KeyCorp

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“Human Capital Engaging a high performing and collaborative workforce is a top strategic priority for Key. Our human capital management strategy is focused on attracting, retaining, developing, motivating and rewarding the talent our businesses need to drive sound, profitable growth, and ultimately, enhance shareholder value, which we do by offering a competitive total rewards package, providing opportunities for career development and growth, and fostering a culture that is fair and inclusive for all.”

Annual report 2025A · The company itself

“Such investments cause compensation and benefits to represent our greatest expense.”

Annual report 2025A · The company itself

“Successfully competing in our markets also depends on our ability to invest in technology and infrastructure, execute transactions reliably and effectively, maintain and enhance our reputation, and attract, retain, and motivate talented employees, all while prudently managing risks and expenses.”

Annual report 2025A · The company itself

“◦Our controls and procedures may fail or be circumvented, and our methods of reducing risk exposure may not be effective. ◦Our operations and financial performance could be adversely affected by severe weather and natural disasters, both directly and as a result of impacts on our customers. ◦Our development and use of AI, including through third parties, exposes us to inherent risks that may adversely impact KeyCorp. •Compliance Risk ◦We are subject to extensive government regulation, supervision, and tax legislation. ◦We are subject to complex and evolving laws and regulations regarding privacy and cybersecurity, which could limit our ability to pursue business initiatives, increase the cost of doing business and subject us to compliance risks and potential liability.”

Annual report 2025A · The company itself

“Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of AI, introduces new information security risks and exposure for us and for our third party service providers, and, additionally, such technologies may be used to identify vulnerabilities; such technologies have resulted in a substantial increase in the volume and sophistication of cyberattacks against financial and other institutions, including the use of generative AI to conduct more sophisticated social engineering attacks.”

Annual report 2025A · The company itself

“The increasing pressure from our competitors, both bank and nonbank, to keep pace and adopt new technologies and products and services requires us to incur substantial expense. We may be unsuccessful in developing or introducing new products and services, modifying our existing products and services, adapting to changing consumer preferences and spending and saving habits, achieving market acceptance or regulatory approval, sufficiently developing or maintaining a loyal customer base, or offering products and services at prices equal to or lower than the prices offered by our competitors.”

Annual report 2025A · The company itself

“Increased model and generative AI use could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.”

Annual report 2025A · The company itself

“We use, and will increasingly use AI, including through third party vendors acting on our behalf and other counterparties, in connection with our business and operations. AI is complex and rapidly evolving and in order to compete with other banks and financial institutions effectively, we must incorporate new and emerging AI technology into our business and this may subject us to new or heightened legal, regulatory, operational, and other risk.”

Annual report 2025A · The company itself

“Banking is a confidence sensitive business, so disruption within the financial markets, including negative news, rumors, or misinformation regarding the banking industry or perceived risks of a bank’s safety and soundness, can adversely impact the market price and volatility of our common stock, cause deposit runoff or prompt the loss of important customers or counterparties.”

Annual report 2025A · The company itself

“Damage to our reputation could significantly impact our business and major stakeholders. Our ability to attract and retain customers, clients, investors, and highly skilled management and employees is affected by our reputation.”

Annual report 2025A · The company itself

“Through KeyBank and certain other subsidiaries, we provide a wide range of retail and commercial banking, commercial leasing, investment management, consumer finance, student loan refinancing, commercial mortgage servicing and special servicing, and investment banking products and services to individual, corporate, and institutional clients through two major business segments: Consumer Bank and Commercial Bank.”

Annual report 2025A · The company itself

“We are subject to the risk of defaults by our loan clients and counterparties. Many of our routine transactions expose us to credit risk, including the risk of default of our counterparties, which include other financial institutions, or clients.”

Annual report 2025A · The company itself

“We have exposure to many different industries and counterparties in the financial services industries, and we routinely execute transactions with such counterparties, including brokers and dealers, banks, mortgage originators, hedge funds, insurance companies, and other institutional clients.”

