Capital One Financial (COF) 10-K2019 FY Annual report

Capital One Financial Corporation, a Delaware corporation established in 1994 and headquartered in McLean, Virginia, is a diversified financial services holding company with banking and non-banking subsidiaries. Capital One Financial Corporation and its subsidiaries (the “Company” or “Capital One”) offer a broad array of financial products and services to consumers, small businesses and commercial clients through digital channels, branches, Cafés and other distribution channels.

As of December 31, 2019, our principal subsidiaries included:

We also offer products outside of the U.S. principally through Capital One (Europe) plc (“COEP”), an indirect subsidiary of COBNA organized and located in the United Kingdom (“U.K.”), and through a branch of COBNA in Canada. Both COEP and our branch of COBNA in Canada have the authority to provide credit card loans.

We regularly explore and evaluate opportunities to acquire financial services and products as well as financial assets, including credit card and other loan portfolios, and enter into strategic partnerships as part of our growth strategy. We also explore opportunities to acquire technology companies and related assets to improve our information technology infrastructure and to deliver on our digital strategy. We may issue equity or debt to fund our acquisitions. In addition, we regularly consider the potential disposition of certain of our assets, branches, partnership agreements or lines of business.

On September 24, 2019, we launched a new credit card issuance program with Walmart Inc. (“Walmart”) and are now the exclusive issuer of Walmart’s cobrand and private label credit card program in the U.S. On October 11, 2019, we completed the acquisition of the existing portfolio of Walmart’s cobrand and private label credit card receivables (“Walmart acquisition”). As of the acquisition date, we added approximately $8.1 billion to our domestic credit card loans held for investment portfolio.

In the second quarter of 2019, we made the decision to exit several small partnership portfolios in our Credit Card business. We sold approximately $900 million of receivables and transferred approximately $100 million to loans held for sale as of June 30, 2019, which resulted in a gain on sale of $49 million recognized in other non-interest income and an allowance release of $68 million.

This event affected approximately 100 million individuals in the United States and approximately 6 million in Canada. We believe no credit card account numbers or log-in credentials were compromised. The largest category of information accessed was information on consumers and small businesses as of the time they applied for one of our credit card products from 2005 through early 2019. This information included personal information that we routinely collect at the time we receive credit card applications, including names, addresses, zip codes/postal codes, phone numbers, email addresses, dates of birth, and self-reported income. In addition to credit card application data, the individual also obtained portions of credit card customer data, including customer status data (e.g., credit scores, credit limits, balances, payment history, contact information) and fragments of transaction data from a total of 23 days during 2016, 2017 and 2018. Approximately 120,000 Social Security numbers of our credit card customers and approximately 80,000 linked bank account numbers of our secured credit card customers were compromised in this incident. For our Canadian credit card customers, approximately 1 million Social Insurance Numbers were compromised in this incident.

We provided required notification to affected individuals and made free credit monitoring and identity protection available. We retained a leading independent cybersecurity firm that confirmed we correctly identified and fixed the specific configuration vulnerability exploited in the Cybersecurity Incident.

During the year, we incurred $72 million of incremental expenses related to the remediation of and response to the Cybersecurity Incident, largely driven by customer notifications, credit monitoring, technology costs, and professional support, offset by $34 million of insurance recoveries pursuant to our insurance coverage described below. These amounts were treated as adjusting items as it relates to our financial results (“Cyber Adjusting Items”). We expect to be at the low end of the $100 million to $150 million range previously disclosed for the total amount of Cyber Adjusting Items and expect that some of these costs will extend beyond 2019.

We carry insurance to cover certain costs associated with a cyber risk event. This insurance has a total coverage limit of $400 million and is subject to a $10 million deductible, which was met in the third quarter of 2019, as well as standard exclusions. We continue to expect that a significant portion of the Cyber Adjusting Items will be covered by insurance. Insurance reimbursements will also be treated as adjusting items, and the timing of recognizing insurance reimbursements may differ from the timing of recognizing the associated expenses.

We continue to invest significantly in cybersecurity and expect to make additional investments as we continue to assess our cybersecurity program. These estimated investments are in addition to the estimated Cyber Adjusting Items and we expect to absorb them within our existing operating efficiency ratio guidance.

Our reported results excluding adjusting items, including the Cyber Adjusting Items, and our existing operating efficiency ratio guidance represent non-GAAP measures which we believe help users of our financial information understand the impact of these adjusting items on our reported results as well as provide an alternate measurement of our operating performance.

Our common stock trades on the New York Stock Exchange (“NYSE”) under the symbol “COF” and is included in the Standard & Poor’s (“S&P”) 100 Index. We maintain a website at www.capitalone.com. Documents available under Corporate Governance in the Investor Relations section of our website include:

These documents also are available in print to any stockholder who requests a copy. We intend to disclose future amendments to certain provisions of our Code of Conduct, and waivers of our Code of Conduct granted to executive officers and directors, on the website within four business days following the date of the amendment or waiver.

Our consolidated total net revenues are derived primarily from lending to consumer and commercial customers net of funding costs associated with our deposits, long-term debt and other borrowings. We also earn non-interest income which primarily consists of interchange income, net of reward expenses, service charges and other customer-related fees. Our expenses primarily consist of the provision for credit losses, operating expenses, marketing expenses and income taxes.

Our principal operations are organized for management reporting purposes into three major business segments, which are defined primarily based on the products and services provided or the types of customers served: Credit Card, Consumer Banking and Commercial Banking. The operations of acquired businesses have been integrated into our existing business segments. Certain activities that are not part of a segment, such as management of our corporate investment portfolio, asset/liability management by our centralized Corporate Treasury group and residual tax expense or benefit to arrive at the consolidated effective tax rate that is not assessed to our primary business segments, are included in the Other category.

Customer usage and payment patterns, credit quality, levels of marketing expense and operating efficiency all affect our profitability. In our Credit Card business, we experience fluctuations in purchase volume and the level of outstanding loan receivables due to seasonal variances in consumer spending and payment patterns which, for example, are highest around the winter holiday season. Net charge-off rates for our credit card loan portfolio also have historically exhibited seasonal patterns as well and generally tend to be the highest in the first quarter of the year. No individual quarter in 2019, 2018 or 2017 accounted for more than 30% of our total revenues in any of these fiscal years.

Each of our business segments operates in a highly competitive environment, and we face competition in all aspects of our business from numerous bank and non-bank providers of financial services.

Our Consumer Banking and Commercial Banking businesses compete with national, state and direct banks for deposits, commercial and auto loans, as well as with savings and loan associations and credit unions for loans and deposits. Our competitors also include automotive finance companies, commercial mortgage banking companies and other financial services providers that provide loans, deposits, and other similar services and products. In addition, we compete against non-depository institutions that are able to offer these products and services. Securities firms and insurance companies that elect to become financial holding companies may acquire banks and other financial institutions. Combinations of this type could significantly change the competitive environment in which we conduct business. The financial services industry is also likely to become more competitive as further technological advances enable more companies to provide financial services. These technological advances may diminish the importance of depository institutions and other financial intermediaries in the transfer of funds between parties. In addition, competition among direct banks is intense because online banking provides customers the ability to rapidly deposit and withdraw funds and open and close accounts in favor of products and services offered by competitors.

Capital One Financial Corporation is a bank holding company (“BHC”) and a financial holding company (“FHC”) under the Bank Holding Company Act of 1956, as amended (“BHC Act”), and is subject to the requirements of the BHC Act, including approval requirements for investments in or acquisitions of banking organizations, capital adequacy standards and limitations on nonbanking activities. As a BHC and FHC, we are subject to supervision, examination and regulation by the Board of Governors of the Federal Reserve System (“Federal Reserve”). Permissible activities for a BHC include those activities that are so closely related to banking as to be a proper incident thereto. In addition, an FHC is permitted to engage in activities considered to be financial in nature (including, for example, securities underwriting and dealing and merchant banking activities), incidental to financial activities or, if the Federal Reserve determines that they pose no risk to the safety or soundness of depository institutions or the financial system in general, activities complementary to financial activities.

To become and remain eligible for FHC status, a BHC and its subsidiary depository institutions must meet certain criteria, including capital, management and Community Reinvestment Act (“CRA”) requirements. Failure to meet such criteria could result, depending on which requirements were not met, in restrictions on new financial activities or acquisitions or being required to discontinue existing activities that are not generally permissible for BHCs.

The Banks are national associations chartered under the laws of the United States and the deposits of which are insured by the Deposit Insurance Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”) up to applicable limits. The Banks are subject to comprehensive regulation and periodic examination by the Office of the Comptroller of the Currency (“OCC”), the FDIC and the Consumer Financial Protection Bureau (“CFPB”).

We are also registered as a financial institution holding company under the laws of the Commonwealth of Virginia and, as such, we are subject to periodic examination by the Virginia Bureau of Financial Institutions. We also face regulation in the international

jurisdictions in which we conduct business. See “Regulation of Businesses by Authorities Outside the United States” below for additional details.

The business activities of the Company and the Banks are also subject to regulation and supervision under various laws and regulations.

The activities of the Banks as consumer lenders are subject to regulation under various federal laws, including, for example, the Truth in Lending Act (“TILA”), the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the CRA, the Servicemembers Civil Relief Act and the Military Lending Act, as well as under various state laws. TILA, as amended, imposes a number of restrictions on credit card practices impacting rates and fees, requires that a consumer’s ability to pay be taken into account before issuing credit or increasing credit limits, and imposes revised disclosures required for open-end credit.

