KeyCorp (KEY) 10-K2022 FY Annual report

00000915762022FYFALSETRUEFALSEhttp://fasb.org/us-gaap/2022#AccountingStandardsUpdate201613Memberhttp://fasb.org/us-gaap/2022#AccruedLiabilitiesAndOtherLiabilitieshttp://fasb.org/us-gaap/2022#AccruedLiabilitiesAndOtherLiabilitieshttp://fasb.org/us-gaap/2022#OtherAssetshttp://fasb.org/us-gaap/2022#OtherAssetshttp://fasb.org/us-gaap/2022#OtherAssetshttp://fasb.org/us-gaap/2022#OtherAssetshttp://fasb.org/us-gaap/2022#OtherAssetshttp://fasb.org/us-gaap/2022#OtherAssetshttp://fasb.org/us-gaap/2022#AccruedLiabilitiesAndOtherLiabilitieshttp://fasb.org/us-gaap/2022#AccruedLiabilitiesAndOtherLiabilitieshttp://fasb.org/us-gaap/2022#PropertyPlantAndEquipmentAndFinanceLeaseRightOfUseAssetAfterAccumulatedDepreciationAndAmortizationhttp://fasb.org/us-gaap/2022#PropertyPlantAndEquipmentAndFinanceLeaseRightOfUseAssetAfterAccumulatedDepreciationAndAmortizationhttp://fasb.org/us-gaap/2022#LongTermDebthttp://fasb.org/us-gaap/2022#LongTermDebt0.040.0250.0250.0250.0250000091576us-gaap:EstimateOfFairValueFairValueDisclosureMemberus-gaap:SegmentDiscontinuedOperationsMemberkey:EducationLendingMember2021-12-31

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

ANNUAL REPORT

PURSUANT TO SECTION 13 OR 15(d)

OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended

SECURITIES REGISTERED PURSUANT TO SECTION 12(g) OF THE ACT: NONE

From time to time, we have made or will make forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These statements do not relate strictly to historical or current facts. Forward-looking statements usually can be identified by the use of words such as “goal,” “objective,” “plan,” “expect,” “assume,” “anticipate,” “intend,” “project,” “believe,” “estimate,” “will,” “would,” “should,” “could,” or other words of similar meaning. Forward-looking statements provide our current expectations or forecasts of future events, circumstances, results or aspirations. Our disclosures in this report contain forward-looking statements. We may also make forward-looking statements in other documents filed with or furnished to the SEC. In addition, we may make forward-looking statements orally to analysts, investors, representatives of the media and others.

Forward-looking statements, by their nature, are subject to assumptions, risks, and uncertainties, many of which are outside of our control. Our actual results may differ materially from those set forth in our forward-looking statements. There is no assurance that any list of risks and uncertainties or risk factors is complete. In addition, no assurance can be given that any plan, initiative, projection, goal, commitment, expectation, or prospect set forth in this report can or will be achieved. Factors that could cause our actual results to differ from those described in forward-looking statements include, but are not limited to:

Any forward-looking statements made by us or on our behalf speak only as of the date they are made, and we do not undertake any obligation to update any forward-looking statement to reflect the impact of subsequent events or

circumstances, except as required by applicable securities laws. Before making an investment decision, you should carefully consider all risks and uncertainties disclosed in our SEC filings, including this report on Form 10-K and our subsequent reports on Forms 10-Q and 8-K and our registration statements under the Securities Act of 1933, as amended, all of which are or will upon filing be accessible on the SEC’s website at www.sec.gov and on our website at www.key.com/ir.

Throughout this discussion, references to “Key,” “we,” “our,” “us,” and similar terms refer to the consolidated entity consisting of KeyCorp and its subsidiaries. “KeyCorp” refers solely to the parent holding company, and “KeyBank” refers solely to KeyCorp’s subsidiary bank, KeyBank National Association. “KeyBank (consolidated)” refers to the consolidated entity consisting of KeyBank and its subsidiaries.

We want to explain some industry-specific terms at the outset so you can better understand the discussion that follows.

KEYCORP

2022 FORM 10-K ANNUAL REPORT

TABLE OF CONTENTS

PART I

KeyCorp, organized in 1958 under the laws of the State of Ohio, is headquartered in Cleveland, Ohio. We are a BHC under the BHCA and one of the nation’s largest bank-based financial services companies, with consolidated total assets of approximately $189.8 billion at December 31, 2022. KeyCorp is the parent holding company for KeyBank National Association, its principal subsidiary, through which most of our banking services are provided. Through KeyBank and certain other subsidiaries, we provide a wide range of retail and commercial banking, commercial leasing, investment management, consumer finance, student loan refinancing, commercial mortgage servicing and special servicing, and investment banking products and services to individual, corporate, and institutional clients through two major business segments: Consumer Bank and Commercial Bank.

As of December 31, 2022, these services were provided across the country through KeyBank’s 972 full-service retail banking branches and a network of 1,265 ATMs in 15 states, as well as additional offices, online and mobile banking capabilities, including our national digital bank, Laurel Road, and a telephone banking call center. Additional information pertaining to our two business segments is included in the “Business Segment Results” section in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this report, and in Note 25 (“Business Segment Reporting”) of the Notes to Consolidated Financial Statements presented in Item 8. Financial Statements and Supplementary Data, which are incorporated herein by reference.

In addition to the customary banking services of accepting deposits and making loans, our bank and its trust company subsidiary offer personal and institutional trust custody services, personal financial and planning services, access to mutual funds, treasury services, and international banking services. Through our bank, trust company, and registered investment adviser subsidiaries, we provide investment management services to clients that include large corporate and public retirement plans, foundations and endowments, high-net-worth individuals, and multi-employer trust funds established for providing pension or other benefits to employees.

We provide other financial services — both within and outside of our primary banking markets — through various nonbank subsidiaries. These services include community development financing, securities underwriting, investment banking and capital markets products, and brokerage. We also provide merchant services to businesses.

KeyCorp is a legal entity separate and distinct from its banks and other subsidiaries. Accordingly, the right of KeyCorp, its security holders, and its creditors to participate in any distribution of the assets or earnings of its banks and other subsidiaries is subject to the prior claims of the creditors of such banks and other subsidiaries, except to the extent that KeyCorp’s claims in its capacity as a creditor may be recognized.

We derive the majority of our revenues within the United States from customers domiciled in the United States. Revenue from foreign countries and external customers domiciled in foreign countries was immaterial to our consolidated financial statements.

Our management structure and basis of presentation is divided into two business segments, Consumer Bank and Commercial Bank. Note 25 (“Business Segment Reporting”) describes the products and services offered by each of these business segments and provides more detailed financial information pertaining to the segments, including changes in basis of presentation.

The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our Laurel Road digital lending business by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services. In addition, wealth management and investment services are offered to assist non-profit and high-net-worth clients with their banking, trust, portfolio management, charitable giving, and related needs.

The Commercial Bank consists of the Commercial and Institutional operating segments. The Commercial operating segment is a full-service, commercial banking platform that focuses primarily on serving the borrowing, cash

management, and capital markets needs of middle market clients within Key’s 15-state branch footprint. It is also a significant, national, commercial real estate lender and third-party servicer of commercial mortgage loans and special servicer of CMBS. The Institutional operating segment operates nationally in providing lending, equipment financing, and banking products and services to large corporate and institutional clients. The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology. The operating segment includes the KBCM platform which provides a broad suite of capital markets products and services including syndicated finance, debt and equity capital markets, derivatives, foreign exchange, financial advisory, and public finance. Additionally, KBCM provides fixed income and equity sales and trading services to investor clients.

Our executive offices are located at 127 Public Square, Cleveland, Ohio 44114-1306, and our telephone number is (216) 689-3000. Our website is www.key.com, and the investor relations section of our website may be reached through www.key.com/ir. We make available free of charge, on or through the investor relations section of our website, annual reports on Form 10-K, quarterly reports on Form 10-Q, and current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as well as proxy statements, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. Also posted on our website, and available in print upon request from any shareholder to our Investor Relations Department, are the charters for our Technology Committee, Audit Committee, Compensation and Organization Committee, Executive Committee, Nominating and Corporate Governance Committee, and Risk Committee; our Corporate Governance Guidelines; the Code of Business Conduct and Ethics for our directors, officers, and employees; our Standards for Determining Independence of Directors; our policy for Review of Transactions Between KeyCorp and Its Directors, Executive Officers and Other Related Persons; our Statement of Political Activity; and our Corporate Responsibility Report. Within the time period required by the SEC and the NYSE, we will post on our website any amendment to the Code of Ethics and any waiver applicable to any senior executive officer or director. We also make available a summary of filings made with the SEC of statements of beneficial ownership of our equity securities filed by our directors and officers under Section 16 of the Exchange Act. The “Regulatory Disclosures & Filings” section under the “Financials” tab of the investor relations section of our website includes public disclosures concerning our historic annual and mid-year stress-testing activities under the Dodd-Frank Act and our quarterly regulatory capital disclosures under the third pillar of Basel III.

Information contained on or accessible through, including any reports available on, our website or any other website referenced in this report is not part of this report. References to websites in this report are intended to be inactive textual references only.

Shareholders may obtain a copy of any of the above-referenced corporate governance documents by writing to our Investor Relations Department at Investor Relations, KeyCorp, 127 Public Square, Mailcode OH-01-27-0737, Cleveland, Ohio 44114-1306; by calling (216) 689-4221; or by sending an e-mail to investor_relations@keybank.com.

The market for banking and related financial services is highly competitive. Key competes with other providers of financial services, such as BHCs, commercial banks, savings associations, credit unions, mortgage banking companies, finance companies, mutual funds, insurance companies, investment management firms, investment banking firms, broker-dealers, and other local, regional, national, and global institutions that offer financial services. Some of our competitors are larger and may have more financial resources, while some of our competitors enjoy fewer regulatory constraints and may have lower cost structures. The financial services industry has become more competitive as technology advances have lowered barriers to entry, enabling more companies, including nonbank companies, to provide financial services. Technological advances may diminish the importance of depository institutions and other financial institutions. Mergers and acquisitions have also led to increased concentration in the banking industry, placing added competitive pressure on Key’s core banking products and services as we see competitors enter some of our markets or offer similar products. We compete by offering quality products and innovative services at competitive prices, and by maintaining our product and service offerings to keep pace with customer preferences and industry standards.

Engaging a diverse and talented team is a top strategic priority for Key. Our human capital management strategy is focused on attracting, developing, and retaining the talent our businesses need to deliver strong returns to our shareholders, which we do by offering a competitive total rewards package, providing opportunities for career development and growth, and fostering a culture that is fair and inclusive.

Competitive Rewards

We make investments to hire the people we need to serve our customers and communities and regularly review our pay practices to reflect changing market and economic conditions. We have steadily increased our starting minimum wage since 2015 and made other adjustments responding to market trends, competitive pressures and a dynamic market for talent.

These investments include a comprehensive and competitive total rewards program, representing our investment in our teammates’ collective success and reflecting our commitment to helping them thrive. Key’s benefits offerings include employee health and welfare plans, a 401(k) plan with competitive matching contributions, paid parental leave, a Discounted Stock Purchase Plan, wellness incentives and a lifestyle reimbursement account program.

With respect to pay, we design our compensation programs to balance risk and reward and align with the guidance of our regulators, and we regularly monitor these programs to remain within our risk tolerances. We subject all discretionary incentives paid to our employees to a robust risk adjustment process that begins before grant and extends beyond payment.

Career Development and Growth

We invest in our teammates’ growth and professional development through a variety of internal networking groups, formal and informal mentoring programs, and a suite of leadership development programs as well as by offering employees the opportunities to develop and enhance their skills through formal learning curricula and the opportunity to obtain collegiate or post-collegiate education and relevant certifications.

Creating a Fair and Inclusive Culture

Key’s purpose is to help our clients, colleagues, and communities thrive. We remain committed to attracting a talented and diverse workforce and supplier base that represents the clients and communities we serve. In 2022, we continued to focus on increasing minority representation in management and leadership roles, expanding our overall recruiting focus, developing diverse candidate slates and pipelines, increasing supplier diversity, providing mentorship opportunities, offering implicit bias training, and leveraging our existing employee resource groups to strengthen both engagement and inclusion.

In addition, we are committed to pay equity as a foundational element of our culture. As of February 2022, at KeyBank women earn on average more than 99% of what their male teammates earn, and people of color earn on average more than 99% of what their white teammates earn, after taking into account an employee’s job. Our analysis is based on total compensation (base salary and all discretionary incentives) covering all teammates eligible for a discretionary incentive, other than our Executive Leadership Team whose pay is set by our Board of Directors. More information about our commitment to pay equity and our commitment to increasing diversity is available at www.key.com/about/diversity/pay-equity-commitment.jsp.

As of December 31, 2022, our overall workforce was 58.7% female. In addition, as of December 31, 2022, our workforce was also 75.3% White, 9.1% Black/African American, 6.9% Hispanic/Latino, 6.1% Asian and 2.7% other. Our Board of Directors is 46% diverse (six of our 13 total Directors are diverse, with four women, one of whom is also a minority, and two male minorities) and our Executive Leadership Team is 36% diverse (four women and one minority out of 14 total executives).