Annual report 2025A · The company itself

“Credit Risk We have concentrated credit exposure in commercial and industrial loans, commercial real estate loans, and commercial leases. As of December 31, 2025, approximately 72% of our loan portfolio consisted of commercial and industrial loans, commercial real estate loans, including commercial mortgage and construction loans, and commercial leases.”

Annual report 2025A · The company itself

“The Commercial operating segment is a full-service, commercial banking platform that focuses primarily on serving the borrowing, cash management, and capital markets needs of middle market clients within Key’s 15-state branch footprint.”

Annual report 2025A · The company itself

“The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology.”

Annual report 2025A · The company itself

“It is also a significant, national, commercial real estate lender and third-party master and special servicer of commercial mortgage loans.”

Annual report 2025A · The company itself

“Credit Risk We have concentrated credit exposure in commercial and industrial loans, commercial real estate loans, and commercial leases. As of December 31, 2025, approximately 72% of our loan portfolio consisted of commercial and industrial loans, commercial real estate loans, including commercial mortgage and construction loans, and commercial leases.”

Annual report 2025A · The company itself

“The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology.”

Annual report 2025A · The company itself

“Our ability to maintain and grow deposits may be constrained by gaps in our product offerings, emerging technologies and changes in consumer behaviors and preferences, our scale relative to other banks and financial institutions, underlying macroeconomic conditions and monetary policy, and loss of confidence in our brand and our business.”

Annual report 2025A · The company itself

“The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our digital brand by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services.”

Annual report 2025A · The company itself

“Online and mobile banking have made it easier for customers to withdraw their deposits. Higher than customary withdrawals can raise funding cost, which may reduce Key’s net interest margin and net interest income.”

Annual report 2025A · The company itself

“Successfully competing in our markets also depends on our ability to invest in technology and infrastructure, execute transactions reliably and effectively, maintain and enhance our reputation, and attract, retain, and motivate talented employees, all while prudently managing risks and expenses.”

Annual report 2025A · The company itself

“Mergers and acquisitions have also led to increased concentration in the banking industry, placing added competitive pressure on Key’s core banking products and services as we see competitors enter some of our markets or offer similar products.”

Annual report 2025A · The company itself

“Acquisitions or strategic partnerships may disrupt our business and dilute shareholder value. Acquisitions of businesses, such as financial technology companies or investment banking firms, bank branches, or other banks involves various risks commonly associated with acquisitions or partnerships, including exposure to unknown or contingent liabilities of the acquired company; diversion of our management’s time and attention; significant integration risk with respect to employees, accounting systems, and technology platforms; increased regulatory scrutiny; and the possible loss of key employees and customers of the acquired company.”

Annual report 2025A · The company itself

“The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology.”

Annual report 2025A · The company itself

“The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology.”

Annual report 2025A · The company itself

“A large portion of our clients are active in real estate, with most focused on the multifamily space, which has been the best performing real estate sector over the cycle. However, while development and construction have continued 26 Table of contents at muted levels over the past two years, oversupply of multifamily housing is a concern in certain urban markets. This oversupply has resulted in higher vacancy rates and put pressure on some borrowers to achieve underwritten rents.”

Annual report 2025A · The company itself

“The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our digital brand by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services.”

Annual report 2025A · The company itself

“The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology.”

Annual report 2025A · The company itself

“Comprehensive reform of the legislative and regulatory environment for financial services companies remains ongoing.”

Annual report 2025A · The company itself

“The Economic Growth, Regulatory Relief, and Consumer Protection Act (“EGRRCPA”) raised the asset threshold above which the Federal Reserve is required to apply enhanced prudential standards to BHCs with at least $250 billion in total consolidated assets and gave the Federal Reserve the authority to apply enhanced prudential standards to BHCs with at least $100 billion in assets but less than $250 billion in assets (like KeyCorp) if it determines that the application of the enhanced prudential standards is appropriate to prevent or mitigate risks to financial stability or to promote the safety and soundness of the BHC or BHCs, taking into consideration the BHC’s or BHCs’ capital structure, riskiness, complexity, financial activities, size, and other relevant factors.”