Depending on the underlying issue and applicable law, regulators may be authorized to impose penalties for violations of these statutes and, in certain cases, to order banks to compensate customers. Borrowers may also have a private right of action for certain violations. Federal bankruptcy and state debtor relief and collection laws may also affect the ability of a bank, including the Banks, to collect outstanding balances owed by borrowers.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) requires that the amount of any interchange fee received by a debit card issuer with respect to debit card transactions be reasonable and proportional to the cost incurred by the issuer with respect to the transaction. Rules adopted by the Federal Reserve to implement these requirements limit interchange fees per debit card transaction to $0.21 plus five basis points of the transaction amount and provide for an additional $0.01 fraud prevention adjustment to the interchange fee for issuers that meet certain fraud prevention requirements.

We are subject to multiple federal and state laws concerning data privacy, such as the Gramm-Leach Bliley Act. This area has seen increasing legislative and regulatory activity. For example, in 2018, the State of California passed the California Consumer Privacy Act (“CCPA”), which creates obligations on covered companies to, among other things, share certain information they have collected about individuals who are California residents with those individuals, subject to some exceptions. The California Attorney General has received public comment on the proposed regulations and is expected to issue final CCPA regulations in the first half of 2020. We have analyzed the CCPA and determined its initial applicability to our business. We will review the final CCPA regulations and determine their impact to our business while we continue to monitor data privacy legal developments in other jurisdictions.

The Bank Secrecy Act and the USA PATRIOT Act of 2001 (“Patriot Act”) require financial institutions, among other things, to implement a risk-based program reasonably designed to prevent money laundering and to combat the financing of terrorism, including through suspicious activity and currency transaction reporting, compliance, record-keeping and customer due diligence.

The Patriot Act also contains financial transparency laws and provides enhanced information collection tools and enforcement mechanisms to the U.S. government, including due diligence and record-keeping requirements for private banking and correspondent accounts; standards for verifying customer identification at account opening; rules to produce certain records upon request of a regulator or law enforcement agency; and rules to promote cooperation among financial institutions, regulators and law enforcement agencies in identifying parties that may be involved in terrorism, money laundering and other crimes.

FDIC is authorized to terminate a bank’s deposit insurance upon a finding by the FDIC that the bank’s financial condition is unsafe or unsound or that the institution has engaged in unsafe or unsound practices or has violated any applicable rule, regulation, order or condition enacted or imposed by the bank’s regulatory agency. The termination of deposit insurance would likely have a material adverse effect on a bank’s liquidity and earnings.

Certain of our nonbank subsidiaries are subject to supervision and regulation by various other federal and state authorities. United Income, Inc. is an investment adviser registered with the SEC and regulated under the Investment Advisers Act of 1940. Capital One Securities, Inc. and KippsDeSanto & Company are registered broker-dealers regulated by the SEC and the Financial Industry Regulatory Authority. Our broker-dealer subsidiaries are subject, among other things, to net capital rules designed to measure the general financial condition and liquidity of a broker-dealer. Under these rules, broker-dealers are required to maintain the minimum net capital deemed necessary to meet their continuing commitments to customers and others, and to keep a substantial portion of their assets in relatively liquid form. These rules also limit the ability of a broker-dealer to transfer capital to its parent companies and other affiliates. Broker-dealers are also subject to regulations covering their business operations, including sales and trading practices, public offerings, publication of research reports, use and safekeeping of client funds and securities, capital structure, record-keeping and the conduct of directors, officers and employees.

The Commodity Futures Trading Commission (“CFTC”) and the SEC have jointly issued final rules further defining the Dodd-Frank Act’s “swap dealer” definitions. Based on these rules, no Capital One entity is currently required to register with the CFTC or SEC as a swap dealer. The Dodd-Frank Act also requires all swap market participants to keep certain swap transaction records and report pertinent information to swap data repositories on a real-time and on-going basis. Further, each swap, group, category, type or class of swap that the CFTC or SEC determines must be cleared through a derivatives clearinghouse (unless the swap is eligible for a clearing exemption) must also be executed on a designated contract market (“DCM”), exchange or swap execution facility (“SEF”), unless no DCM, exchange or SEF has made the swap available for trading.

We and each of our subsidiaries, including the Banks, are subject to the “Volcker Rule,” a provision of the Dodd-Frank Act that contains prohibitions on proprietary trading and certain investments in, and relationships with, covered funds (hedge funds, private equity funds and similar funds), subject to certain exemptions, in each case as the applicable terms are defined in the Volcker Rule and the implementing regulations. The implementing regulations also require that we establish and maintain a compliance program designed to ensure adherence with the requirements of the regulations.

The Federal Reserve, OCC and FDIC (collectively, the “Federal Banking Agencies”) have issued regulations (“Basel III Capital Rule”) that implement certain capital and liquidity requirements published by the Basel Committee on Banking Supervision (“Basel Committee”), along with certain Dodd-Frank Act and other capital provisions. The Basel III Capital Rule includes the “Basel III Standardized Approach” and the “Basel III Advanced Approaches.” Prior to January 1, 2020, the Basel III Advanced Approaches were mandatory for institutions with total consolidated assets of $250 billion or more or total consolidated on-balance sheet foreign exposure of $10 billion or more. The Basel III Capital Rule revised the definition of regulatory capital, established a new common equity Tier 1 capital requirement, set higher minimum capital ratio requirements, and introduced a capital conservation buffer of 2.5%, a supplementary leverage ratio of 3.0%, and a countercyclical capital buffer (currently set at 0.0%). Compliance with the Basel III Capital Rule went into effect for Capital One beginning on January 1, 2014, with certain provisions becoming effective later according to various start dates and phase-in periods that ended January 1, 2019.

In October 2019, the Federal Banking Agencies amended the Basel III Capital Rule to provide for tailored application of certain capital requirements across different categories of banking institutions (“Tailoring Rules”). These categories are determined primarily by an institution’s asset size, with adjustments to a more stringent category possible if the institution exceeds certain

other risk-based thresholds. As a BHC with total consolidated assets of at least $250 billion that does not exceed any of the applicable risk-based thresholds, we are a Category III institution under the Tailoring Rules. Therefore, we are no longer subject to the Basel III Advanced Approaches and certain associated capital requirements, such as the requirement to include in regulatory capital certain elements of Accumulated other comprehensive income (“AOCI”), although we will remain subject to the countercyclical capital buffer and supplementary leverage ratio, which were previously required only for Basel III Advanced Approaches institutions.

In July 2019, the Federal Banking Agencies finalized certain changes to the Basel III Capital Rule for institutions not subject to the Basel III Advanced Approaches, including Capital One (“Capital Simplification Rule”). These changes, effective January 1, 2020, generally raise the threshold above which covered institutions must deduct certain assets from their common equity Tier 1 capital, including certain deferred tax assets, mortgage servicing assets, and investments in unconsolidated financial institutions. We anticipate that the Tailoring Rules and Capital Simplification Rule will, taken together, decrease our capital requirements.

Global systemically important banks (“G-SIBs”) that are based in the U.S. are subject to an additional common equity Tier 1 capital requirement (“G-SIB Surcharge”). We are not a G-SIB based on the most recent available data and thus we are not subject to a G-SIB Surcharge.

In December 2018, the Federal Banking Agencies issued a final rule to address regulatory capital treatment of credit loss allowances under the current expected credit loss (“CECL”) model. The CECL model became applicable to Capital One as of January 1, 2020. The rule (“CECL Capital Rule”) revises the Federal Banking Agencies’ regulatory capital rules to identify which credit loss allowances under the CECL model are eligible for inclusion in regulatory capital and to provide banking organizations the option to phase in over a three-year transition period ending January 1, 2023 the day-one adverse effects on regulatory capital that may result from the adoption of the CECL model (“CECL Transition Election”). We intend to make the CECL Transition Election beginning in the first quarter of 2020.

The “Market Risk Rule” supplements the Basel III Capital Rule by requiring institutions subject to the Market Risk Rule to adjust their risk-based capital ratios to reflect the market risk in their trading portfolios. The Market Risk Rule generally applies to institutions with aggregate trading assets and liabilities equal to the lesser of:

The Basel Committee has published a liquidity framework that includes two standards for liquidity risk supervision. One standard, the liquidity coverage ratio (“LCR”), seeks to promote short-term resilience by requiring organizations to hold sufficient high-quality liquid assets to survive a stress scenario lasting for 30 days. The other standard, the net stable funding ratio (“NSFR”), seeks to promote longer-term resilience by requiring sufficient stable funding over a one-year period based on the liquidity characteristics of its assets and activities.

The Company and the Banks are subject to the LCR as implemented by the Federal Reserve and OCC (“LCR Rule”). The LCR Rule requires the Company and each of the Banks to hold an amount of eligible high-quality liquid assets (“HQLA”) that equals or exceeds 100% of their respective projected adjusted net cash outflows over a 30-day period, each as calculated in accordance with the LCR Rule. The LCR Rule requires us to calculate the LCR daily. In addition, the Company is required to make quarterly public disclosures of its LCR and certain related quantitative liquidity metrics, along with a qualitative discussion of its LCR.

Under the Tailoring Rules, as a Category III institution with less than $75 billion in weighted average short-term wholesale funding, the Company’s and the Banks’ total net cash outflows are multiplied by an outflow adjustment percentage of 85%. We expect this outflow adjustment to materially increase the LCR for the Banks but not for the Company. The LCR Rule restricts the amount of HQLA held at the Banks in excess of the Banks’ total net cash outflow amount that can be included in the Company’s HQLA amount (referred to as “Trapped Liquidity”). Therefore, although we typically manage Bank-level LCRs at a level well above the regulatory minimum of 100%, the amount of Trapped Liquidity will also increase as the Banks’ total net cash outflows are reduced

by the 85% factor. That increase in Trapped Liquidity will prevent the Company’s LCR from materially changing as a result of the Tailoring Rules. 

