Santander Holdings USA, Inc.

Summary Risk Factors

The Company is subject to a number of risks that if realized could affect its business, financial condition, results of operations, cash flows and access to liquidity materially. As a financial services organization, certain elements of risk are inherent in our businesses. Accordingly, the Company encounters risk as part of the normal course of its businesses. Some of the Company’s more significant challenges and risks include the following:

•We are vulnerable to disruptions and volatility in the global financial markets. Disruptions and volatility in financial markets can have a material adverse effect on our ability to access capital and liquidity on acceptable financial terms. Negative and fluctuating economic conditions, such as a changing interest rate environment, may cause our lending margins to decrease and reduce customer demand for our higher margin products and services.

•We are subject to substantial regulation. As a financial institution, we are subject to extensive regulation by government agencies, including limitations on permissible activities, required financial stress tests, required non-objection to certain actions, investigations and other regulatory proceedings. If we are unable to meet the expectations of our regulators fully, we may need to divert significant resources to remedial actions, be unable to take planned capital actions, and/or be subject to fines or other enforcement actions, among other things. These circumstances could affect our revenues and expenses and other aspects of our business and operations adversely.

•Credit risk is inherent in our business. Our customers’ and counterparties’ financial condition, repayment abilities, repayment intentions, the value of their collateral, and government economic policies, market interest rates and other factors affect the quality of our loan portfolio. Many of these factors are beyond our control, and there can be no assurance that our current or future loan and lease loss reserves will be sufficient to cover actual losses.

•Liquidity and funding risks are inherent in our business. Changes in market interest rates and our credit spreads occur continuously, may be unpredictable and highly volatile and can significantly increase our cost of funding. We rely primarily on deposits to fund lending activities. However, our ability to maintain or grow deposits depends on factors outside our control, such as general economic conditions and confidence of depositors in the economy and the financial services industry. If deposit withdrawals increase significantly in a short period of time, it could have a material adverse effect on our operating results, financial condition and prospects.

•We are subject to fluctuations in interest rates. Interest rates are highly sensitive to factors beyond our control, such as increased regulation of the financial sector, monetary policies, economic and political conditions, and other factors. Variations in interest rates could impact net interest income, which comprises the majority of our revenue, reducing our growth and potentially resulting in losses.

•We are subject to significant competition. We compete with banks that are larger than us and non-traditional providers of banking services who may not be subject to the same regulatory or legislative requirements to which we are subject. If we are unable to compete successfully with current and new competitors and anticipate changing banking industry trends, our business may be affected adversely.

•We may not be able to detect money laundering or other illegal or improper activities fully or on a timely basis. We work regularly to improve our policies, procedures and capabilities to detect and prevent financial crimes. However, such crimes are evolving continually, and there may be instances in which we may be used by other parties to engage in money laundering or other illegal or improper activities. These instances may result in regulatory fines, sanctions and/or legal enforcement, which could have a material adverse effect on our operating results, financial condition and prospects.

•Risks relating to data collection, processing, storage systems and data security. Proper functioning of financial controls, accounting and other data collection and processing systems is critical to our businesses and our ability to compete effectively. Inadequate personnel, inadequate or failed internal control processes or systems, or external events that interrupt normal business operations could each impair our data collection, processing, storage systems and data security and result in losses.

•We and others in our industry face cybersecurity risks. We take protective measures and monitor and develop our systems continuously to protect our technology infrastructure and data from cyberattacks. However, cybersecurity risks continue to increase for our industry, and the proliferation of new technologies and the increased sophistication and activities of parties behind such attacks present risks for compromised data, theft of funds or theft or destruction ofcorporate information and assets.

•We use AI, which could expose us to certain risks. We utilize AI and continue to explore additional uses of AI in connection with our businesses, products and services. However, AI solutions, such as those provided by third parties, may expose us to risks including, without limitation, inadequacies in the AI service that results in false or misleading information, operational inefficiencies, legal liability, reputational harm and other adverse impacts.

•The financial results of our auto lending business could impact our results. Our auto lending business has historically been a significant source of earnings for the Company. Factors that could negatively affect the auto lending business's financial results could consequently affect SHUSA’s financial results.

The above list is not exhaustive, and we face additional challenges and risks. Please carefully consider all of the information in this Form-K including matters set forth in this "Risk Factors" section.

Risk management and mitigation are important parts of the Company's business model and integrated into the Company's day-to-day operations. The success of the Company's business is dependent on management's ability to identify, understand, manage and mitigate the risks presented by business activities in light of the Company's strategic and financial objectives. These risks include credit risk, market risk, capital risk, liquidity risk, operational risk, model risk, investment risk, compliance and legal risk, and strategic and reputational risk. We discuss our principal risk management processes in the Risk Management section included in Item 7 of this Annual Report on Form 10-K.

The following are the most significant risk factors that affect the Company. Any one or more of these could have a material adverse impact on the Company's business, financial condition, results of operations, or cash flows, in addition to presenting other possible adverse consequences, many of which are described below. These risk factors and other risks we may face are also discussed further in other sections of this Annual Report on Form 10-K.

Macro-Economic and Political Risks

Given that our loan portfolios are concentrated in the United States, adverse changes affecting the economy of the United States could adversely affect our financial condition.

Our loan portfolios are concentrated in the United States. Accordingly, the recoverability of our loan portfolios, our capacity to increase lending and our overall results of operations and financial condition depend significantly on the level of economic activity in the United States. Recessionary conditions in the United States economy would likely have a significant adverse impact on our business, financial condition, and results of operations.

We are vulnerable to disruptions and volatility in the global financial markets.

We face, among others, the following risks in the event of economic downturns or recessions:

•An increase or change in regulation of our industry. Compliance with such regulation has increased our costs and may affect the pricing of our products and services and limit our ability to pursue business opportunities.

•A reduction in demand for our products and services.

•An inability of our borrowers to timely or fully comply with their existing obligations.

•The process we use to estimate losses inherent in our credit exposure, which requires complex judgments, including forecasts of economic conditions and how those economic conditions might impair the ability of our borrowers to repay their loans.

•The degree of uncertainty concerning economic conditions, which may adversely affect the accuracy of our estimates, and which may, in turn, impact the reliability of the process and the sufficiency of our ALLL.

•The value and liquidity of the portfolio of investment securities that we hold may be adversely affected.

•Any worsening of economic conditions, which may impact the financial industry and our financial condition and results of operations.

•Macroeconomic shocks, which may impact the income of our retail and corporate customers and adversely affect the recoverability of our retail loans, resulting in increased loan and lease losses.

Despite the long-term expansion of the U.S. economy, uncertainty remains regarding U.S. monetary policy and the future economic environment. There can be no assurance that economic conditions will continue to improve. Such economic uncertainty could have an adverse effect on our business and results of operations. A downturn of the economic expansion or failure to sustain the economic recovery would likely aggravate the adverse effects of these difficult economic and market conditions on us and on others in the financial services industry. In addition, as described in greater detail below, dislocations in international trade such as interruptions in international supply chains or implementation of tariffs may impact prices and demand for goods and services and lead to lower levels of business and possible declining creditworthiness of customers.

If countries with significant economies default on their debt or experience a significant widening of credit spreads, it may affect financial institutions and bank systems adversely or contribute to other more severe economic or financial conditions. Ifrealized, these scenarios could contribute to severe stress andadverse consequences for the economy and capital markets in the United States as well. In addition, public concern related to the ability of the U.S. government to agree on federal budgetary matters, or that the government may have a total or partial shutdown, may adversely affect the U.S. economy and increase the risk of economic instability or market volatility.

Increased disruption and volatility in the financial markets could have a material adverse effect on us, including our ability to access capital and liquidity on acceptable financial terms, if at all. If capital markets financing becomes unavailable, or excessively expensive, we may be forced to raise the rates we pay on deposits to attract more customers and may be unable to maintain certain liability maturities. Any such adverse impact in capital markets funding availability or increased costs or deposit rates could have a material adverse effect on our net interest margins and liquidity.

If some or all of the foregoing risks were to materialize, they could have a material adverse effect on our business, financial condition and results of operations.

Recent Executive Orders Related to Tariffs May Result in Increased Risks to our Businesses

The U.S. Government has recently taken several actions related to international trade during the past year, including imposing tariffs on global trade partners such as Canada, Mexico, China and the European Union. The announcement of new reciprocal tariffs by the U.S. on most countries in April 2025 led to sudden large sell-offs and significant volatility in U.S and global financial markets. These announcements as well as subsequent additional tariff announcements, negotiations, exemptions and temporary postponements of certain tariffs, and retaliative tariffs and similar measures announced by countries subject to the U.S Government's tariffs have led to concerns related to disruptions to supply chains, reduced purchasing power of consumers and businesses, and an increased likelihood of recessionary conditions. If there is an economic downturn or continued significant disruption in financial markets, we may experience increased likelihood of risks to our businesses, including reduced demand for our products and services, reduced capability of our borrowers to timely or fully comply with their existing obligations, adverse effects on the value and liquidity of investment securities we hold or issue, and greater uncertainty related to financial estimates we use in our businesses.

Some observers have suggested that the tariffs are contributing to increased prices for goods and services in the U.S. Such increased prices could increase our operating costs, decrease the purchasing power of customers, leading to a greater potential for delinquencies in our credit portfolios and reduced demand for our products and services, and reduce our overall economic growth.

Our auto lending business is a significant source of our lending and funding. We may experience reduced demand for auto lending products and services in the event tariffs have negative effects on the auto industry and the U.S. economy in general, including reduced auto sales as a result of, among other things, fewer vehicles being manufactured due to supply chain disruptions and higher manufacturing costs, reduced consumer demand for vehicles due to increased manufacturing costs and corresponding higher prices, and a decrease in automobile sales and loan volumes due to the closure and overall reduction in dealerships operating in the U.S. as a result of an economic downturn.

Our growth, asset quality and profitability may be adversely affected by volatile macroeconomic and political conditions.

While the United States economy has performed well overall, it has experienced volatility in recent periods, characterized by slow or regressive growth. This volatility has resulted in fluctuations in the levels of deposits at depository institutions and in the relative economic strength of various segments of the economy to which we lend.

Negative and fluctuating economic conditions, such as a changing interest rate environment, impact our profitability by causing lending margins to decrease and leading to decreased demand for higher margin products and services. Negative and fluctuating economic conditions could also result in government defaults on public debt. This could affect us in two ways: directly, through portfolio losses, and indirectly, through instabilities that a default on public debt could cause to the banking system as a whole.

In addition, our revenues are subject to risk of loss from unfavorable political and diplomatic developments, social instability, and changes in governmental policies, international ownership legislation, interest rate caps and tax policies. The U.S. Presidential administration has taken multiple actions in the past year that reduce or eliminate incentives for manufacturers and consumers of electric vehicles and the building of new wind and solar farms for the production of wind energy. For example, the OBBBA accelerated the end of the federal electrical vehicle tax credit to September 2025, earlier than previously planned. The OBBBA also accelerated the termination of tax credits for wind and solar energy facilities. Various executive orders and other actions during 2025 resulted in additional de-emphasis and reduced government support for renewable energy projects, such as declaring a national energy emergency and directing government bodies to facilitate expedited permitting for energy sources other than wind and solar energy, crude oil and natural gas, and withdrawing from wind energy leasing projects within the offshore continental shelf. Our businesses include financing the sale of electric vehicles and financing the creation of renewable energy developments such as wind farms. Governmental policies that disincentivize these industries and projects could lead to reductions in our revenue in these areas. Growth, asset quality and profitability may be affected by volatile macroeconomic and political conditions.

Risks Relating to Our Business

Legal, Regulatory and Compliance Risks

We are subject to substantial regulation which could adversely affect our business and operations.