Annual report 2025A · The company itself

“Further, the Federal Reserve has detailed the processes that BHCs should maintain to ensure they hold adequate capital under severely adverse conditions and have ready access to funding before engaging in any capital activities. The severity and other features of these processes, which take the form of stress tests and other measures, may evolve from year to year and are used by the Federal Reserve to, among other things, evaluate our management of capital and the adequacy of our regulatory capital and to determine the stress capital buffer that we must maintain above our minimum regulatory capital requirements.”

Annual report 2025A · The company itself

“To facilitate our wholesale funding and other business activities, we maintain credit ratings with three major credit rating agencies, and their assessments of our capital and liquidity are prominent determinants of our credit ratings. Additionally, from time to time, the agencies revise their bank rating methodologies and may increase their expectations of the amount and/or type of capital and liquidity we hold in order to maintain our investment grade credit ratings.”

Annual report 2025A · The company itself

“From time to time, federal banking regulators tailor the extent to which various categories of large banks are subject to certain capital, liquidity and other regulations. For instance, Category IV banks with assets between $100 billion and $250 billion, including Key, are not currently subject to certain capital and liquidity standards required of larger banks.”

Annual report 2025A · The company itself

“The FDIC may impose a special assessment on IDIs to recover the loss to the failed bank resulting from the use of the systemic risk exception to protect uninsured depositors. A special assessment could increase our noninterest expense for that quarter, as was the case during the fourth quarter of 2023 and first quarter of 2024.”

Annual report 2025A · The company itself

“Regulators can implement measures designed to strengthen capital and liquidity standards and restore confidence in the banking system applicable to Key including those discussed in “Regulatory capital requirements” under the heading “Supervision and Regulation” in Item 1 of this report. These regulatory rules could have a material effect on our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Changes in FHLB lending policies or the haircuts they apply to our pledged collateral could adversely affect our liquidity and profitability.”

Annual report 2025A · The company itself

“Further, regulatory guidance adopted by federal banking regulators related to how banks select, contract with, evaluate, engage with, and manage their third parties, including such third parties’ use of subcontractors and 35 Table of contents downstream service providers, impacts whether and how we work with such parties, as well as the cost of managing such relationships.”

Annual report 2025A · The company itself

“Changes to existing statutes and regulations, and taxes (including industry-specific taxes and surcharges), or their interpretation or implementation, could affect us in substantial and unpredictable ways, particularly with those laws and regulations that serve to protect customers. Such changes may subject us to additional costs, adversely impact our income, and increase our litigation risk should we fail to appropriately comply and may also impact consumer behavior, limit the types of financial services and products we may offer, affect the investments we make, and change the manner in which we operate.”

Annual report 2025A · The company itself

“In addition, changes to laws and regulations may impact our customers by requiring them to adjust their operations or practices or impair their ability to pay fees or outstanding loans or afford new products, which could negatively impact demand for our products and services.”

Annual report 2025A · The company itself

“A number of states have also recently enacted consumer privacy laws that impose compliance obligations with respect to personal information or issued guidance regarding the same, such as the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (known as the “CCPA”), and the New York Department of Financial Services Cybersecurity Regulations.”

Annual report 2025A · The company itself

“On October 18, 2022, the FDIC adopted a final rule, applicable to all IDIs (including KeyBank), to increase the initial base deposit insurance assessment rate schedules uniformly by two basis points consistent with the Amended Restoration Plan approved by the FDIC on June 21, 2022. The FDIC indicated that it was taking this action in order to restore the DIF reserve ratio to the required statutory minimum of 1.35% by the statutory deadline of September 30, 2028. Under the final rule, the increase in rates began with the first quarterly assessment period of 2023 and will remain in effect unless and until the reserve ratio meets or exceeds 2% in order to support growth in the DIF in progressing toward the FDIC’s long-term goal of a 2% reserve ratio.”