In April 2016, the Federal Banking Agencies issued an interagency notice of proposed rulemaking regarding the U.S. implementation of the Basel III NSFR (“Proposed NSFR”), which would apply to the same institutions subject to the LCR Rule. The Proposed NSFR would require us to maintain a sufficient amount of stable funding in relation to our assets, derivatives exposures and commitments over a one-year horizon period. Although the Proposed NSFR is generally consistent with the Basel NSFR standard, it is more stringent in certain areas. The financial and operational impact on us of a final NSFR rule remains uncertain until a final rule is published. There is uncertainty regarding the timing and form of any such final rule.

The FDICIA requires the Federal Banking Agencies to take “prompt corrective action” for banks that do not meet minimum capital requirements. The FDICIA establishes five capital ratio levels: well capitalized; adequately capitalized; undercapitalized; significantly undercapitalized; and critically undercapitalized. The three undercapitalized categories are based upon the amount by which a bank falls below the ratios applicable to an adequately capitalized institution. The capital categories are determined solely for purposes of applying the FDICIA’s prompt corrective action (“PCA”) provisions, and such capital categories may not constitute an accurate representation of the Banks’ overall financial condition or prospects.

The Basel III Capital Rule updated the PCA framework to reflect new, higher regulatory capital minimums. For an insured depository institution to be well capitalized, it must maintain a total risk-based capital ratio of 10% or more; a Tier 1 capital ratio of 8% or more; a common equity Tier 1 capital ratio of 6.5% or more; and a leverage ratio of 5% or more. An adequately capitalized depository institution must maintain a total risk-based capital ratio of 8% or more; a Tier 1 capital ratio of 6% or more; a common equity Tier 1 capital ratio of 4.5% or more; a leverage ratio of 4% or more; and, for Category III and certain other institutions under the Tailoring Rules, a supplementary leverage ratio of 3% or more. The PCA provisions also authorize the Federal Banking Agencies to reclassify a bank’s capital category or take other action against banks that are determined to be in an unsafe or unsound condition or to have engaged in unsafe or unsound banking practices.

As an additional means to identify problems in the financial management of depository institutions, the FDICIA required the Federal Banking Agencies to establish certain non-capital safety and soundness standards. The standards adopted by the Federal Banking Agencies relate generally to operations and management, asset quality, interest rate exposure and executive compensation. The Federal Banking Agencies are authorized to take action against institutions that fail to meet such standards.

We are a “covered company” subject under the Dodd-Frank Act to certain enhanced prudential standards, including requirements that may be recommended by the Financial Stability Oversight Council (“FSOC”) and implemented by the Federal Reserve and other regulators. We remain a covered company under the amendments to the Dodd-Frank Act made by the Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”), which provided reduced enhanced prudential standards for institutions with less than $250 billion in assets. As a result, we are subject to more stringent standards and requirements than those applicable to institutions that are not covered companies. The FSOC may also issue recommendations to the Federal Reserve or other primary financial regulatory agencies to apply new or enhanced standards to certain financial activities or practices.

The Federal Reserve and FDIC have issued rules requiring the Company to implement resolution planning for orderly resolution in the event the covered company faces material financial distress or failure. The FDIC issued similar rules regarding resolution planning applicable to the Banks. In addition, the OCC has issued rules requiring banks with assets of $250 billion or more to develop recovery plans detailing the actions they would take to remain a going concern when they experience considerable financial or operational stress, but have not deteriorated to the point that resolution is imminent.

The Federal Reserve established a rule that implements the requirement in the Dodd-Frank Act that the Federal Reserve conduct annual stress tests on the capacity of our capital to absorb losses as a result of adverse economic conditions. This rule also requires the Company to conduct its own stress tests and publish the results of the stress tests on our website or other public forum. As a Category III institution under the Tailoring Rules, the Company must disclose the results of its company-run stress test in 2020 and every two years thereafter. The OCC has adopted a similar stress test rule requiring banks with at least $250 billion in assets, including CONA, to conduct their own company-run stress tests. Under that OCC rule, CONA must disclose the results of this stress test in 2020 and every two years thereafter.

The Federal Reserve also established rules implementing other aspects of the enhanced prudential standards under the Dodd-Frank Act (“Enhanced Standards Rule”). Under the Enhanced Standards Rule, the Company must meet liquidity risk management standards, conduct internal liquidity stress tests, and maintain a 30-day buffer of highly liquid assets, in each case, consistent with the requirements of the Enhanced Standards Rule. These requirements are in addition to the LCR, discussed above in “Basel III and United States Liquidity Rules.” The Enhanced Standards Rule also requires that the Company comply with, and hold capital commensurate with, the requirements of, any regulations adopted by the Federal Reserve relating to capital planning and stress tests. Stress testing and capital planning regulations are discussed further below under “Dividends, Stock Repurchases and Transfers of Funds.” The Enhanced Standards Rule also requires that the Company establish and maintain an enterprise-wide risk management framework that includes a risk committee and a chief risk officer.

Although not a requirement of the Dodd-Frank Act, the OCC established regulatory guidelines (“Heightened Standards Guidelines”) that apply heightened standards for risk management to large institutions subject to its supervision, including the Banks. The Heightened Standards Guidelines establish standards for the development and implementation by the Banks of a risk governance framework.

Certain acquisitions of our capital stock may be subject to regulatory approval or notice under federal or state law. Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of our capital stock in excess of the amount that can be acquired without regulatory approval, including under the BHC Act and the Change in Bank Control Act (“CIBC Act”).

Federal law and regulations prohibit any person or company from acquiring control of the Company or the Banks without, in most cases, prior written approval of the Federal Reserve or the OCC, as applicable. Control exists if, among other things, a person or company acquires more than 25% of any class of our voting stock or otherwise has a controlling influence over us. For a publicly traded BHC such as ourselves, a rebuttable presumption of control arises under the CIBC Act if a person or company acquires more than 10% of any class of our voting stock.

Additionally, COBNA and CONA are “banks” within the meaning of Chapter 13 of Title 6.1 of the Code of Virginia governing the acquisition of interests in Virginia financial institutions (“Financial Institution Holding Company Act”). The Financial Institution Holding Company Act prohibits any person or entity from acquiring, or making any public offer to acquire, control of a Virginia financial institution or its holding company without making application to, and receiving prior approval from, the Virginia Bureau of Financial Institutions.

Under the Federal Reserve’s capital planning rules (commonly referred to as Comprehensive Capital Analysis and Review or “CCAR”), “covered BHCs,” including ourselves, must submit a capital plan to the Federal Reserve on an annual basis that contains a description of all planned capital actions, including dividends or stock repurchases, over a nine-quarter planning horizon beginning with the first quarter of the calendar year the capital plan is submitted (“CCAR cycle”). A covered BHC may take the proposed capital actions if the Federal Reserve does not object to the plan.

Dodd-Frank Act stress testing, described above in “Enhanced Prudential Standards and Other Requirements under the Dodd-Frank Act,” is a complementary exercise to CCAR. It is a forward-looking exercise conducted by the Federal Reserve and covered financial companies to help assess whether a company has sufficient capital to absorb losses and support operations during adverse economic conditions. The supervisory stress test, after incorporating a firm’s planned capital actions, is used for quantitative assessment in CCAR.

The Company must file its capital plan and stress testing results with the Federal Reserve by April 5 of each year (unless the Federal Reserve designates a later date), using data as of the end of the prior calendar year. The Federal Reserve is expected to provide its objection or non-objection to that capital plan in June of that year. The Federal Reserve’s objection or non-objection applies to planned capital actions from the third quarter of the year the capital plan is submitted through the end of the second quarter of the following year. The Company, along with other BHCs subject to the supplementary leverage ratio, must incorporate an estimate of its supplementary leverage ratio into its capital plan and stress tests.

The current capital planning and stress testing rules place supervisory focus on quarterly capital issuances and distributions by establishing a cumulative net distribution requirement. Under a “de minimis” exception, if a company does not receive an objection to its capital plan, it may in certain cases distribute up to 0.25% of its Tier 1 capital above the distributions in its capital plan. With certain limited exceptions, to the extent a BHC does not issue the amount of a given class of regulatory capital instrument that it

projected in its capital plan, as measured on an aggregate basis beginning in the third quarter of the planning horizon, the BHC must reduce its capital distributions.

In December 2018, the Federal Reserve announced that it will maintain its pre-CECL framework for calculating allowances on loans in the supervisory stress test for the 2020 and 2021 supervisory stress testing cycles until the impact of CECL is better known and understood. The Federal Reserve stated further that although bank holding companies required to perform company-run stress tests will be required to incorporate CECL into those stress tests starting in the 2020 cycle, it will not issue supervisory findings on those firms’ allowance estimations in the CCAR exercise through 2021.

