HUNTINGTON BANCSHARES INC /MD/

Regulatory Environment

The banking industry is highly regulated. We are subject to supervision, regulation, and examination by various federal and state regulators, including the Federal Reserve, OCC, SEC, CFPB, FDIC, FINRA, and various state regulatory agencies. The statutory and regulatory framework that governs us is generally intended to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole.

Banking statutes, regulations, and policies are continually under review by the U.S. Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to Huntington and its subsidiaries. Any change in the statutes, regulations, or regulatory policies applicable to us, including changes in their interpretation or implementation, could have a material effect on our business or organization. The second Trump administration has implemented significantly different policies from the Biden administration, including new proposed regulations and rescissions or withdrawals of previous guidance, and sharply reduced the workforce at the federal banking agencies. The cumulative impact of these changes, and whether they will last over time, is unclear.

Huntington and the Bank each qualify as a Category IV banking organization as of December 31, 2025, which is subject to the least restrictive of the requirements among the categories, because Huntington has $100 billion or more, and less than $250 billion, in total consolidated assets and does not exceed certain risk-based thresholds. If Huntington were to exceed $250 billion in total consolidated assets when averaged over the four most recent consecutive quarters and not exceed certain risk-based thresholds, Huntington and the Bank would each qualify as a Category III banking organization, which is subject to additional requirements. Huntington’s acquisition of Cadence results in Huntington’s total consolidated assets exceeding $250 billion at closing and is expected to cause Huntington’s total average consolidated assets to exceed $250 billion in the fourth quarter of 2026, causing Huntington and the Bank to become subject to the standards applicable to Category III banking organizations, following a transition period.

Our business remains subject to extensive regulation and supervision, and the U.S. banking agencies may issue additional rules to tailor the application of certain other regulatory requirements to BHCs and banks, including Huntington and the Bank.

We are also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, both as administered by the SEC, as well as the rules of Nasdaq that apply to companies with securities listed on the Nasdaq Global Select Market.

The following discussion describes certain elements of the comprehensive regulatory framework applicable to us. This discussion is not intended to describe all laws and regulations applicable to Huntington, the Bank, and Huntington’s other subsidiaries.

Supervision, Examination, and Enforcement

Huntington is a BHC under the BHC Act that has elected to be an FHC. FHCs may engage in, and be affiliated with, companies engaging in a broader range of activities than those permitted for a BHC, so long as such activities are (i) financial in nature or incidental to such financial activity or (ii) complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of a depository institution or to the financial system generally. These activities include, for example, securities underwriting, securities dealing, making a market in securities, making merchant banking investments in non-financial companies, and engaging in insurance underwriting and agency activities. To become and remain eligible for FHC status, a BHC and its subsidiary depository institutions must meet certain criteria, including capital, management, and CRA requirements. Failure to meet such criteria could result, depending on which requirements were not met, in restrictions on new financial activities or acquisitions, or in being required to discontinue existing activities that are not generally permissible for BHCs.

Huntington is subject to primary supervision, regulation, and examination by the Federal Reserve, which serves as the primary regulator of our consolidated organization. The primary regulators of our non-bank subsidiaries directly regulate the activities of those subsidiaries, with the Federal Reserve exercising a supervisory role. Such non-bank subsidiaries include, for example, broker-dealers and investment advisers both registered with the SEC.

2025 Form 10-K 11

The Bank is a national banking association chartered under the laws of the U.S. As a national bank, the activities of the Bank are limited to those specifically authorized under the National Bank Act and OCC regulations. The Bank is subject to comprehensive primary supervision, regulation, and examination by the OCC. As a member of the DIF, the Bank is also subject to regulation and examination by the FDIC.

A principal objective of the U.S. bank regulatory regime is to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole, by ensuring the financial safety and soundness of BHCs and banks, including Huntington and the Bank. Bank regulators regularly examine the operations of BHCs and banks. In addition, BHCs and banks are subject to periodic reporting and filing requirements.

The Federal Reserve, OCC, and FDIC have broad supervisory and enforcement authority with regard to BHCs and banks, including the power to conduct examinations and investigations, impose nonpublic supervisory agreements, issue cease and desist orders, impose fines and other civil and criminal penalties, terminate deposit insurance, and appoint a conservator or receiver. In addition, Huntington, the Bank, and other Huntington subsidiaries are subject to supervision, regulation, and examination by the CFPB, which is the primary administrator of most federal consumer financial statutes and Huntington’s primary consumer financial regulator. Supervision and examinations are confidential, and the outcomes of these actions may not be made public.

Bank regulators have various remedies available if they determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of a banking organization’s operations are unsatisfactory. The regulators may also take action if they determine that the banking organization or its management is violating or has violated any law or regulation. The regulators have the power to, among other things, (1) prohibit unsafe or unsound practices, (2) require affirmative actions to correct any violation or practice, (3) issue administrative orders that can be judicially enforced, (4) direct increases in capital, (5) direct the sale of subsidiaries or other assets, (6) limit dividends and distributions, (7) restrict growth, (8) assess civil monetary penalties, (9) remove officers and directors, and (10) terminate deposit insurance.

Engaging in unsafe or unsound practices or failing to comply with applicable laws, regulations, and supervisory agreements could subject the Company, its subsidiaries, and their respective officers, directors, and institution-affiliated parties to the remedies described above, and other sanctions. In addition, the FDIC may terminate a bank’s deposit insurance upon a finding that the bank’s financial condition is unsafe or unsound or that the bank has engaged in unsafe or unsound practices or has violated an applicable rule, regulation, order, or condition enacted or imposed by the bank’s regulatory agency.