Annual report 2025A · The company itself

“Table of contents On November 16, 2023, the FDIC issued a final rule to impose a special assessment on IDIs (including KeyBank) to recover the loss to the DIF resulting from the use of the systemic risk exception to protect the uninsured depositors of SVB and Signature. Under the final rule, the FDIC would collect a special assessment from IDIs at an annual rate of approximately 13.4 basis points (or 3.36 basis points per quarter) over eight quarterly assessment periods, starting with the first quarterly assessment period of 2024 (i.e., January 1, 2024 through March 31, 2024) with an invoice payment date of June 28, 2024.”

Annual report 2025A · The company itself

“Operational risk includes the risk of fraud by employees or others outside of Key, clerical and recordkeeping errors, nonperformance by vendors, threats from cyber activity, and computer/telecommunications malfunctions. Fraudulent activity has escalated, become more sophisticated, and is ever evolving as there are more options to access financial services.”

Annual report 2025A · The company itself

“In addition, several financial institutions, including Key, have experienced significant distributed denial-of-service attacks, some of which involved sophisticated and targeted attacks intended to disrupt, disable, or degrade services, or sabotage systems or data. Other attacks have attempted to obtain unauthorized access to confidential, proprietary, or personal information or intellectual property, to extort money through the use of “ransomware” or other extortion tactics, or to alter or destroy data or systems, often through various attack vectors and methods, including the introduction of computer viruses or malicious or destructive code (commonly referred to as “malware”), phishing, cyberattacks, account takeovers, credential stuffing, and other means.”

Annual report 2025A · The company itself

“If the business’s systems that process or store debit or credit card information experience a security breach, our card holders may experience fraud on their card accounts. We may suffer losses associated with such fraudulent transactions, as well as for other costs, such as replacing impacted cards.”

Annual report 2025A · The company itself

“Table of contents We also face risks related to the interdependence and interconnectivity of financial entities and technology systems. A technology failure, cyberattack or other security breach that significantly compromises the systems of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us.”

Annual report 2025A · The company itself

“Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of AI, introduces new information security risks and exposure for us and for our third party service providers, and, additionally, such technologies may be used to identify vulnerabilities; such technologies have resulted in a substantial increase in the volume and sophistication of cyberattacks against financial and other institutions, including the use of generative AI to conduct more sophisticated social engineering attacks.”

Annual report 2025A · The company itself

“Security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware and SIM card swapping, and other methods.”

Annual report 2025A · The company itself

“Any mishandling or misuse of personal information by Key or our vendors or our failure to comply with notification requirements related to incidents relating to such personal information could expose us to litigation or regulatory fines, penalties, or other sanctions.”

Annual report 2025A · The company itself

“In addition, there has been a significant increase in privacy-related litigation in recent years with respect to how organizations collect information and technical data from their public facing websites, and federal and state courts have been creating new legal frameworks around consumer and website privacy, which also creates new risks on businesses. As new privacy-related laws and regulations, and judicially-created frameworks, are implemented in jurisdictions in which KeyBank operates, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for noncompliance and reporting obligations in the case of data breaches, may significantly increase.”

Annual report 2025A · The company itself

“We are also subject to the risk that disruptions to how our customers access our banking services, such as disruptions to our technology platforms (e.g., online banking websites or mobile applications) or other impacts to our branches, could harm our reputation with customers. In particular, a cybersecurity event impacting Key or our customers’ data or personal information could negatively impact our reputation and customer confidence in Key and our data security procedures.”

Annual report 2025A · The company itself

“Also, rules adopted by the federal banking agencies require a financial institution to notify its primary federal regulator within 36 hours of certain computer-security incidents, including an incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, an institution’s operations or activities or its ability to deliver products or services to a material portion of its customer base. In addition, the SEC has adopted final rules requiring public companies (including KeyCorp) to disclose on Form 8-K material cybersecurity incidents and to disclose annually on Form 10-K information regarding their cybersecurity risk management, strategy, and governance.”

Annual report 2025A · The company itself

“Should the fundamentals of the commercial real estate market deteriorate, our financial condition and results of operations could be adversely affected. After disruptions in 2022 through early 2024 as a result of the increases in the Fed Funds rate and dislocations in the office sector as a result of COVID-19, the commercial and residential real estate markets have remained relatively steady over the past 18 months as they have adjusted to a more “normalized” rate environment.”

