Capital One

“Similar to other large corporations in our industry, we are exposed to operational risk that can manifest itself in many ways, such as errors in execution, inadequate processes, inaccurate models, faulty or disabled technological infrastructure, malicious disruption and fraud by employees or persons outside of our company, whether through attacks on Capital One directly, or on our third-party service providers or customers. In addition, the increased use of near real-time money movement solutions and the use of AI, as well as other emerging technologies, increases the complexity of preventing, detecting and recovering fraudulent transactions.”

Annual report 2025A · The company itself

“The use of AI, “bots” or other automation software can increase the velocity and efficacy of these types of attacks and such use by companies has resulted in, and may continue to result in, cyber-attacks and other security incidents that implicate the sensitive and confidential information, including personal information, of AI users.”

Annual report 2025A · The company itself

“The methods and techniques employed by malicious actors continue to develop and evolve rapidly, including from emerging technologies, such as AI and quantum computing, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and enable persistent access for an extended period of time before being detected and remediated, if at all. We and our service providers and other third parties with which we interact may be unable to anticipate or identify certain attack methods or techniques in order to implement effective preventative or detective measures or mitigate or remediate the damages caused in a timely manner.”

Annual report 2025A · The company itself

“For example, generative AI has been known to produce false or “hallucinatory” inferences or output. Certain generative AI tools use machine learning and predictive analytics, which can create inaccurate, incomplete or misleading outputs; unexpected results; or errors or inadequacies, any of which may not be easily detectable.”

Annual report 2025A · The company itself

“In addition, models and AI that are based on historical data sets might not be accurate predictors of future outcomes. The ability of models and AI to appropriately predict future outcomes may degrade over time due to limited historical patterns, extreme or unanticipated market movements, or customer behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events).”

Annual report 2025A · The company itself

“AI may subject us to new or heightened legal, regulatory, ethical or other challenges, and a negative public opinion of AI could impede the acceptance of AI solutions. If the models or AI solutions that we or a third party create and use or the data inputs, formulas, or algorithms on which such models or AI solutions rely – or if the content, analyses or recommendations that the models or AI solutions produce are (or are perceived to be) deficient, inaccurate, biased, unethical or controversial – we could incur operational inefficiencies, competitive harm, legal liability, or brand or reputational harm.”

Annual report 2025A · The company itself

“They may be subject to human error, data limitations, process delays or system failure.”

Annual report 2025A · The company itself

“If any of our employees, contractors, third-party service providers or other third parties with which we do business use any third-party AI solutions in connection with our business, it may lead to the inadvertent or unauthorized disclosure or incorporation of our sensitive and confidential information, including personal information, into third-party systems or publicly available or third-party training sets, which may impact our ability to realize the benefit of our intellectual property or other proprietary rights in such information.”

Annual report 2025A · The company itself

“Additionally, consumer activists and regulators have sought to expand financial institutions’ responsibility to hold customers harmless for transactions that they authorized on their accounts that are the result of scams. Emerging generative AI capabilities, such as synthetic video, images and identity documents may introduce new risks, in the form of identity fraud and scams.”

Annual report 2025A · The company itself

“Additionally, the growth of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, may increase fraud losses as well as change circumstances when the merchant or issuer is liable for fraud losses. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance, and the interplay between laws and regulations relating to, among other things, fraud, payments, privacy, data protection, data security and AI may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem.”

Annual report 2025A · The company itself

“We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital currencies or cryptocurrencies (including stablecoins and tokenized deposits), prepaid systems and payment services targeting users of social networks, communications platforms and online gaming. If we are unable to continue to keep pace with innovation and fail to reflect such technology in our payments offerings, do not effectively market our products and services, are unable to deliver them effectively and securely to our customers or are prohibited from or unwilling to enter emerging areas of competition, our business and results of operations could be adversely affected.”

Annual report 2025A · The company itself

“Also, our competitors or other third parties may incorporate emerging technologies, such as AI, into their products or services more quickly or more successfully than we do, which could impair our ability to compete effectively. For example, our competitors may be more timely or successful in developing or integrating AI technologies to increase their productivity and reduce their costs or to provide better transaction execution or improved products or services to clients.”

Annual report 2025A · The company itself

“Some of our competitors are substantially larger than we are, which may allow those competitors to invest more money into their technology infrastructure and digital innovation than we do.”

Annual report 2025A · The company itself

“Furthermore, given intellectual property ownership and license rights surrounding AI, such as generative AI, are currently not fully addressed by courts or regulators, any output created by us using AI may not be subject to copyright or other intellectual property protection, which may adversely affect our intellectual property or other proprietary rights in, or ability to commercialize or use, any such output, and our use or adoption of AI may result in exposure to claims by third parties.”

Annual report 2025A · The company itself

“In addition, advances in technology, such as automation and AI, may lead to workforce evolution. This could require us to invest in additional employee training, manage impacts on morale and retention, and compete for employment candidates who possess more advanced technological skills, all of which could have a negative impact on our business and operations.”

Annual report 2025A · The company itself

“A key part of our strategic focus is the development and use of efficient, flexible computer and operational systems, such as cloud or artificial intelligence (“AI”) technologies. We believe that the continued adoption, development and integration of these technologies is an important part of our efforts to reduce costs, improve quality and security and provide faster, more flexible technology services.”

Annual report 2025A · The company itself

“•If we are not able to invest successfully in and introduce digital and other technological developments across all our businesses, our financial performance may suffer. •We may fail to realize the anticipated benefits of our mergers, acquisitions and strategic partnerships. •Reputational risk and social factors may impact our results and damage our brand. •If we are not able to protect our intellectual property rights, or we violate third-party intellectual property rights, our revenue and profitability could be negatively affected. •Our risk management strategies may not be fully effective in mitigating our risk exposures in all market environments or against all types of risk. •Our business could be negatively affected if we are unable to attract, develop, retain and motivate key senior leaders and skilled employees.”

Annual report 2025A · The company itself

“In particular, we use models and AI in certain processes and may expand our use of AI in additional processes in the future. Some examples may include determining the pricing of products, identifying potentially fraudulent transactions, grading loans, extending credit, measuring market and interest rate risks, predicting deposit levels or loan losses, assessing capital adequacy, estimating the value of financial instruments and balance sheet items, software development, personalizing customer experiences and other operational functions. We continue to invest in building new capabilities that use new AI technologies, such as generative AI, and we expect our use of these technologies to increase over time.”

Annual report 2025A · The company itself

“Our competitive position could also be affected if we are unable to deploy, in a cost-effective and competitive manner, technology such as generative AI.”

Annual report 2025A · The company itself

“If we are not able to invest successfully in and introduce digital and other technological developments across all our businesses, our financial performance may suffer. Our industry is subject to rapid and significant technological changes, including due to the increasing development and use of AI, and our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings.”

Annual report 2025A · The company itself

“We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital currencies or cryptocurrencies (including stablecoins and tokenized deposits), prepaid systems and payment services targeting users of social networks, communications platforms and online gaming. If we are unable to continue to keep pace with innovation and fail to reflect such technology in our payments offerings, do not effectively market our products and services, are unable to deliver them effectively and securely to our customers or are prohibited from or unwilling to enter emerging areas of competition, our business and results of operations could be adversely affected.”

Annual report 2025A · The company itself

“The increased pressure on transaction fees associated with card payments due to competition could create additional risk to growth for both our card issuing businesses and the Global Payment Network. This, in turn, could adversely affect the revenue for our network and card issuing businesses, as well as our ability to attract and retain Network Partners who may seek alternatives from both traditional and non-traditional payment service providers, which may limit our ability to maintain or grow revenues from the Global Payment Network.”

