HUNTINGTON BANCSHARES INC MD

Regulatory Matters

Regulatory Environment

The banking industry is highly regulated. We are subject to supervision, regulation, and examination by various federal and state regulators, including the Federal Reserve, OCC, SEC, CFPB, FDIC, FINRA, and various state regulatory agencies. The statutory and regulatory framework that governs us is generally intended to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole.

Banking statutes, regulations, and policies are continually under review by Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to Huntington and its subsidiaries. Any change in the statutes, regulations, or regulatory policies applicable to us, including changes in their interpretation or implementation, could have a material effect on our business or organization.

Huntington and the Bank each qualify as a Category IV banking organization subject to the least restrictive of the requirements applicable to firms with $100 billion or more in total consolidated assets. Our business, however, remains subject to extensive regulation and supervision, and the U.S. banking agencies may issue additional rules to tailor the application of certain other regulatory requirements to BHCs and banks, including Huntington and the Bank. The scope of laws and regulations and the intensity of supervision to which we are subject has increased in response to the banking turmoil in early 2023, technological factors, market changes, and climate change concerns, and there is increased scrutiny and possible denials of bank mergers and acquisitions by federal banking regulators.

We are also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, both as administered by the SEC, as well as the rules of Nasdaq that apply to companies with securities listed on the Nasdaq Global Select Market.

2024 Form 10-K 11

The following discussion describes certain elements of the comprehensive regulatory framework applicable to us. This discussion is not intended to describe all laws and regulations applicable to Huntington, the Bank, and Huntington’s other subsidiaries.

Supervision, Examination and Enforcement

Huntington is a BHC under the BHC Act that has elected to be an FHC. FHCs may engage in, and be affiliated with, companies engaging in a broader range of activities than those permitted for a BHC, so long as such activities are (i) financial in nature or incidental to such financial activity or (ii) complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of a depository institution or to the financial system generally. These activities include, for example, securities underwriting, securities dealing, making a market in securities, making merchant banking investments in non-financial companies, and engaging in insurance underwriting and agency activities. To become and remain eligible for FHC status, a BHC and its subsidiary depository institutions must meet certain criteria, including capital, management, and CRA requirements. Failure to meet such criteria could result, depending on which requirements were not met, in restrictions on new financial activities or acquisitions, or being required to discontinue existing activities that are not generally permissible for BHCs.

Huntington is subject to primary supervision, regulation, and examination by the Federal Reserve, which serves as the primary regulator of our consolidated organization. The primary regulators of our non-bank subsidiaries directly regulate the activities of those subsidiaries, with the Federal Reserve exercising a supervisory role. Such non-bank subsidiaries include, for example, broker-dealers and investment advisers both registered with the SEC.

The Bank is a national banking association chartered under the laws of the U.S. As a national bank, the activities of the Bank are limited to those specifically authorized under the National Bank Act and OCC regulations. The Bank is subject to comprehensive primary supervision, regulation, and examination by the OCC. As a member of the DIF, the Bank is also subject to regulation and examination by the FDIC.

A principal objective of the U.S. bank regulatory regime is to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole, by ensuring the financial safety and soundness of BHCs and banks, including Huntington and the Bank. Bank regulators regularly examine the operations of BHCs and banks. In addition, BHCs and banks are subject to periodic reporting and filing requirements.

The Federal Reserve, OCC, and FDIC have broad supervisory and enforcement authority with regard to BHCs and banks, including the power to conduct examinations and investigations, impose nonpublic supervisory agreements, issue cease and desist orders, impose fines and other civil and criminal penalties, terminate deposit insurance, and appoint a conservator or receiver. In addition, Huntington, the Bank, and other Huntington subsidiaries are subject to supervision, regulation, and examination by the CFPB, which is the primary administrator of most federal consumer financial statutes and Huntington’s primary consumer financial regulator. Supervision and examinations are confidential, and the outcomes of these actions may not be made public.

Bank regulators have various remedies available if they determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of a banking organization’s operations are unsatisfactory. The regulators may also take action if they determine that the banking organization or its management is violating or has violated any law or regulation. The regulators have the power to, among other things, (1) prohibit unsafe or unsound practices, (2) require affirmative actions to correct any violation or practice, (3) issue administrative orders that can be judicially enforced, (4) direct increases in capital, (5) direct the sale of subsidiaries or other assets, (6) limit dividends and distributions, (7) restrict growth, (8) assess civil monetary penalties, (9) remove officers and directors, and (10) terminate deposit insurance.

