HUNTINGTON BANCSHARES INC MD

Compliance Risks:

We operate in a highly regulated industry, and the laws and regulations that govern our operations, corporate governance, executive compensation and financial accounting, or reporting, including changes in them, or our failure to comply with them, may adversely affect us and our business model.

The banking industry is highly regulated. We are subject to supervision, regulation, and examination by various federal and state regulators, including the Federal Reserve, OCC, SEC, CFPB, FDIC, FINRA, and various state regulatory agencies. The statutory and regulatory framework that governs us is generally intended to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole - not to protect shareholders. These laws and regulations, many of which are discussed in Item 1: Business - “Regulatory Matters,” among other matters, prescribe minimum capital requirements, impose limitations on our business activities (including foreclosure and collection practices), limit the dividend or distributions that we can pay, restrict the ability of institutions to guarantee our debt, and impose certain specific accounting requirements that may be more restrictive and may result in greater or earlier charges to earnings or reductions in our capital than GAAP. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations often impose additional compliance costs. Such regulation and supervision may increase our costs and limit our ability to pursue business opportunities. Further, our failure to comply with these laws and regulations, even if the failure was inadvertent or reflects a difference in interpretation, could subject us to restrictions on our business activities, fines, and other penalties, any of which could adversely affect our results of operations, capital base, and the price of our securities. Further, any new laws, rules, and regulations could make compliance more difficult or expensive or otherwise adversely affect our business and financial condition.

38 Huntington Bancshares Incorporated

Under the supervision of the CFPB, our consumer and business banking products and services are subject to heightened regulatory oversight and scrutiny with respect to compliance under consumer laws and regulations. We may face a greater number or wider scope of investigations, enforcement actions, and litigation in the future related to consumer practices, thereby increasing costs associated with responding to or defending such actions. Also, federal and state regulators have been increasingly focused on sales practices of branch personnel, including taking regulatory action against other financial institutions. In addition, increased regulatory inquiries and investigations, as well as any additional legislative or regulatory developments affecting our consumer businesses, and any required changes to our business operations resulting from these developments, could result in significant loss of revenue, require remuneration to our customers, trigger fines or penalties, limit the products or services we offer, limit the fees we are able to charge, require us to increase our prices and, therefore, reduce demand for our products, impose additional compliance costs on us, increase the cost of collection, cause harm to our reputation, or otherwise adversely affect our consumer businesses.

Legislative and regulatory actions taken now or in the future that impact the financial industry may materially adversely affect us by increasing our costs, adding complexity in doing business, impeding the efficiency of our internal business processes, negatively impacting the recoverability of certain of our recorded assets, requiring us to increase our regulatory capital, limiting our ability to pursue business opportunities, and otherwise resulting in a material adverse impact on our financial condition, results of operation, liquidity, or stock price.

Both the scope of the laws and regulations and the intensity of the supervision to which we are subject may increase in times of financial crisis, as well as a result of other factors such as technological and market changes. Compliance with these laws and regulations have resulted in and will continue to result in additional costs, which could be significant, and may have a material and adverse effect on our results of operations. In addition, if we do not appropriately comply with current or future legislation and regulations, especially those that apply to our consumer operations, which has been an area of heightened focus, we may be subject to fines, penalties or judgments, or material regulatory restrictions on our businesses, which could adversely affect operations and, in turn, financial results.

We expect the Trump administration will seek to implement a regulatory reform agenda that is significantly different than that of the Biden administration. We expect there will be changes in rulemaking, supervision, examination, and enforcement priorities of the federal banking agencies. The evolving regulatory and supervisory environment and uncertainty about the timing and scope of future laws, regulations, and policies may contribute to decisions we may make to suspend, reduce, or withdraw from existing businesses, activities, or initiatives, which may result in potential lost revenue or significant restructuring or related costs or exposures.

In addition, regulatory responses in connection with severe market downturns or unforeseen stress events may alter or disrupt our planned future strategies and actions. Adverse developments affecting the overall strength and soundness of other financial institutions, the financial services industry as a whole, and the general economic climate and U.S. Treasury market could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. During 2023, the FDIC took control and was appointed receiver of Silicon Valley Bank, Signature Bank, and First Republic Bank, respectively. The failure of other banks and financial institutions and the measures taken by governments and regulators in response to these events, including increased regulatory scrutiny and heightened supervisory expectations could adversely impact our business, financial condition, and results of operations.

The resolution of significant pending litigation, if unfavorable, could have an adverse effect on our results of operations for a particular period.

We face legal risks in our businesses, and the volume of claims and amount of damages and penalties claimed in litigation and regulatory proceedings against financial institutions remain high. Substantial legal liability against us could have material adverse financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects. It is possible that the ultimate resolution of these matters, if unfavorable, may be material to the results of operations for a particular reporting period.