Annual report 2025A · The company itself

“We were the largest issuer of credit cards in the United States of America (“U.S.”) based on the outstanding balance of credit card loans as of December 31, 2025.”

Annual report 2025A · The company itself

“In addition to credit cards, we also offer debit cards, bank lending, treasury management and depository services, auto loans and other consumer lending products in markets across the U.S.”

Annual report 2025A · The company itself

“Additionally, through the acquisition of Discover, we acquired new products including personal loans as well as the Discover Network, the PULSE Network, Diners Club International (“Diners Club”) and Network Partners (collectively, the “Global Payment Network”).”

Annual report 2025A · The company itself

“The Discover Network processes transactions for credit and debit cards issued on its network and provides payment transaction processing and settlement services. The PULSE Network operates an electronic funds transfer network, providing financial institutions issuing debit cards on the PULSE Network with access to ATMs domestically and internationally, as well as merchant acceptance throughout the U.S. for debit card transactions.”

Annual report 2025A · The company itself

“Diners Club is a global payments network of licensees, which are generally financial institutions, that issue Diners Club-branded charge cards and/or provide card acceptance services. We also have agreements with a number of financial institutions, financial technology firms, networks and other commercial service providers (collectively, “Network Partners”) for the provision of card issuing, payments processing and related services on the Global Payment Network.”

Annual report 2025A · The company itself

“In our Credit Card business, we generally experience fluctuations in purchase volume and the level of outstanding loan receivables from seasonal variances in consumer spending and payment patterns which, for example, have historically been the highest around the winter holiday season.”

Annual report 2025A · The company itself

“Changes or instability in the macroeconomic environment may impact payment patterns, consumer spending and credit losses. Because we offer a broad array of financial products and services to consumers, small businesses and commercial clients, our financial results are impacted by the level of consumer and business activity and the demand for our products and services. A prolonged period of economic weakness, volatility, slow growth or a significant deterioration in economic conditions, in the countries in which we operate, could have a material adverse effect on our financial condition and results of operations as customers or commercial clients default on their loans, maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity.”

Annual report 2025A · The company itself

“Aggressive pricing throughout the industry may adversely affect the retention of existing balances and the cost-efficient acquisition of new deposit funds and may affect our growth and profitability.”

Annual report 2025A · The company itself

“In addition, a variety of economic or social factors may cause changes in borrowing activity, including credit card use, payment patterns and the rate of defaults by account holders and borrowers domestically and internationally. These economic and social factors include changes in consumer confidence levels, the public’s perception regarding the banking industry and consumer debt, including credit card use, and changing attitudes about the stigma of bankruptcy.”

Annual report 2025A · The company itself

“As one of the nation’s largest banks based on deposits as of December 31, 2025, we service banking customer accounts through digital channels and our network of branch locations, cafés, call centers and automated teller machines (“ATMs”).”

Annual report 2025A · The company itself

“Because we originate a relatively greater proportion of consumer loans in our loan portfolio compared to other large bank peers and originate both prime and subprime credit card accounts and auto loans, we may experience higher delinquencies and a greater number of accounts charging off, as well as greater fluctuations in those metrics, compared to other large bank peers, which could result in increased credit losses, operating costs and regulatory scrutiny.”

Annual report 2025A · The company itself

“We have incurred and expect to incur a number of significant non-recurring costs associated with the integration of Discover. There are a large number of processes, policies, procedures, operations, technologies and systems that have been and will continue to be integrated, including purchasing, accounting and finance, payroll, cybersecurity, compliance, treasury management, customer management operations, vendor management, risk management, lines of business, pricing and benefits. While we have assumed that a certain level of costs will be incurred, many of the expenses that we will incur are, by their nature, difficult to estimate accurately.”

Annual report 2025A · The company itself

“There can be no assurance that we will be able to accurately anticipate and respond to the changing demands we will face as we continue to expand our operations or that we will be able to achieve further growth at all. Additionally, we face risks that any business, technology, service or product we integrate from Discover may significantly under-perform relative to our expectations, and that we may not achieve the benefits we expect, which could, among other things, result in a write-down of goodwill and other intangible assets associated with the Transaction.”

Annual report 2025A · The company itself

“As a result of the Transaction, we have become the legal successor to Discover and, as a result, have assumed the risks relating to actions that were or may be later instituted against Discover or us relating to Discover’s previous actions, as well as ongoing expenses in defending and resolving these actions, and are subject to reputational and other risks associated with Discover’s previous actions.”

Annual report 2025A · The company itself

“Any merger, acquisition, disposition or strategic partnership we undertake, including the Transaction, entails certain risks, which may materially and adversely affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our existing operations, or are not able to achieve the anticipated benefits of any merger, acquisition or strategic partnership, including cost savings and other synergies, our business could be negatively affected.”

Annual report 2025A · The company itself

“Risks Relating to the Transaction and Integration of Discover We may not be able to successfully integrate our businesses associated with the Transaction, or such integration may be more difficult, time-consuming or costly than expected. The successful integration of two independent businesses is complex, difficult, time-consuming and costly. The success of the Transaction depends, in part, on our ability to successfully integrate Discover’s operations in a manner that results in various benefits and that does not materially disrupt existing customer relationships or materially decrease revenues due to loss of customers. Additionally, the success of the Transaction depends on our ability to successfully integrate Discover into our Risk Management Framework (the “Framework”), compliance systems and corporate culture, which we believe requires extensive investment, including to enhance the risk management function at Discover consistent with our risk management standards and those of regulators, as well as to address remediation obligations under existing and possible future regulatory orders.”

Annual report 2025A · The company itself

“We continue to evaluate and anticipate engaging in, among other merger and acquisition activity, additional strategic partnerships, selected acquisitions of financial institutions, and acquisitions or divestitures of other businesses or assets, including credit card and other loan portfolios.”

Annual report 2025A · The company itself

“The soundness of other financial institutions and other third parties, actual or perceived, could adversely affect us. Our ability to engage in routine funding and other transactions could be adversely affected by the stability and actions of other financial services institutions.”

Annual report 2025A · The company itself

“In addition to credit cards, we also offer debit cards, bank lending, treasury management and depository services, auto loans and other consumer lending products in markets across the U.S.”

Annual report 2025A · The company itself

“Funding Our funding sources include deposits, senior and subordinated notes, securitized debt obligations, federal funds purchased, securities loaned or sold under agreements to repurchase and FHLB advances secured by certain portions of our loan and securities portfolios. A key objective in our use of these markets is to maintain access to a diversified mix of wholesale funding sources. Insured deposits in our Consumer Banking business represent our primary source of funding, as they are a relatively stable and low cost source of funding.”

Annual report 2025A · The company itself

“In addition, we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients, resulting in a significant credit concentration with respect to the financial services industry overall.”

Annual report 2025A · The company itself

“Commercial Loans by Industry Table 19 summarizes our commercial loans held for investment by industry classification as of December 31, 2025 and 2024. Industry classifications below are based on our interpretation of the Federal Loan Classification codes as they pertain to each individual loan. Table 19: Commercial Loans by Industry (Percentage of portfolio) Industry Classification: Finance 42 % 39 % Real Estate & Construction 25 26 Government & Education 8 8 Commercial Services 4 4 Health Care & Pharmaceuticals 3 4 Food & Beverage Manufacturing & Wholesale 3 3 Oil, Gas & Pipelines 2 3 Technology, Telecommunications & Media 2 3 Other 11 10 Total Credit Risk Measurement We closely monitor economic conditions and loan performance trends to assess and manage our exposure to credit risk.”

