KEYCORP /NEW/

The following discussion provides a summary of recent regulatory developments and should be read in conjunction with the disclosure included in our 2024 Form 10-K under the heading “Supervision and Regulation” in Item 1. Business and under the heading “V. Compliance Risk” in Item 1A. Risk Factors as well as the disclosure included in Part II, Item 1A. "Risk Factors" of this report.

Regulatory capital requirements

KeyCorp and KeyBank are subject to regulatory capital requirements that are based largely on the Basel III international capital framework (“Basel III”). The Basel III capital framework and the U.S. implementation of the Basel III capital framework (“Regulatory Capital Rules”) are discussed in more detail in Item 1. Business of our 2024 Form 10-K under the heading “Supervision and Regulation — Regulatory capital requirements.”

Under the Regulatory Capital Rules, standardized approach banking organizations, such as KeyCorp and KeyBank, are required to meet the minimum capital and leverage ratios set forth in Figure 1 below. At September 30, 2025, KeyCorp’s ratios under the fully phased-in Regulatory Capital Rules were as set forth in Figure 1.

Figure 1. Minimum Capital Ratios and KeyCorp Ratios Under the Regulatory Capital Rules

(a)As a standardized approach banking organization, KeyCorp is not subject to the 3% supplementary leverage ratio requirement. However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules are adopted.

(b)Stress capital buffer must consist of Common Equity Tier 1 capital. As a standardized approach banking organization, KeyCorp is not subject to the countercyclical capital buffer of up to 2.5% imposed upon an advanced approaches banking organization under the Regulatory Capital Rules. However, KeyCorp will be subject to the countercyclical capital buffer if proposed revisions to the Regulatory Capital Rules are adopted. KeyCorp’s stress capital buffer is 3.20% as of October 1, 2025.

(c)September 30, 2025 capital ratios are estimates

Revised prompt corrective action framework

The federal Prompt Corrective Action (“PCA”) framework under the FDIA groups FDIC-insured depository institutions into one of five prompt corrective action capital categories: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” In addition to implementing the Basel III capital framework in the United States, the Regulatory Capital Rules also revised the PCA capital category threshold ratios applicable to FDIC-insured depository institutions such as KeyBank. The revised PCA framework table in Figure 2 identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the PCA Framework.

Figure 2. "Well Capitalized" and "Adequately Capitalized" Capital Category Ratios under Revised Prompt Corrective Action Framework

(a)A “well capitalized” institution also must not be subject to any written agreement, order, or directive to meet and maintain a specific capital level for any capital measure.

(b)As a “standardized approach” banking organization, KeyBank is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018. However, KeyBank will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules are adopted.

As of September 30, 2025, KeyBank (consolidated) satisfied the risk-based and leverage capital requirements necessary to be considered “well capitalized” for purposes of the revised PCA framework. However, investors should not regard this determination as a representation of the overall financial condition or prospects of KeyBank because the PCA framework is intended to serve a limited supervisory function. Moreover, it is important to note that the PCA framework does not apply to BHCs, like KeyCorp.

Capital planning and stress testing

On June 27, 2025, the Federal Reserve announced the results of the supervisory stress test that it conducted of 22 large BHCs (not including KeyCorp). As a Category IV banking organization subject to a supervisory stress test every other year, KeyCorp was not required to participate in the Federal Reserve’s supervisory stress test in 2025. On August 29, 2025, the Federal Reserve published the updated stress capital buffer requirements for large BHCs, including BHCs like KeyCorp that did not participate in the supervisory stress test in 2025. KeyCorp’s updated stress capital buffer is 3.2% (based on the results of KeyCorp’s 2024 supervisory stress test and adjusted for KeyCorp’s planned common stock dividends as set forth in KeyCorp’s 2025 capital plan). This stress capital buffer became effective on October 1, 2025, and will remain in effect until September 30, 2026, unless KeyCorp later receives an updated stress capital buffer requirement from the Federal Reserve.

See Item 1. Business of our 2024 Form 10-K under the heading “Supervision and Regulation - Regulatory capital requirements - Capital planning and stress testing” for a discussion of other developments concerning capital planning and stress testing requirements.