For more information about our diversity and inclusion efforts, a more detailed breakdown of employee diversity by EEO-1 categories, and information about how we work every day and in every way to help our clients, colleagues, and communities thrive, please see our website and our Corporate Responsibility report at https://investor.key.com/esg-information/corporate-responsibility/.

Key’s Workforce

KeyCorp’s executive officers are principally responsible for managing the operations of KeyCorp, making policy for KeyCorp, executing on strategic decisions, and managing material risks, subject to the supervision and direction of the Board. All executive officers are subject to annual election at the annual organizational meeting of the Board held each May.

Set forth below are the names and ages of the executive officers of KeyCorp as of December 31, 2022, the positions held by each at KeyCorp during the past five years, and the year each first became an executive officer of KeyCorp. Because James Waters has been employed at KeyCorp for less than five years, information is being provided concerning his prior business experience. There are no family relationships among the directors or the executive officers, and there is no arrangement or understanding between any executive officer and any other person pursuant to which the executive officer was selected.

We have other financial services subsidiaries that are subject to regulation, supervision, and examination by the Federal Reserve, as well as other state and federal regulatory agencies and self-regulatory organizations. Because KeyBank engages in derivative transactions, in 2013 it provisionally registered as a swap dealer with the CFTC and became a member of the NFA, the self-regulatory organization for participants in the U.S. derivatives industry. Our securities brokerage and asset management subsidiaries are subject to supervision and regulation by the SEC, FINRA, and state securities regulators, and our insurance subsidiaries are subject to regulation by the insurance regulatory authorities of the states in which they operate. Our other nonbank subsidiaries are subject to laws and regulations of both the federal government and the various states in which they are authorized to do business.

Background

KeyCorp and KeyBank are subject to regulatory capital requirements that are based largely on the work of an international group of supervisors known as the Basel Committee on Banking Supervision (“Basel Committee”). The Basel Committee is responsible for establishing international bank supervisory standards for implementation in member jurisdictions, to enhance and align bank regulation on a global scale, and to promote financial stability.

The regulatory capital framework developed by the Basel Committee and implemented in the United States is a predominately risk-based capital framework that establishes minimum capital requirements based on the amount of regulatory capital a banking organization maintains relative to the amount of its total assets, adjusted to reflect credit risk (“risk-weighted assets”). Each banking organization subject to this regulatory capital framework is required to satisfy certain minimum risk-based capital measures (e.g., a tier 1 risk-based capital ratio requirement of tier 1 capital to total risk-weighted assets), and in the United States, a minimum leverage ratio requirement of tier 1 capital to average total on-balance sheet assets, which serves as a backstop to the risk-based measures.

A capital instrument is assigned to one of two tiers based on the relative strength and ability of that instrument to absorb credit losses on a going concern basis. Capital instruments with relatively robust loss-absorption capacity are assigned to tier 1, while other capital instruments with relatively less loss-absorption capacity are assigned to tier 2. A banking organization’s total capital equals the sum of its tier 1 and tier 2 capital.

The Basel Committee also developed a market risk capital framework (that also has been implemented in the United States) to address the substantial exposure to market risk faced by banking organizations with significant trading activity and augment the credit risk-based capital requirements described above. For example, the minimum total risk-based capital ratio requirement for a banking organization subject to the market risk capital rule equals the ratio of the banking organization’s total capital to the sum of its credit risk-weighted assets and market risk-weighted assets. Only KeyCorp is subject to the market risk capital rule, as KeyBank does not engage in substantial trading activity.

Basel III

To address deficiencies in the international regulatory capital standards identified during the 2007-2009 global financial crisis, in 2010 the Basel Committee released comprehensive revisions to the international regulatory capital framework, commonly referred to as “Basel III.” The Basel III revisions are designed to strengthen the quality and quantity of regulatory capital, in part through the introduction of a Common Equity Tier 1 capital requirement; provide more comprehensive and robust risk coverage, particularly for securitization exposures, equities, and off-balance sheet positions; and address pro-cyclicality concerns through the implementation of capital buffers. The Basel Committee also released a series of revisions to the market risk capital framework to address deficiencies identified during its initial implementation (e.g., arbitrage opportunities between the credit risk-based and market risk capital rules) and in connection with the global financial crisis.

KeyCorp and KeyBank are subject to regulatory capital requirements implemented by the U.S. banking agencies that are based largely on Basel III (“Regulatory Capital Rules”). Consistent with the international framework, the Regulatory Capital Rules further restrict the type of instruments that may be recognized in tier 1 and tier 2 capital; establish a minimum Common Equity Tier 1 capital ratio requirement of 4.5% and capital buffers to absorb losses during periods of financial stress while allowing an institution to provide credit intermediation as it would during a normal economic environment; and refine several of the methodologies used for determining risk-weighted assets. The Regulatory Capital Rules provide additional requirements for large banking organizations with over $250 billion in total consolidated assets or $10 billion in foreign exposure, but those additional requirements do not apply to KeyCorp or KeyBank. Accordingly, for purposes of the Regulatory Capital Rules, KeyCorp and KeyBank are treated as “standardized approach” banking organizations.

Regulatory Capital Rules

Revised prompt corrective action framework

The federal prompt corrective action framework established under the FDIA groups FDIC-insured depository institutions into one of five prompt corrective action capital categories: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” In addition to implementing the Basel III capital framework in the U.S., the Regulatory Capital Rules also revised the prompt corrective action capital category threshold ratios applicable to FDIC-insured depository institutions such as KeyBank, with an effective date of January 1, 2015. The Revised Prompt Corrective Action Framework table below identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the Prompt Corrective Action Framework.

Revised Prompt Corrective Action Framework

Recent regulatory capital-related developments

In December 2017, the Basel Committee released its final revisions to Basel III. The revisions seek to restore credibility in the calculation of risk-weighted assets (“RWAs”) and improve the comparability of regulatory capital ratios across banking organizations by: (1) enhancing the robustness and risk-sensitivity of the standardized approach for credit risk, credit valuation adjustment, and operational risk; (2) constraining the use of internal models by placing limits on certain inputs used to calculate capital requirements under the internal ratings-based approach for credit risk (used by advanced approaches banking organizations) and removing the ability to use an internal model for purposes of determining the capital charge for credit valuation adjustment (“CVA”) risk and operational risk; (3) introducing a leverage ratio buffer to further limit the leverage of global systemically-important banks; and (4) replacing the existing Basel II output floor with a more robust, risk-sensitive floor based on the Basel III standardized approach.

The U.S. federal banking agencies released a statement announcing their support for the Basel Committee’s efforts, but cautioned that they will consider how to appropriately incorporate these revisions into the Regulatory Capital

Rules, and that any proposed changes based on the Basel Committee revisions would be subject to notice-and-comment rulemaking. In view of the prohibition under the Dodd-Frank Act on the use of credit ratings in federal regulation, there is some uncertainty as to whether or how the agencies would implement the ratings-based aspects of the Basel Committee revisions to Basel III, as well as any other aspect of the Basel Committee revisions that permit the U.S. agencies to exercise home-country discretion, for example, due to differences in accounting or market practices, and legal requirements.

Subsequently, in December 2018, the Basel Committee released an update to its Pillar 3 disclosure framework, to more appropriately align it to the changes adopted under the Basel Committee’s final revisions to Basel III. Before any action is taken by the federal banking agencies with respect to the revised Pillar 3 disclosure framework, the federal agencies must determine whether and to what extent they will implement the final revisions to Basel III released by the Basel Committee in December 2017.

On July 9, 2019, the federal banking agencies issued a final rule to simplify certain aspects of the Regulatory Capital Rules for standardized approach banking organizations, including Key. The final rule simplifies, for these banking organizations, the regulatory capital requirements for mortgage servicing assets, certain deferred tax assets arising from temporary differences, and investments in the capital of unconsolidated financial institutions. The final rule replaces multiple deduction thresholds with a single 25% deduction threshold for each of these categories and requires that a 250% risk weight be applied to mortgage servicing assets and deferred tax assets that are not deducted from capital. The final rule also simplifies the calculation of the amount of capital issued by a consolidated subsidiary of a banking organization and held by third parties that is includable in regulatory capital. In addition, the final rule makes certain technical amendments to the Regulatory Capital Rules that are applicable to standardized approach banking organizations as well as advanced approaches banking organizations. The final rule provided an effective date of October 1, 2019, for the technical amendments and an effective date of April 1, 2020, for the simplification changes. On November 13, 2019, the federal banking agencies published an amendment to the final rule to provide standardized approach banking organizations with the option to implement the simplification changes on either January 1, 2020, or April 1, 2020. We chose to implement the simplification changes on April 1, 2020.

In November 2019, the federal banking agencies adopted a final rule to amend the Regulatory Capital Rules by revising the definition of a high volatility commercial real estate (“HVCRE”) exposure. HVCRE exposures are subject to a heightened risk weight under the Regulatory Capital Rules. The final rule, which became effective on April 1, 2020, conforms the HVCRE definition to statutory changes enacted in May 2018. The final rule also clarifies the treatment under the revised HVCRE definition of credit facilities that finance one-to-four family residential properties as well as credit facilities that finance the development of land.

Liquidity requirements

U.S. banking organizations are subject to regulatory liquidity requirements based on international liquidity standards established by the Basel Committee in 2010, and subsequently revised between 2013 and 2014 (as revised, the “Basel III liquidity framework”). The Basel III liquidity framework establishes quantitative standards designed to ensure that a banking organization is appropriately positioned, from a balance sheet perspective, to satisfy its short- and long-term funding needs.

To address short-term liquidity risk, the Basel III liquidity framework established a liquidity coverage ratio (“Basel III LCR”), calculated as the ratio of a banking organization’s high-quality liquid assets to its total net cash outflows over 30 consecutive calendar days. In addition, to address long-term liquidity risk, the Basel III liquidity framework established a net stable funding ratio (“Basel III NSFR”), calculated as the ratio of the amount of stable funding available to a banking organization to its required amount of stable funding.

In October 2014, the federal banking agencies published a final rule to implement the Basel III LCR for U.S. banking organizations (the “Liquidity Coverage Rules”). Consistent with the Basel III LCR, the U.S. Liquidity Coverage Rules established a minimum LCR for certain internationally active bank and nonbank financial companies (excluding KeyCorp), and a modified version of the LCR (“Modified LCR”) for BHCs and other depository institution holding companies with over $50 billion in consolidated assets that are not internationally active (including KeyCorp). Under the Liquidity Coverage Rules, KeyCorp was required to calculate a Modified LCR on a monthly basis and was required to satisfy a minimum Modified LCR requirement of 100%. KeyBank was not subject to the LCR or the Modified LCR under the Liquidity Coverage Rules.

In December 2016, the Federal Reserve adopted a final rule to implement public disclosure requirements for the LCR and Modified LCR. Under the final rule, each calendar quarter KeyCorp was required to publicly disclose certain quantitative information regarding its Modified LCR calculation, together with a discussion of the factors that have a significant effect on its Modified LCR. KeyCorp began complying with these disclosure requirements for the calendar quarter beginning October 1, 2018.

Large BHCs, like KeyCorp, are also subject to liquidity requirements contained in regulations adopted pursuant to the Dodd-Frank Act and the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”). As enacted in 2010, the Dodd-Frank Act required the Federal Reserve to impose enhanced prudential standards and early remediation requirements (collectively, “EPSs”), including enhanced liquidity standards, upon BHCs (like KeyCorp) with at least $50 billion in total consolidated assets.

In March 2014, the Federal Reserve published a final rule to implement certain of the EPSs required under the Dodd-Frank Act, including liquidity requirements relating to cash flow projections, a contingency funding plan, liquidity risk limits, the monitoring of liquidity risks (with respect to collateral, legal entities, currencies, business lines, and intraday exposures), liquidity stress testing, a liquidity buffer, and liquidity risk management requirements, including requirements that apply to the board of directors, the risk committee, senior management, and the independent review function. KeyCorp was required to comply with the final rule starting on January 1, 2015.

EGRRCPA, enacted on May 24, 2018, raised the asset threshold above which the Federal Reserve is required to apply EPSs to BHCs from $50 billion to $250 billion. EGRRCPA gave the Federal Reserve the authority, following notice and comment procedures, to continue to apply EPSs to any BHCs having at least $100 billion but less than $250 billion in total consolidated assets (like KeyCorp) if it determines that the application of the EPS is appropriate to prevent or mitigate risks to financial stability or to promote the safety and soundness of the BHC or BHCs, taking into consideration the BHC’s or BHCs’ capital structure, riskiness, complexity, financial activities, size, and other relevant factors.

On October 20, 2020, the federal banking agencies adopted a final rule to implement the Basel III NSFR for U.S. banking organizations. The NSFR final rule, which became effective on July 1, 2021, requires certain banking organizations with more than $100 billion in total assets to maintain minimum amounts of stable funding to support their assets, commitments, and derivatives exposures over a one-year time horizon. The final NSFR rule tailors the application of the NSFR requirement to large banking organizations in each of the four risk-based categories of institutions established by the Tailoring Rules. Key is a Category IV firm. Category IV firms with average weighted short-term wholesale funding of less than $50 billion will not be subject to an NSFR requirement. Key does not meet the $50 billion threshold and is not subject to an NSFR requirement.