Annual report 2025A · The company itself

“For example, in January 2025, we experienced a multi-day system outage due to a technical issue experienced by FIS, a third-party service provider, which temporarily impacted certain services for some of our customers.”

Annual report 2025A · The company itself

“These relationships include, but are not limited to: Amazon Web Services, Inc. (“AWS”) for our cloud infrastructure, Total System Services LLC (“TSYS”) for consumer and commercial credit card processing services for our North American and U.K. portfolios and Fidelity Information Services (“FIS”) for certain of our banking systems. Certain of the acquired Discover businesses, including the Global Payment Network, are processed through a combination of data centers and the use of third-party vendors.”

Annual report 2025A · The company itself

“We are also heavily dependent on the security, capability, integrity and continuous availability of the technology systems and networks that we use to manage our internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to our customers, develop and offer new products and communicate with stakeholders.”

Annual report 2025A · The company itself

“Other than the ongoing integration of Discover, we have substantially migrated primarily all aspects of our core information technology infrastructure and systems and customer-facing applications to third-party cloud infrastructure platforms, principally AWS.”

Annual report 2025A · The company itself

“Consumers expect robust digital experiences from their financial services providers. The ability for customers to access their accounts and conduct financial transactions using digital technology, including mobile applications, is an important aspect of the financial services industry, and financial institutions are rapidly introducing new digital and other technology-driven products and services that aim to offer a better customer experience and to reduce costs.”

Annual report 2025A · The company itself

“In addition, our ongoing investments in technology may increase our expenses. As our business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business strategies or risks, management of outsourced services, asset purchases or other acquisitions, structural reorganization, compliance with new laws or regulations, the integration of newly acquired businesses or the prevention or occurrence of cyber-attacks and other security incidents.”

Annual report 2025A · The company itself

“A key part of our strategic focus is the development and use of efficient, flexible computer and operational systems, such as cloud or artificial intelligence (“AI”) technologies. We believe that the continued adoption, development and integration of these technologies is an important part of our efforts to reduce costs, improve quality and security and provide faster, more flexible technology services.”

Annual report 2025A · The company itself

“•If we are not able to invest successfully in and introduce digital and other technological developments across all our businesses, our financial performance may suffer. •We may fail to realize the anticipated benefits of our mergers, acquisitions and strategic partnerships. •Reputational risk and social factors may impact our results and damage our brand. •If we are not able to protect our intellectual property rights, or we violate third-party intellectual property rights, our revenue and profitability could be negatively affected. •Our risk management strategies may not be fully effective in mitigating our risk exposures in all market environments or against all types of risk. •Our business could be negatively affected if we are unable to attract, develop, retain and motivate key senior leaders and skilled employees.”

Annual report 2025A · The company itself

“If we are not able to invest successfully in and introduce digital and other technological developments across all our businesses, our financial performance may suffer. Our industry is subject to rapid and significant technological changes, including due to the increasing development and use of AI, and our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings.”

Annual report 2025A · The company itself

“Properties Our corporate and banking real estate portfolio consists of approximately 12.3 million square feet of owned or leased office and retail space, which is used to support our business. Of this overall portfolio, approximately 10.4 million square feet of space is dedicated for various corporate office uses and approximately 1.9 million square feet of space is for bank branches and cafés.”

Annual report 2025A · The company itself

“•Credit Card: Consists of our domestic consumer card lending, personal loans, domestic small business card lending and international card businesses in the U.K. and Canada. •Consumer Banking: Consists of our deposit gathering and lending activities for consumers and small businesses, national auto lending and services offered by the Global Payment Network. •Commercial Banking: Consists of our lending, deposit gathering, capital markets and treasury management services to commercial real estate and commercial and industrial customers.”

Annual report 2025A · The company itself

“We maintain an auto securitization program. •Commercial: We offer a range of commercial lending products, including loans secured by commercial real estate and loans to middle market commercial and industrial companies. Our commercial loans may have a fixed or variable interest rate; however, the majority of our commercial loans have variable rates.”

Annual report 2025A · The company itself

“•Credit Card: Consists of our domestic consumer card lending, personal loans, domestic small business card lending and international card businesses in the U.K. and Canada. •Consumer Banking: Consists of our deposit gathering and lending activities for consumers and small businesses, national auto lending and services offered by the Global Payment Network. •Commercial Banking: Consists of our lending, deposit gathering, capital markets and treasury management services to commercial real estate and commercial and industrial customers.”

Annual report 2025A · The company itself

“Our customers typically include companies with annual revenues between $20 million and $2 billion.”

Annual report 2025A · The company itself

“Our primary loan products include credit cards, auto loans and commercial lending products. •Credit cards: Consists of our domestic consumer card lending, personal loans, domestic small business card lending and international card businesses in the U.K. and Canada.”

Annual report 2025A · The company itself

“Primary Loan Products We provide a variety of lending products. Our primary loan products include credit cards, auto loans and commercial lending products. •Credit cards: Consists of our domestic consumer card lending, personal loans, domestic small business card lending and international card businesses in the U.K. and Canada.”

Annual report 2025A · The company itself

“Portions of our business concentrated primarily on serving the global travel industry, including the Diners Club network, could be disproportionately affected by events that are global in nature, including events that impact international conditions, travel restrictions or perceptions about the safety of travel, all of which may result in an indefinite decline in consumer or business travel activity.”

Annual report 2025A · The company itself

“We maintain an auto securitization program. •Commercial: We offer a range of commercial lending products, including loans secured by commercial real estate and loans to middle market commercial and industrial companies. Our commercial loans may have a fixed or variable interest rate; however, the majority of our commercial loans have variable rates.”

Annual report 2025A · The company itself

“Commercial Loans by Industry Table 19 summarizes our commercial loans held for investment by industry classification as of December 31, 2025 and 2024. Industry classifications below are based on our interpretation of the Federal Loan Classification codes as they pertain to each individual loan. Table 19: Commercial Loans by Industry (Percentage of portfolio) Industry Classification: Finance 42 % 39 % Real Estate & Construction 25 26 Government & Education 8 8 Commercial Services 4 4 Health Care & Pharmaceuticals 3 4 Food & Beverage Manufacturing & Wholesale 3 3 Oil, Gas & Pipelines 2 3 Technology, Telecommunications & Media 2 3 Other 11 10 Total Credit Risk Measurement We closely monitor economic conditions and loan performance trends to assess and manage our exposure to credit risk.”

Annual report 2025A · The company itself

“Portions of our business concentrated primarily on serving the global travel industry, including the Diners Club network, could be disproportionately affected by events that are global in nature, including events that impact international conditions, travel restrictions or perceptions about the safety of travel, all of which may result in an indefinite decline in consumer or business travel activity.”

Annual report 2025A · The company itself

“Under the Basel III Capital Rules, we must maintain a minimum common equity Tier 1 (“CET1”) capital ratio of 4.5%, a Tier 1 capital ratio of 6.0% and a total capital ratio of 8.0%, in each case in relation to risk-weighted assets. In addition, we must maintain a minimum leverage ratio of 4.0% and a minimum supplementary leverage ratio of 3.0%.”

Annual report 2025A · The company itself

“In October 2025, the Federal Reserve proposed revisions to its supervisory stress testing framework. The first proposal included requirements for the Federal Reserve to annually disclose its supervisory stress test models and provide a formal public comment period on material changes to these models and the design of annual stress test scenarios, as well as shifting the “as of” or “jump-off” date of the stress test data from December 31 to September 30 (the “Stress Testing Transparency Proposal”).”