In April 2018, the Federal Reserve issued a proposed rule (“Stress Capital Buffer Proposed Rule”) that would implement a firm-specific “stress capital buffer” requirement and a “stress leverage buffer” requirement. The Federal Reserve described the Stress Capital Buffer Proposed Rule as designed to simplify the agency’s regulatory regime by integrating the supervisory stress tests with its non-stress capital rules. Under the Stress Capital Buffer Proposed Rule, a firm’s stress capital buffer would have a floor of 2.5% of total risk-weighted assets, replacing the existing 2.5% capital conservation buffer, and would equal, as a percentage of total risk-weighted assets, the sum of (i) the difference between a firm’s starting common equity Tier 1 capital ratio and the low point under the severely adverse scenario of the Federal Reserve’s supervisory stress test plus (ii) the ratio of the firm’s projected four quarters of common stock dividends to risk-weighted assets as projected under CCAR (for the fourth to seventh quarters of the planning horizon). A firm’s new “Standardized Approach capital conservation buffer” would include its stress capital buffer, any G-SIB surcharge (not applicable to us), and any applicable countercyclical capital buffer (currently set at zero). The consequences of breaching the stress capital buffer requirement would be consistent with the current capital conservation buffer framework and would result in increasingly strict limitations on capital distributions and discretionary bonus payments. The Stress Capital Buffer Proposed Rule would replace the current CCAR post-stress leverage ratio requirement with a stress leverage buffer requirement. Additionally, the proposal would modify certain CCAR assumptions relating to balance sheet growth, prefunding of dividends, and capital distributions. It is not clear which of these changes, if any, will be finalized and when they would go into effect.

Historically, dividends from the Company’s direct and indirect subsidiaries have represented a major source of the funds we have used to pay dividends on our stock, make payments on corporate debt securities and meet our other obligations. There are various federal law limitations on the extent to which the Banks can finance or otherwise supply funds to us through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, provisions of Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. In general, federal and applicable state banking laws prohibit insured depository institutions, such as the Banks, from making dividend distributions without first obtaining regulatory approval if such distributions are not paid out of available earnings or would cause the institution to fail to meet applicable capital adequacy standards.

Each of CONA and COBNA, as an insured depository institution, is a member of the DIF maintained by the FDIC. Through the DIF, the FDIC insures the deposits of insured depository institutions up to prescribed limits for each depositor. The FDIC sets a Designated Reserve Ratio (“DRR”) for the DIF. To maintain the DIF, member institutions may be assessed an insurance premium, and the FDIC may take action to increase insurance premiums if the DRR falls below its required level.

Under regulations issued by the Federal Reserve, a BHC must serve as a source of financial and managerial strength to its subsidiary banks (the so-called “source of strength doctrine”). The Dodd-Frank Act codified this doctrine.

Under the “cross-guarantee” provision of the Financial Institutions Reform, Recovery and Enforcement Act of 1989 (“FIRREA”), insured depository institutions such as the Banks may be liable to the FDIC with respect to any loss incurred, or reasonably anticipated to be incurred, by the FDIC in connection with the default of, or FDIC assistance to, any commonly controlled insured depository institution. The Banks are commonly controlled within the meaning of the FIRREA cross-guarantee provision.

The Dodd-Frank Act provides the FDIC with liquidation authority that may be used to liquidate nonbank financial companies and BHCs if the Treasury Secretary, in consultation with the President and based on the recommendation of the Federal Reserve and other appropriate Federal Banking Agencies, determines that doing so is necessary, among other criteria, to mitigate serious adverse

effects on U.S. financial stability. Upon such a determination, the FDIC would be appointed receiver and must liquidate the company in a way that mitigates significant risks to financial stability and minimizes moral hazard. The costs of a liquidation of the company would be borne by shareholders and unsecured creditors and then, if necessary, by risk-based assessments on large financial companies. The FDIC has issued rules implementing certain provisions of its liquidation authority and may issue additional rules in the future.

COBNA is subject to regulation in foreign jurisdictions where it operates, currently in the United Kingdom and Canada.

In the United Kingdom, COBNA operates through COEP, which was established in 2000 and is an authorized payment institution regulated by the Financial Conduct Authority (“FCA”) under the Payment Services Regulations 2017 and the Financial Services and Markets Act 2000. COEP’s indirect parent, Capital One Global Corporation, is wholly-owned by COBNA and is subject to regulation by the Federal Reserve as an “agreement corporation” under the Federal Reserve’s Regulation K.

The FCA set a deadline of August 29, 2019 (“the Deadline”) for the submission of complaints to firms (including COEP) about Payment Protection Insurance (“PPI”). In order to ensure complainants were treated fairly and in anticipation of the increase in complaint volumes that the Deadline would create, the FCA closely supervised all large lenders (including COEP) throughout 2019. COEP received a significant volume of complaints, particularly in the weeks immediately preceding the Deadline, and expects to be handling those complaints through the second quarter of 2020. Escalations to the Financial Ombudsman Service (“FOS”) may then take place until the end of 2020. During that time, the FCA will continue to closely supervise firms that handle PPI complaints and the supporting processes, people and systems.

In Canada, COBNA operates as an authorized foreign bank pursuant to the Bank Act (Canada) (“Bank Act”) and is permitted to conduct its credit card business in Canada through its Canadian branch, Capital One Bank (Canada Branch) (“Capital One Canada”). The primary regulator of Capital One Canada is the Office of the Superintendent of Financial Institutions. Other regulators include the Financial Consumer Agency of Canada (“FCAC”), the Office of the Privacy Commissioner of Canada, and the Financial Transactions and Reports Analysis Centre of Canada. Capital One Canada is subject to regulation under various Canadian federal laws, including the Bank Act and its regulations, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and the Personal Information Protection and Electronic Documents Act.

On December 13, 2018, Bill C-86, Budget Implementation Act, 2018, No. 2 was passed by Parliament. Among other things, Bill C-86 amends the Bank Act (Canada) to consolidate and strengthen provisions that apply to banks and authorized foreign banks in the areas of consumer protection, corporate governance, business practices, public reporting, disclosure of information and access to basic banking services. Bill C-86 also amends the FCAC Act to enhance the role and powers of the FCAC by, among other things, increasing the maximum penalty for a violation of the consumer protection provisions of the Bank Act from 50,000 Canadian dollars (“CAD”) for natural persons and 500,000 CAD in the case of financial institutions or a payment card network to 1 million CAD and 10 million CAD, respectively. We are continuing to analyze the impacts of Bill C-86 in order to determine its applicability and impact to our business.

As part of our continuous efforts to review and improve our technologies, we may either develop such capabilities internally or rely on third-party outsourcers who have the ability to deliver technology that is of higher quality, lower cost, or both. We continue to rely on third-party outsourcers to help us deliver systems and operational infrastructure. These relationships include (but are not limited to): Amazon Web Services, Inc. (“AWS”) for our cloud infrastructure, Total System Services LLC (“TSYS”) for consumer and commercial credit card processing services for our North American and U.K. portfolios, Fidelity Information Services (“FIS”) for certain of our banking systems and International Business Machines Corporation for mainframe managed services.

From time to time, we have made and will make forward-looking statements, including those that discuss, among other things, strategies, goals, outlook or other non-historical matters; projections, revenues, income, returns, expenses, capital measures, capital allocation plans, accruals for claims in litigation and for other claims against us; earnings per share, efficiency ratio, operating efficiency ratio, or other financial measures for us; future financial and operating results; our plans, objectives, expectations and intentions; and the assumptions that underlie these matters.

To the extent that any such information is forward-looking, it is intended to fit within the safe harbor for forward-looking information provided by the Private Securities Litigation Reform Act of 1995.

Numerous factors could cause our actual results to differ materially from those described in such forward-looking statements, including, among other things:

This section highlights significant factors, events, and uncertainties that make an investment in our securities risky. The events and consequences discussed in these risk factors could, in circumstances we may not be able to accurately predict, recognize, or control, have a material adverse effect on our business, growth, reputation, prospects, financial condition, operating results, cash flows, liquidity, and stock price. These risk factors do not identify all risks that we face; our operations could also be affected by factors, events, or uncertainties that are not presently known to us or that we currently do not consider to present significant risks to our operations. In addition, the global economic and political climate amplifies many of these risks.

We offer a broad array of financial products and services to consumers, small businesses and commercial clients. A prolonged period of economic volatility, slow growth, or a significant deterioration in economic conditions, in the United States, Canada or the United Kingdom, could have a material adverse effect on our financial condition and results of operations as customers default on their loans, maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity.

Some of the risks we face in connection with adverse changes and instability in the macroeconomic environment, including changes in consumer confidence levels and behavior, include the following:

In the United Kingdom, changes in consumer behavior or an economic slowdown arising from the U.K.’s exit from the European Union (“Brexit”) could adversely affect our U.K. operations. The impact of Brexit and its full effects on us are uncertain and will depend on the post-Brexit relationships that the U.K. implements with the European Union (“EU”) and countries that are not a part of the EU. While Capital One does not have operations in any other EU jurisdictions, increased market volatility and global economic deterioration resulting from an uncontrolled Brexit could have a negative impact on credit conditions in the U.K. and negatively affect our business and financial condition.

Our ability to borrow from other financial institutions or to engage in funding transactions on favorable terms or at all could be adversely affected by disruptions in the capital markets or other events, including actions by rating agencies and deteriorating investor expectations, which could limit our access to funding. In addition, fluctuations in interest rates, credit spreads and other market factors could negatively impact our results of operations. Both shorter-term and longer-term interest rates remain below long-term historical averages and the yield curve has been relatively flat compared to past periods. A flat yield curve combined with low interest rates generally leads to lower revenue and reduced margins because it tends to limit our ability to increase the spread between asset yields and funding costs. Sustained periods of time with a flat yield curve coupled with low interest rates, or an inversion of the yield curve, could have a material adverse effect on our net interest margin and earnings.