On December 1, 2021, the Federal Reserve published revisions to the FR 2052a liquidity reporting form in order to accurately reflect the NSFR final rule and to capture other data elements necessary to monitor banking organizations’ liquidity positions and compliance with liquidity risk management standards. The revisions were effective on May 1, 2022, for Category I firms and on October 1, 2022, for Category II, III, and IV firms (including KeyCorp).

Capital planning and stress testing

The Federal Reserve’s capital plan rule requires each U.S.-domiciled, top-tier BHC with total consolidated assets of at least $100 billion (like KeyCorp) to develop and maintain a written capital plan supported by a robust internal capital adequacy process. The capital plan must be submitted to the Federal Reserve for supervisory review in connection with the BHC’s CCAR (described below). The supervisory review includes an assessment of many factors, including KeyCorp’s ability to maintain capital above each minimum regulatory capital ratio on a pro forma basis under expected and stressful conditions throughout the planning horizon.

The Federal Reserve’s CCAR is an intensive assessment of the capital adequacy of large U.S. BHCs and of the practices these BHCs use to assess their capital needs. The Federal Reserve expects BHCs subject to CCAR to have and maintain regulatory capital in an amount that is sufficient to withstand a severely adverse operating environment and, at the same time, be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and provide credit intermediation.

The Federal Reserve has conducted a supervisory stress test on KeyCorp, pursuant to which the Federal Reserve projects revenues, expenses, losses, and resulting post-stress capital levels and regulatory capital ratios under conditions that affect the U.S. economy or the financial condition of KeyCorp, including supervisory baseline and severely adverse scenarios (and through 2018, an adverse scenario), that are determined by the Federal Reserve. KeyCorp and KeyBank have also been required to conduct their own company-run stress tests to assess the impact of stress scenarios (including supervisor-provided baseline, adverse, and severely adverse scenarios and, for KeyCorp, one KeyCorp-defined baseline scenario and at least one KeyCorp-defined stress scenario) on their consolidated earnings, losses, and capital over a nine-quarter planning horizon, taking into account their current condition, risks, exposures, strategies, and activities. While KeyBank has only had to conduct an annual stress test, KeyCorp has had to conduct both an annual and a mid-cycle stress test. KeyCorp and KeyBank have been required to report the results of their annual stress tests to the Federal Reserve and the OCC. KeyCorp has been required to report the results of its mid-cycle stress test to the Federal Reserve. Summaries of the results of these company-run

stress tests (through KeyCorp’s 2018 mid-cycle stress test results) have been disclosed under the “Regulatory Disclosures & Filings” section of the “Financials” tab of Key’s Investor Relations website: http://www.key.com/ir. Such summaries were not disclosed after 2018 because of the rule changes discussed below.

A separate rule was issued by the federal banking agencies in October 2019 to implement a provision in EGRRCPA that raised the asset threshold that triggers the requirement for federally-regulated banks to conduct company-run stress tests on an annual basis from $10 billion to $250 billion in total consolidated assets. Under this final rule, federally-regulated banks with total assets of less than $250 billion (like KeyBank) will no longer be required to conduct annual company-run stress tests. Also, this final rule removes the “adverse” scenario as a required scenario for all stress testing requirements applicable to BHCs and federally-regulated banks so that such stress tests will be required to include only “baseline” and “severely adverse” scenarios.

On June 23, 2022, the Federal Reserve announced the results of the supervisory stress test that it conducted of 34 BHCs having more than $100 billion in total consolidated assets (including KeyCorp). The Federal Reserve indicated that all BHCs subject to the stress test maintained capital ratios above the minimum required levels under the severely adverse scenario. The stress test results for individual BHCs will be used to determine a BHC’s stress capital buffer requirement, which became effective on October 1, 2022, and will remain in effect until September 30, 2023, unless the firm later receives an updated stress capital buffer requirement from the Federal Reserve. On August 4, 2022, the Federal Reserve confirmed that KeyCorp’s required stress capital buffer, based on its June 2022 stress test, is 2.5%, which is the minimum buffer required for banking organizations the size of KeyCorp.

Dividend restrictions

Federal law and regulation impose limitations on the payment of dividends by our national bank subsidiaries, like KeyBank. Historically, dividends paid by KeyBank have been an important source of cash flow for KeyCorp to pay dividends on its equity securities and interest on its debt. Dividends by our national bank subsidiaries are limited to the lesser of the amounts calculated under an earnings retention test and an undivided profits test. Under the earnings retention test, without the prior approval of the OCC, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year’s net income combined with the retained net income of the two preceding years. Under the undivided profits test, a dividend may not be paid in excess of a bank’s undivided profits. Moreover, under the FDIA, an insured depository institution may not pay a dividend if the payment would cause it to be less than “adequately capitalized” under the prompt corrective action framework or if the institution is in default in the payment of an assessment due to the FDIC. Similarly, under the Regulatory Capital Rules, a banking organization that fails to satisfy the minimum capital conservation buffer requirement will be subject to certain limitations, which include restrictions on capital distributions. For more information about the payment of dividends by KeyBank to KeyCorp, please see Note 3 (“Restrictions on Cash, Dividends, and Lending Activities”) in this report.

Deposit insurance and assessments

The DIF provides insurance coverage for domestic deposits funded through assessments on insured depository institutions like KeyBank. The amount of deposit insurance coverage for each depositor’s deposits is $250,000 per depository.

The FDIC must assess the premium based on an insured depository institution’s assessment base, calculated as its average consolidated total assets minus its average tangible equity. KeyBank’s current annualized premium assessments can range from $.025 to $.45 for each $100 of its assessment base. The rate charged depends on KeyBank’s performance on the FDIC’s “large and highly complex institution” risk-assessment scorecard, which includes factors such as KeyBank’s regulatory rating, its ability to withstand asset and funding-related stress, and the relative magnitude of potential losses to the FDIC in the event of KeyBank’s failure.

On October 18, 2022, the FDIC adopted a final rule, applicable to all insured depository institutions, to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028. The FDIC said that the reserve ratio had declined below this level because of the increase in insured deposits since the start of the pandemic and other factors that affect the level of the DIF. Under the final rule, the increase in rates will begin with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% reserve ratio. The increase in assessment rates will apply to KeyBank.

Conservatorship and receivership of insured depository institutions

Upon the insolvency of an insured depository institution, the FDIC will be appointed as receiver or, in rare circumstances, conservator for the insolvent institution under the FDIA. In an insolvency, the FDIC may repudiate or disaffirm any contract to which the institution is a party if the FDIC determines that performance of the contract would be burdensome and that disaffirming or repudiating the contract would promote orderly administration of the institution’s affairs. If the contractual counterparty made a claim against the receivership (or conservatorship) for breach of contract, the amount paid to the counterparty would depend upon, among other factors, the receivership (or conservatorship) assets available to pay the claim and the priority of the claim relative to others. In addition, the FDIC may enforce most contracts entered into by the insolvent institution, notwithstanding any provision that would terminate, cause a default, accelerate or give other rights under the contract solely because of the insolvency, the appointment of the receiver (or conservator), or the exercise of rights or powers by the receiver (or conservator). The FDIC may also transfer any asset or liability of the insolvent institution without obtaining approval or consent from the institution’s shareholders or creditors. These provisions would apply to obligations and liabilities of KeyCorp’s insured depository institution subsidiaries, such as KeyBank, including obligations under senior or subordinated debt issued to public investors.

Receivership of certain SIFIs

The Dodd-Frank Act created a new resolution regime, as an alternative to bankruptcy, known as the “orderly liquidation authority” (“OLA”) for certain SIFIs, including BHCs and their affiliates. Under the OLA, the FDIC would generally be appointed as receiver to liquidate and wind down a failing SIFI. The determination that a SIFI should be placed into OLA receivership is made by the U.S. Treasury Secretary, who must conclude that the SIFI is in default or in danger of default and that the SIFI’s failure poses a risk to the stability of the U.S. financial system. This determination must come after supermajority recommendations by the Federal Reserve and the FDIC, and consultation between the U.S. Treasury Secretary and the President.

If the FDIC is appointed as receiver under the OLA, its powers and the rights and obligations of creditors and other relevant parties would be determined exclusively under the OLA. The powers of a receiver under the OLA are generally based on the FDIC’s powers as receiver for insured depository institutions under the FDIA. Certain provisions of the OLA were modified to reduce disparate treatment of creditors’ claims between the U.S. Bankruptcy Code and the OLA. However, substantial differences between the two regimes remain, including the FDIC’s right to disregard claim priority in some circumstances, the use of an administrative claims procedure under OLA to determine creditors’ claims (rather than a judicial procedure in bankruptcy), the FDIC’s right to transfer claims to a bridge entity, and limitations on the ability of creditors to enforce contractual cross-defaults against potentially viable affiliates of the entity in receivership. OLA liquidity would be provided through credit support from the U.S. Treasury and assessments made, first, on claimants against the receivership that received more in the OLA resolution than they would have received in ordinary liquidation (to the full extent of the excess), and second, if necessary, on SIFIs like KeyCorp utilizing a risk-based methodology.

Depositor preference

The FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, the claims of its depositors (including claims of its depositors that have subrogated to the FDIC) and certain claims for administrative expenses of the FDIC as receiver have priority over other general unsecured claims. If an insured depository institution fails, insured and uninsured depositors, along with the FDIC, will be placed ahead of unsecured, nondeposit creditors, including the institution’s parent BHC and subordinated creditors, in order of priority of payment.

Resolution plans

BHCs with at least $50 billion in total consolidated assets, like KeyCorp, have been required to periodically submit to the Federal Reserve and FDIC a plan discussing how the company could be rapidly and orderly resolved if the company failed or experienced material financial distress. Insured depository institutions with at least $50 billion in total consolidated assets, like KeyBank, have also been required to submit a resolution plan to the FDIC. These plans have been due annually unless the requirement to submit the plans was deferred by the regulators. The Federal Reserve and FDIC make available on their websites the public sections of resolution plans for the companies, including KeyCorp and KeyBank, that submitted plans. The public sections of the resolution plans of KeyCorp and KeyBank are available at http://www.federalreserve.gov/supervisionreg/resolution-plans.htm and https://www.fdic.gov/regulations/reform/resplans/. KeyCorp’s last resolution plan was submitted in 2017, and KeyBank’s last resolution plan was submitted in 2022. KeyCorp is no longer required to submit a resolution plan because of the rule change discussed below while KeyBank remains subject to resolution plan requirements as discussed below.

The Bank Secrecy Act

The BSA requires all financial institutions (including banks and securities broker-dealers) to, among other things, maintain a risk-based system of internal controls reasonably designed to prevent money laundering and the financing of terrorism. It includes a variety of recordkeeping and reporting requirements (such as cash and suspicious activity reporting) as well as due diligence and know-your-customer documentation requirements. Key has established and maintains an AML program to comply with the BSA’s requirements.

Consumer Financial Protection Bureau

Title X of the Dodd-Frank Act created the CFPB, a consumer financial services regulator with supervisory authority over banks and their affiliates with assets of more than $10 billion, like Key, to carry out federal consumer protection laws. The CFPB also regulates financial products and services sold to consumers and has rulemaking authority with respect to federal consumer financial laws. Any new regulatory requirements promulgated by the CFPB or modifications in the interpretations of existing regulations could require changes to Key’s consumer-facing businesses. The Dodd-Frank Act also gives the CFPB broad data collecting powers for fair lending for both small business and mortgage loans, as well as extensive authority to prevent unfair, deceptive and abusive practices.

Volcker Rule

The Volcker Rule implements Section 619 of the Dodd-Frank Act, which prohibits “banking entities,” such as KeyCorp, KeyBank and their affiliates and subsidiaries, from owning, sponsoring, or having certain relationships with hedge funds and private equity funds (referred to as “covered funds”) and engaging in short-term proprietary trading of financial instruments, including securities, derivatives, commodity futures and options on these instruments.

The Volcker Rule excepts certain transactions from the general prohibition against proprietary trading, including transactions in government securities (e.g., U.S. Treasuries or any instruments issued by the GNMA, FNMA, FHLMC, a Federal Home Loan Bank, or any state or a political division of any state, among others); transactions in connection with underwriting or market-making activities; and transactions as a fiduciary on behalf of customers. A banking entity may also engage in risk-mitigating hedging activity if it can demonstrate that the hedge reduces or mitigates a specific, identifiable risk or aggregate risk position of the entity. The banking entity is required to conduct an analysis supporting its hedging strategy and the effectiveness of the hedges must be monitored and, if necessary, adjusted on an ongoing basis.

Although the Volcker Rule became effective on April 1, 2014, the Federal Reserve exercised its unilateral authority to extend the compliance deadline until July 21, 2017, with respect to covered funds. In addition, on December 12, 2016, the Federal Reserve released additional guidelines regarding how banking entities may seek an extension of the conformance period for certain legacy covered fund investments. Under the Dodd-Frank Act, the Federal Reserve is authorized to provide a banking entity up to an additional five years to conform legacy investments (i.e., contractual commitments of a banking organization on or before May 1, 2010, to make an investment) in “illiquid” covered funds.