Engaging in unsafe or unsound practices or failing to comply with applicable laws, regulations, and supervisory agreements could subject the Company, its subsidiaries, and their respective officers, directors, and institution-affiliated parties to the remedies described above, and other sanctions. In addition, the FDIC may terminate a bank’s deposit insurance upon a finding that the bank’s financial condition is unsafe or unsound or that the bank has engaged in unsafe or unsound practices or has violated an applicable rule, regulation, order, or condition enacted or imposed by the bank’s regulatory agency.

12 Huntington Bancshares Incorporated

Huntington is subject to the Federal Reserve’s LFI Rating System, which places a greater emphasis on capital and liquidity, including related planning and risk management practices, as compared to the supervisory rating system applicable to smaller BHCs. These ratings are confidential.

Pause on Major Federal Reserve Rulemakings

In January 2025, the Federal Reserve stated that Vice Chair for Supervision Michael Barr would step down from the position, effective, February 28, 2025. The Federal Reserve stated that it will not issue any major rulemakings from the time of the announcement until a new vice chair for supervision is confirmed by the U.S. Senate.

Bank Acquisitions by Huntington

BHCs, such as Huntington, must obtain prior approval of the Federal Reserve in connection with any acquisition that results in the BHC owning or controlling 5% or more of any class of voting securities of a bank or another BHC.

Late in the term of the Biden administration, the standards by which bank and financial institution acquisitions would be evaluated have been undergoing review and change by the OCC and the DOJ, but not by the Federal Reserve. These reviews and changes were incorporated into non-binding guidance. Whether and how the guidance might be further changed or interpreted by the Trump administration is uncertain.

In September 2024, the OCC adopted a final rule and policy statement regarding its review of Bank Merger Act applications for OCC-supervised institutions, including the Bank. The final rule removes the ability for Bank Merger Act applicants to file a streamlined application form for certain types of acquisitions and removes the expedited review process for Bank Merger Act applications. The policy statement provides 19 indicators of whether a Bank Merger Act application is more or less likely to be approved by the OCC. The policy statement also provides heightened expectations around the existing statutory factors the OCC is required to consider in evaluating Bank Merger Act applications.

In September 2024, the DOJ withdrew its 1995 Bank Merger Guidelines and issued the 2024 Banking Addendum. The DOJ clarified that it will assess competition considerations in connection with bank and bank holding company mergers using its 2023 Merger Guidelines, which is the general merger review framework the DOJ now uses to evaluate transactions in all segments of the economy, and the 2024 Banking Addendum. The 2024 Banking Addendum provides guidance on how the DOJ will assess competition in the context of bank and bank holding company mergers. An analysis under the 2023 Merger Guidelines and 2024 Banking Addendum may include consideration of theories of harm and relevant markets not considered under the 1995 Bank Merger Guidelines, which focused primarily on concentrations of deposits and branches.

Acquisitions of Ownership of the Company

Acquisitions of Huntington’s voting stock above certain thresholds are subject to prior regulatory notice or approval under federal banking laws, including the BHC Act and the Change in Bank Control Act of 1978. Under the Change in Bank Control Act, a person or entity generally must provide prior notice to the Federal Reserve before acquiring the power to vote 10% or more of our outstanding common stock. Investors should be aware of these requirements when acquiring shares in our stock.

Interstate Banking

Under the Riegle-Neal Act, a BHC may acquire banks in states other than its home state, subject to any state requirement that the bank has been organized and operating for a minimum period of time, not to exceed five years, and the requirement that the BHC not control, prior to or following the proposed acquisition, more than 10% of the total amount of deposits of insured depository institutions nationwide or, unless the acquisition is the BHC’s initial entry into the state, more than 30% of such deposits in the state (or such lesser or greater amount set by the state). The Riegle-Neal Act also authorizes banks to merge across state lines, thereby creating interstate branches. A national bank, such as the Bank, with the approval of the OCC may open a branch in any state if the law of that state would permit a state bank chartered in that state to establish the branch.

2024 Form 10-K 13

Enhanced Prudential Standards

BHCs with consolidated assets of more than $100 billion, such as Huntington, are currently subject to certain enhanced prudential standards. As a result, Huntington is subject to more stringent standards, including liquidity and capital requirements, leverage limits, stress testing, resolution planning, and risk management standards, than those applicable to institutions with less than $100 billion in total consolidated assets. Certain larger banking organizations are subject to additional enhanced prudential standards. As a Category IV banking organization, Huntington is subject to the least restrictive enhanced prudential standards applicable to firms with $100 billion or more in total consolidated assets.

Liquidity Requirements

Huntington, as a Category IV banking organization with less than $50 billion in weighted short-term wholesale funding, is exempt from the LCR and net stable funding ratio requirements but continues to be subject to internal liquidity stress tests and standards.