Huntington is subject to the Federal Reserve’s LFI Rating System, which places a greater emphasis on capital and liquidity, including related planning and risk management practices, as compared to the supervisory rating system applicable to smaller BHCs. These ratings are confidential. The LFI Rating System includes three components: capital planning and positions, liquidity risk management and positions, and governance and controls, and each component has four potential ratings: broadly meets expectations, conditionally meets expectations, deficient-1, or deficient-2.

In November 2025, the Federal Reserve adopted a final notice to revise its LFI Rating System for large BHCs with total consolidated assets of $100 billion or more. The Federal Reserve’s LFI Rating System prior to the notice provided that any firm that had one or more deficient-1 ratings was not considered “well managed.” The final notice amended the LFI Rating System by considering a firm with no more than one deficient-1 rating to be “well managed.” Firms that do not meet this standard, as well as firms with a deficient-2 rating for any component, would not be deemed “well managed” and would face limitations on certain acquisitions and new activities.

Bank Acquisitions by Huntington

BHCs, such as Huntington, must obtain prior approval of the Federal Reserve in connection with any acquisition that results in the BHC owning or controlling 5% or more of any class of voting securities of a bank or another BHC.

The standards by which bank and financial institution acquisitions would be evaluated may be subject to change. In September 2024, the OCC adopted a final rule and policy statement regarding its review of Bank Merger Act applications for OCC-supervised institutions, including the Bank. In May 2025, the OCC adopted a final rule that restored the ability for Bank Merger Act applicants to file a streamlined application form for certain types of acquisitions and the expedited review process for Bank Merger Act applications, which had been removed by the 2024 final rule, and rescinded the 2024 policy statement.

12 Huntington Bancshares Incorporated

In September 2024, the DOJ withdrew its 1995 Bank Merger Guidelines and issued the 2024 Banking Addendum. The DOJ clarified that it will assess competition considerations in connection with bank and BHC mergers using its 2023 Merger Guidelines, which is the general merger review framework the DOJ now uses to evaluate transactions in all segments of the economy, and the 2024 Banking Addendum. The 2024 Banking Addendum provides guidance on how the DOJ will assess competition in the context of bank and BHC mergers. An analysis under the 2023 Merger Guidelines and 2024 Banking Addendum may include consideration of theories of harm and relevant markets not considered under the 1995 Bank Merger Guidelines, which focused primarily on concentrations of deposits and branches.

Acquisitions of Ownership of the Company

Acquisitions of Huntington’s voting stock above certain thresholds are subject to prior regulatory notice or approval under federal banking laws, including the BHC Act and the Change in Bank Control Act of 1978. Under the Change in Bank Control Act, a person or entity generally must provide prior notice to the Federal Reserve before acquiring the power to vote 10% or more of our outstanding common stock. Investors should be aware of these requirements when acquiring shares in our stock.

Interstate Banking

Under the Riegle-Neal Act, a BHC may acquire banks in states other than its home state, subject to any state requirement that the bank has been organized and operating for a minimum period of time, not to exceed five years, and the requirement that the BHC not control, prior to or following the proposed acquisition, more than 10% of the total amount of deposits of insured depository institutions nationwide or, unless the acquisition is the BHC’s initial entry into the state, more than 30% of such deposits in the state (or such lesser or greater amount set by the state). The Riegle-Neal Act also authorizes banks to merge across state lines, thereby creating interstate branches. A national bank, such as the Bank, with the approval of the OCC may open a branch in any state if the law of that state would permit a state bank chartered in that state to establish the branch.

Enhanced Prudential Standards

BHCs with consolidated assets of more than $100 billion, such as Huntington, are currently subject to certain enhanced prudential standards. As a result, Huntington is subject to more stringent standards, including liquidity and capital requirements, leverage limits, stress testing, resolution planning, and risk management standards, than those applicable to institutions with less than $100 billion in total consolidated assets. Huntington is a Category IV banking organization and therefore is subject to the least restrictive enhanced prudential standards applicable to firms with $100 billion or more in total consolidated assets. Once Huntington exceeds $250 billion in total average consolidated assets, including following consummating the acquisition of Cadence, and not exceed certain risk-based thresholds, Huntington and the Bank will each qualify as a Category III banking organization and become subject to additional enhanced prudential standards, such as limitations on Huntington’s aggregate net credit exposures to any single, unaffiliated company (referred to as SCCL).

Liquidity Requirements

Huntington and the Bank, as Category IV banking organizations with less than $50 billion in weighted short-term wholesale funding, are exempt from the LCR and NSFR requirements.

The LCR would require each of Huntington and the Bank to hold an amount of eligible HQLA that equals or exceeds 100% of its respective projected adjusted net cash outflows over a 30-day period. The LCR would require each of Huntington and the Bank to calculate its respective LCR daily. When Huntington becomes a Category III institution with less than $75 billion in weighted average short-term wholesale funding, Huntington’s and the Bank’s total net cash outflows will be multiplied by an outflow adjustment percentage of 85%. In addition, Huntington will also be required to make quarterly public disclosures of its LCR and certain related quantitative liquidity metrics, along with a qualitative discussion of its LCR.