Key does not anticipate that the proprietary trading restrictions in the Volcker Rule will have a material impact on its business, but it may be required to divest certain fund investments as discussed in more detail in Note 6 (“Fair Value Measurements”) in Item 8 of this report. On January 13, 2017, Key filed for an additional extension for illiquid funds, to retain certain indirect investments until the earlier of the date on which the investments are conformed or are expected to mature or July 21, 2022. The application for an extension was approved on February 14, 2017. This time period was subsequently extended to July 21, 2023. As of December 31, 2022, we have not committed to sell these investments. Therefore, these investments continue to be valued using the net asset value per share methodology.

Enhanced prudential standards and early remediation requirements

As enacted in 2010, the Dodd-Frank Act required the Federal Reserve to impose EPSs upon BHCs, like KeyCorp, with at least $50 billion in total consolidated assets. Prudential standards were required to include enhanced risk-based capital requirements and leverage limits, liquidity requirements, risk-management and risk committee requirements, resolution plan requirements, credit exposure report requirements, single counterparty credit limits (“SCCL”), supervisory and company-run stress test requirements and, for certain financial companies, a debt-to-

equity limit. Early remediation requirements were required to include limits on capital distributions, acquisitions, and asset growth in early stages of financial decline and capital restoration plans, capital raising requirements, limits on transactions with affiliates, management changes, and asset sales in later stages of financial decline, which would be triggered by forward-looking indicators including regulatory capital and liquidity measures.

The resolution plan requirements were implemented by a joint final rule adopted by the Federal Reserve and FDIC in 2011 and were revised by a joint final rule adopted by the Federal Reserve and FDIC in 2019. In 2011, the Federal Reserve also issued a proposal to implement the stress test, early remediation, and SCCL requirements. However, when that proposal was adopted as a final rule in 2012, it included only the stress test requirements and not the SCCL or early remediation requirements.

In March 2014, the Federal Reserve published a final rule to implement certain of the EPSs required under the Dodd-Frank Act, including: (i) the incorporation of the Regulatory Capital Rules through the Federal Reserve’s previously finalized rules on capital planning and stress tests; (ii) liquidity requirements; (iii) the risk management framework, the risk committee, and the chief risk officer as well as the corporate governance requirements as they relate to liquidity risk management; and (iv) a 15-to-1 debt-to-equity limit for companies that the FSOC determines pose a “grave threat” to U.S. financial stability. KeyCorp was required to comply with the final rule starting on January 1, 2015.

EGRRCPA, which was enacted on May 24, 2018, raised, from $50 billion to $250 billion, the asset threshold above which the Federal Reserve is required to apply EPSs to BHCs. EGRRCPA gave the Federal Reserve the authority, following notice and comment procedures, to continue to apply EPSs to any BHCs having at least $100 billion but less than $250 billion in total consolidated assets (like KeyCorp). Also, this statute requires the Federal Reserve to continue to conduct periodic stress tests of BHCs with assets between $100 billion and $250 billion (like KeyCorp), and the requirement for a publicly traded BHC to have a risk committee continues to apply if a BHC has assets of at least $50 billion.

On June 14, 2018, the Federal Reserve issued a final rule establishing SCCL requirements for BHCs with $250 billion or more in total consolidated assets. The final rule does not apply to KeyCorp. The Federal Reserve has taken no further action on the early remediation requirements proposed in 2011.

Bank transactions with affiliates

Federal banking law and regulation imposes qualitative standards and quantitative limitations upon certain transactions by a bank with its affiliates, including the bank’s parent BHC and certain companies the parent BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms, and cannot exceed certain amounts that are determined with reference to the bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. These provisions significantly restrict the ability of KeyBank to fund its affiliates, including KeyCorp, KBCM, and KeyCorp’s nonbanking subsidiaries engaged in making merchant banking investments (and certain companies in which these subsidiaries have invested).

Provisions added by the Dodd-Frank Act expanded the scope of: (i) the definition of affiliate to include any investment fund having any bank or BHC-affiliated company as an investment adviser; (ii) credit exposures subject to the prohibition on the acceptance of low-quality assets or securities issued by an affiliate as collateral, the quantitative limits, and the collateralization requirements to now include credit exposures arising out of derivative, repurchase agreement, and securities lending/borrowing transactions; and (iii) transactions subject to quantitative limits to now also include credit collateralized by affiliate-issued debt obligations that are not securities. In addition, these provisions require that a credit extension to an affiliate remain secured in accordance with the collateral requirements at all times that it is outstanding, rather than the previous requirement of only at the inception or upon material modification of the transaction. These provisions also raise significantly the procedural and substantive

hurdles required to obtain a regulatory exemption from the affiliate transaction requirements. While these provisions became effective on July 21, 2012, the Federal Reserve has not yet issued a proposed rule to implement them.

Supervision and governance

On November 2, 2018, the Federal Reserve announced that it is adopting a new supervisory rating system for large financial institutions, including BHCs with total consolidated assets of $100 billion or more (like KeyCorp) (“LFI Rating System”), in order to align the Federal Reserve’s rating system with the post-crisis supervisory programs for these firms. The LFI Rating System will provide a supervisory evaluation of whether an institution possesses sufficient operational strength and resilience to maintain safe and sound operations through a range of conditions and will assess an institution’s capital planning and positions, liquidity risk management and positions, and governance and controls. Institutions subject to the LFI Rating System will be rated using the following scale: Broadly Meets Expectations, Conditionally Meets Expectations, Deficient-1, and Deficient-2, with the Conditionally Meets Expectations rating intended to be used as a transitory rating to allow an institution time to remediate a concern identified during the supervisory evaluation. The Federal Reserve assigned initial ratings under the LFI Rating System in 2019 to institutions that are subject to the Large Institution Supervision Coordinating Committee framework (excluding KeyCorp) and assigned initial ratings in 2020 for all other large financial institutions subject to this rating system (including KeyCorp).

The governance and controls component of the LFI Rating System was the subject of two separate, but related proposals: (i) proposed guidance regarding supervisory expectations for boards of directors of large financial institutions; and (ii) proposed guidance regarding core principles for effective senior management, business management, and independent risk management and controls for large financial institutions. The proposed guidance regarding supervisory expectations for boards of directors was published by the Federal Reserve on August 3, 2017. The final guidance on this subject was issued by the Federal Reserve on February 26, 2021. The final guidance describes the key attributes of effective boards of directors of large financial institutions, including BHCs with $100 billion or more in total consolidated assets. This guidance adopts a principles-based approach to describe attributes of effective boards of directors and provides illustrative examples of effective practices. The Federal Reserve indicated that it intends to use the board effectiveness guidance in informing its assessment of governance and controls at all firms subject to the LFI Rating System (including KeyCorp).

The Federal Reserve has not finalized the proposed guidance referenced above regarding core principles for effective senior management, business management, and independent risk management and controls for large financial institutions. This guidance, which was proposed by the Federal Reserve on January 4, 2018, would support the supervisory evaluation under the governance and controls component of the LFI Rating System, together with the above-mentioned guidance regarding the effectiveness of a firm’s board of directors. In general, the guidance proposes core principles for effective senior management, business line management, and the independent risk management and control function. The guidance encourages firms to establish a governance structure with appropriate levels of independence and stature, by appointing a Chief Risk Officer and a Chief Audit Officer. Finally, the guidance emphasizes the importance of independent risk management, internal controls, and internal audit, and establishes principles that firms should use to establish or augment those management and control frameworks. Comments on this proposal were due by March 15, 2018. We are awaiting the final rulemaking.

Community Reinvestment Act

The Community Reinvestment Act (“CRA”) was enacted in 1977 to encourage depository institutions to help meet the credit needs of the communities that they serve, including low- and moderate-income (“LMI”) neighborhoods, consistent with the institutions’ safe and sound operations. The CRA requires the federal banking agencies to assess the record of each institution that they supervise in meeting the credit needs of its entire community, including LMI neighborhoods.

On May 20, 2020, the OCC issued a final rule (the “2020 Final Rule”) to revise the agency’s CRA regulation to strengthen and modernize the framework by which the OCC assesses a bank’s CRA performance. The OCC stated that it was doing so in order to make the CRA regulatory framework more objective, transparent, consistent in application, and reflective of changes in banking and thereby better achieve the statutory purpose of encouraging banks to serve the needs of their communities, particularly LMI neighborhoods and other communities that have been underserved. The final rule became effective on October 1, 2020. Certain provisions of the rule had compliance dates of January 1, 2023, or January 1, 2024.

On September 21, 2020, the Federal Reserve issued an ANPR requesting public comment on ways to modernize CRA regulations by strengthening, clarifying, and tailoring them to reflect the current banking landscape and better achieve the core purpose of the CRA. The ANPR sought public feedback on ways to evaluate how banks meet the needs of LMI communities and address inequities in credit access. Comments were due by February 16, 2021.

On November 24, 2020, the OCC requested public comment on an NPR setting forth the OCC’s proposed approach for determining the benchmarks, thresholds, and minimums that would be used in assessing a bank’s performance under the general performance standards contained in the 2020 Final Rule. Comments on the NPR were due by February 2, 2021. On December 15, 2020, the OCC published a notice requesting comment on an information collection survey that the OCC would require banks subject to the CRA general performance standards to complete. Comments on this notice were due by February 16, 2021.

On May 18, 2021, the OCC announced that it will reconsider the 2020 Final Rule. The OCC said that it intends to evaluate issues and questions that have been raised concerning the 2020 Final Rule, consider additional stakeholder input, reassess relevant data, and take additional regulatory action, as appropriate. In addition, the OCC stated that it does not plan to finalize a rule that it proposed in December 2020 to provide an approach for determining the benchmarks, thresholds, and minimums that would be used to assess a bank’s performance under the 2020 Final Rule. The OCC further said that it was discontinuing the CRA information collection published in December 2020 that relates to this subject.

On July 20, 2021, the OCC announced that it had completed its review of the 2020 Final Rule and that it planned to (i) propose rescinding the 2020 Final Rule; and (ii) work with the Federal Reserve and the FDIC to develop a joint rulemaking to strengthen and modernize regulations implementing the CRA. Also, on July 20, 2021, the OCC, the Federal Reserve, and the FDIC issued an interagency statement indicating that they are committed to working together to issue a joint rulemaking with respect to CRA modernization.

On December 14, 2021, the OCC issued a final rule to rescind the 2020 Final Rule and replace it with a rule based largely on the CRA rules adopted jointly by the federal banking agencies in 1995. The OCC indicated that the adoption of this final rule creates consistency for all insured depository institutions and facilitates the ongoing interagency work to modernize the CRA regulatory framework. This final rule was effective on January 1, 2022, but the compliance date for the final rule’s public file and public notice provisions was April 1, 2022.

On May 5, 2022, the federal banking agencies issued for public comment a proposal to strengthen and modernize their regulations implementing the CRA to better achieve the purposes of the law, adapt to changes in the banking industry, and provide clarity and consistency in the application of their regulations. Among other things, the proposal (1) would revise the community development definitions to clarify eligibility criteria for a broad range of community development activities, (2) would adopt four new tests under which large banks with more than $10 billion in assets (including KeyBank) would be evaluated, (3) would apply a new framework for assigning conclusions and ratings to banks, (4) would require the evaluation of a large bank’s performance in retail lending assessment areas in addition to facility-based assessment areas, and (5) would impose new data collection and reporting requirements on large banks. The four new tests under which large banks would be evaluated are a retail lending test, a retail services and products test, a community development financing test, and a community development services test. Various metrics and performance standards would be applied under these tests. Comments on this proposal were due by August 5, 2022. KeyBank will be required to comply with any final rule that might be adopted.

Control standards

Regulatory developments concerning COVID-19

On June 23, 2020, the federal banking agencies, in conjunction with state bank regulators, issued interagency examiner guidance outlining supervisory principles for assessing the safety and soundness of banks given the ongoing impact of the COVID-19 pandemic. The agencies stated that they will consider the unique, evolving, and potentially long-term nature of the issues that banks are confronting and will exercise appropriate flexibility in their supervisory response. The agencies said that they will continue to assess institutions in accordance with existing agency policies and procedures and will consider whether a bank’s management has managed risk appropriately, including taking appropriate actions in response to stresses caused by the COVID-19 pandemic.

On March 31, 2021, the CFPB announced that it was rescinding seven policy statements issued in 2020, which provided financial institutions with temporary regulatory flexibility in complying with various consumer protection laws when they are working with customers affected by the COVID-19 pandemic. The CFPB indicated that, with these rescissions, it intends to exercise the full scope of its supervision and enforcement authority provided by the Dodd-Frank Act.

Federal LIBOR transition legislation

Developments relating to climate change

On December 16, 2021, the OCC issued draft principles designed to provide a high-level framework for the safe and sound management of exposures to climate-related financial risks by national banks with more than $100 billion in total consolidated assets. The draft principles support efforts by banks to identify, measure, monitor, and mitigate the risks associated with climate change and encourage banks to incorporate consideration of climate-related financial risks into, among other things, strategic planning, credit underwriting, internal reporting, policies, procedures, and limits. The OCC requested public feedback on its draft principles by February 14, 2022, and said that it planned to elaborate on these principles in subsequent guidance that would distinguish roles and responsibilities of boards of directors and management, incorporate the feedback it receives, and consider lessons learned and best practices from the industry and other jurisdictions. Final principles or other guidance from the OCC regarding climate-related risk management would apply to KeyBank.

