutions. Concerns about, or a default by, one institution could lead to significant liquidity problems and losses or defaults by other institutions, as the commercial and financial soundness of many financial institutions are closely related as a result of these credit, trading, clearing and other relationships. Even the perceived lack of creditworthiness of, or questions about, a

As a financial holding company and a bank holding company, we are subject to comprehensive regulation, supervision and examination by the FRB. In addition, CBNA is subject to comprehensive regulation, supervision and examination by the OCC. Our regulators supervise us through regular examinations and other means that allow the regulators to gauge management’s ability to identify, assess and control risk in all areas of operations in a safe and sound manner and to ensure compliance with laws and regulations. In the course of their supervision and examinations, our regulators may require improvements in various areas. If we are unable to implement and maintain any required actions in a timely and effective manner, we could become subject to informal (non-public) or formal (public) supervisory actions and public enforcement orders that could lead to significant restrictions on our existing business or on our ability to engage in any new business. Such forms of supervisory action could include, without limitation, written agreements, cease and desist orders, and consent orders and may, among other things, result in restrictions on our ability to pay dividends, requirements to increase capital, restrictions on our activities, the imposition of civil monetary penalties, and enforcement of such actions through injunctions or restraining orders. We could also be required to dispose of certain assets and liabilities within a prescribed period. The terms of any such supervisory or enforcement action could have a material adverse effect on our business, financial condition and results of operations.

We are a bank holding company that has elected to become a financial holding company pursuant to the Bank Holding Company Act. Financial holding companies are allowed to engage in certain financial activities in which a bank holding company is not otherwise permitted to engage. However, to maintain financial holding company status, a bank holding company (and all of its depository institution subsidiaries) must be “well capitalized” and “well managed.” If a bank holding company ceases to meet these capital and management requirements, there are many penalties it would be faced with, including the FRB may impose limitations or conditions on the conduct of its activities, and it may not undertake any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB. If a company does not return to compliance within 180 days, which period may be extended, the FRB may require divestiture of that company’s depository institutions. To the extent we do not meet the requirements to be a financial holding company in the future, there could be a material adverse effect on our business, financial condition and results of operations.

From time to time, bank regulatory agencies take supervisory actions that restrict or limit a financial institution’s activities and lead it to raise capital or subject it to other requirements. Directives issued to enforce such actions may be confidential and thus, in some instances, we are not permitted to publicly disclose these actions. In addition, as part of our regular examination process, our regulators may advise us to operate under various restrictions as a prudential matter. Any such actions or restrictions, if and in whatever manner imposed, could adversely affect our costs and revenues. Moreover, efforts to comply with any such nonpublic supervisory actions or restrictions may require material investments in additional resources and systems, as well as a significant commitment of managerial time and attention. As a result, such supervisory actions or restrictions, if and in whatever manner imposed, could have a material adverse effect on our business and results of operations; and, in certain instances, we may not be able to publicly disclose these matters.

We are heavily regulated by multiple banking, consumer protection, securities and other regulatory authorities at the federal and state levels. This regulatory oversight is primarily established to protect depositors, the FDIC’s Deposit Insurance Fund, consumers of financial products, and the financial system as a

We are also subject to laws and regulations relating to the privacy of the information of our customers, employees, counterparties and others, and any failure to comply with these laws and regulations could expose us to liability and/or reputational damage. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with those laws and regulations, as well as our potential liability for non-compliance and our reporting obligations in the case of data breaches, may significantly increase.

We are subject to several capital adequacy and liquidity standards. To the extent that we are unable to meet these standards, our ability to make distributions of capital will be limited and we may be subject to additional supervisory actions and limitations on our activities. See “Regulation and Supervision” in Item 1 and the “Capital and Regulatory Requirements” and “Liquidity” sections in Item 7, for further discussion of the regulations to which we are subject.

FRB policy historically required bank holding companies to act as a source of financial and managerial strength to their subsidiary banks. The Dodd-Frank Act codified this policy as a statutory requirement. This support may be required by the FRB at times when we might otherwise determine not to provide it or when doing so is not otherwise in the interests of CFG or our stockholders or creditors, and may include one or more of the following:

As a bank holding company, the Parent Company is a separate and distinct legal entity from CBNA, our banking subsidiary. The Parent Company typically receives substantially all of our revenue from dividends from CBNA. These dividends are the principal source of funds to pay dividends on our equity and interest and principal on our debt. Various federal and/or state laws and regulations, as well as regulatory expectations, limit the amount of dividends that CBNA may pay to the Parent Company. Also, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors. In the event CBNA is unable to pay dividends to the Parent Company, it may not be able to service debt, pay obligations or pay dividends on its common stock. The inability to receive dividends from CBNA could have a material adverse effect on our business, financial condition and results of operations. See the “Supervision and Regulation” section in Item 1 and the “Capital and Regulatory Matters” section in Item 7.

We may become or are involved, from time to time, in reviews, investigations and proceedings (both formal and informal) by governmental and self-regulatory agencies regarding our business. These regulatory actions involve, among other matters, accounting, compliance and operational matters, certain of which may result in adverse judgments, settlements, fines, penalties, injunctions or other relief that may require changes to our business or otherwise materially impact our business.