Annual report 2025A · The company itself

“Regulation of Consumer Lending Activities The activities of the Bank as a consumer lender are subject to regulation under various federal laws, including, for example, the Truth in Lending Act (“TILA”), the Equal Credit Opportunity Act, the Fair Credit Reporting Act (“FCRA”), the CRA, the Servicemembers Civil Relief Act and the Military Lending Act, as well as under various state laws. TILA, as amended, and together with its implementing rule, Regulation Z, imposes a number of restrictions on credit card practices impacting rates and fees, requires that a consumer’s ability to pay be taken into account before issuing credit or increasing credit limits, and imposes revised disclosures required for open-end credit.”

Annual report 2025A · The company itself

“Debit Card Interchange Fees For debit cards issued on networks not owned by the Company, the Bank earns interchange fees when customers use its debit cards to make transactions at merchants. The Bank is subject to the Federal Reserve’s Regulation II (Debit Card Interchange Fees and Routing) for those debit cards issued on networks not owned by the Company, which limits the amount of interchange fees that can be received per debit card transaction by debit card issuers with over $10 billion in assets and places certain prohibitions on payment routing restrictions and network exclusivity.”

Annual report 2025A · The company itself

“Privacy, Data Protection and Data Security We are, or may become, subject to a variety of continuously evolving and developing laws and regulations in the United States at the federal, state and local level regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer and other processing of personal information. For example, at the federal level, we are currently subject to the Gramm-Leach-Bliley Act (“GLBA”) and the FCRA, among other laws and regulations, and expect additional privacy, data protection and data security requirements, including cyber incident reporting requirements, to apply to us as a result of future laws or regulations.”

Annual report 2025A · The company itself

“At the state level, California has enacted the California Consumer Privacy Act (“CCPA”) and continues to issue regulations thereunder, and various other states also have enacted or are in the process of enacting state-level privacy, data protection and/or data security laws and regulations, with which we may be required to comply.”

Annual report 2025A · The company itself

“•Compliance with new and existing domestic and foreign laws, regulations and regulatory expectations is costly and complex, and any significant changes may adversely affect our business. •Our required compliance with applicable laws and regulations related to privacy, data protection and data security, in addition to compliance with our own privacy policies and contractual obligations to third parties, may increase our costs, reduce our revenue, increase our legal exposure and limit our ability to pursue business opportunities. •Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement. •We face intense competition in all of our markets, which could have a material adverse effect on our business and results of operations. •A change in market preference towards other operators of payment networks and alternative payment providers could result in reduced transaction volume, limited merchant acceptance of our cards and limited issuance of cards on our networks by third parties, and in turn may impact our revenue margins.”

Annual report 2025A · The company itself

“The Company, including Discover’s business acquired in the Transaction, may be subject to increased scrutiny by, and/or may require additional regulatory compliance with, governmental authorities in connection with the Transaction as a result of an increase in the size, scope and complexity of the combined company’s business operations, which may have an adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Failure to comply with these laws and regulations and effectively navigate this complex regulatory landscape, even if the failure is inadvertent, results from human error or reflects a difference in interpretation or conflicting legal requirements, could subject us to restrictions on our business activities, fines, criminal sanctions and other penalties and/or damage to our reputation with regulators, our customers or the public.”

Annual report 2025A · The company itself

“The legislative, regulatory and supervisory environment is beyond our control, may change rapidly and unpredictably, and may negatively influence our revenue, costs, operations, transaction volumes, earnings, growth, liquidity and capital levels. There have been efforts to impose price controls and other impositions. Such changes, among others, could impact credit availability, affect our ability or willingness to provide certain products or services, necessitate changes to our business practices or materially reduce our revenues.”

Annual report 2025A · The company itself

“We are subject to a variety of continuously evolving and developing laws and regulations in the United States at the federal, state and local level regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer, security and other processing of personal information. These laws and regulations, and similar laws and regulations in other jurisdictions, impose strict requirements regarding the collection, storage, handling, use, disclosure, transfer, security and other processing of personal information, which may have adverse consequences, including significant compliance costs and severe monetary penalties for non-compliance.”

Annual report 2025A · The company itself

“Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about privacy, data protection and data security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices.”

Annual report 2025A · The company itself

“Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement. Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry and the structure of the credit card industry.”

Annual report 2025A · The company itself

“We have been subject to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including governmental inquiries, investigations and enforcement proceedings.”

Annual report 2025A · The company itself

“In December 2025, the OCC issued a report of preliminary findings of its ongoing supervisory review, in accordance with Executive Order 14331 “Guaranteeing Fair Banking for All Americans,” of the nine largest OCC-regulated banks, including the Bank, to determine whether those banks may have debanked or discriminated against customers or potential customers on the basis of their political or religious beliefs or lawful business activities. In the report, the OCC states that its review is ongoing and, once its supervisory review has concluded, it intends to hold the banks reviewed accountable for any unlawful debanking activities, including by making referrals to the Attorney General.”

Annual report 2025A · The company itself

“Over the last several years, federal and state regulators have focused on risk management, compliance with anti-money laundering (“AML”) and sanctions laws, privacy, data protection and data security, use of service providers, fair access and lending, unfair or deceptive practices, and other consumer protection issues and new technologies. Regulators have indicated the potential for escalating consequences for banks that do not timely resolve open issues or have repeat issues.”

Annual report 2025A · The company itself

“Some of our competitors, including new and emerging competitors in the digital and mobile payments space and other financial technology providers and payment networks, are not subject to the same regulatory requirements or scrutiny to which we are subject, which also could place us at a competitive disadvantage, in particular in the development of new technology platforms or the ability to rapidly innovate.”

Annual report 2025A · The company itself

“In the United States, the Federal Reserve’s Regulation II places limits on the interchange fees that issuers may charge, and requires additional routing requirements for, debit cards issued on four-party networks, such as the remaining debit cards issued by the Bank on networks other than the Global Payment Network.”

Annual report 2025A · The company itself

“In October 2023, the Federal Reserve released a notice of proposed rulemaking to revise Regulation II to further reduce the cap on interchange fees that debit card issuers covered by Regulation II can receive for covered debit card transactions.”

Annual report 2025A · The company itself

“In August 2025, a North Dakota district court ruled that the Federal Reserve exceeded its statutory authority when it originally promulgated Regulation II in 2011. As a result, the court vacated Regulation II, although the court stayed the vacatur order to allow time for the resolution of an appeal and allowed the Federal Reserve’s 2023 proposed rule to go into effect if it becomes finalized.”

Annual report 2025A · The company itself

“In addition, in Canada, Visa and Mastercard payment networks have entered into voluntary agreements with the Department of Finance Canada to maintain an agreed-upon average interchange rate.”

Annual report 2025A · The company itself

“Changes to the terms or implementation of Regulation II or the adoption of other laws and regulations that impose limitations on the fees that can be charged by issuers or networks on debit or credit card transactions or require merchants to be provided an alternative network for transaction routing could have an adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“For example, if a change in law or regulation results in debit card transactions on three-party networks, such as debit cards issued by the Bank on the Global Payment Network being subject to the Regulation II cap on interchange fees, it could result in the Company not recognizing a significant majority of the network revenue synergies that the Company anticipated to be realized in connection with the Transaction.”