As a financial institution, the Company is subject to extensive regulation, which materially affects our businesses. The statutes, regulations, and policies to which the Company is subject may change at any time. In addition, regulators' interpretation and application of the laws and regulations to which the Company is subject may change from time to time. Extensive legislation affecting the financial services industry has been adopted in the United States, and regulations have been and are in the process of being implemented. The manner in which those laws and related regulations are applied to the operations of financial institutions is still evolving. Any legislative or regulatory actions and any required or other changes to our business operations resulting from such legislation and regulations could result in significant loss of revenue, limit our ability to pursue business opportunities or provide certain products and services, affect the value of assets we hold, compel us to increase our prices and therefore reduce demand for our products, impose additional compliance and other costs on us or otherwise adversely affect our businesses. Accordingly, there can be no assurance that future changes in regulations or their interpretation or application will not affect us adversely.

Regulation of the Company as a BHC includes limitations on permissible activities. Moreover, the Company and SBNA are required to perform stress tests and submit capital plans to the Federal Reserve and the OCC. The Federal Reserve may also impose substantial fines and other penalties and enforcement actions for violations we may commit, and has the authority to disallow acquisitions we or our subsidiaries may contemplate, which may limit our future growth plans. Such constraints currently applicable to the Company and its subsidiaries and/or regulatory actions could have an adverse effect on our business, financial condition and results of operations.

Other regulations that significantly affect the Company, or that could significantly affect the Company in the future, relate to capital requirements, liquidity and funding, taxation of the financial sector, and development of regulatory reforms in the United States.

In addition, inconsistency among federal, state and local regulatory requirements could make our continuing ability to comply with all of the regulatory requirements to which we are or may become subject more challenging.

Moreover, the volume, granularity, frequency and scale of regulatory and other reporting requirements necessitate a clear data strategy to enable consistent data aggregation, reporting and management. Inadequate management information systems or processes, including those relating to risk data aggregation and risk reporting, could lead to a failure to meet regulatory reporting requirements or other internal or external information demands that may result in supervisory measures.

Significant United States Regulation

From time to time, we are or may become subject to or involved in formal and informal reviews, investigations, examinations, proceedings, and information gathering requests by federal and state government agencies, including, among others, the Federal Reserve, the OCC, the CFPB, the FDIC, the DOJ, the SEC, FINRA, the Federal Trade Commission and various state regulatory and enforcement agencies.

The DFA resulted in significant structural reforms affecting the financial services industry. This legislation provided for, among other things, the establishment of the CFPB with broad authority to regulate the credit, savings, payment and other consumer financial products and services we offer, the creation of a structure to regulate systemically important financial companies, more comprehensive regulation of the OTC derivatives market, prohibitions on engaging in certain proprietary trading activities, restrictions on ownership of, investment in or sponsorship of hedge funds and private equity funds and restrictions on interchange fees earned through debit card transactions.

Our resolution in a bankruptcy proceeding could result in losses for holders of our debt and equity securities.

Under regulations issued by the Federal Reserve and the FDIC, and as required by Section 165(d) of the DFA, we and Santander must provide to the Federal Reserve and the FDIC a Section 165(d) resolution plan that requires substantial effort, time, and cost to prepare. The purpose of this DFA provision is to provide regulators with plans that would enable them to resolve failing financial companies that pose a significant risk to the financial stability of the United States in a manner that mitigates such risk. As a result of the Economic Growth, Regulatory Relief, and Consumer Protection Act and changes to applicable regulations, Santander is a triennial reduced filer. Santander filed its most recent 165(d) plan in the form of a reduced resolution plan on July 1, 2025. Resolution plans provide a roadmap for the orderly resolution of the material U.S. operations of Santander under hypothetical stress scenarios and the failure of one or more of its U.S. MEs. MEs are defined as subsidiaries or foreign offices of Santander that are significant to the activities of a critical operation or core business line. The U.S. MEs identified in the 2025 Resolution Plan include, among other entities, the Company, SBNA and SC.

The 2025 Resolution Plan describes a strategy for resolving Santander’s U.S. operations, including its U.S. MEs and the core business lines that operate within those U.S. MEs, in a manner that would substantially mitigate the risk that the resolutions would have serious adverse effects on U.S. or global financial stability. Under the 2025 Resolution Plan’s hypothetical resolutions of the U.S. MEs, SBNA would be placed into FDIC receivership and the Company and SC would be placed into bankruptcy under Chapter 7 and Chapter 11 of the U.S. Bankruptcy Code, respec tively. In such a scenario, holders of our LTD and other debt securities would be junior to the claims of priority (as determined by statute) and secured creditors of the Company.

If, after reviewing the 2025 Resolution Plan and any related submissions, the Federal Reserve and the FDIC jointly determine that we failed to cure identified deficiencies, they may jointly impose more stringent capital, leverage or liquidity requirements, restrictions on our growth, activities or operations, or even divestitures, which could have an adverse effect on our business.

The Company, the Federal Reserve and the FDIC are not obligated to follow the Company’s preferred resolution strategy for resolving its U.S. operations under its resolution plan. In addition, Santander could in the future change its resolution strategy for resolving its U.S. operations. In an alternative scenario, the Company alone could enter bankruptcy under the U.S. Bankruptcy Code, and the Company’s subsidiaries would be recapitalized as needed, using assets of the Company, so that they could continue normal operations as going concerns or subsequently be wound down in an orderly manner. As a result, the losses incurred by the Company and its subsidiaries would be imposed first on the holders of the Company’s equity securities and thereafter on unsecured creditors, including holders of our LTD and other debt securities. Holders of our LTD and other debt securities would be junior to the claims of creditors of the Company’s subsidiaries and to the claims of priority (as determined by statute) and secured creditors of the Company. Under either of these scenarios, in a resolution of the Company under the U.S. Bankruptcy Code, holders of our LTD and other debt securities would realize value only to the extent available to the Company as a shareholder of SBNA, SC and its other subsidiaries, and only after any claims of priority and secured creditors of the Company have been fully repaid.

The resolution of the Company under the orderly liquidation authority could result in greater losses for holders of our equity and debt securities.

The ability of holders of our LTD and other debt securities to recover the full amount that would otherwise be payable on those securities in a resolution proceeding under Chapter 11 of the U.S. Bankruptcy Code may be impaired by the exercise of the FDIC’s powers under the “orderly liquidation authority” under Title II of the DFA.

The DFA created a new resolution regime known as the “orderly liquidation authority” to which financial companies, including the Company, can be subjected. Under the orderly liquidation authority, the FDIC may be appointed as receiver to liquidate a financial company if, upon the recommendation of applicable regulators, the United States Secretary of the Treasury determines that the entity is in severe financial distress, the entity’s failure would have serious adverse effects on the U.S. financial system, and resolution under the orderly liquidation authority would avoid or mitigate those effects, among other things.

If the FDIC were appointed as receiver under the orderly liquidation authority, then the orderly liquidation authority, rather than the U.S. Bankruptcy Code, would determine the powers of the receiver and the rights and obligations of creditors and other parties who have transacted with the Company. There are substantial differences between the rights available to creditors under the orderly liquidation authority and under the U.S. Bankruptcy Code. The FDIC may disregard the strict priority of creditor claims in some circumstances, and an administrative claims procedure rather than a judicial procedure would be used to determine creditors’ claims. Furthermore, the FDIC has the right to transfer assets or liabilities of the failed company to a third party or “bridge” entity under the orderly liquidation authority.

Regardless of what resolution strategy Santander might prefer to resolve its U.S. operations, the FDIC could resolve the Company in a manner that would impose losses on the Company’s shareholder, unsecured debtholders (including holders of our LTD) and other creditors, while permitting the Company’s subsidiaries to continue to operate. The application of such an entry strategy in which the Company would be the only legal entity in the U.S. to enter resolution proceedings could result in greater losses to holders of our LTD and other debt securities than the losses that would result from a bankruptcy proceeding or a different resolution strategy for the Company. Assuming the Company entered resolution proceedings and support from the Company to its subsidiaries was sufficient to enable the subsidiaries to remain solvent, losses at the subsidiary level could be transferred to the Company and ultimately borne by the Company’s securityholders (including holders of our LTD and other debt securities), with the result that third-party creditors of the Company’s subsidiaries would receive full recoveries on their claims, while the Company’s securityholders (including holders of our LTD) and other unsecured creditors could face significant losses. In addition, in a resolution under the orderly liquidation authority, holders of our LTD and other debt securities of the Company could face losses ahead of other similarly situated creditors if the FDIC exercised its right, to disregard the strict priority of creditor claims.

The orderly liquidation authority also requires that creditors and shareholders of the financial company in receivership must bear all losses before taxpayers are exposed to any losses, and amounts owed by the financial company or the receivership to the U.S. government would generally receive a statutory payment priority over the claims of private creditors, including holders of our LTD and other debt securities. In addition, under the orderly liquidation authority, claims of creditors (including holders of our LTD and other debt securities) could be satisfied through the issuance of equity or other securities in a bridge entity to which the Company’s assets are transferred. If securities were to be delivered in satisfaction of claims, there can be no assurance that the value of the securities of the bridge entity would be sufficient to repay all or any part of the creditor claims for which the securities were exchanged.

United States stress testing, capital planning, and related supervisory actions

The Company is subjectto stress testing and capital planning requirements under regulations implementing the DFA and other banking laws and policies. Under such rules, the Federal Reserve expects BHCs such as the Company to have sufficient capital to withstand a highly adverse operating environment and to be able to continue operations, maintain ready access to funding, meet obligations to creditors and counterparties, and serve as credit intermediaries. In addition, the Federal Reserve evaluates the planned capital actions of BHCs, including capital distributions such as dividend payments or stock repurchases. As a Category IV IHC under Federal Reserve regulations, we are required to submit a capital plan to the Federal Reserve on an annual basis. We are also subject to supervisory stress testing on a two-year cycle. Our categorization as a Category IV IHC could change depending on the scope and composition of our activities and the completion of strategic transactions and acquisitions. If our categorization changes to be a Category III IHC, we would be subject to increased requirements such as annual stress tests by the Federal Reserve to determine our capital adequacy and more stringent liquidity and risk management practices. Such changes could result in increased costs and required investment in compliance resources.

In March 2020, the Federal Reserve finalized the SCB rule, under which the Federal Reserve uses the results of its supervisory stress tests to establish the size of a firm’s SCB requirement, subject to a floor of 2.5 percent. The Company must maintain capital ratios above the sum of the minimum capital requirements and any applicable capital buffers, including the SCB, in order to avoid restrictions on the distribution of capital, including in the form of dividends and share repurchases.

Other supervisory actions and restrictions on U.S. activities

In addition to the foregoing, U.S. bank regulatory agencies from time to time take supervisory actions under certain circumstances that restrict or limit a financial institution’s activities. In many instances, we are subject to significant legal restrictions on our ability to disclose these actions or the full details of these actions publicly. In addition, as part of the regular examination process, certain U.S. subsidiaries’ regulators may advise the subsidiary to operate under various restrictions as a prudential matter. Under the BHC Act, the Federal Reserve has the authority to disallow us and certain of our U.S. subsidiaries from engaging in certain categories of new activities in the United States or acquiring shares or control of other companies in the United States. Such actions and restrictions currently applicable to us or certain of our U.S. subsidiaries could adversely affect our costs and revenues. Moreover, efforts to comply with nonpublic supervisory actions or restrictions could require material investments in additional resources and systems, as well as a significant commitment of managerial time and attention. As a result, such supervisory actions or restrictions could have a material adverse effect on our business and results of operations, and we may be subject to significant legal restrictions on our ability to publicly disclose these matters or the full details of these actions.

