KEYCORP /NEW/

The following discussion provides a summary of recent regulatory developments and should be read in conjunction with the disclosure included in our 2025 Form 10-K under the heading “Supervision and Regulation” in Item 1. Business and under the heading “V. Compliance Risk” in Item 1A. Risk Factors as well as the disclosure included in Part II, Item 1A. "Risk Factors" of this report.

Regulatory capital requirements

KeyCorp and KeyBank are subject to regulatory capital requirements that are based largely on the Basel III international capital framework (“Basel III”). The Basel III capital framework and the U.S. implementation of the Basel III capital framework (“Regulatory Capital Rules”) are discussed in more detail in Item 1. Business of our 2025 Form 10-K under the heading “Supervision and Regulation — Regulatory Capital and Liquidity Requirements.”

Under the Regulatory Capital Rules, standardized approach banking organizations, such as KeyCorp and KeyBank, are required to meet the minimum capital and leverage ratios set forth in Figure 1 below. At March 31, 2026, KeyCorp’s ratios under the fully phased-in Regulatory Capital Rules were as set forth in Figure 1.

Figure 1. Minimum Capital Ratios and KeyCorp Ratios Under the Regulatory Capital Rules

(a)As a standardized approach banking organization, KeyCorp is not subject to the 3% supplementary leverage ratio requirement.

(b)Stress capital buffer must consist of Common Equity Tier 1 capital. As a standardized approach banking organization, KeyCorp is not subject to the countercyclical capital buffer of up to 2.5% imposed upon an advanced approaches banking organization under the Regulatory Capital Rules. KeyCorp’s stress capital buffer is 3.20% as of October 1, 2025.

(c)March 31, 2026 capital ratios are estimates.

Revised prompt corrective action framework

The federal Prompt Corrective Action (“PCA”) framework under the FDIA groups FDIC-insured depository institutions into one of five prompt corrective action capital categories: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” In addition to implementing the Basel III capital framework in the United States, the Regulatory Capital Rules also revised the PCA capital category threshold ratios applicable to FDIC-insured depository institutions such as KeyBank. The revised PCA framework table in Figure 2 identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the PCA framework.

Figure 2. "Well Capitalized" and "Adequately Capitalized" Capital Category Ratios under Revised Prompt Corrective Action Framework

(a)A “well capitalized” institution also must not be subject to any written agreement, order, or directive to meet and maintain a specific capital level for any capital measure.

(b)As a “standardized approach” banking organization, KeyBank is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018.

As of March 31, 2026, KeyBank (consolidated) satisfied the risk-based and leverage capital requirements necessary to be considered “well capitalized” for purposes of the revised PCA framework. However, investors should not regard this determination as a representation of the overall financial condition or prospects of KeyBank because the PCA framework is intended to serve a limited supervisory function. Moreover, it is important to note that the PCA framework does not apply to BHCs, like KeyCorp.

Recent regulatory capital-related developments

On March 19, 2026, the federal banking agencies issued three proposals that would make significant changes to the Regulatory Capital Rules. The agencies said that these proposals would streamline capital requirements and would better align regulatory capital with risk. One proposal would implement the final elements of the Basel III capital framework (the “Basel III Proposal”). The Basel III Proposal would establish a new approach for calculating risk-based capital ratios, “expanded risk-based approach (“ERBA”)”, that would include requirements for credit risk, equity risk, and operational risk and would increase risk sensitivity by varying capital requirements according to various risk factors. The Basel III Proposal would also establish a new framework for determining market risk capital requirements. The Basel III Proposal would apply to Category I and II banking organizations, and the market risk component of this proposal would also apply to other banking organizations with significant trading activity. All other banking organizations (including Category IV banking organizations such as KeyCorp and KeyBank) would have the option to have their capital requirements determined under the ERBA contained in this proposal.

A second proposal issued by the federal banking agencies on March 19, 2026 would revise the standardized approach for calculating risk-based capital ratios used by most banking organizations, including Category IV banking organizations such as KeyCorp and KeyBank (the “Standardized Approach Proposal”). The Standardized Approach Proposal would increase the calibration and risk sensitivity of risk weights for certain traditional lending activities. Among other things, the proposal would reduce the risk weight applicable to corporate exposures and would introduce a broader range of risk weights for residential mortgages based on more granular risk factors. Also, the Standardized Approach Proposal and the Basel III Proposal would modify the definition of capital by removing the threshold-based deduction for mortgage servicing assets, and the Standardized Approach Proposal would require Category III and IV banking organizations to include most components of AOCI, including net unrealized gains and losses on available-for-sale securities, in regulatory capital subject to a five-year transition.

A third capital-related proposal issued on March 19, 2026 was a proposal from the Federal Reserve to (1) modify the Global Systemically Important Bank (“GSIB”) capital surcharge, which applies to U.S. global systemically important BHCs (not including KeyCorp) and (2) amend the Systemic Risk Report (FR Y-15), which is used to collect systemic risk data from BHCs with total consolidated assets of $100 billion or more (including KeyCorp). The agencies indicated that the capital-related proposals they issued on March 19, 2026 replace the capital-related proposal they issued in July of 2023. Comments on the new proposals are due by June 18, 2026.

Capital planning, stress testing, and stress capital buffer

On June 27, 2025, the Federal Reserve announced the results of the supervisory stress test that it conducted of 22 large BHCs (not including KeyCorp). As a Category IV banking organization subject to a supervisory stress test every other year, KeyCorp was not required to participate in the Federal Reserve’s supervisory stress test in 2025. On August 29, 2025, the Federal Reserve published the updated stress capital buffer requirements for large BHCs, including BHCs like KeyCorp that did not participate in the supervisory stress test in 2025. KeyCorp’s updated stress capital buffer is 3.2% (based on the results of KeyCorp’s 2024 supervisory stress test and adjusted for

KeyCorp’s planned common stock dividends as set forth in KeyCorp’s 2025 capital plan). This stress capital buffer became effective on October 1, 2025. On February 4, 2026, the Federal Reserve announced that it would maintain the current stress capital buffer requirements until 2027 for the BHCs that are subject to its supervisory stress tests (rather than updating the requirements in 2026) so that the Federal Reserve will be able to consider public feedback on its stress test models before setting the new requirements.

See Item 1. Business of our 2025 Form 10-K under the heading “Supervision and Regulation - Regulatory Capital and Liquidity Requirements - Capital planning, stress testing, and stress capital buffer” for a discussion of other developments concerning capital planning, stress testing, and stress capital buffer requirements.

Recovery plans

On March 31, 2026, the OCC issued a final rule to rescind its recovery planning guidelines that applied to banks with average total consolidated assets of at least $100 billion (including KeyBank). In rescinding these guidelines, the OCC stated that the guidelines were overly prescriptive and imposed an unnecessary regulatory burden on the covered institutions. The OCC said that it would still expect all institutions that it regulates to have appropriate risk management processes in place to address all material risks in their operating environment and to maintain a formal contingency funding plan that considers a range of possible stress scenarios, assesses the stability of funding during periods of stress, and provides for a broad range of funding sources under adverse conditions.