Annual report 2025A · The company itself

“Our efforts to comply with the GLBA, the FCRA, the CCPA, the PIPEDA and provincial privacy laws, EU GDPR, U.K. GDPR and other privacy, data protection and data security laws and regulations, as well as our posted privacy policies, and related contractual obligations to third parties, entail substantial expenses, may divert resources from other initiatives and projects, and could limit the services we are able to offer.”

Annual report 2025A · The company itself

“A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions.”

Annual report 2025A · The company itself

“The financial services industry, including Capital One, is particularly at risk because of the increased use of and reliance on digital banking products and other digital services, including mobile banking products, such as mobile payments, and other internet- and cloud-based products and applications, and the development of additional remote connectivity solutions, which increase cybersecurity risks and exposure.”

Annual report 2025A · The company itself

“For example, on July 29, 2019, we announced that on March 22 and 23, 2019 an outside individual gained unauthorized access to our systems (the “2019 Cybersecurity Incident”). This individual obtained certain types of personal information relating to people who had applied for our credit card products and to our credit card customers. While the 2019 Cybersecurity Incident has been remediated, it resulted in fines, litigation, consent orders, settlements, government investigations and other regulatory enforcement inquiries.”

Annual report 2025A · The company itself

“In addition, our customers access our products and services using personal devices that are necessarily external to our security control systems. There has also been a significant proliferation of consumer information available on the internet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. These third-party breach events could create a threat for our customers if their Capital One log-in credentials are the same as or similar to the credentials that have been compromised on other internet sites. This threat could include the risk of unauthorized account access, data loss and fraud.”

Annual report 2025A · The company itself

“The use of AI, “bots” or other automation software can increase the velocity and efficacy of these types of attacks and such use by companies has resulted in, and may continue to result in, cyber-attacks and other security incidents that implicate the sensitive and confidential information, including personal information, of AI users.”

Annual report 2025A · The company itself

“As our employees and contractors are operating under our hybrid work model, our remote interaction with employees, service providers, partners and other third parties on systems, networks and environments over which we have less control (such as through employees’ personal devices) increases our cybersecurity risk exposure.”

Annual report 2025A · The company itself

“The methods and techniques employed by malicious actors continue to develop and evolve rapidly, including from emerging technologies, such as AI and quantum computing, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and enable persistent access for an extended period of time before being detected and remediated, if at all. We and our service providers and other third parties with which we interact may be unable to anticipate or identify certain attack methods or techniques in order to implement effective preventative or detective measures or mitigate or remediate the damages caused in a timely manner.”

Annual report 2025A · The company itself

“We may also be unable to hire, develop and retain talent that keeps pace with the rapidly changing cyber threat landscape, and which are capable of preventing, detecting, mitigating or remediating these risks. Although we seek to maintain a robust suite of authentication and layered information security controls, any one or combination of these controls could fail to prevent, detect, mitigate, remediate or recover from these risks in a timely manner.”

Annual report 2025A · The company itself

“An actual, suspected, threatened or alleged disruption or breach, including as a result of a cyber-attack, or media (including social media) reports of alleged or perceived security vulnerabilities or incidents at Capital One or at our service providers, could result in significant legal and financial exposure, regulatory intervention, litigation, enforcement actions, remediation costs, card reissuance, inability to timely pay our debts (and consequently limit our access to future funding), operational disruptions, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business.”

Annual report 2025A · The company itself

“Furthermore, the Transaction exposes us to additional cybersecurity risks, which we expect to continue until the integration of Discover is completed. These risks include the possibility of previously undetected cybersecurity threats in Discover's operations, systems and networks, as well as risks related to the cybersecurity posture of Discover and its third-party service providers. The materialization of such risks could lead to the degradation or disruption of our operations and services; unauthorized access; breach of confidentiality; and misuse or modification of systems, networks and data.”

Annual report 2025A · The company itself

“If any of our employees, contractors, third-party service providers or other third parties with which we do business use any third-party AI solutions in connection with our business, it may lead to the inadvertent or unauthorized disclosure or incorporation of our sensitive and confidential information, including personal information, into third-party systems or publicly available or third-party training sets, which may impact our ability to realize the benefit of our intellectual property or other proprietary rights in such information.”

Annual report 2025A · The company itself

“Risks of external fraud exceeding our expectations due to larger, more sophisticated, or more frequent fraud attacks, failure to detect and respond to such attacks and/or the reduced capability to recover losses from those incidents. This could result in increased fraud loss, operational cost, customer dissatisfaction, reputational damage and/or constrained revenue growth for us.”

Annual report 2025A · The company itself

“Our risk of fraud continues to increase as third parties that handle confidential consumer information suffer security breaches, we expand our digital banking business and we introduce new products and features (including our acquisition of the Global Payment Network).”

Annual report 2025A · The company itself

“Credit and debit card fraud, identity theft and electronic-transaction related crimes are prevalent, and perpetrators are growing ever more sophisticated.”

Annual report 2025A · The company itself

“Additionally, consumer activists and regulators have sought to expand financial institutions’ responsibility to hold customers harmless for transactions that they authorized on their accounts that are the result of scams. Emerging generative AI capabilities, such as synthetic video, images and identity documents may introduce new risks, in the form of identity fraud and scams.”

Annual report 2025A · The company itself

“In addition, we continue to incur increased costs with respect to preventing, detecting, investigating, mitigating, remediating and recovering from cybersecurity risks, as well as any related attempted fraud. In order to address ongoing and future risks, we must expend significant resources to support protective security measures, investigate and remediate any vulnerabilities of our information systems and infrastructure and invest in new technology designed to mitigate security risks.”

Annual report 2025A · The company itself

“We have insurance against some cyber risks and attacks; nonetheless, our insurance coverage may not be sufficient to offset the impact of a material loss event (including if our insurer denies coverage as to any particular claim in the future), and such insurance may increase in cost or cease to be available on commercially reasonable terms, or at all, in the future. In addition, in the case of any cyber-attack or other security incident, information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such incidents.”

Annual report 2025A · The company itself

“OPERATIONS AND BUSINESS SEGMENTS Our consolidated total net revenues are derived primarily from lending to consumer and commercial customers net of funding costs associated with our deposits, long-term debt and other borrowings. We also earn non-interest income which primarily consists of discount and interchange income, net of reward expenses, and service charges and other customer-related fees.”

Annual report 2025A · The company itself

“For example, some customers have been and may continue to be less willing or able overall to borrow at higher interest rates. Higher interest rates also have hindered and may continue to hinder the ability of some borrowers to support required loan payments.”

Annual report 2025A · The company itself

“Additionally, interest rate fluctuations and competitor responses to those changes may have a material adverse effect on our financial condition and results of operations, as customers or commercial clients default on their loans, maintain lower deposit levels or, in the case of credit card accounts, reduce demand for credit or (for existing customers) the level of borrowing or purchase activity.”

Annual report 2025A · The company itself

“Like other lenders, we face the risk that our customers will not repay their loans. A customer’s ability and willingness to repay us can be adversely affected by decreases in the income of the borrower or increases in their payment obligations to other lenders, whether as a result of a job loss, higher debt levels or rising cost of servicing debt, inflation outpacing wage growth, or by restricted availability of credit generally. We may fail to quickly identify and reduce our exposure to customers that are likely to default on their payment obligations, whether by closing credit lines or restricting authorizations. Our ability to manage credit risk also is affected by legal or regulatory changes (such as restrictions on collections, bankruptcy laws, minimum payment regulations and re-age guidance), competitors’ actions and consumer behavior, and depends on the effectiveness of our collections staff, techniques and models.”