2025 Form 10-K 13

The NSFR would require each of Huntington and the Bank to maintain an amount of available stable funding, which is a weighted measure of a company’s funding sources over a one-year time horizon, calculated by applying standardized weightings to equity and liabilities based on their expected stability, that is no less than a specified percentage of its required stable funding, which is calculated by applying standardized weightings to assets, derivatives exposures, and certain other items based on their liquidity characteristics. When Huntington becomes a Category III institution with less than $75 billion in weighted average short-term wholesale funding, Huntington and the Bank will be each required to maintain available stable funding in an amount at least equal to 85% of its required stable funding. In addition, Huntington will be required to make public disclosures of its NSFR every second and fourth quarter, including certain quantitative metrics and a qualitative discussion of its NSFR drivers and results.

As a Category IV banking organization, Huntington is subject to internal liquidity stress tests and standards. When Huntington becomes a Category III banking organization, Huntington will continue to be subject to internal liquidity stress tests and standards to which Category IV banking organizations are subject, but the frequency of its liquidity stress tests will change from a quarterly basis to a monthly basis.

Long-term Debt Requirements

In August 2023, the U.S. banking agencies issued a proposed rule that would require certain large banking organizations such as Huntington to comply with long-term debt requirements and “clean holding company requirements” similar to those that currently only apply to U.S. global systemically important banking organizations. This proposal would also impose a long-term debt requirement on certain categories of insured depository institutions that are not consolidated subsidiaries of U.S. global systematically important banking organizations, including insured depository institutions with $100 billion or more in total assets, such as the Bank. If adopted, this proposal would require Huntington and the Bank to each maintain a minimum outstanding eligible long-term debt amount of no less than the greater of (i) 6% of total risk-weighted assets, (ii) 2.5% of total leverage exposure (if subject to the supplementary leverage ratio), or (iii) 3.5% of average total consolidated assets. To comply with the requirement, the Bank would be required to issue the minimum amount of eligible long-term debt to Huntington, and Huntington would be required to issue the minimum amount of eligible long-term debt externally. The proposal allows banking organizations to include, as part of the required minimum outstanding eligible long-term debt amounts, certain existing long-term debt. If the rule is finalized as proposed, covered institutions would have three years to comply with the new requirements following a phased-in approach, with 25% of the long-term debt requirement by one year after finalization of the rule, 50% after two years, and 100% after three years.

In addition, if adopted as proposed, the “clean holding company requirements” would limit or prohibit Huntington from entering into certain transactions that could impede its orderly resolution, including, for example, prohibiting Huntington from entering into transactions that could spread losses to subsidiaries and third parties, as well as limiting the amount of the Company’s liabilities that are not eligible long-term debt. The timing and form of any final rule implementing the long-term debt requirements and clean holding company requirements remains uncertain.

14 Huntington Bancshares Incorporated

Regulatory Capital Requirements

Huntington and the Bank are subject to certain risk-based capital and leverage ratio requirements under the U.S. Basel III capital rules adopted by the Federal Reserve, for Huntington, and by the OCC, for the Bank. These quantitative calculations are minimums, and the Federal Reserve and OCC may determine that a banking organization, based on its size, complexity, or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Under the U.S. Basel III capital rules, Huntington’s and the Bank’s assets, exposures, and certain off-balance sheet items are subject to risk weights used to determine the institutions’ risk-weighted assets. These risk-weighted assets are used to calculate the following minimum capital ratios for Huntington and the Bank:

•CET1 Risk-Based Capital Ratio, equal to the ratio of CET1 capital to risk-weighted assets. CET1 capital primarily includes common shareholders’ equity subject to certain regulatory adjustments and deductions, including goodwill, intangible assets, certain deferred tax assets, and AOCI.

•Tier 1 Risk-Based Capital Ratio, equal to the ratio of Tier 1 capital to risk-weighted assets. Tier 1 capital is primarily comprised of CET1 capital, perpetual preferred stock, and certain qualifying capital instruments.

•Total Risk-Based Capital Ratio, equal to the ratio of total capital, including CET1 capital, Tier 1 capital, and Tier 2 capital, to risk-weighted assets. Tier 2 capital primarily includes qualifying subordinated debt and qualifying ALLL. Tier 2 capital also includes, among other things, certain trust preferred securities.

•Tier 1 Leverage Ratio, equal to the ratio of Tier 1 capital to quarterly average assets (net of goodwill, certain other intangible assets, and certain other deductions).

In addition, when Huntington and the Bank become Category III banking organizations, they will become subject to the Supplementary Leverage Ratio, which is equal to the ratio of Tier 1 capital to total leverage exposure, including on-balance sheet assets as well as certain off-balance sheet items, including loan commitments and potential future exposure of derivative contracts.

The total minimum regulatory capital ratios and well-capitalized minimum ratios are reflected in the table below in this section. The Federal Reserve has not yet revised the well-capitalized standard for BHCs to reflect the higher capital requirements imposed under the U.S. Basel III capital rules. For purposes of the Federal Reserve’s Regulation Y, including determining whether a BHC meets the requirements to be an FHC, BHCs, such as Huntington, must maintain a Tier 1 Risk-Based Capital Ratio of 6.0% or greater and a Total Risk-Based Capital Ratio of 10.0% or greater. If the Federal Reserve were to apply the same or a very similar well-capitalized standard to BHCs as that applicable to the Bank, Huntington’s capital ratios as of December 31, 2025, would exceed such revised well-capitalized standard. The Federal Reserve may require BHCs, including Huntington, to maintain capital ratios substantially in excess of mandated minimum levels, depending upon general economic conditions and a BHC’s particular condition, risk profile, and growth plans.