We are subject to extensive regulatory oversight by the federal banking regulators to ensure that we build systems and processes that are commensurate with the nature of our business and that meet the risk management and prudential standards issued by our regulators. A wide array of banking and consumer lending laws apply to almost every aspect of our business. Failure to comply

with these laws and regulations could result in financial, structural and operational penalties, including significant fines and criminal sanctions, and/or damage to our reputation with regulators, our customers or the public. Hiring, training and retaining qualified compliance and legal personnel, and establishing and maintaining compliance-related systems, infrastructure and processes, is difficult and these efforts could limit our ability to invest in other business opportunities. Furthermore, applicable rules and regulations may affect us in an unforeseen manner, or may have a disproportionate impact on us as compared to our competitors. For example, over the last several years, state and federal regulators have focused on compliance with the Bank Secrecy Act and anti-money laundering laws, data integrity and security, use of service providers, fair lending and other consumer protection issues. In July 2015, Capital One entered into a consent order with the OCC to address concerns about our anti-money laundering (“AML”) program and in October 2018, Capital One paid a civil monetary penalty assessed by the OCC relating to our AML program. The OCC lifted the AML consent order in November 2019. Failure to maintain compliance with AML laws and regulations could result in significant additional governmental fines or penalties.

We have a large number of customer accounts in our credit card and auto lending businesses and we have made the strategic choice to originate and service subprime credit card and auto loans, which typically have higher delinquencies and charge-offs than prime customers. As a result, we have significant involvement with credit bureau reporting and the collection and recovery of delinquent and charged-off debt, primarily through customer communications, the filing of litigation against customers in default, the periodic sale of charged-off debt and vehicle repossession. These activities are subject to enhanced legal and regulatory scrutiny from regulators, courts and legislators. Any future changes to our business practices in these areas, including our debt collection practices, whether mandated by regulators, courts, legislators or otherwise, or any legal liabilities resulting from our business practices, including our debt collection practices, could have a material adverse impact on our financial condition.

The legislative and regulatory environment is beyond our control, may change rapidly and unpredictably and may negatively influence our revenue, costs, earnings, growth, liquidity and capital levels. In addition, some rules and regulations may be subject to litigation or other challenges that delay or modify their implementation and impact on us. Adoption of new technologies, such as distributed ledger technologies, artificial intelligence and machine learning technologies, can present unforeseen challenges in applying and relying on existing compliance systems.

Like other lenders, we face the risk that our customers will not repay their loans. A customer’s ability and willingness to repay us can be adversely affected by increases in their payment obligations to other lenders, whether as a result of higher debt levels or rising interest rates, by restricted availability of credit generally, or by the revenue and income of the borrower. We may fail to quickly identify and reduce our exposure to customers that are likely to default on their payment obligations, whether by closing credit lines or restricting authorizations. Our ability to manage credit risk also is affected by legal or regulatory changes (such as restrictions on collections, bankruptcy laws, minimum payment regulations and re-age guidance), competitors’ actions and consumer behavior, and depends on the effectiveness of our collections staff, techniques and models.

Rising losses or leading indicators of rising losses (such as higher delinquencies, higher rates of nonperforming loans, higher bankruptcy rates, lower collateral values, elevated unemployment rates or changing market terms) may require us to increase our allowance for loan and lease losses, which may degrade our profitability if we are unable to raise revenue or reduce costs to compensate for higher losses. In particular, we face the following risks in this area:

Financial institutions are subject to extensive and complex capital and liquidity requirements. These requirements affect our ability to lend, grow deposit balances, make acquisitions and make most capital distributions. Failure to maintain adequate capital or liquidity levels, whether due to adverse developments in our business or the economy or to changes in the applicable requirements, could subject us to a variety of enforcement remedies available to our regulators. These include limitations on the ability to pay dividends and repurchase shares and the issuance of a capital directive to increase capital. Such limitations could have a material adverse effect on our business and results of operations.

In addition, the current capital and liquidity requirements are subject to change. The Federal Banking Agencies finalized the Tailoring Rule in the fourth quarter of 2019. Under the Tailoring Rule, we are a Category III institution, and are no longer subject to the Basel III Advanced Approaches and associated capital requirements, but we continue to be subject to the countercyclical capital buffer and supplementary leverage ratio. In addition, the Federal Reserve is currently considering a proposed rule (the “Stress Capital Buffer Proposed Rule”) that would modify our current Basel III capital requirements and implement firm-specific stress capital requirements. If the Stress Capital Buffer Proposed Rule is not adopted substantially as proposed, or there are other changes to applicable capital and liquidity requirements, we could face unexpected or new limitations on our ability to pay dividends and engage in share repurchases.

Our ability to retain and attract customers depends on our ability to develop, operate, and adapt our technology and organizational infrastructure in a rapidly changing environment. In addition, we must accurately process, record and monitor an increasingly large number of complex transactions. Digital technology, data and software development are deeply embedded into our business model and how we work.

Similar to other large corporations, we are exposed to operational risk that can manifest itself in many ways, such as errors in execution, inadequate processes, inaccurate models, faulty or disabled technological infrastructure, and fraud by employees or persons outside of our company. In addition, we are heavily dependent on the security, capability and continuous availability of the technology systems that we use to manage our internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to our customers, develop and offer new products and communicate with stakeholders.

If we do not maintain the necessary operational, technological and organizational infrastructure to operate our business, including to maintain the security of that infrastructure, our business and reputation could be materially adversely affected. We also are subject to disruptions to our operating systems arising from events that are wholly or partially beyond our control, which may include computer viruses, electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks (including Distributed Denial of Service (“DDOS”) and other attacks on our infrastructure as discussed below), natural disasters, other damage to property or physical assets, or events arising from local or larger scale politics, including terrorist acts. Any failure to maintain our infrastructure or disruption of our operating systems and applications could diminish our ability to operate our businesses, service customer accounts and protect customers’ information, or result in potential liability to customers, reputational damage, regulatory intervention and customers’ loss of confidence in our businesses, any of which could result in a material adverse effect.

We also rely on the business infrastructure and systems of third parties with which we do business and to whom we outsource the operation, maintenance and development of our information technology and communications systems. We have migrated substantially all, and intend to migrate all, of our core information technology systems and customer-facing applications to third-party cloud infrastructure platforms, principally AWS. If we do not complete the transition or fail to administer these new environments in a well-managed, secure and effective manner, or if AWS platforms become unavailable or do not meet their service level agreements for any reason, we may experience unplanned service disruption or unforeseen costs which could result in material harm to our business and results of operations. We must successfully develop and maintain information, financial reporting, disclosure, data-protection and other controls adapted to our reliance on outside platforms and providers. In addition, AWS, or other service providers, could experience system breakdowns or failures, outages, downtime, cyber-attacks, adverse changes to financial condition, bankruptcy, or other adverse conditions, which could have a material adverse effect on our business and reputation. Thus, the substantial amount of our infrastructure that we outsource to AWS or to other third parties may increase our risk exposure.

Any disruptions, failures or inaccuracies of our operational and technology systems and models, including those associated with improvements or modifications to such systems and models, could cause us to be unable to market and manage our products and services, manage our risk, meet our regulatory obligations or report our financial results in a timely and accurate manner, all of which could have a negative impact on our results of operations. In addition, our ongoing investments in infrastructure, which are necessary to maintain a competitive business, integrate acquisitions and establish scalable operations, may increase our expenses. As our business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business strategies, management of outsourced services, asset purchases or other acquisitions, structural reorganization, compliance with new laws or regulations, or the integration of newly acquired businesses, or the occurrence of incidents such as the Cybersecurity Incident. If we are unable to successfully manage our expenses, our financial results will be negatively affected.

Our products and services involve the gathering, authenticating, managing, processing, and the storage and transmission of sensitive and confidential information regarding our customers and their accounts, our employees and third parties with which we do business. Our ability to provide such products and services, many of which are web-based, depends upon the management and safeguarding of information, software, methodologies and business secrets. To provide these products and services to, as well as communicate with, our customers, we rely on information systems and infrastructure, including software and data engineering, and information security personnel, digital technologies, computer and email systems, software, networks and other web-based technologies. We also have arrangements in place with third parties through which we share and receive information about their customers who are or may become our customers.

Technologies, systems, networks and devices of Capital One or our customers, employees, service providers or other third parties with whom we interact continue to be the subject of attempted unauthorized access, mishandling or misuse of information, denial-of-service attacks, computer viruses, website defacement, hacking, malware, ransomware, phishing or other forms of social engineering, and other forms of cyber-attacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and other events. These threats, such as the Cybersecurity Incident, may derive from error, fraud or malice on the part of our employees, insiders or third parties or may result from accidental technological failure. Any of these parties may also attempt to fraudulently induce employees, customers, or other third-party users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or third parties with whom we interact, or to unlawfully obtain monetary benefit through misdirected or otherwise improper payment. Further, cyber and information security risks for large financial institutions like us continue to increase due to the proliferation of new technologies, the use of the internet to conduct financial transactions, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other external parties. In addition, our customers access our products and services using computers, smartphones, tablets, and other mobile devices that are beyond our security control systems.

The methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and persist for an extended period of time before being detected. For example, although we immediately fixed the configuration vulnerability that was exploited in the Cybersecurity Incident once we discovered the unauthorized access, a period of time elapsed between the occurrence of the unauthorized access and the time when we discovered it. In other circumstances, we and our third-party service providers and partners may be unable to anticipate or identify certain attack methods in order to implement effective preventative measures or mitigate or remediate the damages caused in a

timely manner. We may also be unable to hire and develop talent capable of detecting, mitigating or remediating these risks. Although we seek to maintain a robust suite of authentication and layered information security controls, including our cyber threat analytics, data encryption and tokenization technologies, anti-malware defenses and vulnerability management program, any one or combination of these controls could fail to detect, mitigate or remediate these risks in a timely manner. We will likely face an increasing number of attempted cyber-attacks as we expand our mobile- and other internet-based products and services, as well as our usage of mobile and cloud technologies and as we provide more of these services to a greater number of retail clients.