Annual report 2025A · The company itself

“Historically, customers are more likely to miss payments during an economic downturn, recession, periods of high unemployment, or prolonged periods of slow economic growth. Customers might also be more likely to miss payments if the payment burdens on their existing debt grow due to higher interest rates, or if inflation outpaces wage growth.”

Annual report 2025A · The company itself

“We compete on the basis of the rates we pay on deposits and the rates and other terms we charge on the loans we originate or purchase, as well as the quality and range of our customer service, products, innovation and experience, and, with respect to our payment network businesses, the strength, reach, pricing and capabilities of our network offerings to merchants, acquirers and issuers.”

Annual report 2025A · The company itself

“Aggressive pricing throughout the industry may adversely affect the retention of existing balances and the cost-efficient acquisition of new deposit funds and may affect our growth and profitability.”

Annual report 2025A · The company itself

“MARKET RISK PROFILE Our primary market risk exposures include interest rate risk, foreign exchange risk and commodity pricing risk. We are exposed to market risk primarily from the following operations and activities: •Traditional banking activities of deposit gathering and lending; •Asset/liability management activities including the management of investment securities, short-term and long-term borrowings and derivatives; •Foreign operations within our Credit Card and Consumer Banking businesses; and •Customer accommodation activities within our Commercial Banking business.”

Annual report 2025A · The company itself

“As of June 30, 2025, we integrated the acquired assets and assumed liabilities of Discover that are part of our continuing operations into our interest rate risk framework. The Transaction, and subsequent business actions, have resulted in modest impacts to both our net interest income and economic value of equity sensitivities.”

Annual report 2025A · The company itself

“At the current level of interest rates, our projected 12-month net interest income is expected to increase in higher rate scenarios and decrease in lower rate scenarios. The decrease in lower rate scenarios is driven by lower interest income from our assets, including floating rate credit card and commercial loans, being partially offset by lower interest expense from our deposits and other liabilities, net of our interest rate hedges.”

Annual report 2025A · The company itself

“We maintained liquidity reserves of $144 billion and $123.8 billion as of December 31, 2025 and 2024, respectively, as shown in Table 27 below. Included in liquidity reserves are cash and cash equivalents, investment securities and FHLB borrowing capacity secured by loans.”

Annual report 2025A · The company itself

“Credit Ratings Our credit ratings impact our ability to access capital markets and our borrowing costs. For more information, see “Part I—Item 1A.”

Annual report 2025A · The company itself

“We are committed to implementing safeguards designed to protect our customers’ information, as well as our own information and technology. For additional information on our risks associated with cybersecurity and our use of technology systems and our management of these risks, please see “Item 1A.”

Annual report 2025A · The company itself

“•We face risks related to our operational, technological and organizational infrastructure. •A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions. •We face risks resulting from the extensive use of models and data, as well as from our evolving use of AI. •Risks of external fraud exceeding our expectations due to larger, more sophisticated, or more frequent fraud attacks, failure to detect and respond to such attacks and/or the reduced capability to recover losses from those incidents.”

Annual report 2025A · The company itself

“•Compliance with new and existing domestic and foreign laws, regulations and regulatory expectations is costly and complex, and any significant changes may adversely affect our business. •Our required compliance with applicable laws and regulations related to privacy, data protection and data security, in addition to compliance with our own privacy policies and contractual obligations to third parties, may increase our costs, reduce our revenue, increase our legal exposure and limit our ability to pursue business opportunities. •Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement. •We face intense competition in all of our markets, which could have a material adverse effect on our business and results of operations. •A change in market preference towards other operators of payment networks and alternative payment providers could result in reduced transaction volume, limited merchant acceptance of our cards and limited issuance of cards on our networks by third parties, and in turn may impact our revenue margins.”

Annual report 2025A · The company itself

“Similar to other large corporations in our industry, we are exposed to operational risk that can manifest itself in many ways, such as errors in execution, inadequate processes, inaccurate models, faulty or disabled technological infrastructure, malicious disruption and fraud by employees or persons outside of our company, whether through attacks on Capital One directly, or on our third-party service providers or customers. In addition, the increased use of near real-time money movement solutions and the use of AI, as well as other emerging technologies, increases the complexity of preventing, detecting and recovering fraudulent transactions.”

Annual report 2025A · The company itself

“In particular, negative public perceptions regarding our reputation, including negative perceptions regarding our ability to maintain the security of our technology systems and protect customer data, could lead to decreases in the levels of deposits that current and potential consumer and commercial customers choose to maintain with us.”

Annual report 2025A · The company itself

“Negative public opinion or damage to our brand could also result from actual or alleged conduct in any number of activities or circumstances, including lending and payment network practices, regulatory compliance, cyber-attacks or other security incidents, accounting issues, corporate governance and sales and marketing, and from actions taken by regulators or other persons in response to such conduct.”

Annual report 2025A · The company itself

“We are also heavily dependent on the security, capability, integrity and continuous availability of the technology systems and networks that we use to manage our internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to our customers, develop and offer new products and communicate with stakeholders.”

Annual report 2025A · The company itself

“Our ability to compete depends, in part, on our ability to attract and retain our associates and on our reputation as well as our ability to keep pace with innovation, in particular in the development of new technology platforms.”

Annual report 2025A · The company itself

“As of December 31, 2025, Capital One had approximately 76,300 employees worldwide, whom we refer to as “associates.””

Annual report 2025A · The company itself

“During this period of integration, our employees may face distraction and uncertainty, and we may experience increased levels of employee attrition. A loss of key personnel or material erosion of employee morale could have a materially adverse effect on our ability to meet customer expectations, thereby adversely affecting our business and results of operations. The failure to retain members of our management team and other key personnel could also impair our ability to execute our strategy and implement operational initiatives, thereby having a material adverse effect on our financial condition and results of operations.”

Annual report 2025A · The company itself

“We may also be unable to hire, develop and retain talent that keeps pace with the rapidly changing cyber threat landscape, and which are capable of preventing, detecting, mitigating or remediating these risks. Although we seek to maintain a robust suite of authentication and layered information security controls, any one or combination of these controls could fail to prevent, detect, mitigate, remediate or recover from these risks in a timely manner.”

Annual report 2025A · The company itself

“Compensation and Wellness We appreciate the importance of a competitive total compensation package to attract and retain great talent. Our benefits, including competitive parental leave, on-site health centers, company contributions to associates’ 401(k) plans, educational assistance and other health, wellness and financial benefits are designed to support our associates’ wellbeing inside and outside of the workplace.”

Annual report 2025A · The company itself

“Further, our success depends on our ability to attract and retain strong digital and technology leaders, engineers and other specialized personnel. The competition is intense, and the compensation costs continue to increase for such talent.”

Annual report 2025A · The company itself

“Our business could be negatively affected if we are unable to attract, develop, retain and motivate key senior leaders and skilled employees. Our success depends, in large part, on our ability to retain key senior leaders and to attract, develop and retain skilled employees, particularly employees with advanced expertise in credit, risk, digital and technology skills.”

Annual report 2025A · The company itself

“In our Credit Card business, we generally experience fluctuations in purchase volume and the level of outstanding loan receivables from seasonal variances in consumer spending and payment patterns which, for example, have historically been the highest around the winter holiday season.”

Annual report 2025A · The company itself

“Changes or instability in the macroeconomic environment may impact payment patterns, consumer spending and credit losses. Because we offer a broad array of financial products and services to consumers, small businesses and commercial clients, our financial results are impacted by the level of consumer and business activity and the demand for our products and services. A prolonged period of economic weakness, volatility, slow growth or a significant deterioration in economic conditions, in the countries in which we operate, could have a material adverse effect on our financial condition and results of operations as customers or commercial clients default on their loans, maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity.”