Failure to be well-capitalized or to meet minimum capital requirements could result in certain mandatory and possible additional discretionary actions by regulators that, if undertaken, could have an adverse material effect on our operations or financial condition. Failure to be well-capitalized or to meet minimum capital requirements could also result in restrictions on Huntington’s or the Bank’s ability to pay dividends or otherwise distribute capital or to receive regulatory approval of applications.

In addition to meeting the minimum capital requirements under the U.S. Basel III capital rules, Huntington and the Bank must maintain the applicable capital buffer (SCB and CCB, respectively) requirements to avoid becoming subject to restrictions on capital distributions and certain discretionary bonus payments to management. Huntington and the Bank are subject to a SCB of 2.5%. Refer to the SCB Requirements section below for further details. The Tier 1 Leverage Ratio is not impacted by the SCB or CCB, and a banking institution may be considered well-capitalized while remaining out of compliance with the SCB or CCB. Further, when Huntington and the Bank become Category III banking organizations, each will become subject to the CCyB. The CCyB is currently set at zero, but could increase up to 2.5%. Any determination to increase the CCyB generally would be effective twelve months after the announcement of such an increase, unless the federal banking agencies set an earlier effective date.

2025 Form 10-K 15

The following table presents the minimum regulatory capital ratios, minimum ratio plus the capital buffer, and well-capitalized minimums compared with Huntington’s and the Bank’s regulatory capital ratios as of December 31, 2025, calculated using the regulatory capital methodology applicable as of the end of 2025.

(1) Reflects a SCB of 2.5% for both Huntington and the Bank.

(2) Reflects the well-capitalized standard applicable to Huntington under Federal Reserve Regulation Y and the well-capitalized standard applicable to the Bank.

Huntington has the ability to provide additional capital to the Bank to maintain the Bank’s risk-based capital ratios at levels that would be considered well-capitalized.

As of December 31, 2025, Huntington’s and the Bank’s regulatory capital ratios were above the well-capitalized standards and met the applicable capital buffer requirements.

Basel III Endgame Proposal

In July 2023, the U.S. banking agencies issued a proposed rule to implement the Basel III endgame agreement for large banks (2023 Basel III Endgame Proposal). The proposal was aimed at significantly increasing capital requirements for large banks, particularly in the US, by mandating them to hold more capital against potential risks like credit, market, and operational risks.

The Federal Reserve announced that it would publish a re-proposal of its regulations to implement the Basel III endgame agreement. It is uncertain if and when a final rule will be adopted, and if so, whether and to what extent it will differ from the 2023 Basel III Endgame Proposal. As a result, the timing and content of any final rule, and the potential effects of any final rule on Huntington and the Bank, remain uncertain.

Capital Planning and Stress Testing

Huntington is required to develop, maintain, and submit to the Federal Reserve a capital plan every year, which is subject to supervisory review in connection with the Federal Reserve’s CCAR process. Huntington is required to include within its capital plan an assessment of the expected uses and sources of capital and a description of all planned capital actions over a nine-quarter planning horizon, a detailed description of the process for assessing capital adequacy, its capital policy, and a discussion of any expected changes to its business plan that are likely to have a material impact on its capital adequacy. Under the stress buffer requirements, the CCAR process is used to determine a BHC’s SCB requirement. Please refer to the SCB Requirements section below for further details.

16 Huntington Bancshares Incorporated

The Federal Reserve expects BHCs subject to CCAR, such as Huntington, to have sufficient capital to withstand a highly adverse operating environment and to be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and serve as credit intermediaries. In addition, the Federal Reserve evaluates the planned capital actions of these BHCs, including planned capital distributions such as dividend payments or stock repurchases. This involves a quantitative assessment of capital based on supervisory-run stress tests that assess the ability to maintain capital levels above certain minimum ratios, after taking into consideration all capital actions included in a BHC’s capital plan, under baseline and stressful conditions throughout the nine-quarter planning horizon. As part of CCAR, the Federal Reserve evaluates whether BHCs have sufficient capital to continue operations throughout times of economic and financial market stress and whether they have robust, forward-looking capital planning processes that account for their unique risks. We are generally prohibited from making a capital distribution unless, after giving effect to the distribution, we will meet all minimum regulatory capital ratios. Huntington may increase certain types of capital distributions in excess of the amount included in its capital plan without seeking prior approval from the Federal Reserve as long as it otherwise complies with the automatic restrictions on distributions under the Federal Reserve’s capital rules.

Although the Federal Reserve is no longer allowed to object to the capital plan of a large and non-complex BHC, such as Huntington, on a qualitative, as opposed to quantitative, basis, the Federal Reserve may evaluate the strength of Huntington’s qualitative capital planning process through the regular supervisory process and targeted horizontal reviews of particular aspects of capital planning.

In October 2025, the Federal Reserve proposed revisions to its supervisory stress testing framework through two related proposals. The first proposal would modify the timeline and operation of the annual supervisory stress test, including through revisions to the Federal Reserve’s supervisory stress testing policy statements, and solicits comment on the Federal Reserve’s supervisory stress testing models. The second proposal solicits comment on the Federal Reserve’s proposed scenarios for the 2026 supervisory stress test.