Annual report 2025A · The company itself

“◦We are subject to interest rate risk, which could adversely affect net interest income. ◦Our profitability depends upon economic conditions in the geographic regions where we have significant operations and in certain market segments in which we conduct significant business. ◦The soundness of other financial institutions could adversely affect us. •Liquidity Risk ◦We are subject to liquidity risk, which could negatively affect our funding levels. ◦Capital and liquidity requirements imposed by banking regulators and the credit rating agencies may require banks and BHCs to maintain more and higher quality capital and more and higher quality liquid assets. ◦Federal agencies’ actions to ensure stability of the U.S. economy and financial system may have costly or disruptive effects on us. ◦We rely on dividends by our subsidiaries for most of our funds.”

Annual report 2025A · The company itself

“Banking conditions may deteriorate during periods of persistent or large and sudden interest rate increases and/or a slowing economy, negatively affecting business and financial performance.”

Annual report 2025A · The company itself

“In addition, volatility and uncertainty related to inflation and the effects of inflation, which has, in recent years, led to increased costs for businesses and consumers, and could cause the Federal Reserve to reinitiate a series of interest rate increases, which may amplify or contribute to some of the risks of our business by adversely affecting the creditworthiness of our borrowers, increasing our costs, or resulting in lower values for our investment securities and other fixed-rate assets.”

Annual report 2025A · The company itself

“When the Federal Reserve raises or reduces interest rates, the behavior of national money market rate indices, the correlation of consumer deposit rates to financial market interest rates, and the evolution of benchmark rates may not follow historical relationships, which could influence net interest income and net interest margin through basis and other risks.”

Annual report 2025A · The company itself

“Table of contents Moreover, if the interest we pay on deposits and other borrowings increases at a faster rate than the interest we receive on loans and other investments, net interest income, and therefore our earnings, would decline. Conversely, earnings could also be adversely affected if the interest we receive on loans and other investments falls more quickly than the interest we pay on deposits and other borrowings.”

Annual report 2025A · The company itself

“In addition, regulatory liquidity standards require us to hold high-quality liquid assets, which has caused us to change, and may in the future cause us to change, our mix of investments in favor of lower-yielding securities, and may impact future business relationships with certain customers, both of which may reduce our profitability.”

Annual report 2025A · The company itself

“For example, beginning in 2024 and during 2025, the Federal Reserve, after an extended period of raising its monetary policy rate, began lowering interest rates to support what it viewed as a weakening labor market. These types of actions can impact financial markets and our business and cause increased financial market and interest rate volatility.”

Annual report 2025A · The company itself

“If demand for deposit alternatives were to grow materially, KeyBank could experience deposit outflows or be compelled to materially increase deposit interest rates to retain its deposits. Customers may also shift their deposits from non-interest bearing to interest bearing accounts or otherwise to higher cost products at KeyBank.”

Annual report 2025A · The company itself

“Any adverse movement in deposits and associated higher funding costs could reduce our net interest margin and net interest income and otherwise materially and adversely affect our liquidity, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Table of contents ITEM 1A. RISK FACTORS Summary of Risk Factors The following is a summary of some of the material risks and uncertainties that could have an adverse effect on our business. •Credit Risk ◦We have concentrated credit exposure in commercial and industrial loans, commercial real estate loans, and commercial leases. ◦Should the fundamentals of the commercial real estate market deteriorate, our financial condition and results of operations could be adversely affected. ◦We are subject to the risk of defaults by our loan clients and counterparties. ◦Declining asset prices could adversely affect us. ◦Various factors may cause our allowance for loan and lease losses to increase or to be inadequate. ◦Geopolitical destabilization could adversely impact our loan portfolios. •Market Risk ◦A worsening of the U.S. economy and volatile or recessionary conditions in the U.S. or abroad could negatively affect our business or our access to capital markets.”