Annual report 2025A · The company itself

“Decreases in overall business activity and changes in customer behavior (such as the increased use of debt settlement companies) may lead to increases in our charge-off rate caused by bankruptcies and may reduce our ability to recover debt that we have previously charged off. Such changes may also decrease the reliability of our internal processes and models, including those we use to estimate our allowance for credit losses, particularly if unexpected variations in key inputs and assumptions cause actual losses to diverge from the projections of our models and our estimates become increasingly subject to management’s judgment.”

Annual report 2025A · The company itself

“Rising credit losses or leading indicators of rising credit losses (such as higher delinquencies, higher rates of nonperforming loans, higher bankruptcy rates, lower collateral values, elevated unemployment rates or changing market terms) may require us to increase our allowance for credit losses, which would decrease our profitability if we are unable to raise revenue or reduce costs to compensate for higher credit losses, whether actual or expected.”

Annual report 2025A · The company itself

“Historically, customers are more likely to miss payments during an economic downturn, recession, periods of high unemployment, or prolonged periods of slow economic growth. Customers might also be more likely to miss payments if the payment burdens on their existing debt grow due to higher interest rates, or if inflation outpaces wage growth.”

Annual report 2025A · The company itself

“We operate in a highly competitive environment across all of our lines of business, whether in making loans, attracting deposits or in the global payments industry, and we expect competitive conditions to continue to intensify with respect to most of our products, particularly in our card, payment network and consumer banking businesses.”

Annual report 2025A · The company itself

“AI may subject us to new or heightened legal, regulatory, ethical or other challenges, and a negative public opinion of AI could impede the acceptance of AI solutions. If the models or AI solutions that we or a third party create and use or the data inputs, formulas, or algorithms on which such models or AI solutions rely – or if the content, analyses or recommendations that the models or AI solutions produce are (or are perceived to be) deficient, inaccurate, biased, unethical or controversial – we could incur operational inefficiencies, competitive harm, legal liability, or brand or reputational harm.”

Annual report 2025A · The company itself

“The regulation of AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful, emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection and data security, consumer protection, competition and equal opportunity laws and regulations. They are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations.”

Annual report 2025A · The company itself

“In particular, several states, including Colorado and California, have passed or are continuing to propose laws and regulations that govern various facets and uses of AI. We may not be able to anticipate how to respond to these rapidly evolving frameworks, and we may need to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions.”

Annual report 2025A · The company itself

“Climate-related Developments Climate change and the risks it may pose to financial institutions are areas of focus by various legislative bodies and regulators. In the future, new laws, regulations or guidance may be issued, or other regulatory or supervisory actions may be taken in this area by regulatory agencies.”

Annual report 2025A · The company itself

“•We face risks from catastrophic events. •Climate change manifesting as physical or transition risks could adversely affect our businesses, operations and customers and result in increased costs. •We face risks from the use of or changes to assumptions or estimates in our financial statements. •The soundness of other financial institutions and other third parties, actual or perceived, could adversely affect us.”

Annual report 2025A · The company itself

“We face risks from catastrophic events. Natural disasters, geopolitical events, supply chain issues and other catastrophic events can have widespread and unpredictable impacts on global society, economic conditions and consumer and business behavior, which may reoccur or occur over an extended duration. These events could harm our employees, business and infrastructure, including our information technology systems and third-party platforms.”

Annual report 2025A · The company itself

“Like other lenders, we face the risk that our customers will not repay their loans. A customer’s ability and willingness to repay us can be adversely affected by decreases in the income of the borrower or increases in their payment obligations to other lenders, whether as a result of a job loss, higher debt levels or rising cost of servicing debt, inflation outpacing wage growth, or by restricted availability of credit generally. We may fail to quickly identify and reduce our exposure to customers that are likely to default on their payment obligations, whether by closing credit lines or restricting authorizations. Our ability to manage credit risk also is affected by legal or regulatory changes (such as restrictions on collections, bankruptcy laws, minimum payment regulations and re-age guidance), competitors’ actions and consumer behavior, and depends on the effectiveness of our collections staff, techniques and models.”

Annual report 2025A · The company itself

“Rising credit losses or leading indicators of rising credit losses (such as higher delinquencies, higher rates of nonperforming loans, higher bankruptcy rates, lower collateral values, elevated unemployment rates or changing market terms) may require us to increase our allowance for credit losses, which would decrease our profitability if we are unable to raise revenue or reduce costs to compensate for higher credit losses, whether actual or expected.”

Annual report 2025A · The company itself

“In addition, global events and geopolitical instability may lead to increased nation-state targeting us and other financial institutions in the U.S. and abroad, particularly given our expanded global footprint.”

Annual report 2025A · The company itself

“We face risks from catastrophic events. Natural disasters, geopolitical events, supply chain issues and other catastrophic events can have widespread and unpredictable impacts on global society, economic conditions and consumer and business behavior, which may reoccur or occur over an extended duration. These events could harm our employees, business and infrastructure, including our information technology systems and third-party platforms.”

Annual report 2025A · The company itself

“Like other lenders, we face the risk that our customers will not repay their loans. A customer’s ability and willingness to repay us can be adversely affected by decreases in the income of the borrower or increases in their payment obligations to other lenders, whether as a result of a job loss, higher debt levels or rising cost of servicing debt, inflation outpacing wage growth, or by restricted availability of credit generally. We may fail to quickly identify and reduce our exposure to customers that are likely to default on their payment obligations, whether by closing credit lines or restricting authorizations. Our ability to manage credit risk also is affected by legal or regulatory changes (such as restrictions on collections, bankruptcy laws, minimum payment regulations and re-age guidance), competitors’ actions and consumer behavior, and depends on the effectiveness of our collections staff, techniques and models.”

Annual report 2025A · The company itself

“Historically, customers are more likely to miss payments during an economic downturn, recession, periods of high unemployment, or prolonged periods of slow economic growth. Customers might also be more likely to miss payments if the payment burdens on their existing debt grow due to higher interest rates, or if inflation outpaces wage growth.”

Annual report 2025A · The company itself

“For example, debit card transactions on three-party networks could become subject to the Federal Reserve’s Regulation II (Debit Card Interchange Fees and Routing) requirements, and other changes in laws or regulations or in the interpretation of existing laws or regulations could impose additional limitations on the fees issuers or networks can charge on debit or credit card transactions or require merchants to be provided an alternative network for transaction routing, any of which may have an adverse effect on our business.”

Annual report 2025A · The company itself

“Our business, financial condition and results of operations may be adversely affected by legislation, regulation and merchants’ efforts to reduce the fees (including the interchange component) charged by credit and debit card networks and acquirers to facilitate card transactions.”

Annual report 2025A · The company itself

“We face risks from catastrophic events. Natural disasters, geopolitical events, supply chain issues and other catastrophic events can have widespread and unpredictable impacts on global society, economic conditions and consumer and business behavior, which may reoccur or occur over an extended duration. These events could harm our employees, business and infrastructure, including our information technology systems and third-party platforms.”

Annual report 2025A · The company itself

“Many other financial institutions have increased their reliance on deposit funding and, as such, we expect continued competition in the deposit markets, including with some financial institutions with tokenized deposit programs.”