Proposed updates to LFI Rating System

On July 10, 2025, the Federal Reserve issued for public comment a proposal to revise its Large Financial Institution Rating System (the “LFI Rating System”) that applies to BHCs with total consolidated assets of $100 billion or more, including KeyCorp. The proposal would revise the component ratings that a firm must receive to be considered “well managed.” A firm that is not “well managed” faces limitations on certain activities and acquisitions. The Federal Reserve said that the proposed revisions are intended to provide a more accurate assessment of a BHC’s financial and operational strength and resilience and better align the LFI Rating System with the rating systems used for other banking organizations. Comments on the proposal were due 30 days after publication in the Federal Register, or by August 14, 2025.

Consumer Financial Protection Bureau

The CFPB, which was created by the Dodd-Frank Act in 2010, was given the authority by that statute to regulate the offer and sale of consumer financial products and services, enforce federal consumer protection laws, and supervise certain providers of consumer financial products and services, including banks with over $10 billion in assets (such as KeyBank). The Trump administration has announced its intention to close or substantially downsize the CFPB and has taken various actions to accomplish that objective, including issuing a stop work order to CFPB employees, terminating many CFPB employees, placing other CFPB employees on administrative leave, and significantly reducing the CFPB’s annual funding through legislation. A union representing the CFPB’s employees and other interested parties brought a lawsuit in the United States District Court for District of Columbia, seeking a court order to stop the Trump administration from dismantling the CFPB. On March 25, 2025, the court in that case issued a preliminary injunction, which enjoined the Trump administration from taking actions to dismantle the CFPB. The Trump administration has appealed this court order. On August 15, 2025, a three-judge panel of the United States Court of Appeals for the District of Columbia Circuit vacated the preliminary injunction issued by the District Court but stayed its decision for 45 days to allow the plaintiffs an opportunity to seek a rehearing by the full District of Columbia Circuit Court. On September 29, 2025, the plaintiffs filed a petition requesting the full District of Columbia Circuit Court to rehear the case and reinstate the preliminary injunction issued by the District Court. Key is monitoring developments in this case.

Data collection and reporting for small business loans

On March 30, 2023, the CFPB issued a final rule to require certain lenders (including depository institutions such as KeyBank) to report detailed data on applications for credit submitted by small businesses, including those owned by women and minorities. This rule was issued to implement Section 1071 of the Dodd-Frank Act. Various lawsuits were brought to challenge this rule. In one of these lawsuits, the CFPB, on April 3, 2025, asked the court to hold the lawsuit in abeyance because the CFPB planned to issue a new proposed rulemaking on this subject. In that case and two other cases challenging the 1071 rule, courts stayed compliance with the rule for the parties in those cases. On October 2, 2025, the CFPB issued a final rule delaying compliance with the 1071 rule for all institutions covered by the rule. The CFPB extended the compliance dates by approximately one year so that the highest volume lenders would not have to begin collecting data in accordance with the 1071 rule until July 1, 2026, and the moderate and smallest volume lenders would not have to begin collecting such data until January 1, 2027, and October 1, 2027, respectively. Key is monitoring developments regarding the status of the 1071 rule.

Personal financial data rights

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act. The 1033 rule requires financial institutions (including KeyBank) to make available to consumers and authorized third parties data concerning covered consumer financial products or services in an electronic form usable by the consumer and authorized third parties. In adopting the rule, the CFPB said that the 1033 rule was a step towards bringing about an “open banking” system in the United States. Following the issuance of this rule, two trade associations and a national bank filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky. In this lawsuit, the plaintiffs alleged that the CFPB exceeded its statutory authority in adopting the 1033 rule. On May 23, 2025, the CFPB filed a status report with the court saying that it agreed with the plaintiffs that the 1033 rule exceeded the agency’s statutory authority. On May 30, 2025, the parties challenging the rule and the CFPB filed a motion for summary judgment asking the court to invalidate the rule. In a summary judgment motion filed on June 29, 2025, the Financial Technology Association, which had been allowed to intervene in this case, asked the court to uphold the rule. Before the court issued a decision on the summary judgment motions, the CFPB asked the court to stay the litigation, saying that it planned to rewrite the 1033 rule on an accelerated basis. On July 29, 2025, the court granted the CFPB’s request to stay the litigation. On August 21, 2025, the CFPB issued an advance notice of proposed rulemaking, asking the public to respond to a series of questions related to the 1033 rule. Comments were due by October 21, 2025. Key is monitoring developments concerning the 1033 rule.