On March 21, 2022, the SEC issued for public comment a proposal to amend its rules under the Securities Act of 1933 and the Securities Exchange Act of 1934 to require public companies (including KeyCorp) to provide detailed climate-related information in their registration statements and periodic reports. Among other things, the proposal would require public companies to disclose information about (i) climate-related risks that are reasonably likely to have a material impact on the company’s business or financial statements over the short-, medium- or long-term; (ii) the actual and potential impacts of such risks on the company’s strategy, business model, and outlook; (iii) the role of the board of directors in overseeing climate-related risks and management’s role in assessing and managing such risks; (iv) the impact of climate-related events and transitional activities on line items in the company’s consolidated financial statements as well as the financial estimates and assumptions used in the financial statements; and (v) the company’s direct greenhouse gas emissions, indirect emissions from purchased energy, and, if material, indirect emissions from the company’s value chain (which may include financed emissions in a bank’s loan portfolio). The financial services industry has not yet adopted a standardized methodology for banks to use to quantitatively measure indirect emissions from a bank’s value chain, such as financed emissions. Accordingly, this proposal would require many banks to quantify and disclose financed emissions on a comprehensive scale for the first time. Comments on the SEC’s proposal were originally due by May 20, 2022. The comment period was extended to June 17, 2022. On October 7, 2022, the SEC reopened the comment period on this proposal until November 1, 2022, due to a technological error that resulted in a number of public comments submitted through the SEC’s comment website not being received by the SEC.

On December 2, 2022, the Federal Reserve issued for public comment proposed principles that would provide a high-level framework for the safe and sound management of exposures to climate-related financial risks for large banking organizations supervised by the Federal Reserve, including BHCs with over $100 billion in total consolidated assets (such as KeyCorp). The proposed principles would cover six areas: governance; policies, procedures, and limits; strategic planning; risk management; data, risk measurement, and reporting; and scenario analysis. The proposed principles would also describe how climate-related financial risks can be addressed by banking organizations in connection with various specific risk categories, including credit risk, liquidity risk, operational risk, and legal/compliance risk. The proposal issued by the OCC, which would apply to national banks (such as KeyBank), is discussed above.The FDIC’s proposal, which would apply to insured state nonmember banks, state-licensed insured branches of foreign banks, and state savings associations, was issued on March 30, 2022. The Federal Reserve indicated that it intends to coordinate with the other federal banking agencies in issuing any final guidance on this subject. Comments on this proposal were due by February 6, 2023. We are awaiting the final rulemaking.

Computer-Security Incident Notification Requirements

On November 23, 2021, the federal banking agencies published a final rule that establishes computer-security incident notification requirements for banking organizations (including banks and BHCs) and bank service providers. The final rule requires a banking organization to notify its primary federal regulator as soon as possible and no later than 36 hours after the banking organization determines that a computer-security incident that rises to the level of a notification incident has occurred. A notification incident includes, among other things, a computer-security incident that materially disrupts or degrades, or is reasonable likely to materially disrupt or degrade, a banking organization’s operations or activities or its ability to deliver products or services to a material portion of its customer base. The final rule also requires a bank service provider to notify a banking organization of certain material disruptions in services provided to the banking organization. The final rule became effective on April 1, 2022, and has required a compliance date of May 1, 2022. The final rule applies to KeyBank and KeyCorp.

As a financial services organization, we are subject to a number of risks inherent in our transactions and present in the business decisions we make. Described below are the material risks and uncertainties that if realized could have a material and adverse effect on our business, financial condition, results of operations or cash flows, and our access to liquidity. The risks and uncertainties described below are not the only risks we face. Disclosures of risks should not be interpreted to imply that the risks have not already materialized.

Our ERM program incorporates risk management throughout our organization to identify, understand, and manage the risks presented by our business activities. Our ERM program identifies Key’s major risk categories as: credit risk, compliance risk, operational risk, liquidity risk, market risk, reputation risk, strategic risk, and model risk. These risk factors, and other risks we may face, are discussed in more detail in other sections of this report.

As of December 31, 2022, approximately 69% of our loan portfolio consisted of commercial and industrial loans, commercial real estate loans, including commercial mortgage and construction loans, and commercial leases. These types of loans are typically larger than single family residential real estate loans and other types of consumer loans and have a different risk profile. The deterioration of a larger loan or a group of loans in this category could cause an increase in criticized and nonperforming loans, which could result in lower earnings from these loans, additional provision for loan and lease losses, and ultimately an increase in loan losses.

Recent and ongoing Federal Reserve monetary policy, including shrinkage of its balance sheet and incremental increases in target interest rates, have begun to impact the commercial and residential real estate markets. Capitalization rates are rising, and property value appreciation has slowed or ceased altogether. In many markets within Key’s footprint, property values have begun to decrease. Multifamily and industrial properties continue to remain stable, but office, retail, hospitality, and single family detached properties are beginning to show early signs of potential deterioration. Development and construction continue, but at muted levels, and deliveries of additional units into the market have been supported. Oversupply of multifamily housing is a concern in certain urban and gateway markets. However, our exposures in those markets are limited. The most severely impacted commercial real estate segments have been in office and retail. Key’s non-owner occupied office and retail exposures are 12% of our total commercial real estate exposure. Substantial deterioration in property market fundamentals could negatively impact our portfolio, with a large portion of our clients active in real estate but in the comparatively better performing multifamily space. A correction in the real estate markets could impact the ability of borrowers to make debt service payments on loans or to refinance the loans at maturity. A relatively small portion of our commercial real estate loans are construction loans. New construction and value-add or rehabilitation construction projects are

not fully leased at loan origination. These properties typically require additional leasing through the life of the loan to provide cash flow to support debt service payments. If property market fundamentals deteriorate sharply, performance under existing leases could deteriorate and the execution of new leases could slow, compromising the borrower’s ability to cover debt service payments.

Many of our routine transactions expose us to credit risk, including the risk of default of our counterparty or client. Our credit risk may be exacerbated when the collateral held cannot be realized upon or is liquidated at prices insufficient to recover the full amount of the loan or derivative exposure due to us. In deciding whether to extend credit or enter into other transactions, we rely on information furnished by or on behalf of counterparties and clients, including financial statements, credit reports and other information. We also rely on representations of those counterparties, clients, or other third parties as to the accuracy and completeness of that information. The inaccuracy of that information or those representations affects our ability to accurately evaluate the default risk of a counterparty or client. Given the Dodd-Frank legislative mandate to centrally clear eligible derivative contracts, we rely on central clearing counterparties to remain open and operationally viable at all times. A large member failure or a cybersecurity breach could result in a counterparty or client disruption.

We maintain an ALLL (a reserve established through a provision for loan and lease losses charged to expense) that represents our estimate of losses based on our evaluation of risks within our existing portfolio of loans. The level of the allowance at December 31, 2022 represents management’s estimate of expected credit losses over the contractual life of our existing loan portfolio. The determination of the appropriate level of the ALLL inherently involves a degree of subjectivity and requires that we make significant estimates of current credit risks and current trends and reasonable and supportable forecasts of future economic conditions, all of which may undergo frequent and material changes. Changes in economic conditions affecting borrowers, the softening of certain macroeconomic variables that we are more susceptible to, such as GDP, unemployment, SOFR, producer price index, industrial production, interest rates and real estate values, along with updated information regarding existing loans, identification of additional problem loans and other factors, both within and outside of our control, may indicate the need for an increase in the ALLL.

During the Great Recession, the volatility and disruption that the capital and credit markets experienced reached extreme levels. This severe market disruption led to the failure of several substantial financial institutions, which caused the credit markets to constrict and caused a widespread liquidation of assets. These asset sales, along with asset sales by other leveraged investors, including some hedge funds, rapidly drove down prices and valuations across a wide variety of traded asset classes. Asset price deterioration has a negative effect on the valuation of certain of the asset categories represented on our balance sheet and reduces our ability to sell assets at prices we deem acceptable.

The most recent recession, resulting from the impact of the COVID-19 pandemic, did not have significant lasting impact on collateral value. However, there are still risks to economic stability that could reverse recent stable trends in asset prices.

These risks include:

As a financial services institution, we are subject to extensive federal and state regulation, supervision, and tax legislation. Banking regulations are primarily intended to protect depositors’ funds, the DIF, consumers, taxpayers, and the banking system as a whole, not our debtholders or shareholders. These regulations increase our costs and affect our lending practices, capital structure, investment practices, dividend policy, ability to repurchase our common shares, and growth, among other things.

KeyBank and KeyCorp remain covered institutions under the Dodd-Frank Act’s heightened prudential standards and regulations, including its provisions designed to protect consumers from financial abuse. Like similarly situated institutions, Key undergoes routine scrutiny from bank supervisors in the examination process and is subject to enforcement of regulations at the federal and state levels, particularly with respect to consumer banking-related practices, including fair and responsible banking, fair lending, unfair, deceptive or abusive practices, and the Community Reinvestment Act, as well as compliance with AML, BSA and Office of Foreign Assets Control efforts. Federal rulemaking bodies continue to pass new, or modifications to, significant regulations with upcoming effective dates. There has also been an increase in state legislative activity, particularly in areas such as student lending and privacy. As new privacy-related laws and regulations, such as the California Consumer Privacy Act, are implemented in jurisdictions in which KeyBank operates, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for noncompliance and reporting obligations in the case of data breaches, may significantly increase. Compliance with these laws and regulations has required and may continue to require us to change our policies, procedures, and technology for information security and segregation of data, which could, among other things, make us more vulnerable to operational failures, and subject us to monetary penalties for breach of such laws and regulations. As a result, some uncertainty remains as to the aggregate impact upon Key of significant regulations.

Changes to existing statutes and regulations, and taxes (including industry-specific taxes and surcharges), or their interpretation or implementation, could affect us in substantial and unpredictable ways. Interpretation of consumer banking-related regulations may evolve as the industry and the regulators seek to increase access to banking products and services by consumers. These changes may subject us to additional costs and increase our litigation risk should we fail to appropriately comply. Such changes may also impact consumer behavior, limit the types of financial services and products we may offer, affect the investments we make, and change the manner in which we operate. In addition, changes to laws and regulations may impact our customers by requiring them to adjust their operations or practices or impair their ability to pay fees or outstanding loans or afford new products, which could negatively impact demand for our products and services.

Certain federal regulations have been in existence for decades without modification to account for modern banking practices, such as digital delivery of products and services, which can create challenges in execution and in the examination process. Emerging technologies, such as cryptocurrencies, could limit KeyBank’s ability to track the movement of funds. KeyBank’s ability to comply with BSA/AML and other regulations is dependent on its ability to improve detection and reporting capabilities and reduce variation in control processes and oversight accountability.

Additionally, federal banking law grants substantial enforcement powers to federal banking regulators. This enforcement authority includes, among other things, the ability to assess civil money penalties, fines, or restitution, to issue cease and desist or removal orders, and to initiate injunctive actions against banking organizations and affiliated parties. These enforcement actions may be initiated for violations of laws and regulations, for practices determined to be unsafe or unsound, or for practices or acts that are determined to be unfair, deceptive, or abusive. Failure to comply with these and other regulations, and supervisory expectations related thereto, may result in fines, penalties, lawsuits, regulatory sanctions, reputational damage, or restrictions on our business. Moreover, different government administrations may have different regulatory priorities, which may impact the level of regulation of financial institutions and the enforcement environment.

For more information, see “Supervision and Regulation” in Item 1 of this report.

The FASB periodically changes the financial accounting and reporting standards governing the preparation of Key’s financial statements. Additionally, those bodies that establish and/or interpret the financial accounting and reporting standards (such as the FASB, SEC, and banking regulators) may change prior interpretations or positions on how these standards should be applied. These changes can be difficult to predict and can materially affect how Key records and reports its financial condition and results of operations. In some cases, Key could be required to retroactively apply a new or revised standard, resulting in changes to previously reported financial results.

In addition to the other risks discussed in this section, we are subject to operational risk, which represents the risk of loss resulting from human error, inadequate or failed internal processes, internal controls, systems, and external events. Operational risk includes the risk of fraud by employees or others outside of Key, clerical and record-keeping errors, nonperformance by vendors, threats from cyber activity, and computer/telecommunications malfunctions. Fraudulent activity has escalated, become more sophisticated, and is ever evolving as there are more options to access financial services. Operational risk also encompasses compliance and legal risk, which is the risk of loss from violations of, or noncompliance with, laws, rules, regulations, prescribed practices, or ethical standards, as well as the risk of our noncompliance with contractual and other obligations. We are also exposed to operational risk through our outsourcing arrangements, and the effect that changes in circumstances or capabilities of our outsourcing vendors can have on our ability to continue to perform operational functions necessary to our business, such as certain loan processing functions. For example, breakdowns or failures of our vendors’ systems or employees could be a source of operational risk to us. Resulting losses from operational risk could take the form of explicit charges, increased operational costs (including remediation costs), harm to our reputation, inability to secure insurance, litigation, regulatory intervention or sanctions, or foregone business opportunities.