In regulatory actions, such as those referred to above, it is inherently difficult to determine whether any loss is probable or whether it is possible to reasonably estimate the amount of any loss. We cannot predict with certainty if, how or when such proceedings will be resolved or what the eventual fine, penalty or other relief, conditions or restrictions, if any, may be, particularly for actions that are in their early stages of investigation. The Parent Company may be required to make significant restitution payments to CBNA customers arising from certain compliance issues and also may be required to pay civil money penalties in connection with certain of these issues. This uncertainty makes it difficult to estimate probable losses, which, in turn, can lead to substantial disparities between the reserves we may establish for such proceedings and the eventual settlements, fines, or penalties. Adverse regulatory actions could have a material adverse effect on our business, financial condition and results of operations.

Our operations are diverse and complex and we operate in legal and regulatory environments that expose us to potentially significant litigation risk. In the normal course of business, we have been named, from time to time, as a defendant in various legal actions, including arbitrations, class actions and other litigation, arising in connection with our activities as a financial services institution, including with respect to alleged unfair or deceptive business practices and mis-selling of certain products. Certain of the actual or threatened legal actions include claims for substantial compensatory and/or punitive damages or claims for indeterminate amounts of damages. In some cases, the entities that would otherwise be the primary defendants in such cases are bankrupt or in financial distress. Moreover, a number of recent judicial decisions have upheld the right of borrowers to sue lending institutions on the basis of various evolving legal theories, collectively termed “lender liability.” Generally, lender liability is founded on the premise that a lender has either violated a duty, whether implied or contractual, of good faith and fair dealing owed to the borrower or has assumed a degree of control over the borrower resulting in the creation of a fiduciary duty owed to the borrower or its other creditors or stockholders. This could increase the amount of private litigation to which we are subject. For more information regarding ongoing significant legal proceedings in which we may be involved, see Note 18 in Item 8.

We are subject to rules and regulations regarding money laundering and the financing of terrorism. Monitoring compliance with anti-money laundering and anti-terrorism financing rules can put a significant financial burden on banks and other financial institutions and poses significant technical challenges. Although we believe our current policies and procedures are sufficient to comply with applicable rules and regulations, we cannot guarantee that our anti-money laundering and anti-terrorism financing policies and procedures completely prevent situations of money laundering or terrorism financing. Any such failure events may have severe

You should consider an investment in our common stock to be risky, and you should invest in our common stock only if you can withstand a significant loss and wide fluctuation in the market value of your investment. The market price of our common stock could be subject to wide fluctuations in response to, among other things, the factors described in this “Risk Factors” section, and other factors, some of which are beyond our control. These factors include:

Furthermore, the stock markets have experienced price and volume fluctuations that have affected and continue to affect the market price of equity securities of many companies. These fluctuations have often been unrelated or disproportionate to the operating performance of these companies. These broad market fluctuations, as well as general economic, systemic, political and market conditions, such as recessions, loss of investor confidence, interest rate changes or international currency fluctuations, may negatively affect the market price of our common stock.

If any of the foregoing occurs, it could cause our stock price to fall and may expose us to securities class action litigation that, even if unsuccessful, could be costly to defend and a distraction to management.

Holders of our common stock are only entitled to receive such dividends as our Board of Directors may declare out of funds legally available for such payments. Although we have historically declared cash dividends on our common stock, we are not required to do so and may reduce or eliminate our common stock dividend in the future. This could adversely affect the market price of our common stock. Also, as a bank holding company, our ability to repurchase shares and declare and pay dividends is dependent on certain federal regulatory considerations, including the rules of the FRB regarding capital adequacy and dividends. Additionally, we are required to submit periodic capital plans to the FRB for review, or otherwise obtain FRB authorization, before we can take certain capital actions, including repurchasing shares, declaring and paying dividends, or repurchasing or redeeming capital securities. If our capital plan or any amendment to our capital plan is objected to for any reason, our ability to repurchase shares and declare and pay dividends on our capital stock may be limited. Further, if we are unable to satisfy the capital requirements applicable to us for any reason, we may be limited in our ability to repurchase shares and declare and pay dividends on our capital stock. See the “Regulation and Supervision” section in Item 1, for further discussion of the regulations to which we are subject.

We are a bank holding company incorporated in the state of Delaware. Anti-takeover provisions in Delaware law and our amended and restated certificate of incorporation and amended and restated bylaws, as well as regulatory approvals that would be required under federal law, could make it more difficult for a third party to take control of us and may prevent stockholders from receiving a premium for their shares of our common stock. These provisions could adversely affect the market price of our common stock and could reduce the amount that stockholders might get if we are sold.

We believe these provisions protect our stockholders from coercive or otherwise unfair takeover tactics by requiring potential acquirers to negotiate with our Board and by providing our Board with more time to assess any acquisition proposal. However, these provisions apply even if the offer may be determined to be beneficial by some stockholders and could delay or prevent an acquisition that our Board determines is not in our best interest and that of our stockholders.

Furthermore, banking laws impose notice, approval and ongoing regulatory requirements on any stockholder or other party that seeks to acquire direct or indirect “control” of an FDIC-insured depository institution. These laws include the Bank Holding Company Act and the Change in Bank Control Act.