Long-term Debt Requirements

In August 2023, the U.S. banking agencies issued a proposed rule that would require certain large banking organizations such as Huntington to comply with long-term debt requirements and “clean holding company requirements” similar to those that currently only apply to U.S. global systemically important banking organizations. This proposal would also impose a long-term debt requirement on certain categories of insured depository institutions that are not consolidated subsidiaries of U.S. global systematically important banking organizations, including insured depository institutions with $100 billion or more in total assets, such as the Bank. If adopted, this proposal, would require Huntington and the Bank to each maintain a minimum outstanding eligible long-term debt amount of no less than the greater of (i) 6% of total risk-weighted assets, (ii) 2.5% of total leverage exposure (if subject to the supplementary leverage ratio), or (iii) 3.5% of average total consolidated assets. To comply with the requirement, the Bank would be required to issue the minimum amount of eligible long-term debt to Huntington, and Huntington would be required to issue the minimum amount of eligible long-term debt externally. The proposal allows banking organizations to include, as part of the required minimum outstanding eligible long-term debt amounts, certain existing long-term debt. Once the rule is finalized, covered institutions would have three years to comply with the new requirements following a phased-in approach, with 25% of the long-term debt requirement by one year after finalization of the rule, 50% after two years, and 100% after three years.

In addition, if adopted as proposed, the “clean holding company requirements” would limit or prohibit Huntington from entering into certain transactions that could impede its orderly resolution, including, for example, prohibiting Huntington from entering into transactions that could spread losses to subsidiaries and third parties, as well as limiting the amount of the Company’s liabilities that are not eligible long-term debt. The timing and form of any final rule implementing the long-term debt requirements and clean holding company requirements remains uncertain.

Regulatory Capital Requirements

Huntington and the Bank are subject to certain risk-based capital and leverage ratio requirements under the U.S. Basel III capital rules adopted by the Federal Reserve, for Huntington, and by the OCC, for the Bank. These rules implement the Basel III international regulatory capital standards in the U.S., as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the Federal Reserve and OCC may determine that a banking organization, based on its size, complexity, or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the U.S. Basel III capital rules, Huntington’s and the Bank’s assets, exposures, and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for Huntington and the Bank:

•CET1 Risk-Based Capital Ratio, equal to the ratio of CET1 capital to risk-weighted assets. CET1 capital primarily includes common shareholders’ equity subject to certain regulatory adjustments and deductions, including goodwill, intangible assets, certain deferred tax assets, and AOCI.

•Tier 1 Risk-Based Capital Ratio, equal to the ratio of Tier 1 capital to risk-weighted assets. Tier 1 capital is primarily comprised of CET1 capital, perpetual preferred stock, and certain qualifying capital instruments.

14 Huntington Bancshares Incorporated

•Total Risk-Based Capital Ratio, equal to the ratio of total capital, including CET1 capital, Tier 1 capital, and Tier 2 capital, to risk-weighted assets. Tier 2 capital primarily includes qualifying subordinated debt and qualifying ALLL. Tier 2 capital also includes, among other things, certain trust preferred securities.

•Tier 1 Leverage Ratio, equal to the ratio of Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets, and certain other deductions).

Huntington and the Bank elected to temporarily delay certain effects of CECL on regulatory capital pursuant to a rule that allowed BHCs and banks to delay for two years 100% of the day-one impact of adopting CECL and 25% of the cumulative change in the reported allowance for credit losses since adopting CECL. As of December 31, 2024, we have phased in 75% of the cumulative CECL deferral with the full cumulative CECL deferral fully phased in beginning January 1, 2025.

The total minimum regulatory capital ratios and well-capitalized minimum ratios are reflected in the table below in this section. The Federal Reserve has not yet revised the well-capitalized standard for BHCs to reflect the higher capital requirements imposed under the U.S. Basel III capital rules. For purposes of the Federal Reserve’s Regulation Y, including determining whether a BHC meets the requirements to be an FHC, BHCs, such as Huntington, must maintain a Tier 1 Risk-Based Capital Ratio of 6.0% or greater and a Total Risk-Based Capital Ratio of 10.0% or greater. If the Federal Reserve were to apply the same or a very similar well-capitalized standard to BHCs as that applicable to the Bank, Huntington’s capital ratios as of December 31, 2024, would exceed such revised well-capitalized standard. The Federal Reserve may require BHCs, including Huntington, to maintain capital ratios substantially in excess of mandated minimum levels, depending upon general economic conditions and a BHC’s particular condition, risk profile, and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on Huntington’s or the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications.