We rely on our employees to design, manage, and operate our systems and controls to assure that we properly enter into, record and manage processes, transactions and other relationships with customers, suppliers and other parties with whom we do business. We also depend on employees and the systems and controls for which they are responsible to assure that we identify and mitigate the risks that are inherent in our relationships and activities. These concerns are increased when we change processes or procedures, introduce new products or services, or implement new technologies, as we may fail to adequately identify or manage operational risks resulting from such changes. These concerns may be further exacerbated by employee turnover or labor shortages. As a result of our necessary reliance on employees to perform these tasks and manage resulting risks, we are thus subject to human vulnerabilities. These range from innocent human error to misconduct or malfeasance, potentially leading to operational breakdowns or other failures. Our controls may not be adequate to prevent problems resulting from human involvement in our business, including risks associated with the design, operation and monitoring of automated systems. We may also fail to adequately develop a culture of risk management among our employees.

We rely heavily on communications, information systems (both internal and provided by third parties), and the internet to conduct our business. Our business is dependent on our ability to process and monitor large numbers of daily transactions in compliance with legal, regulatory, and internal standards and specifications. In addition, a significant portion of our operations relies heavily on the secure processing, storage, and transmission of personal and confidential information, such as the personal information of our customers and clients. These risks may increase in the future as we continue to increase mobile payments and other internet-based product offerings, expand our internal usage of web/cloud-based products and applications, and maintain and develop new relationships with third party providers, including their downstream service providers. In addition, our ability to extend protections to customers’ information to individual customer devices is limited, especially if the customers willingly provide third parties access to their devices or information.

In the event of a failure, interruption, or breach of our information systems or that of a third party that provides services to us or our customers, we may be unable to avoid impact to our customers. Such a failure, interruption, or breach could result in legal liability, remediation costs, regulatory action, or reputational harm. U.S. financial service

institutions and companies have reported breaches in the security of their websites or other systems and several financial institutions, including Key, have had third parties on which they rely experience such breaches. In addition, several financial institutions, including Key, have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disrupt, disable, or degrade services, or sabotage systems or data. Other attacks have attempted to obtain unauthorized access to confidential, proprietary, or personal information or intellectual property, to extort money through the use of “ransomware” or other extortion tactics, or to alter or destroy data or systems, often through various attack vectors and methods, including the introduction of computer viruses or malicious code (commonly referred to as “malware”), phishing, cyberattacks, account takeovers, credential stuffing, and other means. To the extent that we use third parties to provide services to our clients, we cannot control all of the risks at these third parties or third parties’ downstream service providers. Hardware, software, or applications developed by Key or received from third parties may contain exploitable vulnerabilities, bugs, or defects in design, maintenance or manufacture or other issues that could unpredictably compromise information and cybersecurity. Should an adverse event affecting another company’s systems occur, we may not have indemnification or other protection from the other company sufficient to fully compensate us or otherwise protect us or our clients from the consequences. To date, our losses and costs related to these breaches have not been material, but other similar events in the future could have a significant impact on us.

In addition, our customers routinely use Key-issued credit and debit cards to pay for transactions conducted with businesses in person and over the internet. If the business’s systems that process or store debit or credit card information experience a security breach, our card holders may experience fraud on their card accounts. We may suffer losses associated with such fraudulent transactions, as well as for other costs, such as replacing impacted cards. Key also provides card transaction processing services to some merchant customers under agreements we have with payment networks such as Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a data breach.

We also face risks related to the increasing interdependence and interconnectivity of financial entities and technology systems. A technology failure, cyberattack or other security breach that significantly compromises the systems of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us. Any third-party technology failure, cyberattack, or security breach could adversely affect our ability to effect transactions, service clients, or otherwise operate our business and could result in legal liability, remediation costs, regulatory action, or reputational harm. Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of automation, artificial intelligence and robotics, introduces new information security risks and exposure.

Such security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware and SIM card swapping, and other methods. Our security systems, and those of the third-party service providers on which we rely, may not be able to protect our information systems or data from similar attacks due to the rapid evolution and creation of sophisticated cyberattacks. We are also subject to the risk that a malicious actor or our employees may intercept and/or transmit or otherwise misuse unauthorized personal, confidential, or proprietary information or intellectual property. An interception, misuse, or mishandling of personal, confidential, or proprietary information or intellectual property being sent to or received from a customer or third party could result in legal liability, remediation costs, regulatory action, and reputational harm. Over the last few years, several large companies have disclosed that they or their service providers suffered substantial data security breaches, compromising millions of user accounts and credentials.

The risk of cyberattacks has also increased and will continue to increase in connection with Russia’s invasion of Ukraine. In light of the Ukraine war and other geopolitical events and dynamics, including ongoing tensions with North Korea, Iran and other countries, state-sponsored parties or their supporters may launch retaliatory cyberattacks, and may attempt to cause supply chain disruptions, or carry out other geopolitically motivated retaliatory actions that may adversely disrupt or degrade our operations and may result in data compromise. State-sponsored parties have, and will continue, to conduct cyberattacks to achieve their goals that may include espionage, monetary gain, disruption, and destruction. To accomplish their goals, state-sponsored parties and other cyber criminals have used, and may continue to use, various attack vectors and methods as discussed above.

We have incurred and will continue to incur significant expense in an effort to improve the reliability and resilience of our systems and their security against external and internal threats. Nonetheless, there remains the risk that one or more adverse events might occur. If one does occur, we might not be able to remediate the event or its consequences timely or adequately. While we do maintain cyber information security and business interruption insurance, losses from a major interruption may exceed our coverage and there can be no assurance that liabilities or losses we may incur will be covered under such policies.

Third parties perform significant operational services on our behalf. Additionally, some of our third parties outsource aspects of their operations to downstream service providers. These parties are subject to similar risks as Key relating to cybersecurity and breakdowns or failures of their own systems, internal processes and controls, or employees. One or more of these third parties or their downstream service providers may experience a cybersecurity event or operational disruption and, if any such event does occur, it may not be adequately addressed, either operationally or financially, by such third party. Certain of these third parties may have limited indemnification obligations or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a third party could also impair our operations if those difficulties interfere with such third party’s ability to serve us. For example, we previously announced that we plan to operate our primary platforms and applications on Google Cloud infrastructure. If this planned transition is delayed or impacts the reliability and availability of our services, we may not realize our financial and strategic objectives. In addition, any unanticipated interruption, delay, or degradation in the performance and delivery of our services could negatively impact our customer relationships. Additionally, some of our outsourcing arrangements are located overseas and, therefore, are subject to risks unique to the regions in which they operate. If a critical third party is unable to meet our needs in a timely manner or if the services or products provided by such third party are terminated or otherwise delayed and if we are not able to identify or develop alternative sources for these services and products quickly and cost-effectively, it could have a material adverse effect on our business. Additionally, regulatory guidance adopted by federal banking regulators related to how banks select, engage, and manage their third parties affects the circumstances and conditions under which we work with third parties and the cost of managing such relationships.

From time to time, customers, vendors, or other parties may make claims and take legal action against us. We maintain reserves for certain claims when deemed appropriate based upon our assessment that a loss is probable, estimable, and consistent with applicable accounting guidance. At any given time, we have a variety of legal actions asserted against us in various stages of litigation. Resolution of a legal action can often take years. Whether any particular claims and legal actions are founded or unfounded, if such claims and legal actions are not resolved in our favor, they may result in significant financial liability and adversely affect how the market perceives us and our products and services as well as impact customer demand for those products and services.

We are also involved, from time to time, in other information-gathering requests, reviews, investigations, and proceedings (both formal and informal) by governmental and self-regulatory agencies regarding our business, including, among other things, accounting, compliance, and operational matters, certain of which may result in adverse judgments, settlements, fines, penalties, injunctions, or other relief which, if significant, could adversely affect our business, results of operations and/or financial condition. In recent years, there has been an increase in the number of investigations and proceedings in the financial services industry. A violation of law or regulation by another financial institution may give rise to an inquiry or investigation by regulators or other authorities of the same or similar practices by Key. The outcome of regulatory matters as well as the timing of ultimate resolution are inherently difficult to predict.

We regularly review and update our internal controls, disclosure controls and procedures, and corporate governance policies and procedures. We also maintain an ERM program designed to identify, measure, monitor, report, and analyze our risks. Additionally, our internal audit function provides an independent assessment and testing of Key’s internal controls, policies, and procedures. Any system of controls and any system to reduce risk exposure, however well designed, operated, and tested, is based in part on certain assumptions and can provide only reasonable, not absolute, assurances that the objectives of the system are met. The systems may not work as

intended or be circumvented by employees, third parties, or others outside of Key. Additionally, instruments, systems, and strategies used to hedge or otherwise manage exposure to various types of market compliance, credit, liquidity, operational, and business risks and enterprise-wide risk could be less effective than anticipated. As a result, we may not be able to effectively or fully mitigate our risk exposures in particular market environments or against particular types of risk.

Natural disasters could have a material adverse effect on our financial position and results of operations, and the timing and effects of any natural disaster cannot accurately be predicted. The frequency and severity of some types of natural disasters, including wildfires, tornadoes, severe storms, and hurricanes, have increased as a result of climate change, which further reduces our ability to predict their effects accurately. These and other natural disasters could affect Key directly (for example, by interrupting our systems, damaging our facilities or otherwise preventing us from conducting our business in the ordinary course) or indirectly (for example, by damaging or destroying customer businesses or otherwise impairing customers’ ability to repay their loans, or by damaging or destroying property pledged as collateral for loans made by Key).

Concerns over the long-term impacts of climate change have led and may continue to lead to governmental efforts around the world to mitigate those impacts. New and/or more stringent regulatory requirements could materially affect our results by requiring us to take costly measures to comply with any new laws or regulations related to climate change that may be forthcoming. Consumers and businesses also may change their own behavior as a result of these concerns. Key and its customers will need to respond to new laws and regulations, as well as consumer and business preferences resulting from climate change concerns. Key and its customers may face cost increases, asset value reductions, operating process changes, and the like. The impact on Key’s customers will likely vary depending on their specific attributes, including reliance on or role in carbon intensive activities. Changes to regulations or market shifts to low-carbon products could impact the credit worthiness or the value of assets securing loans of some of our customers, which may require us to adjust our lending portfolios and business strategies. Key’s efforts to take these risks into account in making lending and other decisions, including by increasing business relationships with climate-friendly companies, may not be effective in protecting Key from the negative impact of new laws and regulations or changes in consumer or business behavior.

The increase in remote work has resulted in an expanded potential attack surface and heightened operational risks and may negatively impact our ability, and the ability of our third-party service providers (including their downstream service providers), to perform services efficiently, securely, and without interruptions. A large percentage of our workforce works remotely, and our third-party service providers (including their downstream service providers) may utilize personnel who work remotely. Increased levels of remote access create additional cybersecurity risk and opportunities for cybercriminals to exploit vulnerabilities. For example, cybercriminals have increased their attempts to compromise business emails, including an increase of phishing attempts. These fraudulent activities have resulted in increased fraud losses to us and the financial services industry. In addition to enhanced cybersecurity risk, employees and other personnel performing services for us who work remotely may experience disruptions to their home internet or phone connections, decreased efficiency due to delayed network speeds or other interruptions, and/or delays in the dissemination and exchange of information, any of which could negatively impact our operations. We have experienced, and may continue to experience, disruption related to remote work, which disruptions could adversely impact our business, and could result in legal liability, regulatory penalties, litigation expenses, remediation costs, or reputational harm.

Evolving capital standards resulting from the Dodd-Frank Act and the Regulatory Capital Rules adopted by our regulators have had and will continue to have a significant impact on banks and BHCs, including Key. For a detailed explanation of the capital and liquidity rules that became effective for us on a phased-in basis on January 1, 2015, see the section titled “Regulatory capital requirements” under the heading “Supervision and Regulation” in Item 1 of this report.

The Federal Reserve’s capital standards require Key to maintain more and higher quality capital and could limit our business activities (including lending) and our ability to expand organically or through acquisitions. They could also result in our taking steps to increase our capital that may be dilutive to shareholders or limit our ability to pay dividends or otherwise return capital to shareholders.

In addition, the liquidity standards require us to hold high-quality liquid assets, may require us to change our future mix of investment alternatives, and may impact future business relationships with certain customers. Additionally, support of liquidity standards may be satisfied through the use of term wholesale borrowings, which tend to have a higher cost than that of traditional core deposits.

Further, the Federal Reserve has detailed the processes that BHCs should maintain to ensure they hold adequate capital under severely adverse conditions and have ready access to funding before engaging in any capital activities. These processes, the severity and other characteristics of which may evolve from year-to-year, are used by the Federal Reserve to, among other things, evaluate our management of capital and the adequacy of our regulatory capital and to determine the stress capital buffer that we must maintain above our minimum regulatory capital requirements. The results of these processes are difficult to predict due, among other things, to the Federal Reserve’s use of proprietary stress models that differ from our internal models and may result in the Federal Reserve imposing capital requirements in excess of our expectations which could require us, as applicable, to revise our stress-testing or capital management approaches, resubmit our capital plan or postpone, cancel, or alter or planned capital actions. The results may also lead to limits on Key’s ability to make distributions, including paying out dividends or buying back shares. For more information, see the section titled “Regulatory capital requirements” under the heading “Supervision and Regulation” in Item 1 of this report.

In addition, certain regulatory rule changes related to tailoring outlined in EGRRCPA have been finalized. While marginal relief from certain capital and liquidity standards has been afforded to Key (such as relief from LCR disclosure requirements), overall capital and liquidity management practices and expectations will remain unchanged for the foreseeable future. Moreover, Key has not experienced significant changes to its overall liquidity and capital levels or composition as a result of the final rules.