In recent years, certain U.S. financial institutions have failed and become administered by the FDIC as receiver. Under FDIC receivership, aspects of failed banks may be auctioned or sold to other financial institutions, increasing risks related to consolidation in the banking industry described in greater detail in the "Business and Industry Risks" section below. Such failures may also lead the FDIC to request higher FDIC assessments from banks due to the DIF falling below minimum required levels, or the FDIC requiring special FDIC assessments related to specific bank failures, and lead to banking regulators introducing new or more stringent regulatory requirements and expectations.

We are subject to potential intervention by any of our regulators or supervisors, particularly in response to customer complaints.

As noted above, our business and operations are subject to significant rules and regulations relating to the banking and financial services business. These apply to business operations, affect financial returns, and include reserve and reporting requirements. The relationship between the Company and its customers is also regulated extensively under federal and state consumer protection laws. Among other things, these laws prohibit unfair, deceptive and abusive trading practices, require disclosures of the cost of credit, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide financial privacy protections, and restrict our ability to raise interest rates.

In their supervisory roles, regulators seek to maintain the safety and soundness of financial institutions with the aim of strengthening, but not guaranteeing, the protection of customers and the financial system. Supervisors' continuing supervision of financial institutions is conducted through a variety of regulatory tools, including the collection of information by way of reports obtained from skilled persons, visits to firms and regular meetings with management to discuss issues such as performance, risk management and strategy. In general, regulators have an outcome-focused regulatory approach that involves proactive enforcement and penalties for infringement. As a result, we face increased supervisory intrusion and scrutiny (resulting in increasing internal compliance costs and supervision fees), and in the event of a breach of our regulatory obligations we are likely to face more stringent regulatory fines.

Some regulators focus strongly on consumer protection and on conduct risk. This has included a focus on the design and operation of products, the behavior of customers and the operation of markets. These may potentially cause significant detriment to consumers because of certain product features, governance flaws or distribution strategies. Such rules may prevent institutions from entering into product agreements with customers until such problems have been solved. Sales practices with retail customers, such as incentive compensation structures related to such practices, have previously been a focus of various regulatory and governmental agencies. If we fail to be compliant with such regulations, there would be a risk of an adverse impact on our business from sanctions, fines or other actions imposed by regulatory authorities.

Customers may seek redress if they consider they have suffered loss as a result of mis-selling of a particular product, or through incorrect application of the terms and conditions of a particular product. In light of the inherent unpredictability of litigation and the evolution of judgments by relevant authorities, it is possible that an adverse outcome in some matters could harm our reputation or have a material adverse effect on our operating results, financial condition and prospects arising from any penalties imposed or compensation awarded, together with the costs of defending such actions, reducing our profitability.

We are exposed to risk of loss from legal and regulatory proceedings.

As noted above, we face risk of loss from legal and regulatory proceedings, including tax proceedings that could subject us to monetary judgments, regulatory enforcement actions, fines and penalties. The current regulatory environment reflects an increased supervisory focus on enforcement, combined with uncertainty about the evolution of the regulatory regime, and may lead to material operational and compliance costs. In certain cases, regulatory authorities have required criminal pleas, admissions of wrongdoing, limitations on asset growth, managerial changes, and other extraordinary terms as part of such settlements, all of which could have significant economic consequences for a financial institution.

We are subject to civil and tax claims and party to certain legal proceedings incidental to the normal course of our business from time to time, including in connection with lending activities, relationships with our employees and other commercial, data protection, or tax matters. In view of the inherent difficulty of predicting the outcome of legal matters, particularly when theclaimants seek very large or indeterminate damages, or when the cases present novel legal theories, involve a large number of parties or are in the early stages of investigation or discovery, we cannot state with confidence what the eventual outcome of these pending matters will be or what the eventual loss, fines or penalties related to each pending matter may be. We believe that we have established adequate reserves related to the costs anticipated to be incurred in connection with these various claims and legal proceedings. However, the amount of these provisions is substantially less than the total amount of the claims asserted against us and, in light of the uncertainties involved in such claims and proceedings, there is no assurance that the ultimate resolution of these matters will not significantly exceed the reserves we have currently accrued. As a result, the outcome of a particular matter may materially and adversely affect our business, financial condition and results of operations for a particular period, depending upon, among other factors, the size of the loss or liability imposed and our level of income for that period.

In addition, from time to time, the Company is, or may become, the subject of governmental and self-regulatory agency information-gathering requests, reviews, investigations and proceedings and other forms of regulatory inquiry, including by the SEC and law enforcement authorities.

Often, the announcement or other publication of claims or actions that may arise from such litigation and regulatory proceedings or of any related settlement may spur the initiation of similar claims by other customers, clients or governmental entities. In any such claim or action, demands for substantial monetary damages may be asserted against us and may result in financial liability, changes in our business practices or an adverse effect on our reputation or client demand for our products and services.

Regular and ongoing inspection by our banking and other regulators may result in the need to enhance our regulatory compliance or risk management practices. Such remedial actions may entail significant costs, management attention, and systems development, and such efforts may affect our ability to expand our business until those remedial actions are completed. In some instances, we are subjected to significant legal restrictions on our ability to disclose these types of actions or the full detail of these actions publicly. Our failure to implement enhanced compliance and risk management procedures in a manner and timeframe deemed to be responsive by the applicable regulatory authority could adversely impact our relationship with that regulatory authority and lead to restrictions on our activities or other sanctions.

The magnitude and complexity of projects required to address the Company’s regulatory and legal proceedings, in addition to the challenging macroeconomic environment and pace of regulatory change, may result in execution risk and adversely affect the successful execution of such regulatory or legal priorities.

In many cases, we are required to self-report inappropriate or non-compliant conduct to regulatory authorities, and our failure to do so may represent an independent regulatory violation. Even when we promptly bring matters to the attention of appropriate authorities, we may nonetheless experience regulatory fines, liability to clients, harm to our reputation or other adverse effects in connection with self-reported matters.

We may not be able to detect money laundering and other illegal or improper activities fully or on a timely basis, which could expose us to additional liability and have a material adverse effect on us.

We are required to comply with anti-money laundering, anti-terrorism and other laws and regulations in the jurisdictions in which we operate. These laws and regulations have become increasingly complex and detailed, require improved systems and sophisticated monitoring and compliance personnel, and have become the subject of enhanced government supervision.

While we maintain updated policies and procedures aimed at detecting and preventing the use of our banking network for money laundering and related activities, those policies and procedures may not completely eliminate instances in which we may be used by other parties to engage in money laundering and other illegal or improper activities. Emerging technologies, such as cryptocurrencies and other innovative payment methodologies, could limit our ability to track the movement of funds. Our ability to comply with legal requirements depends on our ability to improve detection and reporting capabilities and reduce variation in control processes and oversight accountability.

These require implementing and embedding effective controls and monitoring within our business and on-going changes to systems and operations. Financial crime is continually evolving and subject to increasingly stringent regulatory oversight and focus. Even known threats can never be fully eliminated, and there will be instances in which we may be used by other parties to engage in money laundering or other illegal or improper activities. To the extent we fail to comply fully with applicable laws and regulations, the relevant government agencies to which we report have the authority to impose fines and other penalties on us. Further, U.S. bank regulators are required, when reviewing bank and BHC acquisition or merger applications, to take into account the effectiveness of our compliance with anti-money laundering regulations. In addition, our business and reputation could suffer if customers use our banking network for money laundering or other illegal or improper purposes.

We may be subject to negative coverage in the media about us or our clients, including with respect to alleged conduct such as failure to detect and/or prevent financial crime activities or comply with the foregoing requirements. Negative media coverage of this type about us, whether it has merit or not, could materially and adversely affect our reputation and perception among current and potential clients, investors, vendors, partners, regulators and other third parties, which in turn could have a material adverse effect on our operating results, financial condition and prospects as well as damage our customers’ and investors’ confidence.

While we review our relevant counterparties’ internal policies and procedures with respect to such matters, to a large degree we rely on our counterparties to maintain and properly apply their own appropriate anti-money laundering procedures. Such measures, procedures and compliance may not be completely effective in preventing third parties from using our and our counterparties’ services as conduits for money laundering (including illegal cash operations) or other illegal activities without our and our counterparties’ knowledge. If we are associated with, or even accused of being associated with, or become a party to, money laundering or other illegal activities, our reputation could suffer and/or we could become subject to fines, sanctions and/or legal enforcement (including being added to any “watch lists” that would prohibit certain parties from engaging in transactions with us), any one of which could have a material adverse effect on our business, financial condition and results of operations.

Changes in taxes and other assessments and incorrect interpretations of tax laws and regulations may affect us adversely.

The legislatures and tax authorities in the jurisdictions in which we operate regularly enact reforms to the tax and other assessment regimes to which we and our customers are subject. Such reforms include changes in the rate of assessments and, occasionally, enactment of temporary taxes, the proceeds of which are earmarked for designated governmental purposes. The effects of these changes and any other changes that result from enactment of additional tax reforms cannot be quantified and there can be no assurance that such reforms would not have an adverse effect upon our business. Aspects of recent U.S. federal income tax reform such as the Tax Cuts and Jobs Act of 2017 limit or eliminate certain income tax deductions, including the home mortgage interest deduction, the deduction of interest on home equity loans and a limitation on the deductibility of property taxes. These limitations and eliminations could affect demand for some of our retail banking products and the valuation of assets securing certain of our loans adversely, increasing our credit loss expense and reducing profitability.

The preparation of our tax returns requires the use of estimates and interpretations of complex tax laws and regulations and is subject to review by taxing authorities. We are subject to the income tax laws of the United States and certain foreign countries. These tax laws are complex and subject to different interpretations by the taxpayer and relevant governmental taxing authorities, which are sometimes subject to prolonged evaluation periods until a final resolution is reached. In establishing a provision for income tax expense and filing returns, we must make judgments and interpretations about the application of these inherently complex tax laws. If the judgments, estimates, and assumptions we use in preparing our tax returns are subsequently found to be incorrect, there could be a material effect on our results of operations.

Credit Risks

If the level of our NPLs increases or our credit quality deteriorates in the future, or if our loan and lease loss reserves are insufficient to cover loan and lease losses, this could have a material adverse effect on us.

Risks arising from changes in credit quality and the recoverability of loans and amounts due from counterparties are inherent in a wide range of our businesses. Non-performing or low credit quality loans have in the past negatively impacted and can continue to

negatively impact our results of operations. In particular, the amount of our reported NPLs may increase in the future as a result of growth in our total loan portfolio, including as a result of loan portfolios we may acquire in the future, or factors beyond our control, such as adverse changes in the credit quality of our borrowers and counterparties or a general deterioration in economic conditions in the United States, the impact of political events, events affecting certain industries or events affecting financial markets. There can be no assurance that we will be able to effectively control the level of the NPLs in our loan portfolio.

Our loan and lease loss reserves are based on our current assessment of and expectations concerning various factors affecting the quality of our loan portfolio. These factors include, among other things, our borrowers’ financial condition, repayment abilities and repayment intentions, the realizable value of any collateral, the prospects for support from any guarantor, government macroeconomic policies, interest rates and the legal and regulatory environment. Our loan and lease loss reserves may also be influenced by other factors such as the degree that our loan portfolios are concentrated by loan type, industry segment, borrower type or location of the borrower or collateral. Such concentrations could increase the possibility that similarly situated borrowers and their collateral may collectively be affected by certain economic or market conditions or events such as, for example, natural or man-made disasters. Many of these factors are beyond our control. As a result, there is no precise method for predicting loan and credit losses, and there can be no assurance that our current or future loan and lease loss reserves will be sufficient to cover actual losses. If our assessment of and expectations concerning the above-mentioned factors differ from actual developments, if the quality of our total loan portfolio deteriorates for any reason, including an increase in lending to individuals and small and medium enterprises, a volume increase in our credit card portfolio or the introduction of new products, or if future actual losses exceed our estimates of expected losses, we may be required to increase our loan and lease loss reserves, which may affect us adversely. If we were unable to control or reduce the level of our non-performing or poor credit quality loans, this also could have a material adverse effect on us.