In addition to meeting the minimum capital requirements under the U.S. Basel III capital rules, Huntington and the Bank must maintain the applicable capital buffer (SCB and CCB, respectively) requirements to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management. Huntington is subject to a SCB of 2.5% effective October 1, 2024. Refer to the SCB Requirements section below for further details. The Bank is subject to a CCB of 2.5%. The Tier 1 Leverage Ratio is not impacted by the SCB or CCB, and a banking institution may be considered well-capitalized while remaining out of compliance with the SCB or CCB.

The following table presents the minimum regulatory capital ratios, minimum ratio plus the capital buffer, and well-capitalized minimums compared with Huntington’s and the Bank’s regulatory capital ratios as of December 31, 2024, calculated using the regulatory capital methodology applicable as of the end of 2024.

(1) Reflects a SCB of 2.5% for both Huntington and the Bank.

(2) Reflects the well-capitalized standard applicable to Huntington under Federal Reserve Regulation Y and the well-capitalized standard applicable to the Bank.

Huntington has the ability to provide additional capital to the Bank to maintain the Bank’s risk-based capital ratios at levels which would be considered well-capitalized.

2024 Form 10-K 15

As of December 31, 2024, Huntington’s and the Bank’s regulatory capital ratios were above the well-capitalized standards and met the applicable capital buffer requirements.

Basel III Endgame Proposal

In July 2023, the U.S. banking agencies issued a proposed rule to implement the Basel III endgame agreement for large banks (2023 Basel III Endgame Proposal). The proposal is aimed at significantly increasing capital requirements for large banks, particularly in the US, by mandating them to hold more capital against potential risks like credit, market, and operational risks.

It is uncertain if and when a final rule will be adopted, and if so, whether and to what extent it will differ from the 2023 Basel III Endgame Proposal. As a result, the timing and content of any final rule, and the potential effects of any final rule on Huntington and the Bank, remain uncertain.

Capital Planning and Stress Testing

Huntington is required to develop, maintain, and submit to the Federal Reserve a capital plan every year, which is subject to supervisory review in connection with the Federal Reserve’s CCAR process. Huntington is required to include within its capital plan an assessment of the expected uses and sources of capital and a description of all planned capital actions over a nine-quarter planning horizon, a detailed description of the process for assessing capital adequacy, its capital policy, and a discussion of any expected changes to its business plan that are likely to have a material impact on its capital adequacy. Under the stress buffer requirements, the CCAR process is used to determine a BHC’s SCB requirement. Please refer to the SCB Requirements section below for further details.

The Federal Reserve expects BHCs subject to CCAR, such as Huntington, to have sufficient capital to withstand a highly adverse operating environment and to be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and serve as credit intermediaries. In addition, the Federal Reserve evaluates the planned capital actions of these BHCs, including planned capital distributions such as dividend payments or stock repurchases. This involves a quantitative assessment of capital based on supervisory-run stress tests that assess the ability to maintain capital levels above certain minimum ratios, after taking into consideration all capital actions included in a BHC’s capital plan, under baseline and stressful conditions throughout the nine-quarter planning horizon. As part of CCAR, the Federal Reserve evaluates whether BHCs have sufficient capital to continue operations throughout times of economic and financial market stress and whether they have robust, forward-looking capital planning processes that account for their unique risks. We are generally prohibited from making a capital distribution unless, after giving effect to the distribution, we will meet all minimum regulatory capital ratios. Huntington may increase certain types of capital distributions in excess of the amount included in its capital plan without seeking prior approval from the Federal Reserve as long as it otherwise complies with the automatic restrictions on distributions under the Federal Reserve’s capital rules.

Although the Federal Reserve is no longer allowed to object to the capital plan of a large and non-complex BHC, such as Huntington, on a qualitative, as opposed to quantitative, basis, the Federal Reserve may evaluate the strength of Huntington’s qualitative capital planning process through the regular supervisory process and targeted horizontal reviews of particular aspects of capital planning.

SCB Requirements

For risk-based capital requirements, Huntington, as a large BHC, is provided an SCB by the Federal Reserve that is determined annually based on the greater of (i) the difference between its starting and minimum projected CET1 Risk-Based Capital Ratio under the severely adverse scenario in the supervisory stress test, plus the sum of the dollar amount of Huntington’s planned common stock dividends for each of the fourth through seventh quarters of the planning horizon as a percentage of risk-weighted assets, or (ii) 2.5%. On April 5, 2024, Huntington submitted its 2024 Capital Plan to the Federal Reserve for supervisory review. By notice dated June 26, 2024, the Federal Reserve informed Huntington that, effective October 1, 2024, its indicative SCB requirement associated with its 2024 Capital Plan is the prescribed minimum SCB of 2.5%, a decrease from its previous SCB of 3.2%.