When Huntington and the Bank become Category III banking organizations, each would become required to conduct its own company-run stress test and to publicly disclose the results on a biennial basis.

SCB Requirements

For risk-based capital requirements, Huntington, as a large BHC, is provided an SCB by the Federal Reserve that is determined annually based on the greater of (i) the difference between its starting and minimum projected CET1 Risk-Based Capital Ratio under the severely adverse scenario in the supervisory-run stress test, plus the sum of the dollar amount of Huntington’s planned common stock dividends for each of the fourth through seventh quarters of the planning horizon as a percentage of risk-weighted assets, or (ii) 2.5%. Huntington’s SCB requirement is 2.5%. Huntington submitted its 2025 Capital Plan to the Federal Reserve for supervisory review, as required by the April 5, 2025 deadline. The Federal Reserve informed Huntington that, effective October 1, 2025, its SCB requirement associated with its 2025 Capital Plan is the prescribed minimum SCB of 2.5%, the same SCB requirement Huntington received in 2024. As a Category IV banking organization, Huntington is subject to the Federal Reserve’s supervisory-run stress test on a biennial basis. Although Huntington was not subject to, and did not elect to participate in, the Federal Reserve’s 2025 supervisory-run stress test, its SCB was reviewed for the dividend add-on component of the SCB but its SCB did not change. When Huntington becomes a Category III banking organization, the frequency of being required to participate in the Federal Reserve’s supervisory-run stress test would change from a biennial basis to an annual basis.

Huntington is authorized to make capital distributions that are consistent with the requirements in the Federal Reserve’s capital rule, inclusive of the SCB requirement. Provided that Huntington is otherwise in compliance with automatic restrictions on distributions under the Federal Reserve’s capital rules, Huntington is not required to seek prior approval to make capital distributions in excess of those included in its capital plan.

In April 2025, the Federal Reserve issued a notice of proposed rulemaking to amend its capital planning and stress testing framework applicable to large banking organizations, including Huntington. The proposal would average stress test results over two consecutive years to reduce volatility in the SCB requirement that results from the stress test. The proposal would also modify the annual effective date of the SCB requirement from October 1 to January 1 of the following year to provide banking organizations with additional time to incorporate the results of the stress test into capital planning and management.

2025 Form 10-K 17

Restrictions on Dividends

Huntington is a legal entity separate and distinct from its banking and non-banking subsidiaries. Since our consolidated net income consists largely of net income of Huntington’s subsidiaries, our ability to make capital distributions, including paying dividends and repurchasing shares, depends upon our receipt of dividends from these subsidiaries. Under federal law, there are various limitations on the extent to which the Bank can declare and pay dividends to Huntington, including those related to regulatory capital requirements, general regulatory oversight to prevent unsafe or unsound practices, and federal banking law requirements concerning the payment of dividends out of net profits, surplus, and available earnings. Certain contractual restrictions also may limit the ability of the Bank to pay dividends to Huntington. No assurances can be given that the Bank will, in any circumstances, pay dividends to Huntington.

Huntington’s ability to declare and pay dividends to our shareholders is similarly limited by federal banking law and Federal Reserve regulations and policy. As discussed in the Capital Planning section above, in general, a BHC may pay dividends and repurchase stock only in accordance with a capital plan that has been reviewed by the Federal Reserve and as to which the Federal Reserve has not objected. Additionally, all of Huntington’s preferred stock outstanding has preference over its common stock with respect to payment of dividends.

Huntington and the Bank must maintain the applicable capital buffer requirements to avoid becoming subject to restrictions on capital distributions, including dividends. For more information on the capital buffer requirements, see the SCB Requirements and the Regulatory Capital Requirements sections above.

The Federal Reserve has indicated generally that it may be an unsafe or unsound practice for a BHC to pay dividends unless its net income is sufficient to fund the dividends and its expected rate of earnings retention is consistent with its capital needs, asset quality, and overall financial condition. The Federal Reserve could prohibit or limit the payment of dividends by a BHC if it determines that payment of the dividend would constitute an unsafe or unsound practice.

Volcker Rule

Under the Volcker Rule, we are prohibited from (1) engaging in short-term proprietary trading for our own account and (2) having certain ownership interests in and relationships with hedge funds or private equity funds (covered funds). The Volcker Rule regulations contain exemptions for market-making, hedging, underwriting, and trading in U.S. government and agency obligations, as well as permit certain ownership interests in certain types of covered funds to be retained. They also permit the offering and sponsoring of covered funds under certain conditions. The Volcker Rule regulations impose significant compliance and reporting obligations on banking entities, such as Huntington. We have put in place the compliance programs required by the Volcker Rule, and any holdings in illiquid covered funds are in compliance with the Volcker Rule.

Resolution Planning

Huntington does not exceed $250 billion total average consolidated assets, therefore, Huntington is not required to submit a 165(d) Resolution Plan to the Federal Reserve and the FDIC. Once Huntington exceeds $250 billion in total average consolidated assets, Huntington will be required to submit to the Federal Reserve and the FDIC every three years a 165(d) Resolution Plan for its orderly resolution in the event it faces material financial distress or failure, with submissions alternating between a full resolution plan and a targeted resolution plan. Following review of a plan, the Federal Reserve and the FDIC may jointly determine that a 165(d) Resolution Plan is not credible or would not facilitate an orderly resolution under the U.S. Bankruptcy Code. If Huntington were to fail to adequately address deficiencies jointly identified by the Federal Reserve and FDIC in a timely manner, it may be subject to more stringent capital, leverage, or liquidity requirements, or restrictions on growth, activities, or operations.

