CAPITAL ONE FINANCIAL CORP

Risk Management Framework

Our Risk Management Framework (the “Framework”) sets consistent expectations for risk management across the Company. It also sets expectations for our “Three Lines of Defense” model, which defines the roles, responsibilities and accountabilities for taking and managing risk across the Company. Accountability for overseeing an effective Framework resides with our Board of Directors either directly or through its committees.

Our Framework sets consistent expectations for risk management across the Company and consists of the following nine elements:

Governance and Accountability

This element of the Framework sets the foundation for the methods for governing risk taking and the interactions within and among our three lines of defense.

We established a risk governance structure and accountabilities to effectively and consistently oversee the management of risks across the Company. Our Board of Directors, Chief Executive Officer and management establish the tone at the top regarding the culture of the Company, including management of risk. Management reinforces expectations at the various levels of the organization.

Strategy and Risk Alignment

Our strategy is informed by and aligned with risk appetite, from development to execution. The Chief Executive Officer develops the strategy with input from the first, second, and third lines of defense, as well as the Board of Directors. The strategic planning process considers relevant changes to the Company’s overall risk profile.

Our Board of Directors approves a Risk Appetite Statement for the Company to set forth the high-level principles that govern risk taking at the Company. The Risk Appetite Statement defines the Board of Directors’ tolerance for certain risk outcomes at an enterprise level and enables senior management to manage and report within these boundaries. This Risk Appetite Statement is also supported by risk category specific risk appetite statements as well as metrics and, where appropriate, Board Limits and Board Notification Thresholds.

Risk Identification

The first line of defense and certain Support Functions identify new and emerging risks, including concentration of risk, across the relevant risk categories associated with their business activities and objectives, in consultation with IRM. Risk identification also must be informed by major changes in infrastructure or organization, introduction of new products and services, acquisitions of businesses, or substantial changes in the internal or external environment.

IRM and certain Support Functions, where appropriate, provide effective challenge in the risk identification process. IRM is also responsible for identifying our material aggregate risks on an ongoing basis.

Assessment, Measurement and Response

Management assesses risks associated with our activities. Risks identified are assessed to understand the severity of each risk and likelihood of occurrence under both normal and stressful conditions. Risk severity is measured through modeling and other quantitative estimation approaches, as well as qualitative approaches, based on management judgment. As part of the risk assessment process, the first and second lines of defense also evaluate the effectiveness of the existing control environment and mitigation strategies.

Management determines the appropriate risk response. Risks may be mitigated or accepted. Actions taken to respond to the risk include implementing new controls, enhancing existing controls, developing additional mitigation strategies to reduce the impact of the risk, and/or monitoring the risk.

Monitoring and Testing

Management periodically monitors risks to evaluate and measure how the risk is affecting our strategy and business objectives, in alignment with risk appetite, including established concentration risk limits. The scope and frequency of monitoring activities depends on the results of relevant risk assessments, as well as specific business risk operations and activities.

The first line of defense is required to evaluate the effectiveness of risk management practices and controls through testing and other activities. IRM and Support Functions, as appropriate, assess the first line of defense’s evaluation of risk management, which may include conducting effective challenge, performing independent monitoring, or conducting risk or control validations. The third line of defense provides independent assurance for first and second line risk management practices and controls.

Aggregation, Reporting and Escalation

Risk aggregation supports strategic decision making and risk management practices through collectively reporting risks across different levels of the Company and providing a comprehensive view of performance against risk appetite. Our risk aggregation processes are designed to aggregate risk information from lower levels of the business hierarchy to high levels and to aggregate risk information to determine material risk themes.

Material risks, new or emerging risks, aggregate risks, risk appetite metrics and other measures across all risk categories are reported to the appropriate governance forum no less than quarterly. Material risks are reported to the Board of Directors and senior management committees no less than quarterly.

Capital and Liquidity Management (including Stress Testing)

Our capital management processes are linked to its risk management practices, including the enterprise-wide identification, assessment and measurement of risks to ensure that all relevant risks are incorporated in the assessment of the Company's capital adequacy. We use identified risks to inform key aspects of the Company’s capital planning, including the development of stress scenarios, the assessment of the adequacy of post-stress capital levels, and the appropriateness of potential capital actions considering the Company’s capital objectives. We quantify capital needs through stress testing, regulatory capital, economic capital and assessments of market considerations. In assessing its capital adequacy, we identify how and where our material risks are accounted for within the capital planning process. Monitoring and escalation processes exist for key capital thresholds and metrics to continuously monitor capital adequacy.