For more information on litigation risks, see Note 21 - “Commitments and Contingent Liabilities” to the Consolidated Financial Statements.

2024 Form 10-K 39

Noncompliance with the Bank Secrecy Act and other anti-money laundering statutes and regulations could cause us material financial loss.

The Bank Secrecy Act contains anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act requires financial institutions to undertake activities including maintaining an anti-money laundering program, verifying the identity of clients, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies. FinCEN, a unit of the Treasury Department that administers the Bank Secrecy Act, is authorized to impose significant civil money penalties for violations of those requirements and has recently engaged in coordinated enforcement efforts with the federal bank regulatory agencies, as well as the DOJ, Drug Enforcement Administration, and IRS.

There is also increased scrutiny of compliance with the rules enforced by the OFAC. If our policies, procedures, and systems are deemed deficient or the policies, procedures, and systems of the financial institutions that we have already acquired or may acquire in the future are deficient, we would be subject to liability, including fines and regulatory actions such as restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain planned business activities, including acquisition plans, which would negatively impact our business, financial condition, and results of operations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us.

For more information regarding the Bank Secrecy Act, Patriot Act, anti-money laundering requirements and OFAC-administered sanctions, refer to Item 1: Business - “Regulatory Matters.”

Cybersecurity and data privacy are areas of heightened legislative and regulatory focus.

As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. For example, the federal bank regulatory agencies (namely, the Federal Reserve, FDIC and OCC) have proposed regulations that would enhance cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, including us and the Bank, and would focus on cyber risk governance and management, management of internal and external dependencies, incident response, cyber resilience, and situational awareness. Although the FDIC and OCC each withdrew this proposal, the Federal Reserve has not withdrawn its propose and may still propose such a rule. For more information regarding applicable cybersecurity and data privacy legislation and regulations, refer to Item 1: Business - “Regulatory Matters.”

We share, use, collect, disclose and otherwise process personal information of our customers and counterparties, including, but not limited to, personal financial information. The sharing, use, collection, disclosure, and other processing of these types of information are governed by increasingly stringent and evolving legislation and regulations, the intent of which is to protect the privacy of personal information, including personal financial information. We may become subject to new legislation or regulations concerning cybersecurity and data privacy. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to change our business practices, policies, or systems or otherwise incur significant additional costs and expenses in order to comply.

Further, we make public statements about our sharing, use, collection, disclosure, and other processing of personal information through our privacy policies, information provided on our website, and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. Our public statements and documentation that provide promises and assurances about cybersecurity and data privacy can subject us to potential government or legal action if they are found to be deceptive, unfair, or misrepresent our actual practices.

40 Huntington Bancshares Incorporated

If cybersecurity or data privacy legislation or regulations are implemented, interpreted, or applied in a manner inconsistent with our current practices, or if we fail to comply (or are perceived to have failed to comply) with applicable legislation and regulation relating to cybersecurity and data privacy, we may be subject to fines, civil or criminal penalties, sanctions, litigation (including class actions), investigations or inquiries, or regulatory enforcement actions or ordered to change our business practices, policies, or systems in a manner that adversely impacts our operating results.

Strategic Risks:

We operate in a highly competitive industry which depends on our ability to successfully execute our strategic plan and adapt our products and services to evolving industry standards and consumer preferences.

We are subject to intense competition from both other financial institutions and from non-bank entities, including FinTech companies. Technology has lowered the barriers to entry, with customers having a growing variety of traditional and nontraditional alternatives, such as crowdfunding, digital wallets, cryptocurrencies, and money transfer services. The continuous widespread adoption of new technologies, including internet services and mobile applications, and advanced ATM functionality, is influencing how individuals and firms conduct their financial affairs and is changing the delivery channels for financial services. Our “People-First, Customer-Centered” strategic plan considers the implications of these changes in technology and how it may impact our customers. Additionally, these changes require us to adapt our product and services, as well as our distribution of them, to evolving industry standards and customer preferences. Failure to address competitive pressures could make it more difficult for us to attract and retain customers across our businesses.

Our success depends, in part, on our ability to successfully implement our strategic plan as well as adapt existing products and services and develop competitive new products and services demanded by our customers. The widespread adoption of technologies will continue to require substantial investments to modify or adapt existing products and services and to develop new product or services. Additionally, we may not be successful in executing our strategic plan, introducing new products or services, achieving market acceptance of new product or services, anticipating or reacting to customers changing preferences, or attracting and retaining loyal customers.

We depend on our executive officers and key personnel to continue the implementation of our long-term business strategy and could be harmed by the loss of their services.