18 Huntington Bancshares Incorporated

As an insured depository institution, the Bank is required to file its own resolution plan with the FDIC. In June 2024, the FDIC adopted a final rule to modify the required frequency and informational content of IDI Resolution Plans, which are applicable to insured depository institutions with $50 billion or more in total assets, including the Bank, and describe the insured depository institution’s strategy for a rapid and orderly resolution in the event of material financial distress or failure. As a result of the final rule, the Bank will be required to submit to the FDIC full IDI Resolution Plans every three years and interim targeted information between full resolution plan submissions. In addition, the final rule introduced a credibility standard that will be used to evaluate full IDI Resolution Plan submissions. If the FDIC finds an IDI Resolution Plan to be not credible, it could subject the insured depository institution to an enforcement action. The Bank submitted its first full IDI Resolution Plan under the final rule on July 1, 2025. The Bank will submit an interim supplement in 2026.

Source of Strength

Huntington is required to serve as a source of financial and managerial strength to the Bank and, under appropriate conditions, to commit resources to support the Bank. This support may be required by the Federal Reserve at times when we might otherwise determine not to provide it or when doing so is not otherwise in the interests of Huntington or our shareholders or creditors. The Federal Reserve may require a BHC to make capital injections into a troubled subsidiary bank and may charge the BHC with engaging in unsafe and unsound practices if the BHC fails to commit resources to such a subsidiary bank or if it undertakes actions that the Federal Reserve believes might jeopardize the BHC’s ability to commit resources to such subsidiary bank.

Under these requirements, Huntington may in the future be required to provide financial assistance to the Bank should it experience financial distress. Capital loans by Huntington to the Bank would be subordinate in right of payment to deposits and certain other debts of the Bank. In the event of Huntington’s bankruptcy, any commitment by Huntington to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee and entitled to a priority of payment.

FDIC as Receiver or Conservator of Huntington

Upon the insolvency of an insured depository institution, such as the Bank, the FDIC may be appointed as the conservator or receiver of the institution. Under the Orderly Liquidation Authority, upon the insolvency of a BHC, such as Huntington, the FDIC may be appointed as conservator or receiver of the BHC, if certain findings are made by the FDIC, the Federal Reserve, and the Secretary of the Treasury, in consultation with the President. Acting as a conservator or receiver, the FDIC would have broad powers to transfer any assets or liabilities of the institution without the approval of the institution’s creditors.

Depositor Preference

The FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, including the Bank, the claims of depositors of the institution (including the claims of the FDIC as subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver would have priority over other general unsecured claims against the institution. If the Bank were to fail, insured and uninsured depositors, along with the FDIC, would have priority in payment ahead of unsecured, non-deposit creditors, including Huntington, with respect to any extensions of credit they have made to such insured depository institution.

Transactions between a Bank and its Affiliates

Federal banking laws and regulations impose qualitative standards and quantitative limitations upon certain transactions between a bank and its affiliates, including between a bank and its holding company and companies that the BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on arm’s-length terms and cannot exceed certain amounts which are determined with reference to the Bank’s regulatory capital. Moreover, if the transaction is a loan or other extension of credit, it must be secured by collateral in an amount and quality expressly prescribed by statute, and if the affiliate is unable to pledge sufficient collateral, the BHC may be required to provide it. The coverage and scope of these requirements apply to the credit exposure arising under derivative transactions, repurchase and reverse repurchase agreements, and securities borrowing and lending transactions. Federal banking laws also place similar restrictions on loans and other extensions of credit by FDIC-insured banks, such as the Bank, and their subsidiaries to their directors, executive officers, and principal shareholders.

2025 Form 10-K 19

Lending Standards and Guidance

The federal bank regulatory agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all insured depository institutions, such as the Bank, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures, and documentation, approval, and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulatory agencies’ Interagency Guidelines for Real Estate Lending Policies.

Heightened Governance and Risk Management Standards

The OCC has published guidelines to set expectations for the governance and risk management practices of national banks with total assets equal to or greater than $50 billion, including the Bank. The guidelines require covered institutions to establish and adhere to a written governance framework in order to manage and control their risk-taking activities. In addition, the guidelines provide standards for the institutions’ boards of directors to oversee the risk governance framework. As discussed in the “Risk Management and Capital” section of the MD&A, the Bank currently has a written governance framework and associated controls.

On December 23, 2025, the OCC issued a notice of proposed rulemaking that would increase the threshold at which the heightened standards apply from $50 billion to $700 billion in total assets. If finalized as proposed, the Bank would no longer be subject to the OCC's heightened standards unless the OCC made a determination to apply some or all of the heightened standards to the Bank.