We manage liquidity risk by applying our Liquidity Adequacy Framework (the “Liquidity Framework”). The Liquidity Framework uses internal and regulatory stress testing and the evaluation of other balance sheet metrics to confirm that we maintain a fortified balance sheet that is resilient to uncertainties that may arise as a consequence of systemic, idiosyncratic, or combined liquidity events.

Risk Data and Enabling Technology

Risk data and technology provides the basis for risk reporting and is used in decision making and to monitor and review changes to our risk profile. There are core Governance, Risk Management and Compliance systems which are used as the system of record for risks, controls, issues and events for our risk categories and supports the analysis, aggregation and reporting capabilities across the categories.

Culture and Talent Management

The Framework must be supported with the right culture, talent and skills to enable effective risk management across the Company.

Every associate at the Company is responsible for risk management; however, associates with specific risk management skills and expertise within the first, second and third lines of defense are critical to execute appropriate risk management across the enterprise.

Risk Categories

We apply our Framework to protect the Company from the major categories of risk that we are exposed to through our business activities. We have seven major categories of risk as noted below.

We provide an overview of how we manage our seven major categories of risk below.

Compliance Risk Management

We recognize that compliance requirements for financial institutions are increasingly complex and that there are heightened expectations from our regulators and our customers. In response, we continuously evaluate the regulatory environment and proactively adjust our compliance program to fully address these expectations.

Our Compliance Management Program establishes expectations for determining compliance requirements, assessing the risk of new product offerings, creating appropriate controls and training to address requirements, monitoring for control performance, and independently testing for adherence to compliance requirements. The program also establishes regular compliance reporting to senior business leaders, the executive committee and the Board of Directors.

The Chief Compliance Officer is responsible for establishing and overseeing our Compliance Management Program. Business areas incorporate compliance requirements and controls into their business policies, standards, processes and procedures. They regularly monitor and report on the efficacy of their compliance controls and our Compliance team periodically independently tests to validate the effectiveness of business controls.

Credit Risk Management

We recognize that we are exposed to cyclical changes in credit quality. Consequently, we try to ensure our credit portfolio is resilient to economic downturns. Our most important tool in this endeavor is sound underwriting. In unsecured consumer loan underwriting, we generally assume that loans will be subject to an environment in which losses are higher than those prevailing at the time of underwriting. In commercial underwriting, we generally require strong cash flow, collateral, covenants, and guarantees. In addition to sound underwriting, we continually monitor our portfolio and take steps to collect or work out distressed loans.

The Chief Credit and Financial Risk Officer, in conjunction with the Chief Credit Officers, is responsible for establishing credit risk policies and procedures, including underwriting and hold guidelines and credit approval authority, and monitoring credit exposure and performance of our lending related transactions. Our Chief Credit Officers are responsible for evaluating the risk implications of credit strategy and the oversight of credit for both the existing portfolio and any new credit investments. They also have formal approval authority for various types and levels of credit decisions, including individual commercial loan transactions. Division Presidents within each segment are responsible for managing the credit risk within their divisions and maintaining processes to control credit risk and comply with credit policies and guidelines. In addition, the Chief Credit and Financial Risk Officer establishes policies, delegates approval authority and monitors performance for non-loan credit exposure entered into with financial counterparties or through the purchase of credit sensitive securities in our investment portfolio.

Our credit policies establish standards in five areas: customer selection, underwriting, monitoring, remediation and portfolio management. The standards in each area provide a framework comprising specific objectives and control processes. These standards are supported by detailed policies and procedures for each component of the credit process. Starting with customer selection, our goal is to generally provide credit on terms that generate above hurdle returns. We use a number of quantitative and qualitative factors to manage credit risk, including setting credit risk limits and guidelines for each of our lines of business. We monitor performance relative to these guidelines and report results and any required mitigating actions to appropriate senior management committees and our Board of Directors.

See also “Credit Risk Profile” below for more information about how we manage credit risk.

Liquidity Risk Management

We recognize that liquidity risk is embedded within our day-to-day and strategic decisions. Liquidity is essential for banks to meet customer withdrawals, account for balance sheet changes, and provide funding for growth. We have acquired and built deposit gathering businesses and actively monitor our funding concentration. We manage our liquidity risk, which is driven by both internal and external factors, centrally and establish quantitative risk limits to continually assess our liquidity adequacy.

The Chief Credit and Financial Risk Officer, in conjunction with the Head of Liquidity, Market and Capital Risk Oversight, is responsible for the establishment of liquidity risk management policies and standards for governance and monitoring of liquidity risk at a corporate level. We assess liquidity strength by evaluating several different balance sheet metrics under severe stress scenarios to ensure we can withstand significant funding degradation. Results are reported to the Asset Liability Committee monthly and to the Risk Committee no less than quarterly. We also continuously monitor market and economic conditions to evaluate emerging stress conditions and to develop appropriate action plans in accordance with our Contingency Funding Plan and our Recovery Plan.