In addition, the FASB’s Topic 326 Financial Instruments - Credit Losses, establishes a single allowance framework for financial assets carried at amortized cost. Under this standard, companies must recognize credit losses on these assets equal to management’s estimate of credit losses over the assets’ remaining expected lives. It is possible that our ongoing reported earnings and lending activity will be impacted negatively as a result of the application of this accounting standard. See “Changes in accounting standards could impact reported earnings” below.

Our loan and investment portfolios are subject to risk of prepayment, which could have a material adverse effect on us.

Our fixed-rate loan and investment portfolios are subject to prepayment risk, which results from the ability of a borrower or issuer to pay a debt obligation prior to maturity. Generally, in a low interest rate environment, prepayment activity increases, and this reduces the weighted average life of our earning assets and could have a material adverse effect on us. We would also be required to amortize net premiums into income over a shorter period of time, thereby reducing the corresponding asset yield and net interest income. Prepayment risk also has a significant adverse impact on credit card and collateralized mortgage loans, since prepayments could shorten the weighted average life of these assets, which may result in a mismatch in our funding obligations and reinvestment at lower yields. Prepayment risk is inherent in our commercial activity, and an increase in prepayments could have a material adverse effect on us.

The value of the collateral securing our loans may not be sufficient, and we may be unable to realize the full value of the collateral securing our loan portfolio.

The value of the collateral securing our loan portfolio may fluctuate or decline due to factors beyond our control, including as a result of macroeconomic factors affecting the United States. The value of the collateral securing our loan portfolio may be adversely affected by force majeure events such as natural disasters (including as a result of climate change), partic ularly in locations in which a significant portion of our loan portfolio is composed of real estate loans. Natural disasters such as earthquakes and floods may cause widespread damage, which could impair the asset quality of our loan portfolio and have an adverse impact on the economy of the affected region. We also may lack sufficiently recent information on collateral values, which may result in an inaccurate assessment of impairment losses of our loans secured by such collateral. If any of the above were to occur, we may need to make additional provisions to cover actual impairment losses on our loans, which may materially and adversely affect our results of operations and financial condition.

Technological changes in the auto industry, accelerated by environmental regulations, could affect our auto consumer business, particularly the residual values of leased vehicles. This transformation could impact our auto finance business as a result of (1) the transition from fuel to electric engines, environmental aspects related to emissions and transition risks derived from political and regulatory decisions; (2) growing customer preferences for car leasing, subscription, car sharing and other services instead of vehicle ownership; (3) increased market concentration in certain manufacturers, distributors and other agents; and (4) the expansion of online sales channels.

In addition, the auto industry could face supply chain disruption and shortages of batteries, semi-conductors and other components linked to geopolitical tensions, conflicts and macroeconomic uncertainty, affecting guarantees, residual used car value and loan delinquencies. Although we monitor our auto portfolios and dealers and have launched specific action plans to address particular issues, these structural changes and disruptions could have a material adverse effect on our operating results, financial condition and prospects.

We are subject to counterparty risk in our banking business.

We are exposed to counterparty risk in addition to credit risks associated with lending activities. Counterparty risk may arise from, for example, investing in securities of third parties, entering into derivatives contracts under which counterparties have obligations to make payments to us or executing securities, futures, currency or commodity trades that fail to settle at the required time due to non-delivery by the counterparty or systems failure by clearing agents, clearinghouses or other financial intermediaries.

We routinely transact with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual funds, hedge funds and other institutional clients. We rely on information provided by or on behalf of counterparties, such as financial statements, and we may rely on representations of our counterparties as to the accuracy and completeness of that information. Defaults by, and even rumors or questions about the solvency of, certain financial institutions and the financial services industry generally have led to market-wide liquidity problems and could lead to losses or defaults by other institutions. Many routine transactions we enter into expose us to significant credit risk in the event of default by one of our significant counterparties.

Liquidity and Financing Risks

Liquidity and funding risks are inherent in our business and could have a material adverse effect on us.

Liquidity risk is the risk that we either do not have sufficient financial resources available to meet our obligations as they become due, or we can secure them only at excessive cost. This risk is inherent in any banking business and can be heightened by a number of enterprise-specific factors, including over-reliance on a particular source of funding, changes in credit ratings or market-wide phenomena such as market dislocation. While we implement liquidity management processes to mitigate and control these risks, unforeseen systemic market factors in particular make it difficult to eliminate these risks completely. Adverse and continued constraints in the supply of liquidity, including inter-bank lending, may materially and adversely affect the cost of funding our business, and extreme liquidity constraints may affect our current operations and our ability to fulfill regulatory liquidity requirements as well as limit growth possibilities.

Our cost of obtaining funding is directly related to prevailing market interest rates and our credit spreads. Increases in interest rates and our credit spreads can significantly increase the cost of our funding. Variations in credit spreads are market-driven and may be influenced by perceptions of our creditworthiness and general market conditions. Changes to interest rates and our credit spreads occur continuously and may be unpredictable and highly volatile.

If wholesale markets financing ceases to be available, or becomes excessively expensive, we may be forced to raise the rates we pay on deposits, with a view to attracting more customers, and/or to sell assets, potentially at depressed prices. The persistence or worsening of these adverse market conditions or an increase in base interest rates could have a material adverse effect on our ability to access liquidity and cost of funding.

We rely, and will continue to rely, primarily on deposits to fund lending activities. The ongoing availability of this type of funding is directly related to our solvency and the success of our policies and sensitive to a variety of factors outside our control, such as general economic conditions and the confidence of depositors in the economy in general, and the financial services industry in particular, as well as competition among banks and non-banks for deposits. Online and mobile banking services may allow customers to withdraw their deposits or send funds to other accounts with short notice. Additionally, account owners with uninsured deposits may be more likely to withdraw their deposits. Any of these factors could significantly increase the amount of significant deposit withdrawals in a short period of time, thereby reducing our ability to access deposit funding in the future on appropriate terms, or at all. If these circumstances were to arise, they could have a material adverse effect on our operating results, liquidity, financial condition and prospects. Difficulties or liquidity issues faced by certain financial entities could cause withdrawals of deposits from those entities and volatility in U.S. and international markets. The spread or potential spread of these or other issues to the broader financial sector could have a material adverse impact on our operating results, financial condition and prospects.

We anticipate that our customers will continue to make deposits (particularly demand deposits and short-term time deposits) in the near future, and we intend to maintain our emphasis on the use of banking deposits as a source of funds. The short-term nature of some deposits could cause liquidity problems for us in the future if deposits are not made in the volumes we expect or are not renewed. If a substantial number of our depositors withdraw their demand deposits, or do not roll over their time deposits upon maturity, we may be materially and adversely affected.

There can be no assurance that, in the event of a sudden or unexpected shortage of funds in the banking system, we will be able to maintain levels of funding without incurring high funding costs, a reduction in the term of funding instruments, or the liquidation of certain assets. If this were to happen, we could be materially adversely affected.

Credit, market and liquidity risk may have an adverse effect on our credit ratings and our cost of funds. Any downgrading in our credit ratings would likely increase our cost of funding, require us to post additional collateral or take other actions under some of our derivative contracts and adversely affect our interest margins and results of operations.

Credit ratings affect the cost and other terms upon which we are able to obtain funding. Rating agencies regularly evaluate us, and their ratings of our debt are based on internal methodologies dependent on a number of factors, including our financial strength and conditions affecting the financial services industry generally.

Any downgrade in our or Santander's debt credit ratings would likely increase our borrowing costs and require us to post additional collateral or take other actions under some of our derivative contracts, and could limit our access to capital markets and adversely affect our commercial business. For example, a ratings downgrade could adversely affect our ability to sell or market certain of our products, engage in certain longer-term and derivatives transactions and retain customers, particularly customers who need a minimum rating threshold in order to invest. In addition, under the terms of certain of our derivatives contracts, we may be required to maintain a minimum credit rating or terminate the contracts. Any of these results of a ratings downgrade, in turn, could reduce our liquidity and have an adverse effect on us, including our operating results and financial condition.

We conduct a significant number of our material derivatives activities through Santander and Santander UK. We estimate that, as of December 31, 2025, if all of the rating agencies were to downgrade Santander’s or Santander UK’s long-term senior debt ratings, we would be required to post additional collateral pursuant to derivatives and other financial contracts. Refer to further discussion in Note 14 of the Notes to the Consolidated Financial Statements.

While certain potential impacts of these downgrades are contractual and quantifiable, the full consequences of a credit rating downgrade are inherently uncertain, as they depend on numerous dynamic, complex and inter-related factors and assumptions, including market conditions at the time of any downgrade, whether any downgrade of a company's long-term credit rating precipitates downgrades to its short-term credit rating, and assumptions about the potential behaviors of various customers, investors and counterparties. Actual outflows could be higher or lower than this hypothetical example depending on certain factors, including which credit rating agency downgrades our credit rating, any management or restructuring actions that could be taken to reduce cash outflows and the potential liquidity impact from loss of unsecured funding (such as from money market funds) or loss of secured funding capacity. Although unsecured and secured funding stresses are included in our stress testing scenarios and a portion of our total liquid assets is held against these risks, it is still the case that a credit rating downgrade could have a material adverse effect on the Company, SBNA, and SC.

In addition, if we were required to cancel our derivatives contracts with certain counterparties and were unable to replace those contracts, our market risk profile could be altered.

There can be no assurance that the rating agencies will maintain their current ratings or outlooks on us. In general, the future evolution of our ratings will be linked, to a large extent, to the macroeconomic outlook and on the impact of significant events on our asset quality, profitability and capital. Failure to maintain favorable ratings and outlooks could increase our cost of funding and adversely affect our net interest margins, which could have a material adverse effect on us.

Market Risks

We are subject to fluctuations in interest rates and other market risks, which may materially and adversely affect us.

Market risk refers to the probability of variations in our net interest income or in the market value of our assets and liabilities due to volatility of interest rates, exchange rates and/or equity prices. Economic activities exposed to market risk include (1) transactions where risk is assumed as a consequence of potential changes in interest rates, inflation rates, exchange rates, stock prices, credit spreads, commodity prices, volatility and other market factors; (2) the liquidity risk from our products and markets; and (3) the balance sheet liquidity risk. Market risk affects (1) our interest income / (charges); (2) the market value of our assets and liabilities, in particular of our securities holdings, loans and deposits, and derivatives transactions; and (3) other areas of our business such as the volume of loans originated or credit spreads.

Interest rate risk arises from movements in interest rates that reduce the value of a financial instrument or portfolio. It can affect loans, deposits, debt securities, most assets and liabilities held for trading, and derivatives. Interest rates are highly sensitive to many factors beyond our control, including monetary policies, regulatory actions affecting the financial sector, domestic and international economic and political conditions, and other factors. Variations in interest rates could affect our net interest income, which constitutes the majority of our revenue, and could reduce our growth rate or result in losses. This is a result of the different effect a change in interest rates may have on the interest earned on our assets and the interest paid on our borrowings. In addition, we may incur costs (which, in turn, will affect our results) as we implement strategies to reduce future interest rate exposure.

Increases in interest rates may reduce the volume of loans we originate. Sustained high interest rates have historically discouraged customers from borrowing and have resulted in increased delinquencies in outstanding loans and deterioration in the quality of assets. Increases in interest rates may also reduce the propensity of our customers to prepay or refinance fixed-rate loans. Increases in interest rates may reduce the value of our financial assets and the collateral used to secure our loans and may reduce gains or require us to record losses on sales of our loans or securities.

