HUNTINGTON BANCSHARES INC /MD/

Operational risk is the risk of loss due to human error, third-party performance failures, or inadequate or failed

internal systems and controls, including the use of financial or other quantitative methodologies that may not

adequately predict future results; violations of, or noncompliance with, laws, rules, regulations, prescribed practices,

or ethical standards; and external influences such as market conditions, fraudulent activities, disasters, failed

business contingency plans, and security risks. We continuously strive to test and strengthen our system of internal

controls to ensure compliance with significant contracts, agreements, laws, rules, and regulations, to reduce our

exposure to fraud and to improve the oversight of our operational risk.

To govern operational risks, we have an Operational Risk Committee, a Legal, Regulatory, and Compliance

Committee, a Funds Movement and Fraud Risk Committee, an Information and Technology Risk Committee, a

Regulatory and Data Oversight Committee, and a Third Party Risk Management Committee. The responsibilities of

these committees, among other duties, include establishing and maintaining management information systems to

monitor material risks and to identify potential concerns, risks, or trends that may have a significant impact and

ensuring that recommendations are developed to address the identified issues. In addition, we have a Model Risk

Oversight Committee that is responsible for policies and procedures describing how model risk is evaluated and

managed and the application of the governance process to implement these practices throughout the enterprise.

These committees report any significant findings and remediation recommendations to the Risk Management

Committee. Potential concerns may be escalated to our ROC and our Audit Committee, as appropriate.

The goal of this framework is to implement effective operational risk monitoring; minimize operational, fraud,

and legal losses; minimize the impact of inadequately designed models; and enhance our overall performance.

Cybersecurity

Cybersecurity represents an important component of Huntington’s overall cross-functional approach to risk

management. We actively manage a cybersecurity operation designed to detect, contain, and respond to

cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to our

business. We actively monitor for cyberattacks, such as attempts related to online deception and loss of sensitive

customer data. We evaluate our technology, processes, and controls to mitigate loss from cyberattacks. Although to

date we have not experienced any material losses due to cyberattacks, with the increasing sophistication,

acceleration, and complexity of cyber events, including from developments in artificial intelligence and other

emerging technologies, we cannot ensure that there will not be a material loss in the future. Cybersecurity threats

continue to evolve and increase across the entire digital landscape. In response to the evolving threat landscape, we

continue to enhance our cybersecurity, operational resilience, and third-party risk management capabilities,

including efforts designed to improve the speed of vulnerability identification, remediation, monitoring, and

recovery. We actively monitor our environment for malicious content and implement specific cybersecurity and

fraud capabilities, including the monitoring of phishing email campaigns. In addition, we have implemented specific

cybersecurity and fraud monitoring of remote connections by geography and volume of connections to detect

anomalous remote logins, since a portion of our workforce works remotely from time to time.

Our objective for managing cybersecurity risk is to avoid or minimize the impacts of both internal and external

threat events or other efforts to penetrate our systems. We work to achieve this objective by hardening networks

and systems against attack and by diligently managing visibility and monitoring controls within our data and

communications environment to recognize events and respond before the attacker has the opportunity to plan and

execute on its own goals. To this end, we employ a set of defense-in-depth strategies, which include efforts to make

us less attractive as a target and less vulnerable to threats, while investing in threat analytic capabilities for rapid

detection and response. Potential concerns related to cybersecurity may be escalated to our board-level ROC and/or

Technology Committee, as appropriate.

As a complement to the overall cybersecurity risk management, we use a number of internal training methods,

both formally through mandatory courses and informally through written communications and other updates, to

ensure awareness of the risks of cybersecurity threats at all levels across the organization. Internal policies and

procedures have been implemented to encourage the reporting of potential phishing attacks or other security risks.

We also use third-party services to test the effectiveness of our cybersecurity risk management framework, and any

such third-parties are required to comply with our policies regarding information security and confidentiality.

2026 3Q Form 10-Q 29