Anti-Money Laundering

The Bank Secrecy Act, as amended by the Patriot Act and Anti-Money Laundering Act of 2020, contains anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act requires financial institutions such as depository institutions to undertake activities, including maintaining an AML program, verifying the identity of customers, verifying the identity of certain beneficial owners for legal entity customers, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies. The Bank is subject to the Bank Secrecy Act and, therefore, is required to implement compliance policies, procedures, and internal controls, provide its employees with AML training, designate an AML compliance officer, and undergo periodic independent auditing and testing to assess the effectiveness of its AML program, among other requirements. The Bank has implemented an AML compliance program, including policies, procedures, and internal controls that are designed to comply with these AML requirements. Bank regulators continue to focus their examinations on AML compliance, and we will continue to monitor and augment, where necessary, our AML compliance programs, including the Bank’s. The federal banking agencies are required, when reviewing bank and BHC acquisition or merger applications, to take into account the effectiveness of the AML activities of the applicant.

The Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act, requires the U.S. Treasury to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, and conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping, and reporting requirements that the Bank Secrecy Act imposes on banks. The Anti-Money Laundering Act of 2020 also contains provisions that promote increased information-sharing and use of technology and increases penalties for violations of the Bank Secrecy Act and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.

20 Huntington Bancshares Incorporated

OFAC Regulation

OFAC is the primary U.S. regulatory authority responsible for administering economic sanctions that affect transactions with designated foreign countries and territories, nationals, and others, as defined by various Executive Orders and in various legislation. OFAC-administered sanctions take many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned country or territory, including prohibitions against direct or indirect imports from and exports to a sanctioned country or territory, and prohibitions on U.S. persons engaging in financial transactions relating to making investments in, or providing investment-related advice or assistance to, a sanctioned country or territory; and (2) a blocking of assets in which the government or “specially designated nationals” of the sanctioned country or territory, or other sanctioned individuals or entities, have an interest by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. OFAC also publishes lists of blocked or designated persons, organizations, and entities, including the Specially Designated Nationals and Blocked Persons List. Blocked assets, for example property and bank deposits, cannot be paid out, withdrawn, set off, or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences. Other jurisdictions and multilateral bodies also administer and impose sanctions.

Cybersecurity and Data Privacy

Federal and state legislation and regulations contain extensive cybersecurity and data privacy provisions. Our regulatory agencies including the CFPB, FDIC, Federal Reserve, and OCC also have oversight over us, the Bank, and our subsidiaries with respect to cybersecurity and data privacy. Huntington and its subsidiaries are subject to the rules and regulations promulgated under the authority of the CFPB and Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to cybersecurity and data privacy. Further, the GLBA, and its regulations such as Regulation P and Regulation S-P, require financial institutions to disclose their data privacy policies and practices relating to sharing personal information and enables retail customers to opt out of our ability to share their personal information with unaffiliated third parties under certain circumstances. The GLBA and its regulations require financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. An amendment to Regulation S-P, was adopted by the SEC on May 16, 2024 and requires registered investment advisers and broker-dealers to, among other things, adopt and implement an incident response program as part of their formal cybersecurity policies and procedures and report data breaches to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization within 30 days of becoming aware of such data breach. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means. Moreover, the U.S. Congress has recently considered, and will likely in the future consider, various proposals for more comprehensive cybersecurity and data privacy legislation, to which we may be subject if passed.

Like other lenders, the Bank and other of our subsidiaries also use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on us and our subsidiaries.

2025 Form 10-K 21

The CISA is intended to improve cybersecurity in the U.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions, and empowers the CISA Agency to oversee this information-sharing process. The CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks or other information or security breaches. The law includes liability protections for companies that share cyber-threat information with third parties so long as such sharing activity is conducted in accordance with the CISA. Although the CISA originally expired on September 30, 2025 and was temporarily reauthorized to remain in effect through January 30, 2026, the long-term status of the CISA remains uncertain pending further action by the U.S. Congress. In addition, the enactment of the CIRCIA in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the CISA Agency within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA Agency proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators. Although the CIRCIA originally required the CISA Agency to finalize its regulations by October 4, 2025, the CISA Agency has extended such deadline to May 2026.

In addition, the Federal Reserve, OCC, and FDIC require, among other things, a banking organization to notify its primary federal regulator as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith could materially disrupt, degrade, or impair its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit, or franchise value, or pose a threat to the stability of the U.S. financial sector.

Cybersecurity and data privacy are also areas of increasing state legislative focus. For example, under California state law, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation and includes a private right of action (permitting lawsuits to be brought by private individuals instead of the state Attorney General or other government actor for certain breaches). Numerous other states have enacted, or are considering enacting, comprehensive data privacy laws that share similarities with the CCPA. In addition, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.

Our cybersecurity and data privacy policies and procedures for the protection of personal information are in effect across all businesses and geographic locations as applicable. See Item 1 C: Cybersecurity for a discussion of our cybersecurity risk management and strategy and cybersecurity governance framework.

FDIC Insurance

The DIF provides insurance coverage for certain deposits, up to a standard maximum deposit insurance amount of $250,000 per depositor, and is funded through assessments on insured depository institutions, based on the risk each institution poses to the DIF. The Bank accepts customer deposits that are insured by the DIF and, therefore, must pay insurance premiums. The FDIC may increase the Bank’s insurance premiums based on various factors, including the FDIC’s assessment of its risk profile.

The FDIC also requires large insured depository institutions, including the Bank, to maintain enhanced deposit account recordkeeping and related information technology system capabilities to facilitate prompt payment of insured deposits if such an institution were to fail.