In addition, we may experience increased delinquencies in a low interest rate environment when such an environment is accompanied by high unemployment and recessionary conditions.

Some of our investment management services fees are based on financial market valuations of assets certain of our subsidiaries manage or hold in custody for clients. Changes in these valuations can affect noninterest income positively or negatively, and ultimately affect our financial results. Significant changes in the volume of activity in the capital markets, and in the number of assignments we are awarded, could also affect our financial results.

To the extent any of these risks materialize, our net interest income and the market value of our assets and liabilities could be materially adversely affected.

Recent government fiscal and monetary policies and other factors have led to increased inflation in the U.S. and globally

Governmental and regulatory authorities throughout the world implemented fiscal and monetary policies and initiatives to mitigate the effects of the pandemic on the economy and individual businesses and households. These fiscal and monetary policy measures accelerated the economic recovery in 2021, but in turn significantly increased public debt and introduced risks of economic overheating in certain countries. In 2022, inflationary pressures intensified due to a number of factors, including the revitalization of demand for consumer goods, labor shortages, supply chain issues, and the rise in the prices of energy, oil, gas and other commodities exacerbated by the war in Ukraine. In an effort to contain inflation, central banks increased interest rates during 2022 and 2023, contributing to a slowdown of the global economy. After a period of persistent high inflation worldwide, from 2023 onwards inflation gradually converged towards central banks’ objectives, enabling interest rate cuts in the second half of 2024 and throughout 2025. Markets remain focused on the timing and extent of policy rate moves because of their impact on economic growth. A return to periods of high inflation could halt or reverse the recent interest rate cuts, increase our operating costs, and reduce households’ purchasing power, leading to higher delinquencies in our growth as monetary and fiscal policies tighten. Conversely, faster-than-expected monetary easing could compress margins through higher deposit betas and deposit-mix shifts. Any of these developments could have a material adverse effect on our operations, financial condition and prospects.

Market conditions have resulted, and could result, in material changes to the estimated fair values of our financial assets. Negative fair value adjustments could have a material adverse effect on our business, financial condition and results of operations.

In recent years, financial markets have been subject to volatility and the resulting widening of credit spreads. We have material exposures to securities and other investments that are recorded at fair value and are therefore exposed to potential negative fair value adjustments. Asset valuations in future periods, reflecting then-prevailing market conditions, may result in negative changes in the fair values of our financial assets, and also may translate into increased impairments. In addition, the value we ultimately realize on disposal of the asset may be lower than its current fair value. Any of these factors could require us to record negative fair value adjustments, which may have a material adverse effect on our business, financial condition and results of operations.

In addition, to the extent fair values are determined using financial valuation models, such values may be inaccurate or subject to change, as the data used by such models may not be available or may become unavailable due to changes in market conditions, particularly for illiquid assets and in times of economic instability. In such circumstances, our valuation methodologies require us to make assumptions, judgments and estimates in order to establish fair value, and reliable assumptions are difficult to make and are inherently uncertain. In addition, valuation models are complex, making them inherently imperfect predictors of actual results. Any resulting impairments or write-downs could have a material adverse effect on our operating results, financial condition and prospects.

We are subject to market, operational and other related risks associated with our derivatives transactions that could have a material adverse effect on us.

We enter into derivatives transactions for trading purposes as well as for hedging purposes. We are subject to market, credit and operational risks associated with these transactions, including basis risk (the risk of loss associated with variations in the spread between the asset yield and the funding and/or hedge cost) and credit or default risk (the risk of insolvency or other inability of the counterparty to a particular transaction to perform its obligations thereunder, including providing sufficient collateral).

The execution and performance of derivatives transactions depend on our ability to maintain adequate control and administration systems and to hire and retain qualified personnel. Moreover, our ability to monitor, analyze and report derivatives transactions adequately continues to depend, to a great extent, on our IT systems. These factors further increase the risks associated with these transactions and could have a material adverse effect on us.

In addition, disputes with counterparties may arise regarding the terms or the settlement procedures of derivatives contracts, including with respect to the value of underlying collateral, which could cause us to incur unexpected costs, including transaction, operational, legal and litigation costs, or result in credit losses, all of which may impair our ability to manage our risk exposure from these products.

Risk Management

Failure to successfully implement and continue to improve our risk management policies, procedures and methods, including our credit risk management system, could materially and adversely affect us, and we may be exposed to unidentified or unanticipated risks.

Risk management is an integral part of our activities. We seek to monitor and manage our risk exposure through a variety of separate but complementary financial, credit, market, operational, compliance and legal reporting systems. We must also maintain a culture of risk management among our employees. Although we employ a broad and diversified set of risk monitoring and risk mitigation techniques, such techniques and strategies may not be fully effective at mitigating all types of risks in our economic or market environments, including risks that we may fail to identify or anticipate.

Some of our tools and metrics for managing risk are based on observed historical market behavior. We apply statistical and other tools to these observations to arrive at quantifications of our risk exposures. These tools and metrics may fail to predict future risk exposures. These risk exposures could, for example, arise from factors we did not anticipate or correctly evaluate in our statistical models. As a result, our losses therefore could be significantly greater than historical measures indicate. In addition, our statistical models do not take all risks into account. Our approach to managing risks could prove insufficient, exposing us to material unanticipated losses. We could face adverse consequences as a result of decisions based on models that are poorly developed, implemented, or used, or as a result of a modeled outcome being misunderstood or used for purposes for which it was not designed, or if the data or inputs of the models were incorrect or insufficient. In addition, if existing or potential customers believe our risk management is inadequate, they could take their business elsewhere or seek to limit transactions with us. This could have a material adverse effect on our reputation, operating results, financial condition, and prospects.

As a commercial bank, one of the main types of risks inherent in our business is credit risk. For example, an important feature of our credit risk management is the use of an internal credit rating to assess the particular risk profile of a customer. Since this process involves detailed analyses of the customer, taking into account both quantitative and qualitative factors, it is subject to human and IT systems errors. In exercising their judgment on the current and future credit risk of our customers, our employees may not always assign an accurate credit rating, which may result in a higher exposure to credit risks than indicated by our risk rating system.

We have been refining our credit policies and guidelines to address potential risks associated with particular industries or types of customers. However, we may not be able to timely detect all possible risks before they occur or, due to limited tools available to us, our employees may not be able to implement them effectively, which may increase our credit risk. Failure to effectively implement, consistently follow or continuously refine our credit risk management system may result in an increase in the level of NPLs and a higher risk exposure for us, which could have a material adverse effect on our business, financial condition and results of operations.

Model Risk

We rely on models for many of our decisions. Their inaccurate or incorrect use could have a material adverse effect on us.

We use models for approval (scoring/rating), capital calculation, behavior, provisions, market, operational risk, compliance and liquidity. A model is a system, approach or quantitative method that applies statistical, economic, financial or mathematical theories, techniques or hypotheses to transform input data into quantitative estimates. It involves simplified representations of real world relationships between characteristics, values and observed assumptions that allows us to focus on specific aspects. Model risk is the negative consequence of decisions based on their inaccurate, improper or incorrect use. Sources of model risk include (1) incorrect or incomplete data in the model itself or the modelling method used in systems; and (2) incorrect use or implementation of the model.

Model risk can cause financial loss, erroneous commercial and strategic decision-making and/ordamage to our transactions. In addition, the fair value of our financial assets, determined using financial valuation models, may be inaccurate or subject to change and, as a consequence, we may have to recognize impairments or write-downs that could have a material adverse effect on our operating results, financial condition and prospects. Market conditions have resulted and could result in material changes to the estimated fair values of our financial assets. Negative fair value adjustments could have a material adverse effect on our operating results, financial condition and prospects.

Business and Industry Risks

The financial problems our customers face could adversely affect us.

Market turmoil and economic recession could materially and adversely affect the liquidity, businesses and/or financial condition of our borrowers, which could in turn increase our NPL ratios, impair our loans and other financial assets and result in decreased demand for borrowings in general. Any of the conditions described above could have a material adverse effect on our business, financial condition and results of operations.

Increased competition and industry consolidation may adversely affect our results of operations.

We face substantial competition in all parts of our business from numerous banks and non-bank providers of financial services, including in originating loans and attracting deposits, providing customer service, the quality and range of products and services, technology, interest rates and overall reputation, and we expect competitive conditions to continue to intensify. Our competition comes principally from other domestic and foreign banks, mortgage banking companies, consumer finance companies, insurance companies and other lenders and purchasers of loans.

There has been a trend towards consolidation in the banking industry, which has created larger banks with which we must now compete. Some of our competitors are substantially larger than we are, which may give those competitors advantages such as a more diversified product and customer base, the ability to reach more customers and potential customers, operational efficiencies, lower-cost funding and larger branch networks. Many competitors are also focused on cross-selling their products, which could affect our ability to maintain or grow existing customer relationships or require us to offer lower interest rates or fees on our lending products or higher interest rates on deposits. There can be no assurance that increased competition will not adversely affect our growth prospects and therefore our operations. We also face competition from non-bank competitors such as brokerage companies, department stores (for some credit products), leasing and factoring companies, mutual fund and pension fund management companies and insurance companies.

Non-traditional providers of banking services, such as financial technology companies, internet based e-commerce providers, mobile telephone companies and internet search engines, may offer and/or increase their offerings of financial products and services directly to customers. These non-traditional providers of banking services currently have an advantage over traditional providers because they are not subject to the same regulatory or legislative requirements to which we are subject. Several of these competitors may have long operating histories, large customer bases, strong brand recognition and significant financial, marketing and other resources. They may adopt more aggressive pricing and rates and devote more resources to technology, infrastructure and marketing.

New competitors may enter the market or existing competitors may adjust their services with unique product or service offerings or approaches to providing banking services. If we are unable to compete successfully with current and new competitors, or if we are unable to anticipate and adapt our offerings to changing banking industry trends, including technological changes, our business may be adversely affected. In addition, our failure to anticipate or adapt to emerging technologies or changes in customer behavior effectively, including among younger customers, could delay or prevent our access to new digital-based markets, which would in turn have an adverse effect on our competitive position and business. Furthermore, the widespread adoption of new technologies, including distributed ledger, artificial intelligence, and/or biometrics, to provide services such as cryptocurrencies and payments, could require substantial expenditures to modify or adapt our existing products and services as we continue to grow our internet and mobile banking capabilities. Our customers may choose to conduct business or offer products in areas that may be considered speculative or risky. Such new technologies and the rise in customer use of internet and mobile banking platforms in recent years could negatively impact the value of our investments in bank premises, equipment and personnel for our branch network. The persistence or acceleration of this shift in demand towards internet and mobile banking may necessitate changes to our retail distribution strategy, which may include closing and/or selling certain branches and restructuring our remaining branches and workforce. These actions could lead to losses on these assets and increased expenditures to renovate, reconfigure or close a number of our remaining branches or otherwise reform our retail distribution channel. Furthermore, our failure to keep pace with innovation or to swiftly and effectively implement such changes to our distribution strategy could have an adverse effect on our competitive position.

Increasing competition could also require that we increase the rates we offer on deposits or lower the rates we charge on loans, which could also have a material adverse effect on our business, financial condition and results of operations. It may also negatively affect our business results and prospects by, among other things, limiting our ability to increase our customer base and expand our operations and increasing competition for investment opportunities.

If our customer service levels were perceived by the market to be materially below those of our competitors, we could lose existing and potential business. If we are not successful in retaining and strengthening customer relationships, we may lose market share, incur losses on some or all of our activities or fail to attract new deposits or retain existing deposits. Additionally, reputational or operational incidents associated with new products could affect customer trust and brand perception, amplifying competitive pressures. Any of the considerations described above could have amaterial adverse effect on our business, financial condition and prospects.