A disruption or breach, including as a result of a cyber-attack such as the Cybersecurity Incident, or media reports of perceived security vulnerabilities at Capital One or at third-party service providers, could result in significant legal and financial exposure, regulatory intervention, litigation and remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business. We and other U.S. financial services providers continue to be targeted with evolving and adaptive cybersecurity threats from sophisticated third parties. We are continuing to assess the impact of the Cybersecurity Incident and there can be no assurance that additional unauthorized access or cyber incidents will not occur or that we will not suffer material losses in the future. Unauthorized access or cybersecurity incidents could occur more frequently and on a more significant scale. If future attacks like these are successful or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services. In addition, a breach or attack affecting one of our third-party service providers or partners could harm our business even if we do not control the service that is attacked.

In addition, the increasing prevalence and the evolution of cyber-attacks and other efforts to breach or disrupt our systems or those of our partners, retailers or other market participants has led, and will likely continue to lead, to increased costs to us with respect to preventing, mitigating and remediating these risks, as well as any related attempted fraud. In order to address ongoing and future risks, including from the Cybersecurity Incident, we must expend significant resources to support protective security measures, investigate and remediate any vulnerabilities of our information systems and infrastructure and invest in new technology designed to mitigate security risks. The Cybersecurity Incident, or successful cyber-attacks at other large financial institutions or other market participants (whether or not we are impacted), could lead to a general loss of customer confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the financial system in general which could result in reduced use of our financial products. We have insurance against some cyber-risks and attacks, including insurance that is expected to cover certain costs associated with the Cybersecurity Incident; nonetheless, our insurance coverage may not be sufficient to offset the impact of a material loss event, and such insurance may increase in cost or cease to be available on commercial terms in the future.

A breach, failure or other disruption of our information systems or infrastructure or data management processes, or those of our customers, partners, service providers or other market participants, could lead, depending on the nature of the incident, to the unauthorized or unintended access to and release, gathering, monitoring, misuse, loss or destruction of personal or confidential data about our customers, employees or other third parties in our possession. Any party that obtains this personal or confidential data through a breach or disruption may use this information for ransom, to be paid by us or a third-party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes. Further, such disruption or breach could also result in unauthorized access to our proprietary information, intellectual property, software, methodologies and business secrets and in unauthorized transactions in Capital One accounts or unauthorized access to personal or confidential information maintained by those entities. There has been a significant proliferation of consumer information available on the internet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. While we were not directly involved in these third-party breach events, the stolen information can create a vulnerability for our customers if their Capital One log-in credentials are the same as or similar to the credentials that have been compromised on other sites. This vulnerability could include the risk of unauthorized account access, data loss and fraud. The use of artificial intelligence, “bots” or other automation software, can increase the velocity and efficacy of these types of attacks.

We are continuing to assess the impact of the Cybersecurity Incident. The Cybersecurity Incident, other data security incidents we may experience in the future, or media reports of perceived security vulnerabilities at Capital One or at third-party service providers, could result in significant legal and financial exposure, regulatory intervention, remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business.

We are subject to a variety of continuously evolving and developing laws and regulations in the United States and abroad regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer and security of personal data. Significant uncertainty exists as privacy and data protection laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements. For example, in Canada we are subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”). In addition, the General Data Protection Regulation (“GDPR”) applies EU data protection law to all companies processing data of EU residents, regardless of the company’s location. More recently, on January 1, 2020, the CCPA went into effect for companies doing business in California. These laws impose strict requirements regarding the collection, storage, handling, use, disclosure, transfer and security of personal data, which may have adverse consequences, including severe monetary penalties. Our efforts to comply with PIPEDA, GDPR, CCPA and other privacy and data protection laws entail substantial expenses, may divert resources from other initiatives and projects, and could limit the services we are able to offer. Furthermore, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The enactment of more restrictive laws, rules, regulations, or future enforcement actions or investigations could impact us through increased costs or restrictions on our business, and noncompliance could result in monetary or other penalties and significant legal liability.

We rely on quantitative models, and our ability to manage data and aggregate data in an accurate and timely manner, assess and manage our various risk exposures, estimate certain financial values and manage compliance with required regulatory capital requirements. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting deposit levels or loan losses, assessing capital adequacy and calculating economic and regulatory capital levels, estimate the value of financial instruments and balance sheet items, and other operational functions. Our risk reporting and management, including business decisions based on information incorporating models, depend on the effectiveness of our models and our policies, programs, processes and practices governing how data is acquired, validated, stored, protected, processed and analyzed. Any issues with the quality or effectiveness of our data aggregation and validation procedures, as well as the quality and integrity of data inputs, formulas or algorithms, could result in inaccurate forecasts, ineffective risk management practices or inaccurate risk reporting. In addition, models based on historical data sets might not be accurate predictors of future outcomes and their ability to appropriately predict future outcomes may degrade over time. While we continuously update our policies, programs, processes and practices, many of our data management, aggregation, and implementation processes are manual and subject to human error or system failure. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risk, to produce accurate financial, regulatory and operational reporting as well as to manage changing business needs. If our risk management framework is ineffective, we could suffer unexpected losses which could materially adversely affect our results of operation or financial condition. Also, any information we provide to the public or to our regulators based on poorly designed or implemented models could be inaccurate or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our stockholders, could be affected adversely due to the perception that the quality of the models used to generate the relevant information is insufficient.

Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry and the structure of the credit card industry. Given the inherent uncertainties involved in litigation, government investigations and regulatory enforcement decisions, and the very large or indeterminate damages sought in some matters asserted against us, there can be significant uncertainty as to the ultimate liability we may incur from these kinds of matters. The finding, or even the assertion, of substantial legal liability against us could have a material adverse effect on our business and financial condition and could cause significant reputational harm to us, which could seriously harm our business. The Cybersecurity Incident has resulted in litigation, government investigations and other regulatory enforcement inquiries.

In addition, financial institutions, such as ourselves, face significant regulatory scrutiny, which can lead to public enforcement actions. We and our subsidiaries are subject to comprehensive regulation and periodic examination by the Federal Reserve, the SEC, OCC, FDIC and CFPB. We have been subject to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including governmental inquiries, investigations and enforcement proceedings, including by the OCC, Department of Justice, Financial Crimes Enforcement Network (“FinCEN”) and state Attorneys General.

We operate in a highly competitive environment, whether in making loans, attracting deposits or in the global payments industry, and we expect competitive conditions to continue to intensify with respect to most of our products. We compete on the basis of the rates we pay on deposits and the rates and other terms we charge on the loans we originate or purchase, as well as the quality and range of our customer service, products, innovation and experience. This increasingly competitive environment is primarily a result of changes in technology, product delivery systems and regulation, as well as the emergence of new or significantly larger financial services providers, all of which may affect our customers’ expectations and demands. In addition to offering competitive products and services, we invest in and conduct marketing campaigns to attract and inform customers.

Some of our competitors, including new and emerging competitors in the digital and mobile payments space and other financial technology providers, are not subject to the same regulatory requirements or legislative scrutiny to which we are subject, which also could place us at a competitive disadvantage, in particular in the development of new technology platforms or the ability to rapidly innovate. We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital or “crypto” currencies, prepaid systems and payment services targeting users of social networks, communications platforms and online gaming. If we are unable to continue to keep pace with innovation, do not effectively market our products and services or are prohibited from or unwilling to enter emerging areas of competition, our business and results of operations could be adversely affected.

Some of our competitors are substantially larger than we are, which may give those competitors advantages, including a more diversified product and customer base, the ability to reach more customers and potential customers, operational efficiencies, broad-based local distribution capabilities, lower-cost funding and larger existing branch networks. Many of our competitors are also focusing on cross-selling their products and developing new products or technologies, which could affect our ability to maintain or grow existing customer relationships or require us to offer lower interest rates or fees on our lending products or higher interest rates on deposits. Competition for loans could result in origination of fewer loans, earning less on our loans or an increase in loans that perform below expectations.

As of December 31, 2019, we operate as one of the largest online direct banks in the United States by deposits. While direct banking provides a significant opportunity to attract new customers that value greater and more flexible access to banking services at reduced costs, we face strong and increasing competition in the direct banking market. Aggressive pricing throughout the industry may adversely affect the retention of existing balances and the cost-efficient acquisition of new deposit funds and may affect our growth and profitability. Customers could also close their online accounts or reduce balances or deposits in favor of products and services offered by competitors for other reasons. These shifts, which could be rapid, could result from general dissatisfaction with our products or services, including concerns over pricing, online security or our reputation. The potential consequences of this competitive environment are exacerbated by the flexibility of direct banking and the financial and technological sophistication of our online customer base.

In our credit card business, competition for rewards customers may result in higher rewards expenses, or we may fail to attract new customers or retain existing rewards customers due to increasing competition for these consumers. We have expanded the loan portfolio in our partnership business with the additions of a number of large partnerships. The market for key business partners, especially in the credit card business, is very competitive, and we may not be able to grow or maintain these partner relationships.

We face the risk that we could lose partner relationships, even after we have invested significant resources, time and expense into acquiring and developing the relationships. The loss of any of our key business partners could have a negative impact on our results of operations, including lower returns, excess operating expense and excess funding capacity.