22 Huntington Bancshares Incorporated

The FDIC, as required under the FDIA, established a plan on September 15, 2020, to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. This plan did not include an increase in the deposit insurance assessment rate. Based on the FDIC’s recent projections, however, the FDIC determined that the DIF reserve ratio is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates. In October 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning on January 1, 2023. The FDIC also concurrently maintained the Designated Reserve Ratio for the DIF at 2%.

In November 2023, the FDIC issued a final rule to implement a special assessment to recoup losses to the DIF associated with bank failures in the first half of 2023. Under the final rule, the assessment base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion of uninsured deposits. On December 16, 2025, the FDIC issued an interim final rule providing that the FDIC will collect the special assessment over an initial seven quarters of the collection period, which began in the second quarter of 2024, at a quarterly rate of 3.36 basis points, and reduce the rate which the special assessment will be collected in the eighth collection quarter, which will have an invoice payment date of March 30, 2026, to 2.97 basis points. Under the interim final rule, upon termination of the FDIC’s receiverships of Silicon Valley Bank and Signature Bank, the FDIC will either provide an offset to insured depository institutions, if the special assessment amount then-collected exceeds losses, or collect from insured depository institutions a one-time final shortfall special assessment, if losses exceed the special assessment amount then-collected. In addition, the FDIC will provide an offset to regular quarterly deposit insurance assessments for banks subject to the special assessment if, following the final resolution of litigation between the FDIC and SVB Financial Trust, the total amount collected through the special assessment exceeds the loss estimate at that time.

Compensation

Our compensation practices are subject to oversight by the Federal Reserve and, with respect to some of our subsidiaries and employees, by other financial regulatory bodies. The scope and content of compensation regulation in the financial industry are continuing to develop, and we expect that these regulations and resulting market practices will continue to evolve over a number of years.

The federal bank regulatory agencies have issued joint guidance on executive compensation designed to ensure that the incentive compensation policies of banking organizations, such as Huntington and the Bank, do not encourage imprudent risk taking and are consistent with the safety and soundness of the organization. The SEC has a rule that directs stock exchanges to require listed companies to implement clawback policies to recover incentive-based compensation from current or former executive officers in the event of certain financial restatements and requires companies to disclose their clawback policies and their actions under those policies.

Community Reinvestment Act

The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and soundness practices. The relevant federal bank regulatory agency, the OCC in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report.

The CRA requires the relevant federal bank regulatory agency to consider a bank’s CRA assessment when considering the bank’s application to conduct certain mergers or acquisitions or to open or relocate a branch office. The Federal Reserve also must consider the CRA record of each subsidiary bank of a BHC in connection with any acquisition or merger application filed by the BHC. An unsatisfactory CRA record could substantially delay or result in the denial of an approval or application by Huntington or the Bank. The Bank received the highest possible overall CRA rating of “Outstanding” in its most recent examination.

In October 2023, the U.S. banking agencies issued a final rule to amend their regulations implementing the CRA. In July 2025, the federal banking agencies issued a notice of proposed rulemaking, which, if finalized, would rescind the CRA final rule issued in October 2023 and reinstate that CRA framework that existed prior to the issuance of that rule. Implementation of the October 2023 final rule, which was subject to an injunction and has not taken effect, would have materially changed the CRA framework, including imposing additional costs and changing how CRA performance would be assessed.

2025 Form 10-K 23

Debit Interchange Fees

We are subject to a statutory requirement that interchange fees for electronic debit transactions that are paid to or charged by payment card issuers, including the Bank, be reasonable and proportional to the cost incurred by the issuer. Interchange fees for electronic debit transactions are limited to 21 cents plus 0.05% of the transaction, plus an additional one cent per transaction fraud adjustment. These fees impose requirements regarding routing and exclusivity of electronic debit transactions. As an issuer with over $10 billion in assets, the Bank is subject to, and in compliance with, Regulation II, which requires, among other things, that debit card issuers should enable all debit card transactions, including card-not-present transactions such as online payments, to be processed on at least two unaffiliated payment card networks.

In October 2023, the Federal Reserve released a notice of proposed rulemaking that would lower the maximum interchange fee that a large debit card issuer can receive on a debit card transaction. Under the proposal, the Federal Reserve would set the components of the maximum interchange fee to amounts lower than those in the currently applicable Regulation II. In addition, the proposal would adopt an approach for future adjustments to the interchange fee cap, which would occur every other year based on issuer cost data gathered from large debit card issuers.

Consumer Protection Regulation and Supervision

We are subject to supervision and regulation by the CFPB with respect to federal consumer protection laws. We are also subject to certain state consumer protection laws, and under the Dodd-Frank Act, state attorneys general and other state officials are empowered to enforce certain federal consumer protection laws and regulations. State authorities have increased their focus on and enforcement of consumer protection rules. These federal and state consumer protection laws apply to a broad range of our activities and to various aspects of our business and include laws relating to interest rates, fair lending, disclosures of credit terms and estimated transaction costs to consumer borrowers, debt collection practices, the use of and the provision of information to consumer reporting agencies, and the prohibition of unfair, deceptive, or abusive acts or practices in connection with the offer, sale, or provision of consumer financial products and services.

In May 2025, President Trump signed a Congressional Review Act resolution that overturned the CFPB’s December 2024 final rule, which would have taken effect October 1, 2025 and imposed certain requirements on overdraft fees, similar to those that apply to credit cards, unless the financial institution limited the amount of overdraft fees to the higher of the amount of costs and losses to provide overdraft services or $5.00.