Inability to manage the growth of our operations or to integrate our inorganic growth successfully could adversely impact profitability

We allocate management and planning resources to develop strategic plans for organic growth, and to identify possible acquisitions and disposals and areas for restructuring our businesses. From time to time, we evaluate acquisition, partnership, divestiture and other strategic opportunities that we believe offer additional value to our shareholders and are consistent with our business strategy. However, we may not be able to identify suitable acquisition, partnership, divestiture or other strategic candidates. Additionally, we may be unable to complete ongoing or future acquisitions, partnerships, divestitures or other strategic transactions in a timely or cost-effective manner, on the originally announced terms, or at all. Even if we complete any such transactions successfully, we may not be able to successfully realize the expected results, benefits or synergies in a timely manner or at all. These results, benefits or synergies could also be adversely affected by acquisition or divestiture-related charges and contingencies. In particular, our ability to benefit from any such acquisitions or partnerships depend in part on our successful integration of those businesses. Any such integration entails significant risks, such as unforeseen difficulties in integrating operations and systems, unexpected liabilities or contingencies relating to the acquired businesses, and delivery and execution risks. We can give no assurances that our expectations with regards to integration and synergies of these businesses will materialize. We also cannot provide assurance that we will, in all cases, be able to manage our growth effectively or deliver our strategic growth objectives. Challenges that may result from our strategic growth decisions include our ability to:

•manage the operations and employees of expanding businesses efficiently;

•maintain or grow our existing customer base;

•assess the value, strengths and weaknesses of investment or acquisition candidates, including local regulation that can reduce or eliminate expected synergies;

•finance strategic investments or acquisitions;

•align our current IT systems adequately with those of an enlarged group;

•apply our risk management policies effectively to an enlarged group;

•manage a growing number of entities without over-committing management or losing key personnel; and

•operate and implement SBNA’s new online banking platform Openbank with our other banking systems seamlessly and efficiently.

Any failure to manage growth effectively could have a material adverse effect on our financial condition and results of operations.

We may also be subject to litigation in connection with or as a result of, any such transactions, including claims from terminated employees, customers, suppliers or third parties. For example, in the case of an acquisition, we may be held responsible for the activities of an acquired business. This includes liability for actions or non-compliance of an acquired business prior to its acquisition or in connection with its acquisition or integration. In the case of a divestiture, we may be required to indemnify the buyer for certain liabilities in connection with claims against the divested entity or business.

Completion and integration of any such transactions may also divert management attention from other matters, result in additional costs and expenses, or adversely affect our relationships with our customers, suppliers, employees and any other third parties, any of which may adversely affect our business or results of operations.

Good will impairments may be required in relation to acquired businesses.

We have made business acquisitions for which it is possible that the goodwill which has been attributed to those businesses may have to be written down if our valuation assumptions are required to be reassessed as a result of any deterioration in the business’ underlying profitability, asset quality, interest rate environment, or other relevant matters. Impairment testing with respect togoodwill is performed annually, more frequently if impairment indicators are present, and includes a comparison of the carrying amount of the reporting unit with its fair value. If the carrying value of the reporting unit is higher than the fair value, the impairment is measured as this excess of carrying value over fair value. We did not recognize any impairments of goodwill in 2025, 2024, or 2023; however, based on future market conditions and the Company's financial performance, it is possible we may be required to record additional impairment of goodwill attributable to one or more of the Company's reporting units in the future. There can be no assurance that we will not have to write down the value attributed to goodwill further in the future, which would not impact risk-based capital ratios adversely but would adversely affect our results of operations and stockholder's equity.

We rely on recruiting, retaining and developing appropriate senior management and skilled personnel.

Our continued success depends partly on the continued service of key members of our management team. The ability to continue to attract, train, motivate and retain highly qualified professionals is a key element of our strategy. The successful implementation of our growth strategy depends on the availability of skilled management and employees. If we or one of our business units or other functions do not staff operations or lose one or more key senior executives and fail to replace them promptly and effectively, our business, financial condition and results of operations, including control and operational risks, may be adversely affected.

The financial industry in the United States and abroad faces and may continue to face more stringent regulation of employee compensation, which could have an adverse effect on our ability to retain our experienced management team and key employees and our ability to attract appropriately qualified personnel, which could have a material adverse impact on our business, financial condition, and results of operations.

Damage to our reputation could cause harm to our business prospects.

Maintaining a positive reputation is critical to our attracting and maintaining customers, investors and employees and conducting business transactions with our counterparties. Damage to our reputation could materially and adversely affect how we are perceived by current and potential clients, investors, vendors, partners, regulators, and other third parties, which in turn could have a material adverse effect on our operating results, financial condition, and prospects as well as damage our customers' and investors' confidence. Harm to our reputation can arise from numerous sources including, among others, employee misconduct, litigation or regulatory outcomes, failure to deliver minimum standards of service and quality, dealing with sectors that are not well perceived by the public (e.g., weapons industries), dealing with customers on sanctions lists, ratings downgrades, compliance failures, unethical behavior, press speculation, perception of our environmental, social and governmental practices and disclosures, and the activities of customers and counterparties, including activities that affect the environment negatively. Further, adverse publicity, regulatory actions or fines, litigation, operational failures or the failure to meet client expectations or other obligations could materially and adversely affect our reputation, our ability to attract and retain clients or our sources of funding for the same or other businesses. Our reputation could also suffer if we are the subject of negative coverage in the media, whether it has merit or not.

Actions by the financial services industry generally or by certain members of, or individuals in, the industry can also affect our reputation. Since we are part of the global Santander group and conduct business under the “Santander” brand, negative public opinion about the actions or activities of other Santander businesses around the world could affect our reputation adversely. Additionally, the role played by financial services firms in the financial crisis and increased regulatory supervision and enforcement have caused public perception of us and others in the financial services industry to decline. Such criticism could take many forms, including protests at our locations, and could increase dissatisfaction among customers, investors and employees of the Company and damage the Company’s reputation. Alternatively, yielding to such activism could damage the Company’s reputation with groups whose views are not aligned with those of the activists. In either case, certain clients and customers may cease to do business with the Company, and the Company’s ability to attract new clients and customers may be diminished. Activist pressure can also be a factor when we consider pursuing new business opportunities, potentially resulting in our not pursuing otherwise profitable opportunities.

Prese rving and enhancing our reputation also depends on maintaining systems, procedures and controls that address known risks and regulatory requirements, as well as our ability to timely identify, understand and mitigate additional risks that arise due to changes in our businesses and the markets in which we operate, the regulatory environment and customer expectations.

We could suffer significant reputational harm if we fail to identify and manage potential conflicts of interest properly. The failure to adequately address, or the perceived failure to adequately address, conflicts of interest could affect the willingness of clients to deal with us or give rise to litigation or enforcement actions against us. Therefore, there can be no assurance that conflicts of interest will not arise in the future that could cause material harm to us.

While negative public opinion once was primarily a response to adverse coverage in traditional news media, increased use of social media platforms has resulted in rapid dissemination of information and misinformation, which can magnify potential harm to the Company’s reputation. We may be the subject of misinformation and misrepresentations deliberately propagated in media or social media to harm our reputation or for other deceitful purposes, including by others seeking to gain an illegal market advantage by spreading false information about us. There can be no assurance that we would be able to neutralize or contain false information that may be propagated regarding the Company, which could have an adverse effect on our operating results, financial condition and prospects.

Fraudulent activity associated with our products or networks could cause us to suffer reputational damage, the use of our products to decrease and our fraud losses to be materially adversely affected. We are subject to the risk of fraudulent activity associated with merchants, customers and other third parties handling customer information. The risk of fraud continues to increase for the financial services industry in general. Credit and debit card fraud, identity theft and related crimes are prevalent, and perpetrators are growing more sophisticated. Our resources, customer authentication methods and fraud prevention tools may not be sufficient to accurately predict or prevent fraud. Additionally, our fraud risk continues to increase as third parties that handle confidential consumer information suffer security breaches and we expand our direct banking business and introduce new products and features. Our financial condition, the level of our fraud charge-offs and other results of operations could be materially adversely affected if fraudulent activity were to increase significantly. High-profile fraudulent activity could negatively impact our brand and reputation. In addition, significant increases in fraudulent activity could lead to regulatory intervention and reputational and financial damage to our brands, which could negatively impact the use of our products and services and have a material adverse effect on our business, financial condition and results of operations.

SBNA engages in transactions with its affiliates that may not be on favorable terms to the affiliate.

Federal banking laws establish numerous requirements for transactions banks have with their affiliates, including that such transactions be on terms and conditions that are at least as favorable to the bank as those prevailing at the time for comparable transactions the bank has with non-affiliates.

SBNA enters into many transactions with its affiliates in the ordinary course of business, including agreements pursuant to which SHUSA may render services, such as administrative, accounting, finance, treasury, legal services and others.

SBNA is likely to continue to engage in transactions with affiliates and such transactions are not required to be and may not be considered favorable to SHUSA.

Technology and Cybersecurity Risks

Risks relating to our IT infrastructure, management information systems, data collection, processing, storage systems and security are inherent in our business

Our ability to remain competitive depends in part on our ability to maintain, protect and upgrade our IT on a timely and cost-effective basis. We must continually make significant investments and improvements in our IT infrastructure in order to meet the needs of our customers. and comply with evolving regulatory requirements and operational and resilience expectations. While we expect to continue such investments, there is no assurance that we will achieve or sustain the level of capital expenditures necessary to support the continuous improvement and upgrading of our IT infrastructure in the future. To the extent we are dependent on any particular technology or technological solution, we may be harmed if that technology or technological solution becomes non-compliant with existing industry standards, fails to meet or exceed the capabilities of our competitors’ comparable technologies or technological solutions, becomes increasingly expensive to service, retain and update, becomes subject to third-party claims of intellectual property infringement, misappropriation or other violation, or malfunctions or functions in a way that we did not anticipate. Additionally, new technologies and technological solutions are being released continually. Accordingly, it is difficult to predict the problems we may encounter in improving our technologies’ functionality. There is no assurance that we will be able to successfully adopt new technology as critical systems and applications become obsolete and better ones become available. Large scale programs to modernize technology, data and reporting – including compliance with evolving prudential reporting frameworks – are complex and time-consuming (often requiring many years to execute). Delays in execution, data-quality issues, or control weaknesses may lead to supervisory actions, fines, remediation costs or constraints on strategic initiatives. Any failure to improve or upgrade our IT infrastructure and management information systems effectively and in a timely and cost-efficient manner could have a material adverse effect on us.

Quantum computing poses a significant emerging risk to existing encryption standards, potentially enabling data breaches, authentication bypasses and other new types of cyber threats. As regulatory and supervisory scrutiny of post-quantum readiness increases, financial institutions face growing compliance and implementation pressures. The transition to post-quantum cryptography is complex due to legacy systems, interdependent banking infrastructures and evolving international standards. Uneven or delayed adoption across the financial ecosystem could prolong reliance on quantum-vulnerable encryption, thereby increasing systemic exposure and delaying a coordinated and secure transition.