The federal government, in recent years, has taken unprecedented steps to provide stability to and confidence in the financial markets. For example, the Federal Reserve initiated a round of emergency interest rate cuts designed to mitigate some of the economic effects resulting from the pandemic. The discontinuation and, in some cases, reversal of such initiatives have since impacted financial markets and our business. These effects include increased market and interest rate volatility, higher debt yields, an inverted slope to the yield curve, and unanticipated changes to quality spread premiums that may not follow historical relationships or patterns. Additionally, new initiatives or legislation may not be implemented, or, if implemented, may not be adequate to counter any negative effects of discontinuing programs or, in the event of an economic downturn, to support and stabilize the economy.

As market conditions evolve and respond to the influence of these government agency initiatives, or lack thereof, the slope of the yield curve will shift and influence our loan and deposit rates and value of investments. The actions of federal agencies are not fully predictable which contributes to market volatility and changes to the slope of the yield curve.

We are a legal entity separate and distinct from our subsidiaries. With the exception of cash that we may raise from debt and equity issuances, we receive substantially all of our funding from dividends by our subsidiaries. Dividends by our subsidiaries are the principal source of funds for the dividends we pay on our common and preferred stock and interest and principal payments on our debt. Federal banking law and regulations limit the amount of dividends that KeyBank (KeyCorp’s largest subsidiary) can pay. For further information on the regulatory restrictions on the payment of dividends by KeyBank, see “Supervision and Regulation” in Item 1 of this report.

In the event KeyBank is unable to pay dividends to us, we may not be able to service debt, pay obligations, or pay dividends on our common or preferred stock. Such a situation could result in Key losing access to alternative wholesale funding sources. In addition, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to the prior claims of the subsidiary’s creditors.

Market conditions or other events could negatively affect our access to or the cost of funding, affecting our ongoing ability to accommodate liability maturities and deposit withdrawals, meet contractual obligations, or fund asset growth and new business initiatives at a reasonable cost, in a timely manner and without adverse consequences.

Although we maintain a liquid asset portfolio and have implemented strategies to maintain sufficient and diverse sources of funding to accommodate planned as well as unanticipated changes in assets, liabilities, and off-balance sheet commitments under various economic conditions (including a reduced level of wholesale funding sources), a substantial, unexpected, or prolonged change in the level or cost of liquidity could have a material adverse effect on us. If the cost effectiveness or the availability of supply in these credit markets is reduced for a prolonged period of time, our funding needs may require us to access funding and manage liquidity by other means. These alternatives may include generating client deposits, securitizing or selling loans, extending the maturity of wholesale borrowings, borrowing under certain secured borrowing arrangements, using relationships developed with a variety of fixed income investors, and further managing loan growth and investment opportunities. These alternative means of funding may result in an increase to the overall cost of funds and may not be available under stressed conditions, which would cause us to liquidate a portion of our liquid asset portfolio to meet any funding needs.

The rating agencies regularly evaluate the securities issued by KeyCorp and KeyBank. The ratings of our long-term debt and other securities are based on a number of factors, including our financial strength, ability to generate earnings, and other factors. Some of these factors are not entirely within our control, such as conditions affecting the financial services industry and the economy and changes in rating methodologies. Changes in any of these factors could impact our ability to maintain our current credit ratings. A rating downgrade of the securities of KeyCorp or KeyBank could adversely affect our access to liquidity and could significantly increase our cost of funds, trigger additional collateral or funding requirements, and decrease the number of investors and counterparties willing to lend to us, reducing our ability to generate income.

Any failure by the U.S. federal government to increase the debt ceiling or any government shutdown could adversely affect the U.S. and global economy and our liquidity, financial condition and earnings.

U.S. debt ceiling and budget deficit concerns have increased the possibility of credit-rating downgrades and economic slowdowns, or a recession in the United States or globally. The U.S. federal government hit its borrowing limit, or debt ceiling, on January 19, 2023. If the government fails to increase the debt limit, the U.S. government’s sovereign credit rating may be downgraded and the U.S. government could default on its debts, which could adversely affect the U.S. and global financial markets, banking systems, and economic conditions. Absent intervention by the Federal Reserve, these developments could cause interest rates and borrowing costs to further increase, which may negatively impact our ability to access the debt markets, including the corporate bond markets, on favorable terms. In addition, disagreement over the federal budget has previously caused the U.S. federal government to shut down for periods of time. An extended period of shutdown of portions of the U.S. federal government could negatively impact the financial performance of certain customers and could negatively impact customers’ future access to certain loan and guaranty programs. Continued adverse political and economic conditions could have a material adverse effect on our business, financial condition and results of operations.

A worsening of economic and market conditions or downside shocks could result in adverse effects on Key and others in the financial services industry. Recent and persistent interest rate increases and a slowing economy have presented a challenge for the industry, including Key, and affects business and financial performance.

In particular, we face the following risks, and other unforeseeable risks, in connection with a downturn in the economic and market environment or in the face of downside shocks or a recession, whether in the United States or internationally:

Our earnings are largely dependent upon our net interest income. Net interest income is the difference between interest income earned on interest-earning assets such as loans and securities and interest expense paid on interest-bearing liabilities such as deposits and borrowed funds. Interest rates are highly sensitive to many factors that are beyond our control, including general economic conditions, the competitive environment within our markets, consumer preferences for specific loan and deposit products, and policies of various governmental and regulatory agencies, in particular, the Federal Reserve. Changes in monetary policy, including changes in interest rate controls being applied by the Federal Reserve, could influence the amount of interest we receive on loans and securities, the amount of interest we pay on deposits and borrowings, our ability to originate loans and obtain deposits, and the fair value of our financial assets and liabilities. When the Federal Reserve raises interest rates, the behavior of national money market rate indices, the correlation of consumer deposit rates to financial market interest rates, and the setting of benchmark rates may not follow historical relationships, which could influence net interest income and net interest margin.

Moreover, if the interest we pay on deposits and other borrowings increases at a faster rate than the interest we receive on loans and other investments, net interest income, and therefore our earnings, would be adversely affected. Conversely, earnings could also be adversely affected if the interest we receive on loans and other investments falls more quickly than the interest we pay on deposits and other borrowings.

On July 27, 2017, the Chief Executive of the United Kingdom Financial Conduct Authority (the “Authority”), which regulates LIBOR, announced that the Authority intends to stop persuading or compelling banks to submit rates for the calculation of LIBOR to the administrator of LIBOR after 2021. On March 5, 2021, ICE Benchmark Administration (“IBA”), the Authority-regulated and authorized administrator of LIBOR, confirmed, following a consultation process occurring during the end of 2020 and beginning of 2021, its intention to cease one-week and two-month USD LIBOR settings at December 31, 2021, and cease the USD LIBOR panel at June 30, 2023, effectively ceasing all other USD LIBOR tenors. On December 31, 2021, as expected, IBA ceased to publish one-

week and two-month ISD LIBOR. We anticipate that IBA will cease publishing LIBOR as we know it on June 30, 2023.

Key’s transition away from the use of LIBOR to alternative rates continues. With respect to new originations, regulators issued guidance indicating that new LIBOR originations should not extend beyond December 31, 2021. In the United States, the ARRC and the Federal Reserve Bank of New York started in May 2018 to publish the SOFR as an alternative to U.S. dollar LIBOR. SOFR is a broad measure of the cost of borrowing cash overnight that is collateralized by U.S. treasury securities. SOFR-based rates are currently used in new loans made by KeyCorp. The uncertainty regarding the transition from LIBOR to another benchmark rate or rates, including SOFR-based rates, could have adverse impacts on floating-rate obligations, loans, deposits, derivatives, and other financial instruments that currently use LIBOR as a benchmark rate and, ultimately, adversely affect KeyCorp’s financial condition and results of operations. The adverse impact could take various forms and is dependent upon certain factors outside of our control such as: timing of adoption by market forces of a new widely accepted LIBOR replacement, timing of LIBOR cessation, counterparty acceptance of a new reference rate for both new and existing contracts, and competition presented by non-regulated entities, among others. Additionally, since LIBOR and any replacement reference rate may have significantly different attributes, it is difficult to predict the amount of increased costs associated with implementing the transition to a new reference rate, including costs relative to product changes, systems changes, compliance and operational oversight costs, and legal expenses, among others. While the LIBOR Act will assist in the transition of certain LIBOR contracts to SOFR-based benchmark replacements, there are many LIBOR contracts, including commercial loans, that will not be subject to the core transition mechanisms and safe harbor provided by the LIBOR Act. Absent amendments, such LIBOR contracts could create uncertainties and risks. Also as of December 31, 2022, the Authority has an open consultation as to whether nonrepresentative synthetic USD LIBOR should be published for the one, three, and six-month tenors of USD LIBOR for a finite period of time. This too could create uncertainty regarding how certain LIBOR contracts transition once LIBOR in its current form ceases to be published.

We have concentrations of loans and other business activities in geographic regions where our bank branches are located — Washington; Oregon/Alaska; Rocky Mountains; Indiana/Northwest Ohio/Michigan; Central/Southwest Ohio; East Ohio/Western Pennsylvania; Atlantic; Western New York; Eastern New York; and New England — and additional exposure to geographic regions outside of our branch footprint. Economic growth in the various regions where we operate has been uneven, and the health of the overall U.S. economy may differ from the economy of any particular geographic region. Adverse conditions in a geographic region such as inflation, unemployment, recession, natural disasters, impact of the COVID-19 pandemic, or other factors beyond our control could impact the ability of borrowers in these regions to repay their loans, decrease the value of collateral securing loans made in these regions, or affect the ability of our customers in these regions to continue conducting business with us.

Additionally, a significant portion of our business activities are concentrated within the commercial real estate, healthcare, finance, and utilities market segments. The profitability of some of these market segments depends upon the health of the overall economy, seasonality, the impact of regulation, and other factors that are beyond our control and may be beyond the control of our customers in these market segments.

An economic downturn or recession in one or more geographic regions where we conduct our business, or any significant or prolonged impact on the profitability of one or more of the market segments with which we conduct significant business activity, could adversely affect the demand for our products and services, the ability of our customers to repay loans, the value of the collateral securing loans, and the stability of our deposit funding sources.

Our ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. We have exposure to many different industries and counterparties in the financial services industries, and we routinely execute transactions with such counterparties, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds, insurance companies, and other institutional clients. Financial services institutions are interrelated as a result of trading, clearing, counterparty, or other relationships. Defaults by one or more financial services institutions have led to, and may cause, market-wide liquidity problems and losses. Many of our transactions with other financial institutions expose us to credit risk in the event of default of a counterparty or client. In addition, our credit risk may be affected when the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of our loan or derivatives exposure.

Less regulated and poorly capitalized non-bank financial institutions may be particularly vulnerable to asset quality deterioration as their borrower’s ability to service their obligations declines amid the pandemic. This could put additional stress on traditional lenders.

Our ability to attract and retain customers, clients, investors, and highly skilled management and employees is affected by our reputation. Damage to our reputation could also adversely impact our credit ratings and access to capital markets.

Significant harm to our reputation can arise from various sources, including inappropriate behavior or misconduct of employees, actual or perceived unethical behavior, litigation or regulatory outcomes, inadequate or ineffective risk management practices, failing to deliver minimum or required standards of service and quality, corporate governance and regulatory compliance failures, disclosure of confidential information, significant or numerous failures, interruptions or breaches of our information systems, failure to meet external commitments and goals, including financial and ESG-related commitments, and the activities of our clients, customers and counterparties, including vendors. Actions by the financial services industry generally or by certain members or individuals in the industry as well as legislative or regulatory actions that target or negatively impact the industry may also have a significant adverse effect on our reputation.

Negative coverage about Key published in traditional media or on social media websites, whether or not factually correct, may affect our reputation and our business prospects and impact our ability to attract and retain highly skilled employees. Social media facilitates the rapid dissemination of information or misinformation, thereby increasing the potential for rapid and widespread dissemination of inaccurate, false, misleading, or other negative information that could damage our reputation. Negative public opinion can also adversely affect our ability to attract and maintain customer relationships and could subject us to litigation and regulatory action.

We are also subject to the risk that disruptions to how our customers access our banking services, such as disruptions to our technology platforms (e.g., online banking websites or mobile applications) or other impacts to our branches, could harm our reputation with customers. In particular, a cyber security event impacting Key or our customers’ data could negatively impact our reputation and customer confidence in Key and our data security procedures.

We could also suffer significant reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interests is complex as we expand our business activities through more numerous transactions, obligations, and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to deal with us, which could adversely affect our businesses, and could give rise to litigation or enforcement actions.

Financial services companies, including Key, face increasing criticism from social and environmental activists who target companies, including Key, for engaging in business with clients engaged in industries such activists perceive to be harmful to communities or the environment. Such criticism directed at Key could generate dissatisfaction among our stakeholders. Additionally, however we respond to such criticism, we face the risk that current or potential clients may decline to do business with us or current or potential employees refuse to work with us. This

can be true regardless of whether we are perceived by some as not having done enough to address activist concerns or by others as having inappropriately yielded to activist pressures.