Huntington is authorized to make capital distributions that are consistent with the requirements in the Federal Reserve’s capital rule, inclusive of the SCB requirement. Provided that Huntington is otherwise in compliance with automatic restrictions on distributions under the Federal Reserve’s capital rules, Huntington is not required to seek prior approval to make capital distributions in excess of those included in its capital plan.

16 Huntington Bancshares Incorporated

Restrictions on Dividends

Huntington is a legal entity separate and distinct from its banking and non-banking subsidiaries. Since our consolidated net income consists largely of net income of Huntington’s subsidiaries, our ability to make capital distributions, including paying dividends and repurchasing shares, depends upon our receipt of dividends from these subsidiaries. Under federal law, there are various limitations on the extent to which the Bank can declare and pay dividends to Huntington, including those related to regulatory capital requirements, general regulatory oversight to prevent unsafe or unsound practices, and federal banking law requirements concerning the payment of dividends out of net profits, surplus, and available earnings. Certain contractual restrictions also may limit the ability of the Bank to pay dividends to Huntington. No assurances can be given that the Bank will, in any circumstances, pay dividends to Huntington.

Huntington’s ability to declare and pay dividends to our shareholders is similarly limited by federal banking law and Federal Reserve regulations and policy. As discussed in the Capital Planning section above, in general, a BHC may pay dividends and repurchase stock only in accordance with a capital plan that has been reviewed by the Federal Reserve and as to which the Federal Reserve has not objected.

Huntington and the Bank must maintain the applicable capital buffer requirements to avoid becoming subject to restrictions on capital distributions, including dividends. For more information on the capital buffer requirements, see the SCB Requirements and the Regulatory Capital Requirements sections above.

The Federal Reserve has indicated generally that it may be an unsafe or unsound practice for a BHC to pay dividends unless a its net income is sufficient to fund the dividends and the expected rate of earnings retention is consistent with its capital needs, asset quality, and overall financial condition. The Federal Reserve could prohibit or limit the payment of dividends by a BHC if it determines that payment of the dividend would constitute an unsafe or unsound practice.

Volcker Rule

Under the Volcker Rule, we are prohibited from (1) engaging in short-term proprietary trading for our own account and (2) having certain ownership interests in and relationships with hedge funds or private equity funds (covered funds). The Volcker Rule regulations contain exemptions for market-making, hedging, underwriting, trading in U.S. government and agency obligations, and also permit certain ownership interests in certain types of covered funds to be retained. They also permit the offering and sponsoring of covered funds under certain conditions. The Volcker Rule regulations impose significant compliance and reporting obligations on banking entities, such as Huntington. We have put in place the compliance programs required by the Volcker Rule and any holdings in illiquid covered funds are in compliance with the Volcker Rule.

Resolution Planning

As a Category IV banking organization, Huntington is not required to submit a resolution plan to the Federal Reserve. As an insured depository institution, the Bank is required to file a resolution plan with the FDIC, and the Bank submitted its most recent resolution plan to the FDIC on November 30, 2022. In June 2024, the FDIC adopted a final rule to modify the required frequency and informational content of resolution plan submissions applicable to insured depository institutions with $50 billion or more in total assets, including the Bank, which describe the insured depository institution’s strategy for a rapid and orderly resolution in the event of material financial distress or failure. As a result of the final rule, the Bank will be required to submit to the FDIC full resolution plans every three years and interim targeted information between full resolution plan submissions. In addition, the final rule introduces a new credibility standard that will be used to evaluate full resolution plan submissions. If the FDIC finds an insured depository institution’s resolution plan to be not credible, it could subject the insured depository institution to an enforcement action. The final rule became effective October 1, 2024 and the deadline for the Bank’s first resolution plan submission under the final rule is July 1, 2025.

2024 Form 10-K 17

Source of Strength

Huntington is required to serve as a source of financial and managerial strength to the Bank and, under appropriate conditions, to commit resources to support the Bank. This support may be required by the Federal Reserve at times when we might otherwise determine not to provide it or when doing so is not otherwise in the interests of Huntington or our shareholders or creditors. The Federal Reserve may require a BHC to make capital injections into a troubled subsidiary bank and may charge the BHC with engaging in unsafe and unsound practices if the BHC fails to commit resources to such a subsidiary bank or if it undertakes actions that the Federal Reserve believes might jeopardize the BHC’s ability to commit resources to such subsidiary bank.