Like other financial institutions with a large customer base, we have been subject to and are likely to continue to be the subject of attempted cyberattacks in light of the fact that we receive, manage, process, hold and transmit proprietary confidential sensitive and personal data including that of our customers and employees, in the conduct of our banking operations, as well as a large number of assets. Our business depends on our ability to process a large number of transactions efficiently and accurately, and on our ability to rely on our digital technologies, computer and e-mail services, spreadsheets, software and networks, as well as on the secure processing, storage and transmission of confidential and other information in our computer systems and networks and those of our third-party service providers. The proper and secure functioning of financial controls, accounting and other data collection and processing systems is critical to our businesses and our ability to compete effectively. Cybersecurity incidents and data losses can result from inadequate personnel, inadequate or failed internal control processes and systems, or external events or actors that interrupt normal business operations. We also face the risk that the design of our cybersecurity controls and procedures proves to be inadequate or is circumvented. Any material disruption or slowdown of our systems could cause information, including data related to customer requests, to be lost or delivered to our clients with delays or errors, which could reduce demand for our products and services, result in customer claims and materially and adversely affect us.

Although we work with our clients, third-party service providers, counterparties and other external parties to develop secure transmission capabilities and prevent information security risk, we routinely exchange personal, confidential and proprietary information by electronic means, which may be a target for attempted cyberattacks. For example, on May 14, 2024, Santander announced that it had become aware of an unauthorized access to a Santander database that included certain customer and employee information hosted by a third-party provider. Only U.S. employee data was involved in this event, no U.S. customer data was involved. Several measures were implemented immediately to manage the incident, such as blocking access to the database, strengthening fraud prevention, preventative actions to prevent similar incidents from occurring again, maintaining direct contact with regulatory agencies and collaborating with law enforcement agencies in the investigation. Risks related to the electronic exchange of sensitive information are especially applicable in the current environment, in which there has been a shift in recent years to work-from-home policies for a significant portion of the workforce, as they access our secure networks remotely. If we cannot maintain effective and secure electronic data and information, management and processing systems or if we fail to maintain complete physical and electronic records, the result could be disruptions to our operations, claims from customers, regulators, employees and other parties, violations of applicable privacy and other laws, regulatory sanctions and serious reputational and financial harm to us.

Many companies across the country and in the financial services industry have reported significant breaches in the security of their websites or other systems. Cybersecurity risks have increased significantly in recent years due to the development and proliferation of new technologies, increased use of the internet and telecommunications technology to conduct financial transactions, and increased sophistication and activities of organized crime groups, state-sponsored and individual hackers, terrorist organizations, disgruntled employees and other insiders, activists and other threat actors. Financial institutions, the government and retailers have in recent years reported cyber incidents that compromised data, resulted in the theft of funds or the theft or destruction of corporate information and other assets.

We take protective measures and continuously monitor, assess and enhance our systems to protect our technology infrastructure and data from misappropriation, corruption, unauthorized access, or disruption. We maintain a cybersecurity and information security risk management program that includes policies, practices, and controls designed to prevent, detect, respond to, and recover from disruptions to our systems and to enhance the security and resilience of our infrastructure, as described in greater detail in Item 1C - Cybersecurity of this Annual Report on Form 10-K.

Our controls and capabilities include performing ongoing risk assessments for information systems that store, transmit or process information assets, and implementing preventative and detective controls commensurate with identified risks. We also maintain processes to identify, assess, and manage cybersecurity and information security risks associated with third-party service providers through due diligence, contractual requirements, ongoing monitoring, and periodic assessments of service providers’ operations and controls. We develop and enforce controls governing user access to systems and software based on the principle of least privilege, under which access is prohibited unless expressly authorized, limited to the minimum necessary for business purposes, and promptly modified or terminated when no longer required. We also maintain controls to monitor and review access rights and system activity. In addition, we maintain incident response and business continuity processes designed to enable the timely identification, escalation, containment, and remediation of cybersecurity incidents, and to support the continued operation of critical business functions. We seek to educate and maintain awareness among our employees regarding information security and privacy risks, controls, and individual responsibilities through ongoing training and awareness programs. Our cybersecurity and information security program is reviewed and updated regularly to address changes in our business, technology environment, regulatory requirements, and the evolving threat landscape.

Nevertheless, while we have not experienced material losses or other material consequences relating to cyberattacks or other information or security breaches, whether directed at us, our third parties or other external parties that our third parties rely on, our systems, software and networks, as well as those of our clients, third-party service providers, counterparties and other third parties, may be vulnerable to unauthorized access, misuse, computer viruses or other malicious code, phishing attacks, cyberattacks such as denial of service, malware, ransomware, phishing, and other events of a similar nature. Such events could result in security breaches or give rise to the manipulation or loss of significant amounts of personal, proprietary or confidential information of our customers, employees, suppliers, counterparties and other third parties, disrupt, sabotage or degrade service on our systems, or result in the theft or loss of significant levels of liquid assets, including cash. We may also be impacted by cyberattacks against national critical infrastructure in the geographic locations in which we operate, such as telecommunications networks. Our IT systems are dependent on such national critical infrastructure and cyberattacks against such infrastructure could affect our ability to service our customers negatively.

Our technology and cybersecurity risk profile is affected by our reliance on third-party service providers, including providers of cloud infrastructure, data services, and cybersecurity solutions upon which certain critical systems, applications, and data processing capabilities depend. Reliance on these vendors may increase our exposure to operational disruptions, cybersecurity incidents, or systemic outages. Any prolonged service interruption or security failure could impair our ability to operate critical business functions, serve customers, or comply with regulatory requirements. Our ability to transition services to alternative providers may be constrained by available alternative options; contractual, technical, or operational considerations; increasing remediation costs; and extending recovery timelines.

As cybersecurity threats continue to evolve and increase in sophistication, we cannot guarantee the effectiveness of our policies, practices and controls to protect against all such circumstances that could result in disruptions to our systems. This is because, among other reasons, the techniques used in cyberattacks change frequently and cyberattacks can originate from a wide variety of sources, including not only cyber-criminals but also activists and states regarded by the international community to be rogue states. Threat actors may seek to gain access to our systems either directly or by using equipment or passwords belonging to employees, customers, third-party service providers or other authorized users of our systems. In theevent of a cyberattack or security breach affecting a third-party entity on which we rely, our ability to conduct business, and the security of our customer information, could be impaired in a manner to that of a cyberattack or security breach affecting us directly. We also may not receive information or notice of the breach in a timely manner, or we may have limited options to influence how and when the cyberattack or security breach is addressed.

As financial institutions continue to be interconnected with central agents, exchanges and clearinghouses, they may be increasingly susceptible to negative consequences of cyberattacks and security breaches affecting the systems of such third parties. It could take a significant amount of time for a cyberattack to be investigated, during which time we may not be in a position to fully understand and remediate the attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences associated with a particular cyberattack. The perception of a security breach affecting us or any part of the financial services industry, whether correct or not, could result in a loss of confidence in our cybersecurity measures or otherwise damage our reputation with customers and third parties with whom we do business. Should such adverse events occur, we may not have indemnification or other protection from the third party sufficient to compensate or protect us from the consequences.

As attempted cyberattacks continue to evolve, we may incur significant costs in our attempts to modify or enhance our protective measures against such attacks to investigate or remediate any vulnerability or resulting breach, or in communicating cyberattacks to our customers. An interception, misuse or mishandling of personal, confidential or proprietary information sent to or received from a client, vendor, service provider, counterparty or third party or a cyberattack could result in our inability to recover or restore data that has been stolen, manipulated or destroyed, damage to our systems and those of our clients, customers and counterparties, violations of applicable privacy and other laws, or other significant disruption of operations, including disruptions in our ability to use our accounting, deposit, loan and other systems and our ability to communicate with and perform transactions with customers, third-party service providers and other parties. These effects could be exacerbated if we would need to shut down portions of our technology infrastructure temporarily to address a cyberattack, if our technology infrastructure is not sufficiently redundant to meet our business needs while an aspect of our technology is compromised, or if a technological or other solution to a cyberattack is slow to be developed. Even if we timely resolve the technological issues in a cyberattack, a temporary disruption in our operations could adversely affect customer satisfaction and behavior, expose us to reputational damage, contractual claims, regulatory, supervisory or enforcement actions, or litigation.

U.S. banking agencies and other federal and state government agencies continue to focus their attention on cybersecurity and data privacy risks and have proposed enhanced risk management standards that would apply to us. In recent years, the SEC adopted new rules related to disclosures of cybersecurity risk management, strategy, governance, and incidents by public companies. These rules have two main components for domestic public companies: (1) disclosure of material cybersecurity incidents on Form 8-K within four business days of determining that a cybersecurity incident is material; and (2) annual disclosure of a company’s risk management, strategy, and governance relating to cybersecurity matters on Form 10-K. Such legislation and regulations relating to cybersecurity and data privacy may require that we modify systems, change service providers, or alter business practices or policies regarding information security, handling of data and privacy. Additionally, the NYDFS regulations include enhanced requirements including independent audits, additional Board reporting and oversight, authentication, penetration testing, and incident response and continuity planning. These changes are in line with our existing information security program requirements. In addition, the NYDFS requires covered companies to notify the NYDFS within 72 hours after determining that a notifiable cybersecurity event has occurred. Regulations such as these could subject us to heightened compliance complexity and operational costs. We may be required to report events related to data privacy or cybersecurity issues, events where customer information may be compromised, unauthorized access to our systems and other security breaches to affected individuals or the relevant regulatory authorities. To the extent we do not successfully meet supervisory standards pertaining to cybersecurity, we could be subject to supervisory actions, substantial fines, civil and criminal penalties, significant litigation and reputational damage or ordered to change our business practices, policies or systems in a manner that adversely impacts our operating results.

We use AI, which could expose us to liability or adversely affect our business.

We utilize, and continue to explore additional uses of, AI in connection with our business, products and services, including AI designed to improve the customer experience and reduce operational risk.

However, there are significant risks involved in utilizing AI, and no assurance can be provided that our use will enhance our products or services or produce the intended results. For example, AI models may be flawed, trained on insufficient or poor-quality data, reflect unwanted forms of bias or contain other errors or inadequacies, any of which may not be easily detectable. AI solutions (including those supplied by third parties) may produce false, inaccurate, misleading, biased or otherwise deficient inferences or outputs, rely on data, technology or intellectual property to which we or any of our contractors, vendors or service providers lack rights, or be subject to new documentation, transparency, governance and validation expectations. Strengthening controls to address these risks—such as human oversight, testing and independent model validation—may increase costs and affect time-to-market, and any errors or inadequacies in AI systems used for control functions (such as transaction monitoring or sanctions screening) could lead to operational disruptions, compliance failures, regulatory scrutiny, reputational harm, fines or penalties. AI may subject us to new or heightened legal, regulatory, ethical, operational, reputational or other challenges, and AI may involve inappropriate or controversial data practices by developers and end-users, or other factors adversely affecting public opinion of AI, any of which could impair the acceptance of AI solutions. We also depend on third-party models, datasets and infrastructure; outages, and changes in functionality or terms or concentration in a limited number of providers could disrupt our operations or increase costs.

If the AI solutions we create or use are deficient, inaccurate or controversial, we could incur operational inefficiencies, competitive harm, legal liability, brand or reputational harm, or other adverse impacts on our business and financial results. There can be no assurance that our use of AI will be successful in reducing our operational risk or increasing our operational efficiencies or otherwise result in our intended outcomes.

Additionally, the use of AI solutions by companies has resulted in and may continue to result in cyberattacks, data breaches, data losses and other security incidents that implicate the proprietary, confidential, sensitive and personal data of AI users. For example, if any of our employees, contractors, vendors, service providers or other third parties with which we do business use any third-party AI-powered solutions in connection with our business, it may lead to the inadvertent disclosure or incorporation of our proprietary, confidential, sensitive or personal data into third-party systems or publicly available or third-party training sets (including so-called 'data leakage'), which may impact our ability to realize the benefits of our intellectual property or proprietary, confidential, sensitive or personal data, harming our competitive position and business. If we do not have sufficient rights to use the data or other material or content on which our AI solutions or other AI tools we use rely, we also may incur liability through the violation of applicable laws and regulations, third-party intellectual property, privacy or other rights, or contracts to which we are a party (including third-party claims of intellectual property infringement, misappropriation or other violation or other misuse of data, content or technology, regulatory enforcement actions and contractual remedies). Further, the use of AI solutions within products or services that we use or that are used by our contractors, vendors, service providers or other third parties with which we do business may pose similar risks, and we have limited ability to control the manner in which third-party products are developed or maintained or the manner in which third-party services are provided.