We use internal and regulatory stress testing and the evaluation of other balance sheet metrics within our Liquidity Framework to confirm we maintain a fortified balance sheet. We rely on a combination of stable and diversified funding sources, along with a stockpile of liquidity reserves, to effectively manage our liquidity risk. We maintain a sizable liquidity reserve of cash and cash equivalents, high-quality unencumbered securities and investment securities and certain loans that are either readily-marketable or pledgeable. We also continue to maintain access to secured and unsecured debt markets through regular issuance.

See also “Liquidity Risk Profile” below for more information about how we manage liquidity risk.

Market Risk Management

We recognize that interest rate and foreign exchange risk are present in our business due to the nature of our assets and liabilities. Market risk is inherent from the financial instruments associated with our business operations and activities including loans, deposits, securities, short-term borrowings, long-term debt and derivatives. We manage market risk exposure, which is principally driven by balance sheet interest rate risk, centrally and establish quantitative risk limits to monitor and control our exposure.

The Chief Credit and Financial Risk Officer, in conjunction with the Head of Liquidity, Market, and Capital Risk Oversight, is responsible for the establishment of market risk management policies and standards for the governance and monitoring of market risk at a corporate level. The market risk position is calculated and analyzed against pre-established limits. We use industry accepted techniques to analyze and measure interest rate and foreign exchange risk and we perform sensitivity analysis to identify our risk exposures under a broad range of scenarios. Results are reported to the Asset Liability Committee monthly and to the Risk Committee no less than quarterly.

Management is authorized to utilize financial instruments as outlined in our policy to actively manage market risk exposure. Investment securities and derivatives are the main levers for the management of interest rate risk. In addition, we also use derivatives to manage our foreign exchange risk.

Operational Risk Management

We recognize the criticality of managing operational risk on both a strategic and day-to-day basis and that there are heightened expectations from our regulators and our customers. We have implemented appropriate operational risk management policies, standards, processes and controls to enable the delivery of high quality and consistent customer experiences and to achieve business objectives in a controlled manner.

The Chief Operational Risk Officer, in collaboration with the CTRO, is responsible for establishing and overseeing our Operational Risk Management Program. The program establishes practices for assessing the operational risk profile and executing key control processes for operational risks. These risks include topics such as internal and external fraud, cybersecurity and technology risk, data management, model risk, third-party management, and business continuity. Operational Risk Management and Technology Risk Management enforce these practices and delivers reporting of operational risk results to senior business leaders, the executive committee and the Board of Directors. For additional information on how we manage cybersecurity and technology risk, see “Part I—Item 1C. Cybersecurity” of this Report.

Reputation Risk Management

We recognize that reputation risk is of particular concern for financial institutions and, increasingly, technology companies, in the current environment. Areas of concern have expanded to include company policies, practices and values and, with the growing use of social and digital platforms, public corporations face a new level of scrutiny and channels for activism and advocacy. The heightened expectations of internal and external stakeholders have made corporate culture, values and conduct pressure points for individuals and advocates voicing concerns or seeking change. We manage both strategic and tactical reputation issues and build our relationships with government officials, media, community and consumer advocates, customers and other constituencies to help strengthen the reputations of both our Company and industry. Our actions include implementing pro-customer practices in our business and serving low to moderate income communities in our market area consistent with a quality bank and an innovative technology leader. The Executive Vice President of External Affairs is responsible for managing our overall reputation risk program. Day-to-day activities are controlled by the frameworks set forth in our Reputation Risk Management Policy and other risk management policies.

Strategic Risk Management

We recognize that strategic risk is present within our business and the Company’s strategy. We monitor risks for the impact on current or future earnings, capital growth or enterprise value arising from changes to the Company’s competitive and market positions, including as a result of evolving forces in the industry. Additionally, we monitor timely and effective responsiveness to these conditions, strategic decisions that impact the Company’s scale, market position or operating model and failure to appropriately consider implementation risks in the Company’s strategy. Potential areas of opportunity or risk inform the Company’s strategy, which is led by the Chief Executive Officer and other senior executives. The Chief Enterprise Risk Officer, in consultation with the Chief Credit and Financial Risk Officer, oversees the identification and assessment of risks associated with the Company’s strategy and the monitoring of these risks throughout the year.

Our Strategic Risk Management Policy, processes and controls encompass an ongoing assessment of risks associated with corporate or line of business specific strategies. These risks are managed through periodic reviews, along with regular updates to senior management and the Board.