Under these requirements, Huntington may in the future be required to provide financial assistance to the Bank should it experience financial distress. Capital loans by Huntington to the Bank would be subordinate in right of payment to deposits and certain other debts of the Bank. In the event of Huntington’s bankruptcy, any commitment by Huntington to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee and entitled to a priority of payment.

FDIC as Receiver or Conservator of Huntington

Upon the insolvency of an insured depository institution, such as the Bank, the FDIC may be appointed as the conservator or receiver of the institution. Under the Orderly Liquidation Authority, upon the insolvency of a BHC, such as Huntington, the FDIC may be appointed as conservator or receiver of the BHC, if certain findings are made by the FDIC, the Federal Reserve, and the Secretary of the Treasury, in consultation with the President. Acting as a conservator or receiver, the FDIC would have broad powers to transfer any assets or liabilities of the institution without the approval of the institution’s creditors.

Depositor Preference

The FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, including the Bank, the claims of depositors of the institution (including the claims of the FDIC as subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver would have priority over other general unsecured claims against the institution. If the Bank were to fail, insured and uninsured depositors, along with the FDIC, would have priority in payment ahead of unsecured, non-deposit creditors, including Huntington, with respect to any extensions of credit they have made to such insured depository institution.

Transactions between a Bank and its Affiliates

Federal banking laws and regulations impose qualitative standards and quantitative limitations upon certain transactions between a bank and its affiliates, including between a bank and its holding company and companies that the BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms and cannot exceed certain amounts which are determined with reference to the Bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. The Dodd-Frank Act expanded the coverage and scope of these regulations, including by applying them to the credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions. Federal banking laws also place similar restrictions on loans and other extensions of credit by FDIC-insured banks, such as the Bank, and their subsidiaries to their directors, executive officers, and principal shareholders.

Lending Standards and Guidance

The federal bank regulatory agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all insured depository institutions, such as the Bank, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures, and documentation, approval, and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulatory agencies’ Interagency Guidelines for Real Estate Lending Policies.

18 Huntington Bancshares Incorporated

Heightened Governance and Risk Management Standards

The OCC has published guidelines to set expectations for the governance and risk management practices of certain large financial institutions, including the Bank. The guidelines require covered institutions to establish and adhere to a written governance framework in order to manage and control their risk-taking activities. In addition, the guidelines provide standards for the institutions’ boards of directors to oversee the risk governance framework. As discussed in the “Risk Management and Capital” section of the MD&A, the Bank currently has a written governance framework and associated controls.

Anti-Money Laundering

The Bank Secrecy Act, as amended by the Patriot Act and Anti-Money Laundering Act of 2020, contains anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act requires financial institutions such as depository institutions to undertake activities, including maintaining an AML program, verifying the identity of customers, verifying the identity of certain beneficial owners for legal entity customers, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies. The Bank is subject to the Bank Secrecy Act and, therefore, is required to implement compliance policies, procedures, and internal controls, provide its employees with AML training, designate an AML compliance officer, and undergo a periodic independent auditing and testing to assess the effectiveness of its AML program, among other requirements. The Bank has implemented an AML compliance program, including policies, procedures, and internal controls that are designed to comply with these AML requirements. Bank regulators continue to focus their examinations on AML compliance, and we will continue to monitor and augment, where necessary, our AML compliance programs, including the Bank’s. The federal banking agencies are required, when reviewing bank and BHC acquisition or merger applications, to take into account the effectiveness of the AML activities of the applicant.

The Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act, does not directly impose new requirements on banks, but requires the U.S. Treasury to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, and conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping and reporting requirements that the Bank Secrecy Act imposes on banks. The Anti-Money Laundering Act of 2020 also contains provisions that promote increased information-sharing and use of technology and increases penalties for violations of the Bank Secrecy Act and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.

OFAC Regulation

OFAC is the primary U.S. regulatory authority responsible for administering economic sanctions that affect transactions with designated foreign countries, nationals, and others, as defined by various Executive Orders and in various legislation. OFAC-administered sanctions take many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (2) a blocking of assets in which the government or “specially designated nationals” of the sanctioned country have an interest by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. OFAC also publishes lists of blocked or designated persons, organizations, and entities, including the Specially Designated Nationals and Blocked Persons List. Blocked assets, for example property and bank deposits, cannot be paid out, withdrawn, set off, or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences. Other jurisdictions and multilateral bodies also administer and impose sanctions.