We depend on our partners to effectively promote our cobrand and private label products and integrate the use of our credit cards into their retail operations. The failure by our partners to effectively promote and support our products as well as changes they may make in their business models could adversely affect card usage and our ability to achieve the growth and profitability objectives of our partnerships. In addition, if our partners do not adhere to the terms of our program agreements and standards, or otherwise diminish the value of our brand, we may suffer reputational damage and customers may be less likely to use our products.

Some of our competitors have developed, or may develop, substantially greater financial and other resources than we have, may offer richer value propositions or a wider range of programs and services than we offer or may use more effective advertising, marketing or cross-selling strategies to acquire and retain more customers, capture a greater share of spending and borrowings, attain and develop more attractive cobrand card programs and maintain greater merchant acceptance than we have. We may not be able to compete effectively against these threats or respond or adapt to changes in consumer spending habits as effectively as our competitors.

In such a competitive environment, we may lose entire accounts or may lose account balances to competing firms, or we may find it more costly to maintain our existing customer base. Customer attrition from any or all of our lending products, together with any lowering of interest rates or fees that we might implement to retain customers, could reduce our revenues and therefore our earnings. Similarly, unexpected customer attrition from our deposit products, in addition to an increase in rates or services that we may offer to retain deposits, may increase our expenses and therefore reduce our earnings.

Credit card interchange fees are generally one of the largest components of the costs that merchants pay in connection with the acceptance of credit cards and are a meaningful source of revenue for our credit card businesses. Interchange fees are the subject of significant and intense global legal, regulatory and legislative focus, and the resulting decisions, regulations and legislation may have a material adverse impact on our overall business, financial condition and results of operations.

Regulators and legislative bodies in a number of countries are seeking to reduce credit card interchange fees through legislation, competition-related regulatory proceedings, central bank regulation and or litigation. Interchange reimbursement rates in the United States are set by credit card networks such as MasterCard and Visa. In some jurisdictions, such as Canada and certain countries in the EU, interchange fees and related practices are subject to regulatory activity that has limited the ability of certain networks to establish default rates, including in some cases imposing caps on permissible interchange fees. We have already experienced these impacts in our international card businesses. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the payments industry. Consequently, a development in one country, state or region may influence regulatory approaches in another, such as our primary market, the United States.

Some major retailers may have sufficient bargaining power to independently negotiate lower interchange fees with MasterCard and Visa, which could, in turn, result in lower interchange fees for us when our cardholders undertake purchase transactions with these retailers. In 2016, some of the largest merchants individually negotiated lower interchange rates with MasterCard and/or Visa. These and other merchants also continue to lobby aggressively for caps and restrictions on interchange fees and their efforts may be successful or they may in the future bring legal proceedings against us or other credit card and debit card issuers and networks.

Beyond pursuing litigation, legislation and regulation, merchants may also promote forms of payment with lower fees, such as ACH-based payments, or seek to impose surcharges at the point of sale for use of credit or debit cards. New payment systems, particularly mobile-based payment technologies, could also gain widespread adoption and lead to issuer transaction fees or the displacement of credit card accounts as a payment method.

The heightened focus by merchants and regulatory and legislative bodies on the fees charged by credit and debit card networks, and the ability of certain merchants to successfully negotiate discounts to interchange fees with MasterCard and Visa or develop alternative payment systems, could result in a reduction of interchange fees. Any resulting loss in income to us could have a material adverse effect on our business, financial condition and results of operations.

Our industry is subject to rapid and significant technological changes and our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings. We expect digital technologies to have a significant impact on banking over time. Consumers expect robust digital experiences from their financial services providers. The ability for customers to access their accounts and conduct financial transactions using digital technology, including mobile applications, is an important aspect of the financial services industry and financial institutions are rapidly introducing new digital and other technology-driven products and services that aim to offer a better customer experience and to reduce costs. We continue to invest in digital technology designed to attract new customers, facilitate the ability of existing customers to conduct financial transactions and enhance the customer experience related to our products and services.

We have engaged in merger and acquisition activity and entered into strategic partnerships over the past several years. We continue to evaluate and anticipate engaging in, among other merger and acquisition activity, additional strategic partnerships and selected acquisitions of financial institutions and other acquisition targets, including credit card and other loan portfolios. We may not be able to identify and secure future acquisition targets on terms and conditions that are acceptable to us, or successfully complete within the anticipated time frame and achieving the anticipated benefits of proposed mergers, acquisitions and strategic partnerships, which could impair our growth.

Any merger, acquisition or strategic partnership we undertake entails certain risks, which may materially and adversely affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our existing operations, or are not able to achieve the anticipated benefits of any merger, acquisition or strategic partnership, including cost savings and other synergies, our business could be negatively affected. In addition, it is possible that the ongoing integration processes could result in the loss of key employees, errors or delays in systems implementation, exposure to cybersecurity risks associated with acquired businesses, exposure to additional regulatory oversight, the disruption of our ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect our ability to maintain relationships with partners, clients, customers, depositors and employees or to achieve the anticipated benefits of any merger, acquisition or strategic partnership.

Integration efforts also may divert management attention and resources. These integration matters may have an adverse effect on us during any transition period.

In addition, we may face the following risks in connection with any merger, acquisition or strategic partnership:

Our ability to attract and retain customers is highly dependent upon the perceptions of consumer and commercial borrowers and deposit holders and other external perceptions of our products, services, trustworthiness, business practices, workplace culture, compliance practices or our financial health. In addition, our brand is very important to us. Maintaining and enhancing our brand depends largely on our ability to continue to provide high-quality products and services. Adverse perceptions regarding our reputation in the consumer, commercial and funding markets could lead to difficulties in generating and maintaining accounts as well as in financing them. In particular, negative public perceptions regarding our reputation, including negative perceptions regarding our ability to maintain the security of our technology systems and protect customer data, could lead to decreases in the levels of deposits that consumer and commercial customers and potential customers choose to maintain with us or significantly increase the costs of attracting and retaining customers. In addition, negative perceptions regarding certain industries, partners or clients could also prompt us to cease business activities associated with those entities.

Negative public opinion or damage to our brand could also result from actual or alleged conduct in any number of activities or circumstances, including lending practices, regulatory compliance, security breaches (including the use and protection of customer information, such as a result of the Cybersecurity Incident), corporate governance and sales and marketing, and from actions taken by regulators or other persons in response to such conduct. Such conduct could fall short of our customers’ and the public’s heightened expectations of companies of our size with rigorous data, privacy and compliance practices, and could further harm our reputation. In addition, our cobrand and private label partners or other third parties with whom we have important relationships may take actions over which we have limited control that could negatively impact perceptions about us or the financial services

industry. The proliferation of social media may increase the likelihood that negative public opinion from any of the events discussed above will impact our reputation and business.

In addition, a variety of social factors may cause changes in borrowing activity, including credit card use, payment patterns and the rate of defaults by account holders and borrowers domestically and internationally. These social factors include changes in consumer confidence levels, the public’s perception regarding the banking industry and consumer debt, including credit card use, and changing attitudes about the stigma of bankruptcy. If consumers develop or maintain negative attitudes about incurring debt, or if consumption trends decline or if we fail to maintain and enhance our brand, or we incur significant expenses to do so, our business and financial results could be materially and negatively affected.

We rely on a variety of measures to protect and enhance our intellectual property, including copyrights, trademarks, trade secrets, patents and certain restrictions on disclosure, solicitation and competition. We also undertake other measures to control access to and distribution of our other proprietary information. These measures may not prevent misappropriation of our proprietary information or infringement of our intellectual property rights and a resulting loss of competitive advantage. In addition, our competitors or other third parties may file patent applications for innovations that are used in our industry or allege that our systems, processes or technologies infringe on their intellectual property rights. If our competitors or other third parties are successful in obtaining such patents or prevail in intellectual property-related litigation against us, we could lose significant revenues, incur significant license, royalty or technology development expenses, or pay significant damages.

Some of our methods of managing these risks are based upon our use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than the historical measures indicate and market conditions, particularly during a period of financial market stress can involve unprecedented dislocations. Credit risk is inherent in the financial services business and results from, among other things, extending credit to customers. Our ability to assess the creditworthiness of our customers may be impaired if the models and approaches we use to select, manage and underwrite our consumer and commercial customers become less predictive of future charge-offs due, for example, to rapid changes in the economy, including tariff rates and international trade relations.

While we employ a broad and diversified set of risk monitoring and risk mitigation techniques, those techniques and the judgments that accompany their application cannot anticipate every economic and financial outcome or the timing of such outcomes. For example, our ability to implement our risk management strategies may be hindered by adverse changes in the volatility or liquidity conditions in certain markets and as a result, may limit our ability to distribute such risks (for instance, when we seek to syndicate exposure in bridge financing transactions we have underwritten). We may, therefore, incur losses in the course of our risk management or investing activities.

We have significant investments in bank premises and equipment for our branch network and other branch banking assets including our banking centers and our retail work force. Advances in technology such as digital and mobile banking, in-branch self-service technologies, proximity or remote payment technologies, as well as changing customer preferences for these other methods of banking, could decrease the value of our branch network or other retail distribution assets. As a result, we will continue to adapt our retail distribution strategy. For example, we may close, sell and/or renovate additional branches or parcels of land held for development and restructure or reduce our remaining branches and work force. These actions could lead to losses on these assets or could adversely impact the carrying value of other long-lived assets, reduce our revenues, increase our expenditures, dilute our brand and/or reduce customer demand for our products and services.