We may also face criticism or a loss of confidence, with accompanying reputational risk, from our perceived action or inaction to deliver on our ESG-related commitments. Investors and other stakeholders, including U.S. institutional investors, are increasingly considering how corporations are incorporating ESG matters, including climate change, into their business strategy when analyzing the expected risk and return of potential investments. The specific ESG factors considered, as well as the approach to incorporating the factors into a broader investment process, vary by investor and can shift over time. These shifts in investing priorities may result in adverse effects on the trading price of KeyCorp’s common stock if investors determine that Key has not made sufficient progress on ESG matters or is not aligned with the investors’ ESG-related priorities.

Our ability to compete depends on a number of factors, including, among others, our ability to develop and successfully execute our strategic plans and initiatives. Our strategic priorities include growing profitably and maintaining financial strength; effectively managing risk and reward; engaging a high-performing, talented, and diverse workforce; investing in digitalization to drive growth and simplification; embracing the changes required by our clients and the marketplace; and acquiring, expanding, and retaining targeted client relationships. The success of these initiatives can be subject to changes in the macroeconomic environment which is beyond our control. In addition, our inability to execute on or achieve the anticipated outcomes of our strategic priorities, or to do so in the expected timeframe, may affect how the market perceives us and could impede our growth and profitability.

We face substantial competition in all areas of our operations from a variety of competitors, some of which are larger and may have more financial resources than us. Our competitors primarily include national and super-regional banks as well as smaller community banks within the various geographic regions in which we operate. We also face competition from many other types of financial institutions, including, without limitation, savings associations, credit unions, mortgage banking companies, finance companies, mutual funds, insurance companies, investment management firms, investment banking firms, broker-dealers and other local, regional, national, and global financial services firms. In addition, technology has lowered barriers to entry and made it possible for nonbanks, including large technology companies, to offer products and services traditionally provided by banks. We expect the competitive landscape of the financial services industry to become even more intense as a result of legislative, regulatory, structural, customer preference, and technological changes.

Our ability to compete successfully depends on a number of factors, including: our ability to develop and execute strategic plans and initiatives; our ability to develop, maintain, and build long-term customer relationships based on quality service and competitive prices; our ability to develop competitive products and technologies demanded by our customers, while maintaining our high ethical standards and an effective compliance program and keeping our assets safe and sound; our ability to attract, retain, and develop a highly competent employee workforce; and industry and general economic trends. Increased competition in the financial services industry, or our failure to perform in any of these areas, could significantly weaken our competitive position, which could adversely affect our growth and profitability.

Strategic risk may also be realized due to events or issues that materialize in other risk factor areas. For example, significant deficiencies in end-to-end operational execution and/or product delivery or failure to comply with applicable laws and regulations may result in unmet client expectations or harm and impact our competitive standing in the industry.

The continuous, widespread adoption of new technologies requires us to evaluate our product and service offerings to ensure they remain competitive. Our success depends, in part, on our ability to adapt our products and services, as well as our distribution of them, to evolving industry standards and consumer preferences. New technologies have altered consumer behavior by allowing consumers to complete transactions such as paying bills or transferring

funds directly without the assistance of banks. New products allow consumers to maintain funds in brokerage accounts or mutual funds that would have historically been held as bank deposits. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer loans and deposits and related income generated from those products.

The increasing pressure from our competitors, both bank and nonbank, to keep pace and adopt new technologies and products and services requires us to incur substantial expense. We may be unsuccessful in developing or introducing new products and services, modifying our existing products and services, adapting to changing consumer preferences and spending and saving habits, achieving market acceptance or regulatory approval, sufficiently developing or maintaining a loyal customer base, or offering products and services at prices equal to or lower than the prices offered by our competitors. These risks may affect our ability to achieve growth in our market share and could reduce both our revenue streams from certain products and services and our revenues from our net interest income.

Our success depends on our ability to attract, retain, motivate, and develop a talented and diverse workforce. Competition for talent in our business is strong and requires us to make investments to provide compensation and benefits at market levels. Rising wages, as well as inflation, may cause us to increase these investments. Such investments cause compensation and benefits to represent our greatest expense.

Additionally, we increasingly compete for talent outside of the core financial services industry. Non-financial institutions may be subject to different pay and hiring expectations than us, which may make it more difficult for us to attract qualified teammates. For example, we are required to deliver a substantial portion of the variable compensation of certain teammates in the form of awards tied to our financial performance. A sustained decline in our share price could impact our ability to retain those individuals. Similarly, our pay practices are subject to scrutiny by our regulators who may identify deficiencies in the structure of, or issue additional guidance on our compensation practices, causing us to make changes that may affect our ability to offer competitive pay to these individuals or that place us at a disadvantage to non-financial service industry competitors.

Finally, while remote work opportunities allow us to hire outside of our traditional footprint, it also increases competition. These factors individually, or collectively, may constrain our ability to hire or retain a sufficient number of qualified employees, which could impact our ability to serve our customers and clients.

Acquiring other banks, bank branches, or other businesses involves various risks commonly associated with acquisitions or partnerships, including exposure to unknown or contingent liabilities of the acquired company; diversion of our management’s time and attention; significant integration risk with respect to employees, accounting systems, and technology platforms; increased regulatory scrutiny; and the possible loss of key employees and customers of the acquired company. We regularly evaluate merger and acquisition and strategic partnership opportunities and conduct due diligence activities related to possible transactions. As a result, mergers or acquisitions involving cash, debt or equity securities may occur at any time. Acquisitions may involve the payment of a premium over book and market values. Therefore, some dilution of our tangible book value and net income per common share could occur in connection with any future transaction.

Banking regulators continue to focus on the models used by banks and bank holding companies in their businesses. The failure or inadequacy of a model may result in increased regulatory scrutiny on us or may result in an enforcement action or proceeding against us by one of our regulators.

PART II

From time to time, KeyCorp or its principal subsidiary, KeyBank, may seek to retire, repurchase, or exchange outstanding debt of KeyCorp or KeyBank, and capital securities or preferred stock of KeyCorp, through cash purchase, privately negotiated transactions, or otherwise. Such transactions, if any, depend on prevailing market conditions, our liquidity and capital requirements, contractual restrictions, and other factors. The amounts involved may be material.

As part of our previous 2021 capital plan, which was effective through the third quarter of 2022, the Board had authorized the repurchase of up to $1.5 billion of our Common Shares. In September 2022, the Board approved the extension of the previous authorization through the third quarter of 2023.

The following table summarizes our repurchases of our Common Shares for the three months ended December 31, 2022.

Introduction

We remain committed to enhancing long-term shareholder value by continuing to execute our relationship-based business model, growing our franchise, and being disciplined in our capital management. We intend to pursue this commitment by growing profitably; acquiring and expanding targeted client relationships; effectively managing risk and rewards; maintaining financial strength; and engaging, retaining, and inspiring our diverse and high-performing workforce. These strategic priorities for enhancing long-term shareholder value are described in more detail below.

We took the following actions during 2022 in support of our corporate strategy:

The following chart provides a reconciliation of net income from continuing operations attributable to Key common shareholders for the year ended December 31, 2021, to the year ended December 31, 2022 (dollars in millions):

To make it easier to compare both the results among several periods and the yields on various types of earning assets (some taxable, some not), we present net interest income in this discussion on a “TE basis” (i.e., as if all income were taxable and at the same rate). For example, $100 of tax-exempt income would be presented as $126, an amount that, if taxed at the statutory federal income tax rate of 21%, would yield $100.

Average loans totaled $111.3 billion for 2022, compared to $100.3 billion in 2021. Commercial loans increased $6.5 billion, reflecting core commercial and industrial loan growth and an increase in commercial mortgage real estate loans, which mitigated the impact of a $4.7 billion decline in PPP balances. Consumer loans increased $4.6 billion driven by Key’s consumer mortgage business and student loan originations from Laurel Road, partly offset by the sale of the indirect auto loan portfolio in the third quarter of 2021.

Average deposits totaled $146.9 billion for 2022, an increase of $1.8 billion compared to 2021. The increase reflects growth from consumer and commercial relationships, partially offset by a decline in time deposits and non-operating commercial deposit balances.

Figure 1 shows the various components of our balance sheet that affect interest income and expense and their respective yields or rates over the past five years. This figure also presents a reconciliation of TE net interest income to net interest income reported in accordance with GAAP for each of those years. The net interest margin, which is an indicator of the profitability of our earning assets less the cost of funding, is calculated by dividing taxable-equivalent net interest income by average earning assets.

Figure 2 shows how the changes in yields or rates and average balances from the prior year affected net interest income. The section entitled “Financial Condition” contains additional discussion about changes in earning assets and funding sources.

Our provision for credit losses was a net charge of $502 million for 2022, compared to a $418 million net benefit for 2021. The increase in our provision for credit losses was a result of reserve increases largely driven by changes in the economic outlook and loan growth, offset somewhat by lower net charge-offs. In 2021, our provision for credit losses was a net benefit due to reserve releases as the economic stress and uncertainty in the U.S. and globally caused by COVID-19 eased, along with significantly lower net loan charge-offs and improved asset quality. In 2023 we expect net charge-offs to average loans to be in the range of 25 to 30 bps.

Noninterest income for 2022 was $2.7 billion, compared to $3.2 billion during 2021. Noninterest income represented 37% of total revenue for 2022 and 44% of total revenue for 2021. In 2023, we expect noninterest income to be down 1% to 3% compared to 2022.

The following discussion explains the composition of certain elements of our noninterest income and the factors that caused those elements to change.

Trust and investment services income

Figure 4. Assets Under Administration

Investment banking and debt placement fees

Investment banking and debt placement fees consist of syndication fees, debt and equity underwriting fees, merger and acquisition and financial advisor fees, gains on sales of commercial mortgages, and agency origination fees. For 2022, investment banking and debt placement fees decreased $299 million, or 31.9%, from the prior year reflecting the slowdown in capital markets activity.

Service charges on deposit accounts

Cards and payments income

Cards and payments income, which consists of debit card, consumer and commercial credit card, and merchant services income, decreased $74 million, or 17.8%, in 2022 compared to 2021. This decrease was primarily due to reduced prepaid card activity as customers rolled off government support programs during the year with a slight offset from an increase in merchant services income.

Other noninterest income

Other noninterest income includes operating lease income and other leasing gains, corporate services income, corporate-owned life insurance income, consumer mortgage income, commercial mortgage servicing fees, and other income. Other noninterest income decreased $112 million, or 11.5%, in 2022 compared to 2021, driven by decreases in consumer mortgage income from lower gain on sale margins and lower saleable volume. Decreases also occurred within operating lease income and other leasing gains from declining operating lease balances. These decreases were slightly offset by an increase in corporate services income from higher derivatives income.

The following discussion explains the composition of certain elements of our noninterest expense and the factors that caused those elements to change.

Non-personnel expense

In total, other non-personnel expense decreased $24 million, or 1.3%, in 2022 compared to 2021 stemming from declines in business services and professional fees and operating expense, with a slight offset from an increase in computer processing costs.

We recorded a tax provision from continuing operations of $422 million for 2022, compared to $642 million for 2021. The effective tax rate, which is the provision for income taxes as a percentage of income from continuing operations before income taxes, was 18.1% for 2022 and 19.7% for 2021. In 2023, we expect our GAAP tax rate to be approximately 20%.

In 2022, our federal tax expense and effective tax rate differ from the amount that would be calculated using the federal statutory tax rate primarily due to investments in tax-advantaged assets, such as corporate-owned life insurance, tax credits associated with energy related projects and low-income housing investments, and periodic adjustments to our tax reserves as described in Note 14 (“Income Taxes”).

This section summarizes the financial performance of our two major business segments (operating segments): Consumer Bank and Commercial Bank. Note 25 (“Business Segment Reporting”) describes the products and services offered by each of these business segments and provides more detailed financial information pertaining to the segments. Dollars in the charts are presented in millions.

Segment imperatives

Market and business overview

As the banking industry moves forward, so do our clients. Anticipating our clients’ needs not only today, but for tomorrow and into the future, has become one of the biggest challenges for the banking industry. We view these challenges as an opportunity to help our current client base meet their own goals, as well as attract new and diverse clients. In an increasingly digital world focused on specialized convenience, we have made meaningful steps to meet those demands through new digital portals including the rollout of our national digital affinity bank, Laurel Road for Doctors. These platforms place us in a strong position to develop long lasting and meaningful relationships with our current and prospective clients. Financial wellness is a core tenet of our customer relationships and we see it in three different ways: diagnose, enhance, and sustain. Our goal is to get our clients to a place where they can comfortably sustain their current financial position so we can be there for them when they are ready to grow. Clients no longer go to a branch to conduct transactions only, they go to seek advice and gain new perspectives on issues they may be facing.

Summary of operations

Building relationships and delivering complex solutions for middle market clients requires a distinctive operating model that understands their business and can provide a broad set of product capabilities. As competition for these clients intensifies, we have positioned the business to maintain and grow our competitive advantage by building targeted scale in businesses and client segments. Strong market share in businesses such as real estate loan servicing and equipment finance highlights our ability to successfully meet customer needs through targeted scale in distinct product capabilities. Clients expect us to understand every aspect of their business. Our seven industry verticals are aligned to drive targeted scale in segments where we have a breadth of industry expertise. Our business model is positioned to meet our client needs because our focus is not on being a universal bank, but rather being the right bank for our clients.

Summary of operations

Financial Condition