2024 Form 10-K 19

Cybersecurity and Data Privacy

Federal and state legislation and regulations contain extensive cybersecurity and data privacy provisions. Our regulatory agencies including the CFPB, FDIC, Federal Reserve, and OCC also have oversight over us, the Bank, and our subsidiaries with respect to cybersecurity and data privacy. Huntington and its subsidiaries are subject to the rules and regulations promulgated under the authority of the CFPB and Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to cybersecurity and data privacy. Further, the GLBA, and its regulations such as Regulation P, require financial institutions to disclose their data privacy policies and practices relating to sharing personal information and enables retail customers to opt out of our ability to share their personal information with unaffiliated third parties under certain circumstances. The GLBA and its regulations require financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. An amendment to Regulation S-P, an implementing regulation under the GLBA, was adopted by the SEC on May 16, 2024 and requires registered investment advisers and broker-dealers to, among other things, adopt and implement an incident response program as part of their formal cybersecurity policies and procedures and report data breaches to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization within 30 days of becoming aware of such data breach. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means. Moreover, the U.S. Congress has recently considered, and is currently considering, various proposals for more comprehensive cybersecurity and data privacy legislation, to which we may be subject if passed.

Like other lenders, the Bank and other of our subsidiaries also use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on us and our subsidiaries.

The CISA is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions, and empowers the CISA Agency to oversee this information sharing process. The CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks or other information or security breaches. The law includes liability protections for companies that share cyber-threat information with third parties so long as such sharing activity is conducted in accordance with the CISA. In addition, the enactment of the CIRCIA in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the CISA Agency within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA Agency proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators.

In addition, effective April 1, 2022, the Federal Reserve, OCC and FDIC issued a rule that, among other things, requires a banking organization to notify its primary federal regulator as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith could materially disrupt, degrade or impair its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the stability of the U.S. financial sector.

20 Huntington Bancshares Incorporated

Cybersecurity and data privacy are also areas of increasing state legislative focus. For example, under California state law, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation and includes a private right of action (permitting lawsuits to be brought by private individuals instead of the state Attorney General or other government actor for certain breaches). Numerous other states have enacted, or are considering enacting, comprehensive data privacy laws that share similarities with the CCPA. In addition, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.

Our cybersecurity and data privacy policies and procedures for the protection of personal information are in effect across all businesses and geographic locations as applicable.

FDIC Insurance

The DIF provides insurance coverage for certain deposits, up to a standard maximum deposit insurance amount of $250,000 per depositor, and is funded through assessments on insured depository institutions, based on the risk each institution poses to the DIF. The Bank accepts customer deposits that are insured by the DIF and, therefore, must pay insurance premiums. The FDIC may increase the Bank’s insurance premiums based on various factors, including the FDIC’s assessment of its risk profile.

The FDIC also requires large insured depository institutions, including the Bank, to maintain enhanced deposit account recordkeeping and related information technology system capabilities to facilitate prompt payment of insured deposits if such an institution were to fail.

The FDIC, as required under the FDIA, established a plan on September 15, 2020, to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. This plan did not include an increase in the deposit insurance assessment rate. Based on the FDIC’s recent projections, however, the FDIC determined that the DIF reserve ratio is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates. In October 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning on January 1, 2023. The FDIC also concurrently maintained the Designated Reserve Ratio for the DIF at 2%.

In November 2023, the FDIC issued a final rule, which became effective April 1, 2024, to implement a special assessment to recoup losses to the DIF associated with the first half 2023 bank failures. Under the final rule, the assessment base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion of uninsured deposits. The FDIC will collect the special assessment over an initial eight-quarter collection period, which began in the second quarter of 2024 and currently projects that the special assessment will be collected for an additional two quarters beyond the initial eight-quarter collection period, at a lower rate, subject to change depending on any adjustments to the loss estimate, mergers or failures, or amendments to reported estimates of uninsured deposits. The Bank recognized expense of $214 million in 2023 and $28 million in 2024 related to the DIF special assessment.

Compensation

Our compensation practices are subject to oversight by the Federal Reserve and, with respect to some of our subsidiaries and employees, by other financial regulatory bodies. The scope and content of compensation regulation in the financial industry are continuing to develop, and we expect that these regulations and resulting market practices will continue to evolve over a number of years.

The federal bank regulatory agencies have issued joint guidance on executive compensation designed to ensure that the incentive compensation policies of banking organizations, such as Huntington and the Bank, do not encourage imprudent risk taking and are consistent with the safety and soundness of the organization. The SEC has a rule that directs stock exchanges to require listed companies to implement clawback policies to recover incentive-based compensation from current or former executive officers in the event of certain financial restatements and requires companies to disclose their clawback policies and their actions under those policies.

2024 Form 10-K 21

Community Reinvestment Act

The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and soundness practices. The relevant federal bank regulatory agency, the OCC in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report.

