KEYCORP /NEW/

Like all businesses, we are subject to operational risk, which is the risk of loss resulting from human error or malfeasance, inadequate or failed internal processes and systems, and external events. These events include, among other things, threats to our cybersecurity, as we are reliant upon information systems and the internet to conduct our business activities. Operational risk intersects with compliance risk, which is the risk of loss from violations of, or noncompliance with, laws, rules and regulations, prescribed practices, and ethical standards. Under the Dodd-Frank Act, large financial companies like Key are subject to heightened prudential standards and regulation. This heightened level of regulation has increased our operational risk. While operational and compliance risk are separate risk disciplines in KeyCorp’s ERM framework, losses and/or additional regulatory compliance costs are included in operational loss reporting and could take the form of explicit charges, increased operational costs, or harm to our reputation.

We seek to mitigate operational risk through identification and measurement of risk, alignment of business strategies with risk appetite and tolerance, and a system of internal controls and reporting. We continuously strive to strengthen our system of internal controls to improve the oversight of our operational risk and to ensure compliance with laws, rules, and regulations. For example, an operational event database tracks the amounts and sources of operational risk and losses. This tracking mechanism helps to identify weaknesses and to highlight the need to take corrective action. We also rely upon software programs designed to assist in assessing operational risk and monitoring our control processes. This technology has enhanced the reporting of the effectiveness of our controls to senior management and the Board.

The Operational Risk Management Program provides the framework for the structure, governance, roles, and responsibilities, as well as the content, to manage operational risk for Key. The Compliance Risk Management Program serves the same function in managing compliance risk for Key. The Operational Risk Committee and the Compliance Risk Committee support the ERM Committee by identifying early warning events and trends, escalating emerging risks, and discussing forward-looking assessments. Both the Operational Risk Committee and the Compliance Risk Committee include attendees from each of the Three Lines of Defense. Primary responsibility for managing and monitoring internal control mechanisms lies with the managers of our various lines of business. The Operational Risk Committee and Compliance Risk Committee are senior management committees that oversee our level of operational and compliance risk and direct and support our operational and compliance infrastructure and related activities. These committees and the Operational Risk Management and Compliance Risk Management functions are an integral part of our ERM Program. Our Internal Audit function regularly assesses the overall effectiveness of our Operational Risk Management and Compliance Risk Management Programs and our system of internal controls. Internal Audit reports the results of reviews on internal controls and systems to senior management and the Audit Committee and updates the Risk Committee, as appropriate, on matters related to the oversight of these controls.

Cybersecurity

For information on our cybersecurity risk management and governance practices, please see Item 1C. Cybersecurity beginning on page 43 of our 2024 Form 10-K.