Annual report 2025A · The company itself

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“Banking conditions may deteriorate during periods of persistent or large and sudden interest rate increases and/or a slowing economy, negatively affecting business and financial performance.”

Annual report 2025A · The company itself

“An economic downturn or recession in one or more geographic regions where we conduct our business, or any significant or prolonged impact on the profitability of one or more of the market segments with which we conduct significant business activity, could adversely affect the demand for our products and services, the ability of our customers to repay loans, the value of the collateral securing loans, and the stability of our deposit funding sources.”

Annual report 2025A · The company itself

“Our ability to maintain and grow deposits may be constrained by gaps in our product offerings, emerging technologies and changes in consumer behaviors and preferences, our scale relative to other banks and financial institutions, underlying macroeconomic conditions and monetary policy, and loss of confidence in our brand and our business.”

Annual report 2025A · The company itself

“Natural disasters, including wildfires, tornadoes, severe storms, and hurricanes, have seemingly become more frequent and severe. The timing and effects of these climate-related physical risks are difficult to accurately predict, and the potential impact of such risks on our operations, employees, communities, and customers could have a material adverse effect on our business, financial position, and results of operations.”

Annual report 2025A · The company itself

“Severe weather events can directly affect our operations by interrupting systems, damaging facilities, disrupting our supply chain, and hindering our ability to conduct business as usual. Additionally, these events can indirectly impact us by damaging or destroying customer businesses, impairing their ability to repay loans, or causing damage to properties pledged as collateral for loans made by Key.”

Annual report 2025A · The company itself

“However, potential headwinds (labor market, geo-political, rate environment) could impact the real estate markets and Key’s portfolio moving forward.”

Annual report 2025A · The company itself

“◦We are subject to interest rate risk, which could adversely affect net interest income. ◦Our profitability depends upon economic conditions in the geographic regions where we have significant operations and in certain market segments in which we conduct significant business. ◦The soundness of other financial institutions could adversely affect us. •Liquidity Risk ◦We are subject to liquidity risk, which could negatively affect our funding levels. ◦Capital and liquidity requirements imposed by banking regulators and the credit rating agencies may require banks and BHCs to maintain more and higher quality capital and more and higher quality liquid assets. ◦Federal agencies’ actions to ensure stability of the U.S. economy and financial system may have costly or disruptive effects on us. ◦We rely on dividends by our subsidiaries for most of our funds.”

Annual report 2025A · The company itself

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“While we have minimal direct foreign company exposure in our loan portfolios, there are correlated and contingent risks posed by geopolitical destabilization within our loan portfolio. For example, conflicts across the world, including the Russia-Ukraine war and the Israel-Hamas war, and recent military action in Venezuela, have proven to or may have a material impact on certain domestic commodity prices, impacting our borrowers' input costs and disrupting supply chains both domestically and abroad. These factors increase potential defaults in our loan portfolio and could ultimately increase loan losses.”

Annual report 2025A · The company itself

“Security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware and SIM card swapping, and other methods.”

Annual report 2025A · The company itself

“Competitive Rewards We make investments to hire and retain the people we need to serve our customers and communities and regularly review our pay practices to reflect changing market and economic conditions.”

Annual report 2025A · The company itself

“An inability to grow cash flow or pressure on expenses created by supply chain, insurance, or interest rate increases would result in an increase in the level of payment defaults within the sector, as well as limiting refinance options. Further, these pressures would likely result in an outflow of capital from the real estate markets, which would in turn drive up capitalization rates and decrease property values.”

Annual report 2025A · The company itself

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“In addition, volatility and uncertainty related to inflation and the effects of inflation, which has, in recent years, led to increased costs for businesses and consumers, and could cause the Federal Reserve to reinitiate a series of interest rate increases, which may amplify or contribute to some of the risks of our business by adversely affecting the creditworthiness of our borrowers, increasing our costs, or resulting in lower values for our investment securities and other fixed-rate assets.”

