HUNTINGTON BANCSHARES INC /MD/

Risk Management Structure

Our risk management program is structured using three lines of defense, each of which is independent of the others:

•First-line consists of business segments engaged in activities designed to generate revenue or reduce expenses, provide operational support or technology services, or deliver products or services to customers.

•Second-line is Corporate Risk Management.

•Third-line consists of Internal Audit and Credit Review.

Segment Risk Officers are embedded in the first-line and report directly to business unit senior management and indirectly to the Chief Risk Officer. They identify and monitor risk, elevate and remediate issues, establish controls, perform testing, and oversee the self-assessment process. Second-line Corporate Risk Management oversees first-line risk-taking activity, establishes policies, sets operating limits, reviews new or modified products and processes, and is responsible for producing an independent assessment of the Company’s risk position relative to the Board’s risk appetite. Third-line Internal Audit and Credit Review provides additional assurance that risk-related functions are operating as intended.

Risk Governance and Risk Appetite

Our Risk Governance Framework and Risk Appetite Statement are foundational to the risk management program. The Risk Governance Framework defines the three lines of defense structure, roles, responsibilities, and requirements. The Risk Appetite Statement is approved by our Board and defines the level and types of risks we are willing to assume to achieve our corporate objectives through defined risk limits for the seven key risk categories to which we are exposed:

•Credit risk, which is risk of loss due to loan and lease customers or other counterparties not being able to meet their financial obligations under agreed-upon terms.

•Market risk, which includes interest rate and price risk. Interest rate risk is the risk to current or projected financial condition arising from movements in interest rates and considers reprice risk, basis risk, yield curve risk, and options risk. Price risk results from changes in the value of either trading portfolios or other obligations that are entered into as part of distributing risk, primarily associated with market making, dealing, and position taking in interest rate, foreign exchange, equity, commodities, and credit markets.

•Liquidity risk, which is the risk that financial condition or overall safety and soundness is adversely affected by an inability, or perceived inability, to meet obligations when they come due, and includes the inability to access funding sources, manage fluctuations in funding levels, or failure to recognize or address changes in market conditions that affect the Company’s ability to liquidate assets quickly and with minimal loss in value.

•Operational risk, which is the risk of loss and resilience arising from inadequate or failed internal processes, systems, models, data, human error or misconduct, or adverse external events. Operational losses can result from internal fraud, external fraud, inadequate or inappropriate employment practices and workplace safety, failure to meet obligations involving customers, products, and business practices, damage to physical assets, business disruption and systems failures, and failures in execution, delivery, and process management.

•Compliance risk, which is risk arising from violations of laws, rules or regulations, or from non-conformance with laws, regulations, prescribed practices, internal policies and procedures, or ethical standards, and can expose the Company to fines, civil money penalties, payment of damages, and voiding of contracts.

•Strategic risk, which is risk arising from adverse business decisions, poor implementation of business decisions, or lack of responsiveness to changes in the banking industry and operating environment, and is a function of the Company’s strategic goals, business strategies, resources, and quality of implementation.

•Reputation risk, which is risk arising from negative public opinion that may impair the Company’s competitiveness by affecting its ability to establish new relationships or services or continue servicing existing relationships.

2025 Form 10-K 61

The Board has defined our risk appetite as aggregate moderate-to-low on a through-the-cycle basis. While we engage in a limited amount of higher risk activity consistent with our strategic objectives, we ensure those positions are offset by lower risk positions. Our second-line Corporate Risk Management maintains and enforces risk limits established in our Risk Appetite Statement for each of our seven risk pillars, which helps ensure we achieve our aggregate moderate-to-low risk appetite objective.

We have a robust risk assessment process which includes qualitative and quantitative components that assess our inherent risk, control environment, and residual risk, and enables us to report to the Board if we are operating within the risk appetite. The process includes individual assessments from first-line business segments and independent second-line assessments for each risk pillar. These are combined to produce an overall Enterprise Risk Assessment that includes, among other things, top and emerging risks and a determination of whether the Company is operating within its risk appetite.

We have a broad range of controls that are factored into our assessments, including key controls, such as segregation of duties and access management, that are tested regularly. We also have robust authorization and reconciliation procedures, as well as staff education and a disciplined risk assessment process.