Annual report 2025A · The company itself

“These actions or initiatives may include more accommodative positions on the processing and approval of traditional bank charters and deposit insurance, expanded access to the banking and payments systems through the approval of competitors, including competitors with novel business models, to hold specialized charters, or more accommodative positions on novel activities performed by banks or non-banks. For example, the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (GENIUS Act) provides a legal framework for stablecoins to be issued in the United States, which may allow new and existing competitors to compete for funds that may have otherwise been deposited with banks, such as the Bank.”

Annual report 2025A · The company itself

“Further, we are now facing ongoing competition from emerging alternative payment providers who may create innovative networks or other arrangements with our primary competitors, large merchants or other industry participants, or provide stablecoins, other digital currencies or tokenized deposits, which could adversely impact our costs, transaction volume and ability to grow our business.”

Annual report 2025A · The company itself

“New payment systems, particularly mobile-based payment technologies and digital currencies and cryptocurrencies (including stablecoins), could also gain widespread adoption and lead to issuer transaction fees or the displacement of credit or debit cards as a payment method.”

Annual report 2025A · The company itself

“Changes in valuations in the debt and equity markets could have a negative impact on the assets we hold in our investment portfolio.”

Annual report 2025A · The company itself

“We maintained liquidity reserves of $144 billion and $123.8 billion as of December 31, 2025 and 2024, respectively, as shown in Table 27 below. Included in liquidity reserves are cash and cash equivalents, investment securities and FHLB borrowing capacity secured by loans.”

Annual report 2025A · The company itself

“Credit Ratings Our credit ratings impact our ability to access capital markets and our borrowing costs. For more information, see “Part I—Item 1A.”

Annual report 2025A · The company itself

“In some jurisdictions, such as Canada and certain countries in Europe, including the U.K., interchange fees and related practices are subject to regulatory activity, including in some cases, imposing caps on permissible interchange fees.”

Annual report 2025A · The company itself

“For example, in the U.K., interchange fees are capped for both consumer credit and debit card transactions.”

Annual report 2025A · The company itself

“We also offer credit card products and certain other services outside of the U.S. principally through Capital One (Europe) plc (“COEP”), an indirect subsidiary of CONA organized and located in the United Kingdom (“U.K.”), and through a branch of CONA in Canada. Both COEP and our Canadian branch of CONA have the authority to provide credit card loans.”

Annual report 2025A · The company itself

“For example, we have a large number of customer accounts in our credit card and auto lending businesses and we have made the strategic choice to originate and service subprime credit card and auto loans, which typically have higher delinquencies and charge-offs than prime customer accounts. As a result, we have significant involvement with credit bureau reporting and the collection and recovery of delinquent and charged-off debt, primarily through customer communications, the filing of litigation against customers in default, the periodic sale of charged off debt and vehicle repossession. These and other consumer lending activities are subject to customer complaints and enhanced legal and regulatory scrutiny from regulators, courts and legislators.”

Annual report 2025A · The company itself

“Regulation or regulatory guidance restricting executive compensation, as well as evolving investor expectations, may limit the types of compensation arrangements that we may enter into with our most senior leaders and could have a negative impact on our ability to attract, retain and motivate such leaders in support of our long-term strategy.”

Annual report 2025A · The company itself

“MARKET RISK PROFILE Our primary market risk exposures include interest rate risk, foreign exchange risk and commodity pricing risk. We are exposed to market risk primarily from the following operations and activities: •Traditional banking activities of deposit gathering and lending; •Asset/liability management activities including the management of investment securities, short-term and long-term borrowings and derivatives; •Foreign operations within our Credit Card and Consumer Banking businesses; and •Customer accommodation activities within our Commercial Banking business.”

Annual report 2025A · The company itself

“Foreign Exchange Risk Foreign exchange risk represents exposure to changes in the values of current holdings and future cash flows denominated in other currencies. We are exposed to foreign exchange risk primarily from the intercompany funding denominated in pound sterling (“GBP”) and the Canadian dollar (“CAD”) that we provide to our businesses in the U.K. and Canada and net equity investments in those businesses. We are also exposed to foreign exchange risk due to changes in the dollar-denominated value of future earnings and cash flows from our foreign operations and from our Euro (“EUR”)-denominated borrowing.”

Annual report 2025A · The company itself

“MARKET RISK PROFILE Our primary market risk exposures include interest rate risk, foreign exchange risk and commodity pricing risk. We are exposed to market risk primarily from the following operations and activities: •Traditional banking activities of deposit gathering and lending; •Asset/liability management activities including the management of investment securities, short-term and long-term borrowings and derivatives; •Foreign operations within our Credit Card and Consumer Banking businesses; and •Customer accommodation activities within our Commercial Banking business.”

Annual report 2025A · The company itself

“Foreign Exchange Risk Foreign exchange risk represents exposure to changes in the values of current holdings and future cash flows denominated in other currencies. We are exposed to foreign exchange risk primarily from the intercompany funding denominated in pound sterling (“GBP”) and the Canadian dollar (“CAD”) that we provide to our businesses in the U.K. and Canada and net equity investments in those businesses. We are also exposed to foreign exchange risk due to changes in the dollar-denominated value of future earnings and cash flows from our foreign operations and from our Euro (“EUR”)-denominated borrowing.”

Annual report 2025A · The company itself

“In addition, advances in technology, such as automation and AI, may lead to workforce evolution. This could require us to invest in additional employee training, manage impacts on morale and retention, and compete for employment candidates who possess more advanced technological skills, all of which could have a negative impact on our business and operations.”

Annual report 2025A · The company itself

“If merchants increasingly impose surcharges or other point of sale pricing strategies in response to transaction fees, card usage and transaction volumes could decline, which could adversely affect our revenues and results of operations.”

Annual report 2025A · The company itself

“Transition risks are the risks resulting from the shift toward a lower-carbon economy arising from the changes in policy, consumer and business sentiment or technologies associated with changes to limit climate change. Transition risks, including changes in consumer preferences and additional regulatory requirements or taxes, could increase our expenses, affect credit performance and impact our strategies or those of our customers.”

Annual report 2025A · The company itself

“As our employees and contractors are operating under our hybrid work model, our remote interaction with employees, service providers, partners and other third parties on systems, networks and environments over which we have less control (such as through employees’ personal devices) increases our cybersecurity risk exposure.”

Annual report 2025A · The company itself

“We have insurance against some cyber risks and attacks; nonetheless, our insurance coverage may not be sufficient to offset the impact of a material loss event (including if our insurer denies coverage as to any particular claim in the future), and such insurance may increase in cost or cease to be available on commercially reasonable terms, or at all, in the future. In addition, in the case of any cyber-attack or other security incident, information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such incidents.”

Annual report 2025A · The company itself

“Properties Our corporate and banking real estate portfolio consists of approximately 12.3 million square feet of owned or leased office and retail space, which is used to support our business. Of this overall portfolio, approximately 10.4 million square feet of space is dedicated for various corporate office uses and approximately 1.9 million square feet of space is for bank branches and cafés.”

Annual report 2025A · The company itself

“We also offer credit card products and certain other services outside of the U.S. principally through Capital One (Europe) plc (“COEP”), an indirect subsidiary of CONA organized and located in the United Kingdom (“U.K.”), and through a branch of CONA in Canada. Both COEP and our Canadian branch of CONA have the authority to provide credit card loans.”

Annual report 2025A · The company itself

“Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our business and the communities where we are located, which are concentrated in the Northern Virginia, New York and Chicago metropolitan areas, Richmond, Virginia, Plano, Texas and the Philippines.”

Annual report 2025A · The company itself