HUNTINGTON BANCSHARES INC MD

RISK MANAGEMENT AND CAPITAL

Risk Governance

Risk awareness, identification and assessment, reporting, and active management are key elements in overall risk management. Controls include, among other, effective segregation of duties, access management, and authorization and reconciliation procedures, as well as staff education and a disciplined assessment process.

We use a multi-faceted approach to risk governance. It begins with the Board of Directors, which has defined our risk appetite as aggregate moderate-to-low, through-the-cycle. This does not preclude engagement in select higher risk activities. Rather, the definition is intended to represent an aggregate view of where we want our overall risk to be managed.

Three Board committees primarily oversee implementation and monitoring of the risk appetite:

•Our Risk Oversight Committee assists the Board in overseeing management of material risks, the approval and monitoring of our capital position and plan that aligns to our overall aggregate moderate-to-low, through-the-cycle risk appetite, the risk governance structure, compliance with applicable laws and regulations, and determining adherence to the board’s stated risk appetite. The ROC has oversight responsibility of our key risk exposures: credit, market, liquidity, compliance, operational, strategic, and reputational. Both our Chief Risk Officer and Credit Review Director report directly to the ROC. This committee also oversees our capital management and planning process, ensures that the amount and quality of capital are adequate in relation to expected and unexpected risks, and that our capital levels exceed “well-capitalized” requirements.

•Our Technology Committee assists our Board in fulfilling its oversight responsibilities with respect to all technology and cybersecurity strategies and plans. The Technology Committee is charged with evaluating Huntington’s capability to properly perform all technology functions necessary for its business plan, including projected growth, technology capacity, planning, operational execution, product development, and management capacity. Our Technology Committee provides oversight of technology investments and plans to drive efficiency as well as to meet defined standards for risk, information security, and redundancy. Our Technology Committee oversees the allocation of technology costs and ensures that they are understood by the Board. Our Technology Committee monitors and evaluates innovation and technology trends that may affect our strategic plans, including monitoring of overall industry trends. The Technology Committee reviews and provides oversight of our continuity and disaster recovery planning and preparedness.

2023 Form 10-K 53

•Our Audit Committee oversees the integrity of the consolidated financial statements, including policies, procedures, and practices regarding the preparation of financial statements, the financial reporting process, disclosures, and internal control over financial reporting. The Audit Committee also provides assistance to our Board in overseeing the internal audit department and the independent registered public accounting firm’s qualifications and independence; compliance with our Financial Code of Ethics for the chief executive officer and senior financial officers; compliance with corporate securities trading policies; compliance with legal and regulatory requirements; and financial risk exposures in coordination with the ROC.

Our Audit and Risk Oversight Committees routinely hold executive sessions with our key officers engaged in accounting and risk management. On a periodic basis, the two committees meet in joint session to cover matters relevant to both, such as the construct and appropriateness of the ACL, which is reviewed quarterly. All directors have access to information provided to each committee and all scheduled meetings are open to all directors.

Our Risk Oversight and Technology Committees hold joint sessions to cover matters relevant to both such as cybersecurity and IT risk and control projects and risk assessments.

Further, through our Human Resources and Compensation Committee, our Board seeks to ensure its overall compensation programs are balanced and align the interests of management, creditors, and shareholders. We utilize a variety of compensation-related tools to induce appropriate behavior, including common stock ownership thresholds for the chief executive officer and certain members of senior management, equity deferrals, recoupment provisions, and the right to terminate compensation plans at any time.

Management has implemented an Enterprise Risk Management and Risk Appetite Framework. Critically important is our self-assessment process, in which each first-line business segment produces an analysis of its risks and the strength of its risk controls. The segment analyses are combined with assessments by our second-line risk management organization of major risk sectors (e.g., credit, market, liquidity, operational, compliance, strategic, and reputation) to produce an overall enterprise risk assessment. Outcomes of the process include a determination of the quality of the overall control environment, the direction of risk, and our position compared to the Board’s defined risk appetite.

Management also utilizes a wide range of metrics (key risk indicators) to monitor risk positions throughout the Company. In general, thresholds for each metric are established, which allows the Company to operate within an aggregate moderate-to-low, through-the-cycle risk appetite. Deviations from the thresholds will indicate if the risk being measured exceeds desired tolerance, which may then necessitate corrective action.

We also have executive level committees to manage and oversee risk, including: ALCO, Credit Policy and Strategy, Risk Management, and Capital Management. Each committee focuses on specific categories of risk and is supported by a series of subcommittees that are tactical in nature. We believe this structure helps ensure appropriate escalation of issues and overall communication of strategies.

Huntington utilizes three lines of defense with regard to risk management: (1) business segments, (2) corporate risk management, and (3) internal audit and credit review. To induce greater ownership of risk within our business segments, segment risk officers have been embedded in the business to identify and monitor risk, elevate and remediate issues, establish controls, perform self-testing, and oversee the self-assessment process. Corporate Risk Management establishes policies, sets operating limits, reviews new or modified products/processes, oversees first-line risk-taking activity, and produces the enterprise risk assessment. The Chief Risk Officer has significant input into the design and outcome of incentive compensation plans. Internal audit and credit review provide additional assurance that risk-related functions are operating as intended.

Huntington classifies/aggregates risk into seven risk pillars. Huntington recognizes that risks can be interrelated or embedded within each other, and therefore managing across risk pillars is a key component of the framework. The following defines the Company’s risk pillars:

•Credit risk, which is the risk of loss due to loan and lease customers or other counterparties not being able to meet their financial obligations under agreed upon terms;

•Market risk, which occurs when fluctuations in interest rates impact earnings and capital. Financial impacts are realized through changes in the interest rates of balance sheet assets and liabilities (net interest margin) or directly through valuation changes of capitalized MSR and/or trading assets (noninterest income);

54 Huntington Bancshares Incorporated

•Liquidity risk, which is the risk to current or anticipated earnings or capital arising from an inability to meet obligations when they come due. Liquidity risk includes the inability to access funding sources or manage fluctuations in funding levels. Liquidity risk also results from the failure to recognize or address changes in market conditions that affect our ability to liquidate assets quickly and with minimal loss in value;

•Operational risk, which is the risk of loss arising from inadequate or failed internal processes or systems, including information security breaches or cyberattacks, human errors or misconduct, or adverse external events. Operational losses result from internal fraud, external fraud, inadequate or inappropriate employment practices and workplace safety, failure to meet professional obligations involving customers, products, and business practices, damage to physical assets, business disruption and systems failures, and failures in execution, delivery, and process management;

•Compliance risk, which exposes us to money penalties, enforcement actions, or other sanctions as a result of non-conformance with laws, rules, and regulations that apply to the financial services industry;

•Strategic risk, which is defined as risk to current or anticipated earnings, capital, or enterprise value arising from adverse business decisions, improper implementation of business decisions or lack of responsiveness to industry / market changes; and

•Reputation risk, which is the risk that negative publicity regarding an institution’s business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions.

A comprehensive discussion of risk management and capital matters affecting us can be found in the Risk Factors section included in Item 1A: Risk Factors and the “Regulatory Matters” section of Item 1: Business of this Form 10-K.

Some of the more significant processes used to manage and control credit, market, liquidity, operational, and compliance risks are described in the following sections.