Board Oversight

While the Board has three committees that primarily oversee implementation of the risk governance framework and risk appetite, the Risk Oversight Committee, Audit Committee, and Technology Committee, the full Board is engaged in discussing risks and monitoring our risk profile. All committees report their deliberations and actions at each full Board meeting. In addition, all scheduled committee meetings are open to all members of the Board, and committees regularly meet in joint sessions to discuss issues that are broadly applicable. Our Board has unfettered access to senior executive officers, and the Board and committees regularly meet in executive session without management present.

•Our Risk Oversight Committee oversees implementation of the Risk Governance Framework and adherence to the Risk Appetite Statement, which takes the form of approving policies, frameworks, receiving regular reports, and engaging in discussion with Executive Management on topics for each of our risk pillars: credit, liquidity, market, operational, compliance, strategic, and reputation risk. The ROC also oversees capital management and ensures the amount and quality of capital are adequate in relation to expected and unexpected losses. ROC oversees the administration, effectiveness, and independence of our Credit Review function, and the Credit Review Director reports directly to the ROC. Our Chief Risk Officer reports to both the ROC and CEO.

•Our Audit Committee oversees integrity of our consolidated financial statements, including policies, procedures, and practices regarding the preparation of financial statements, the financial reporting process, disclosures, and internal control over financial reporting. The Audit Committee oversees the Internal Audit department and the independent registered public accounting firm’s qualifications and independence; compliance with our Financial Code of Ethics for the CEO and senior financial officers; compliance with corporate securities trading policies; compliance with legal and regulatory requirements; and financial risk exposures in coordination with the ROC. Our Chief Auditor reports directly to the Audit Committee.

•Our Technology Committee oversees technology and cybersecurity strategies and plans and is charged with evaluating the Company’s ability to properly perform all technology functions necessary for its business plan, including projected growth, technology capacity, planning, operational execution, product development, and management capacity. It provides oversight of technology investments and plans to drive efficiency as well as to meet defined standards for risk, information security, and redundancy; oversees allocation of technology costs and ensures that they are understood by the Board; evaluates innovation and technology trends that may affect our strategic plans, including monitoring of overall industry trends; and reviews and provides oversight of our continuity and disaster recovery planning and preparedness.

62 Huntington Bancshares Incorporated

Overlapping or common topics are overseen by more than one committee. On a regular basis, the ROC and Audit Committee meet in joint session to cover matters relevant to both committees’ responsibilities, including reviews of annual and quarterly filings, the methodology and level of the ACL, conduct risk, and others. These committees routinely hold executive sessions with our key officers engaged in both accounting and risk management. In addition, the ROC, Audit Committee, and Technology Committee oversee the effectiveness of management’s efforts to address risk issues in a timely, comprehensive, and sustainable manner, and regularly meet in a joint session to discuss. All directors have access to information provided to each committee and all scheduled meetings are open to all directors.

Further, through our Human Resources and Compensation Committee, our Board seeks to ensure its overall compensation programs are balanced and align the interests of management, creditors, and shareholders. We utilize a variety of compensation-related tools to induce appropriate behavior, including common stock ownership thresholds for the CEO and certain members of senior management, equity deferrals, recoupment provisions, and the right to terminate compensation plans at any time. The Chief Risk Officer has significant input into the design and outcome of incentive compensation plans.

Our Risk Governance structure also includes executive level committees to manage and oversee risk, which include Asset & Liability Management, Risk Management (inclusive of credit risk and strategy), Capital Management, Allowance, Incentive Compensation, Sarbanes-Oxley, and Disclosure Review. These committees are strategic in nature and are supported by subcommittees that are tactical. We believe this structure helps ensure appropriate escalation of issues, overall communication of strategies, and adherence to the Board’s risk appetite.

A comprehensive discussion of risk management and capital matters affecting us can be found in the Risk Factors section included in Item 1A: Risk Factors and the “Regulatory Matters” section of Item 1: Business of this Form 10-K.

Some of the more significant processes used to manage and control credit, market, liquidity, operational, and compliance risks are described in the following sections.