The CRA requires the relevant federal bank regulatory agency to consider a bank’s CRA assessment when considering the bank’s application to conduct certain mergers or acquisitions or to open or relocate a branch office. The Federal Reserve also must consider the CRA record of each subsidiary bank of a BHC in connection with any acquisition or merger application filed by the BHC. An unsatisfactory CRA record could substantially delay or result in the denial of an approval or application by Huntington or the Bank. The Bank received the highest possible overall CRA rating of “Outstanding” in its most recent examination.

In October 2023, the U.S. banking agencies issued a final rule to amend their regulations implementing the CRA. The rule materially revises the current CRA framework, including the assessment areas in which a bank is evaluated to include activities associated with online and mobile banking, the tests used to evaluate the Bank in its assessment areas, new methods of calculating credit for lending, investment, and service activities, and additional data collection and reporting requirements. The rule is expected to result in a significant increase in the thresholds for large banks to receive “Outstanding” ratings in the future. The rule was expected to take effect on April 1, 2024, with most of its provisions becoming applicable on January 1, 2026. Reporting of the collected data will not be required until 2027. Several banking industry groups filed a lawsuit seeking to invalidate the CRA final rule, in which they argued that the federal banking agencies exceeded their statutory authority in adopting the CRA final rule. In March 2024, a federal judge granted an injunction to extend the CRA final rule’s effective date, originally set for April 1, 2024. The effective date will be extended each day the injunction remains in place, pending the resolution of the lawsuit.

Debit Interchange Fees

We are subject to a statutory requirement that interchange fees for electronic debit transactions that are paid to or charged by payment card issuers, including the Bank, be reasonable and proportional to the cost incurred by the issuer. Interchange fees for electronic debit transactions are limited to 21 cents plus 0.05% of the transaction, plus an additional one cent per transaction fraud adjustment. These fees impose requirements regarding routing and exclusivity of electronic debit transactions. As an issuer with over $10 billion in assets, Huntington is subject to, and in compliance with, Regulation II which requires, among other things, that debit card issuers should enable all debit card transactions, including card-not-present transactions such as online payments, to be processed on at least two unaffiliated payment card networks.

In October 2023, the Federal Reserve released a notice of proposed rulemaking that would lower the maximum interchange fee that a large debit card issuer can receive on a debit card transaction. Under the proposal, the base component would initially decrease from 21.0 cents to 14.4 cents, thead valorem component would decrease from 5.0 basis points to 4.0 basis points multiplied by the value of the transaction, and the fraud-prevention adjustment would increase from 1.0 cents to 1.3 cents for debit card transactions performed from the effective date of the final rule to June 30, 2025. In addition, the proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered from large debit card issuers.

Consumer Protection Regulation and Supervision

We are subject to supervision and regulation by the CFPB with respect to federal consumer protection laws. We are also subject to certain state consumer protection laws, and under the Dodd-Frank Act, state attorneys general and other state officials are empowered to enforce certain federal consumer protection laws and regulations. State authorities have increased their focus on and enforcement of consumer protection rules. These federal and state consumer protection laws apply to a broad range of our activities and to various aspects of our business and include laws relating to interest rates, fair lending, disclosures of credit terms and estimated transaction costs to consumer borrowers, debt collection practices, the use of and the provision of information to consumer reporting agencies, and the prohibition of unfair, deceptive, or abusive acts or practices in connection with the offer, sale, or provision of consumer financial products and services.

22 Huntington Bancshares Incorporated

In December 2024, the CFPB issued a final rule that amends Regulation Z, which implements the Truth in Lending Act, to apply to overdraft credit provided by insured depository institutions with more than $10 billion in total assets. The final rule is scheduled to go into effect on October 1, 2025. Under the final rule, covered institutions, including the Bank, would be allowed to choose to offer overdrafts as a courtesy overdraft service or as a line of credit. If the courtesy overdraft option is chosen, overdrafts would remain exempt from Regulation Z, as long as fees charged are based on the higher of an institutions breakeven point derived from its own costs and losses, or a benchmark fee of $5 established by the CFPB. If the overdraft line of credit option is chosen, overdrafts would be considered a loan subject to Regulation Z, and therefore, subject to account opening and loan disclosures, required to be held in an account separate from the customer’s checking or transaction account, and may not be conditioned on preauthorized electronic funds transfers. Several banking industry groups filed a lawsuit seeking to invalidate the final rule, in which they argued that the CFPB exceeded its statutory authority in adopting the final rule. The court has not yet ruled on the merits of the lawsuit nor granted a preliminary injunction. We continue to evaluate this rulemaking and assess its potential impact on Huntington and the Bank.