Advances in AI, including generative AI, may also be used by threat actors to facilitate cyber attacks, including the creation of highly convincing phishing and social-engineering campaigns, automated malware development, deepfake-enabled fraud, reconnaissance and vulnerability discovery, and the rapid scaling and customization of attacks across multiple targets. The evolving nature of these threats empowered by AI increases the threat landscape and complexity and heightens cybersecurity, operational, and financial risk.

Risks Associated with our Auto Lending Business

The financial results of the auto lending business could have a negative impact on the Company's operating results and financial condition.

The auto lending business historically has provided a significant source of funding to the Company through earnings. The auto lending business involves risk, including the possibility that poor operating results could negatively affect the operating results of SHUSA.

Factors that affect the financial results of the auto lending business in addition to those which have been previously addressed include, but are not limited to:

•Our auto lending business may be negatively impacted if it is unsuccessful in developing and maintaining relationships with automobile dealerships that correlate to the ability to acquire loans and automotive leases. In addition, economic downturns may result in the closure of dealerships and corresponding decreases in sales and loan volumes.

•Our auto lending business could be negatively impacted if it is unsuccessful in developing and maintaining its serviced for others portfolio. As this is a significant and growing portion of the auto lending business strategy, if an institution for which we currently service assets chooses to terminate rights as a servicer or if we fail to add additional institutions or portfolios to our servicing platform, the auto lending business may not achieve the desired revenue or income from this platform.

•We have repurchase obligations in our capacity as a servicer in securitizations and whole loan sales. If significant repurchases of assets or other payments are required under our responsibility as a servicer, this could have a material adverse effect on the auto lending business' financial condition, results of operations, and liquidity.

Business and Industry Risks

Our ability to maintain our competitive position depends, in part, on the success of new products and services we offer our clients and our ability to continue offering products and services from third parties, and we may not be able to manage various risks we face as we expand our range of products and services that could have a material adverse effect on us.

The success of our operations and our profitability depend, in part, on the success of new products and services we offer our clients and our ability to continue offering products and services from third parties. However, we cannot guarantee that our new products and services will be responsive to client demands or successful once they are offered to our clients, or that they will be successful in the future. In addition, our clients’ needs or desires may change over time, and such changes may render our products and services obsolete, outdated or unattractive, and we may not be able to develop new products that meet our clients’ changing needs. Our success is also dependent on our ability to anticipate and leverage new and existing technologies that may have an impact on products and services in the banking industry. Technological changes may further intensify and complicate the competitive landscape and influence client behavior. If we cannot respond in a timely fashion to the changing needs of our clients, we may lose clients, which could in turn materially and adversely affect us.

The introduction of new products and services can entail significant time and resources, including regulatory approvals. Substantial risks and uncertainties are associated with the introduction of new products and services, including technical and control requirements that may need to be developed and implemented, rapid technological change in the industry, our ability to access technical and other information from our clients and the significant and ongoing investments required to bring new products and services to market in a timely manner at competitive prices. Our failure to manage these risks and uncertainties also exposes us to the enhanced risk of operational lapses, which may result in the recognition of financial statement liabilities. Regulatory and internal control requirements, capital requirements, competitive alternatives, vendor relationships and shifting market preferences may also determine whether initiatives can be brought to market in a manner that is timely and attractive to our clients. Failure to manage these risks in the development and implementation of new products or services successfully could have a material adverse effect on our business and reputation, as well as on our consolidated results of operations and financial condition. In addition, the cost of developing products that are not launched is likely to affect our business, financial condition and results of operations. Any or all of these factors, individually or collectively, could have a material adverse effect on our business, financial condition and results of operations.

We rely on third parties for important products and services.

Third-party vendors provide key components of our business infrastructure such as loan and deposit servicing systems, back office and business process support and software, information technology, internet connections and network access, including cloud-based services. Third parties can be sources of operational risk to us, including with respect to security breaches and cyberattacks affecting those parties. We also are subject to risk with respect to security breaches affecting the vendors and other parties that interact with those service providers. Wemay be required to take steps to protect the integrity of our operational systems, thereby increasing our operational costs and potentially decreasing customer satisfaction. In addition, any problems caused by these third parties, including as a result of their not providing us their services for any reason, their performing their services poorly, or employee misconduct could adversely affect our ability to deliver products and services to customers and otherwise to conduct business, which could lead to reputational damage and regulatory investigations and intervention. Replacing these third-party vendors could also entail significant delays and expense. Further, the operational and regulatory risk we face as a result of these arrangements may be increased to the extent that we restructure them. Any restructuring could involve significant expense to us and entail significant delivery and execution risk, which could have a material adverse effect on our business, financial condition and results of operations.

Our business and financial performance could be adversely affected, directly or indirectly, by disasters, natural or otherwise, including geopolitical events such as terrorist activities, international hostilities, public health emergencies and government responses to such events.

Neither the occurrence nor potential impact of disasters (such as earthquakes, hurricanes, tornadoes, floods and other severe weather conditions, pandemics, and other significant public health emergencies, dislocations, fires, explosions, or other catastrophic accidents or events), terrorist activities or international hostilities can be predicted. However, these occurrences could impact us directly (for example, by causing significant damage to our facilities, preventing a subset of our employees from working for a prolonged period and otherwise preventing us from conducting our business in the ordinary course), or indirectly as a result of their impact on our borrowers, depositors, other customers, suppliers or other counterparties. We could also suffer adverse consequences to the extent that disasters, terrorist activities or international hostilities affect the financial markets or the economy in general or in any particular region. These types of impacts could lead, for example, to an increase in delinquencies, bankruptcies and defaults that could result in our experiencing higher levels of nonperforming assets, net charge-offs and provisions for credit losses.

Our ability to mitigate the adverse consequences of such occurrences is in part dependent on the quality of our resiliency planning and our ability to anticipate the nature of any such event that may occur. The adverse impact of disasters, terrorist activities or international hostilities also could be increased to the extent that there is a lack of preparedness on the part of national or regional emergency responders or on the part of other organizations and businesses with which we deal.

The emergence or outbreak of public health emergencies may force countries to adopt measures similar to those adopted in response to the COVID-19 pandemic that restrict economic activity, may deteriorate the macroeconomic environment and may adversely impact our business and results of operations, including, among others: (1) decreased demand for our products and services; (2) material impairment of our loans and other assets, including goodwill; (3) decline in the value of collateral; (4) constraints on our liquidity due to market conditions, exchange rates and customer withdrawal of deposits and continued draws on lines of credit; (5) downgrades to our credit ratings; and (6) operational disruptions, technology infrastructure failures, increased cybersecurity risks or governmental restrictions affecting our operations. Any downgrade in our credit rating would likely increase our cost of funding, require us to post additional collateral or take other actions under some of our derivative and other contracts and adversely affect our interest margins and results of operations. Any such events could materially and adversely affect our business, financial condition, liquidity and results of operations.

We are also subject to geopolitical risks, such as sanctions, state-sponsored cyberattacks, civil unrest, government or military conflicts and the U.S. or foreign governments’ reactions to such events. For example, disagreements between the U.S. and significant trading partners over economic or political matters such as international trade may result in new or continued sanctions, tariffs and other similar restrictions on trade and investment between countries, which may result in supply chain disruptions and increased costs that could negatively affect us, our customers and our counterparties. In addition, conflicts between countries such as the Russian military action against Ukraine and ongoing conflicts in the Middle East, could lead to regional instability, a rise in commodity prices, increase inflationary pressures and market volatility, and thereby have an indirect effect on us even when we do not have material exposure to such countries.

We depend in part upon dividends and other funds from subsidiaries.

Most of our operations are conducted through our subsidiaries. As a result, our ability to pay dividends, to the extent we decide to do so, depends in part on the ability of our subsidiaries to generate earnings and pay dividends to us. Payment of dividends, distributions and advances by our subsidiaries will be contingent on our subsidiaries’ earnings and business considerations and are limited by legal and regulatory restrictions. Additionally, our right to receive any assets of our subsidiaries as an equity holder of such subsidiaries upon their liquidation or reorganization will be effectively subordinated to the claims of our subsidiaries’ creditors, including trade creditors.

Financial Reporting and Control Risks

The accounting standard setters and other regulatory bodies periodically change the financial accounting and reporting standards that govern the preparation of our Consolidated Financial Statements. These changes can materially impact how we record and report our financial condition and results of operations, as well as affect the calculation of our capital ratios. In some cases, we could be required to apply a new or revised standard retroactively, resulting in the restatement of prior period financial statements.

Climate Change Disclosure

We periodically disclose information such as emissions and other climate-related performance data, statistics, metrics and/or targets. If we lack robust and high-quality climate-related procedures, controls and data, we may not be able to disclose reliable climate-related information accurately. In addition, because the climate-related information is based on current expectations and future estimates about our and third-parties’ operations and businesses and addresses matters that are uncertain to varying degrees, we may not be able to meet our estimates, targets or commitments or we may not be able to achieve them within the timelines we announce. Actual or perceived shortcomings with respect to these emissions and other climate-related initiatives and reporting could result in litigation or regulatory enforcement and impact our ability to hire and retain employees, increase our customers base, and attract and retain certain types of investors.

Any of the conditions described above could have a material adverse effect on our business, financial condition and results of operations.

Disclosure controls and procedures over financial and non-financial reporting and internal controls over financial and non-financial reporting may not prevent or detect all errors or acts of fraud, and lapses in these controls could materially and adversely affect our operations, liquidity and/or reputation.

Disclosure controls and procedures over financial and non-financial reporting are designed to provide reasonable assurance that information required to be disclosed by the Company in reports filed or submitted under the Exchange Act is accumulated and communicated to management, and recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. We also maintain a system of internal controls over financial reporting. However, these controls may not achieve their intended objectives. Control processes that involve human diligence and compliance, such as our disclosure controls and procedures and internal controls over financial reporting, are subject to lapses in judgement and breakdowns resulting from human failures. Controls can be circumvented by collusion or improper management override. Because of these limitations, there are risks that material misstatements due to error or fraud may not be prevented or detected, and that information may not be reported on a timely basis.

Further, there can be no assurance that we will not suffer from material weaknesses in disclosure controls and processes over financial reporting in the future. If we fail to remediate any future material weaknesses or fail to otherwise maintain effective internal controls over financial reporting in the future, such failure could result in a material misstatement of our annual or quarterly financial statements that would not be prevented or detected on a timely basis and which could cause investors and other users to lose confidence in our financial statements and limit our ability to raise capital. Additionally, failure to remediate the material weaknesses or otherwise failing to maintain effective internal controls over financial reporting may negatively impact our operating results and financial condition, impair our ability to timely file our periodic reports with the SEC, subject us to additional litigation and regulatory actions and cause us to incur substantial additional costs in future periods relating to the implementation of remedial measures.

Failure to satisfy obligations associated with public securities filings may have adverse regulatory, economic, and reputational consequences.

If we are not able to file our periodic reports within the time periods prescribed by the SEC, among other consequences, we would be unable to use Form S-3 registration statements until we have timely filed our SEC periodic reports for a period of 12 consecutive months. Our inability to use Form S-3 registration statements would increase the time and resources we need to spend if we choose to access the public capital markets.