Like other financial institutions, our business is sensitive to market interest rate movements and the performance of the capital markets. Disruptions, uncertainty or volatility across the capital markets could negatively impact market liquidity and limit our access to the funding required to operate and grow our business. In addition, changes in interest rates or in valuations in the debt or equity markets could directly impact us. For example, we borrow money from other institutions and depositors, which we use to make loans to customers and invest in debt securities and other earning assets. We earn interest on these loans and assets and pay interest on the money we borrow from institutions and depositors. The interest rates that we pay on the securities we have issued are also influenced by, among other things, applicable credit ratings from recognized rating agencies. A downgrade to any of these credit ratings could affect our ability to access the capital markets, increase our borrowing costs and have a negative impact on our results of operations. Increased charge-offs, rising London Interbank Offering Rate (“LIBOR”) or other applicable reference rates and other events may cause our securitization transactions to amortize earlier than scheduled, which could accelerate our need for additional funding from other sources. Fluctuations in interest rates, including changes in the relationship between short-term rates and long-term rates and in the relationship between our funding basis rate and our lending basis rate, may have negative impacts on our net interest income and therefore our earnings.

In addition, interest rate fluctuations and competitor responses to those changes may affect the rate of customer prepayments for auto and other term loans and may affect the balances customers carry on their credit cards. For example, increases in interest rates increase debt service requirements for some of our borrowers, which may adversely affect those borrowers’ ability to pay as contractually obligated. This could result in additional delinquencies or charge-offs and negatively impact our results of operations. These changes can reduce the overall yield on our earning asset portfolio. Changes in interest rates and competitor responses to these changes may also impact customer decisions to maintain balances in the deposit accounts they have with us. An inability to attract or maintain deposits could materially affect our ability to fund our business and our liquidity position. Many other financial institutions have increased their reliance on deposit funding and, as such, we expect continued competition in the deposit markets. We cannot predict how this competition will affect our costs. If we are required to offer higher interest rates to attract or maintain deposits, our funding costs will be adversely impacted. Changes in valuations in the debt and equity markets could have a negative impact on the assets we hold in our investment portfolio. Such market changes could also have a negative impact on the valuation of assets for which we provide servicing.

The U.K. Financial Conduct Authority, which regulates LIBOR, has announced that it will no longer compel banks to contribute data for the calculation of LIBOR after December 31, 2021. It is likely that banks will no longer continue to contribute submissions for the calculation of LIBOR after that date, which creates significant uncertainty around the publication of LIBOR beyond 2021 and whether LIBOR will continue to be viewed as a reliable market benchmark. It remains unclear what rate or rates may develop as accepted alternatives to LIBOR, or what the effect of such changes will be on the markets for LIBOR-based financial instruments. The Secured Overnight Financing Rate (“SOFR”) has been recommended by the Alternative Reference Rates Committee as an alternative for USD LIBOR, but issues and uncertainty remain with respect to its implementation.

Given LIBOR’s extensive use across financial markets, the transition away from LIBOR presents several risks and challenges to the financial markets and financial institutions, including Capital One. We have loans, derivative contracts, unsecured debt, securitizations, vendor agreements and other instruments with attributes that are either directly or indirectly dependent on LIBOR. Uncertainty as to the nature of potential changes, alternative reference rates such as SOFR, or other reforms may adversely affect market liquidity, the pricing of LIBOR-based instruments, and the availability and cost of associated hedging instruments and borrowings. If SOFR or another rate does not achieve wide acceptance as the alternative to LIBOR, there likely will be disruption

to the markets relying on the availability of a broadly accepted reference rate. In addition, uncertainty regarding LIBOR could result in loss of market share in certain products, adverse tax or accounting impacts, compliance, legal or operational costs and risks associated with client disclosures, as well as systems disruption, model disruption and other business continuity issues for us.

Our success depends, in large part, on our ability to retain key senior leaders and to attract and retain skilled employees, particularly employees with advanced expertise in credit, risk and digital and technology skills. We depend on our senior leaders and skilled employees to oversee simultaneous, transformative initiatives across the enterprise and execute on our business plans in an efficient and effective manner. Competition for such senior leaders and employees, and the costs associated with attracting and retaining them, is high. Our ability to attract and retain qualified employees also is affected by perceptions of our culture and management, our profile in the regions where we have offices and the professional opportunities we offer. Regulation or regulatory guidance restricting executive compensation, as well as evolving investor expectations, may limit the types of compensation arrangements that we may enter into with our most senior leaders and could have a negative impact on our ability to attract, retain and motivate such leaders in support of our long-term strategy. These laws and regulations may not apply in the same manner to all financial institutions, and we therefore may face more restrictions than other institutions and companies with which we compete for talent. These laws and regulations may also hinder our ability to compete for talent with other industries. We rely upon our senior leaders not only for business success, but also to lead with integrity. To the extent our senior leaders behave in a manner that does not comport with our values, the consequences to our brand and reputation could be severe and could adversely affect our financial condition and results of operations. If we are unable to attract, develop and retain talented senior leadership and employees, or to implement appropriate succession plans for our senior leadership, our business could be negatively affected.

Despite the business contingency plans we have in place, such plans do not fully mitigate all potential business continuity risks to us. Natural disasters and other catastrophic events could harm our business and infrastructure, including our information technology systems and third-party platforms. Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our business and the communities where we are located, which are concentrated in the Northern Virginia and New York metropolitan areas, as well as Richmond, Virginia and Plano, Texas. This may include a disruption involving damage or loss of access to a physical site, cyber incidents, terrorist activities, disease pandemics, natural disasters, extreme weather events, electrical outage, environmental hazard, technological infrastructure, communications or other services we use, our employees or third parties with whom we conduct business. In addition, if a natural disaster or other catastrophic event occurs in certain regions where our business and customers are concentrated, such as the mid-Atlantic, New York or Texas metropolitan areas, we could be disproportionately impacted as compared to our competitors. The impact of such events and other catastrophes on the overall economy may also adversely affect our financial condition and results of operations.

Pursuant to generally accepted accounting principles in the U.S. (“U.S. GAAP”), we are required to use certain assumptions and estimates in preparing our financial statements, including determining our allowance for loan and lease losses, the fair value of

We are a separate and distinct legal entity from our subsidiaries, including the Banks. Dividends to us from our direct and indirect subsidiaries, including the Banks, have represented a major source of funds for us to pay dividends on our common and preferred stock, repurchase common stock, make payments on corporate debt securities and meet other obligations. There are various federal law limitations on the extent to which the Banks can finance or otherwise supply funds to us through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. If our subsidiaries’ earnings are not sufficient to make dividend payments to us while maintaining adequate capital levels, our liquidity may be affected and we may not be able to make dividend payments to our common or preferred stockholders, repurchase our common stock, make payments on outstanding corporate debt securities or meet other obligations, each and any of which could have a material adverse impact on our results of operations, financial position or perception of financial health.

Our ability to engage in routine funding and other transactions could be adversely affected by the stability and actions of other financial services institutions. Financial services institutions are interrelated as a result of trading, clearing, servicing, counterparty and other relationships. We have exposure to financial institutions, intermediaries and counterparties that are exposed to risks over which we have little or no control.

In addition, we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients, resulting in a significant credit concentration with respect to the financial services industry overall. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions.

Likewise, adverse developments affecting the overall strength and soundness of our competitors, the financial services industry as a whole and the general economic climate or sovereign debt could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. In addition, adverse developments with respect to third parties with whom we have important relationships also could negatively impact perceptions about us. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face.

None.

Our corporate and banking real estate portfolio consists of approximately 15.2 million square feet of owned or leased office and retail space, used to support our business. Of this overall portfolio, approximately 12.5 million square feet of space is dedicated for various corporate office uses and approximately 2.7 million square feet of space is for bank branches, Cafés and office space.

Our 12.5 million square feet of corporate office space consists of approximately 5.3 million square feet of leased space and 7.2 million square feet of owned space. Our headquarters is located in McLean, Virginia, and is included in our corporate office space. We maintain corporate office space primarily in Virginia, New York, Illinois, Texas, and Delaware.

Our common stock is listed on the NYSE and is traded under the symbol “COF.” As of January 31, 2020, there were 10,107 holders of record of our common stock.

We did not have any sales of unregistered equity securities in 2019.

We reported net income of $5.5 billion ($11.05 per diluted common share) on total net revenue of $28.6 billion for 2019. In comparison, we reported net income of $6.0 billion ($11.82 per diluted common share) on total net revenue of $28.1 billion for 2018, and $2.0 billion ($3.49 per diluted common share) on total net revenue of $27.2 billion for 2017.

On June 27, 2019, we announced that our Board of Directors authorized the repurchase of up to $2.2 billion of shares of our common stock (“2019 Stock Repurchase Program”) beginning in the third quarter of 2019 through the end of the second quarter of 2020. Through the end of 2019, we repurchased approximately $1.4 billion of shares of our common stock under the 2019 Stock Repurchase Program. See “MD&A—Capital Management—Dividend Policy and Stock Purchases” for additional information.

On July 29, 2019, we announced the Cybersecurity Incident. For more information, see “Part I—Item 1. Business—Overview—Cybersecurity Incident” and “Note 18—Commitments, Contingencies, Guarantees and Others.”

Table 1 below presents the average outstanding balance, interest income earned, interest expense incurred and average yield for 2019, 2018 and 2017 for each major category of our interest-earning assets and interest-bearing liabilities. Nonperforming loans are included in the average loan balances below.