We believe that our continued growth and future success will depend in large part on the skills of our management team and our ability to motivate and retain these individuals and other key personnel. The loss of service of one or more of our executive officers or key personnel could reduce our ability to successfully implement our long-term business strategy, our business could suffer, and the value of our stock could be materially adversely affected. Leadership changes will occur from time to time, and we cannot predict whether significant resignations will occur or whether we will be able to recruit additional qualified personnel. We believe our management team possesses valuable knowledge about the banking industry and that their knowledge and relationships would be very difficult to replicate. Our success also depends on the experience of our branch managers and lending officers and on their relationships with the customers and communities they serve. The loss of these key personnel could negatively impact our banking operations. The loss of key personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business, financial condition, or operating results.

2024 Form 10-K 41

Bank regulations regarding capital and liquidity, including the CCAR assessment process and the U.S. Basel III capital and liquidity standards, could require higher levels of capital and liquidity. Among other things, these regulations could impact our ability to pay common stock dividends, repurchase common stock, attract cost-effective sources of deposits, or require the retention of higher amounts of low yielding securities.

The Federal Reserve administers CCAR, a periodic forward-looking quantitative assessment of Huntington’s capital adequacy and planned capital distributions and a review of the strength of Huntington’s practices to assess capital needs. The Federal Reserve makes a quantitative assessment of capital based on supervisory-run stress tests that assess the ability to maintain capital levels above each minimum regulatory capital ratio after making all capital actions included in Huntington’s capital plan, under baseline and stressful conditions throughout a nine-quarter planning horizon. The CCAR process is also used to determine Huntington’s SCB requirement. There can be no assurance that the Federal Reserve or OCC will respond favorably to our capital plans, planned capital actions, or stress test results, and the Federal Reserve, OCC, or other regulatory capital requirements may limit or otherwise restrict how we utilize our capital, including common stock dividends and stock repurchases.

We are also required to maintain minimum capital ratios and the Federal Reserve and OCC may determine that Huntington and/or the Bank, based on size, complexity, or risk profile, must maintain capital ratios above these minimums in order to operate in a safe and sound manner. In the event we are required to raise capital to maintain required minimum capital and leverage ratios or ratios above the required applicable minimums, we may be forced to do so when market conditions are undesirable or on terms that are less favorable to us than we would otherwise require. Furthermore, in order to prevent becoming subject to restrictions on our ability to distribute capital or make certain discretionary bonus payments to management, the Bank must maintain a CCB of 2.5%, and Huntington must maintain the applicable SCB determined as part of the CCAR process, which are in addition to our required minimum capital ratios.

We also face the risk of becoming subject to new or more stringent requirements in connection with the introduction of new regulations or modification of existing regulations, which could require us to hold more capital or liquidity or have other adverse effects on our businesses or profitability. For example, proposed changes to applicable capital and liquidity requirements, such as the Basel III Endgame Proposal and the long-term debt proposal, could result in increased expenses or cost of funding, which could negatively affect our financial results or our ability to pay dividends and engage in share repurchases.

For more information regarding CCAR, stress testing, and capital and liquidity requirements, refer to Item 1: Business - “Regulatory Matters.”

Reputation Risk:

Damage to our reputation could significantly harm our business, including our competitive position and business prospects.

Our ability to attract and retain customers, clients, investors, and employees is affected by our reputation. Significant harm to our reputation can arise from various sources, including officer, director, or employee misconduct, actual or perceived unethical behavior, conflicts of interest, security breaches, litigation or regulatory outcomes, compensation practices, failing to deliver minimum or required standards of service and quality, failing to address customer and agency complaints, compliance failures, unauthorized release, gathering, monitoring, misuse, loss, destruction or other processing of confidential, proprietary, personal, and other information due to cyber-attacks or other information or security breaches, disruptions, compromises or failures of our systems or infrastructure, perception of our corporate responsibility or environmental practices and disclosures, and the activities of our clients, customers, and counterparties, including vendors. Reputation risk related to corporate policies and practices on corporate responsibility and ESG topics is increasingly complex. Divergent ideological and social views may create competing stakeholder, legislative, and regulatory scrutiny that may impact our reputation or operations. In particular, there is an increasing number of state-level anti-ESG initiatives in the U.S. that may conflict with other regulatory requirements or our various stakeholders’ expectations. Such divergent, sometimes conflicting, views on corporate responsibility and ESG-related matters increase the risk that any action or lack thereof by us on such matters will be perceived negatively by some stakeholders. Actions by the financial service industry generally or by institutions or individuals in the industry can adversely affect our reputation indirectly by association. In addition, adverse publicity or negative information posted on social media, whether or not factually correct, may affect our business prospects. All of these could adversely affect our growth, results of operation, and financial condition.

42 Huntington Bancshares Incorporated