Annual report 2025A · The company itself

“To the extent that the Federal Reserve’s policies around managing inflation fail to mitigate the volatility and uncertainty related to inflation and the effects of inflation, or to the extent conditions otherwise worsen or are exacerbated by policies enacted by the U.S. government, including the imposition of tariffs or other commercial policies, we could experience adverse effects on our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“The financial services industry has become more competitive as technology advances have lowered barriers to entry, enabling more companies, including nonbank companies, to provide financial services.”

Annual report 2025A · The company itself

“Personal financial data rights On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act. The 1033 rule requires financial institutions (including KeyBank) to make available to consumers and authorized third parties data concerning covered consumer financial products or services in an electronic form usable by the consumer and authorized third parties.”

Annual report 2025A · The company itself

“New technologies have altered consumer behavior by allowing consumers to complete transactions such as paying bills or transferring funds directly without the assistance of banks. New products allow consumers to maintain funds in brokerage accounts or mutual funds that would have historically been held as bank deposits.”

Annual report 2025A · The company itself

“Emerging technologies, such as cryptocurrencies, could limit KeyBank’s ability to track the movement of funds.”

Annual report 2025A · The company itself

“Furthermore, both financial institutions and their non-banking competitors face the risk that payments processing and other products and services, including deposits and other traditional banking products, could be significantly disrupted by the use of new technologies, such as cryptocurrencies and other applications using secure distributed ledgers that may not require intermediation.”

Annual report 2025A · The company itself

“Debit card interchange fee cap On October 25, 2023, the Federal Reserve issued for public comment a proposal to lower the maximum interchange fee that a debit card issuer with $10 billion or more in total consolidated assets (including KeyBank) can receive for a debit card transaction. The interchange fee cap is currently set at the sum of 21 cents for each transaction plus an amount equal to 0.05% of the value of the transaction and a one cent fraud prevention adjustment for issuers that satisfy certain criteria. In the new proposal, the Federal Reserve proposed to lower the cap to the sum of 14.4 cents for each transaction plus an amount equal to 0.04% of the value of the transaction and a 1.3 cent fraud prevention adjustment.”

Annual report 2025A · The company itself

“KeyBank competes with banks and other financial institutions, and increasingly with non-banks that offer non-deposit and other alternative savings vehicles, such as stablecoins, for deposits.”

Annual report 2025A · The company itself

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“Damage to our reputation could also adversely impact our credit ratings and access to capital markets.”

Annual report 2025A · The company itself

“Differing views on corporate responsibility and sustainability could adversely affect our reputation and our business and results of operations. Views about corporate responsibility and sustainability-related issues are differing, dynamic, and rapidly changing.”

Annual report 2025A · The company itself

“Companies in our industry are also targeted for engaging or not engaging in business with specific customers or with customers in particular industries. Additionally, however we respond to such criticism, we face the risk that current or potential customers may decline to do business with us (or encourage others to do so) or current or potential employees refuse to work for us and could subject us to litigation or regulatory action.”

Annual report 2025A · The company itself

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“To the extent that the Federal Reserve’s policies around managing inflation fail to mitigate the volatility and uncertainty related to inflation and the effects of inflation, or to the extent conditions otherwise worsen or are exacerbated by policies enacted by the U.S. government, including the imposition of tariffs or other commercial policies, we could experience adverse effects on our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“The legal and regulatory environment relating to AI is uncertain and evolving, and any changes to applicable laws and regulations could require changes to our use of AI technology and could cause an increase in associated costs and expenses.”

Annual report 2025A · The company itself

“In addition, given the Dodd-Frank legislative mandate to centrally clear eligible derivative contracts, we rely on central clearing counterparties to remain open and operationally viable at all times. A financial institution or other counterparty failure or a cybersecurity breach that causes the failure of or disruption to a counterparty or client, may materially and adversely affect our business, financial condition, or results of operations.”

Annual report 2025A · The company itself

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“Present risks to stable asset prices include, but are not limited to: •A correction in equity or housing markets; •The imposition of further tariffs and other changes to U.S. or global trade policies; •Supply chain issues such as closed factories and disrupted port activity, as well as the impact of the Russia-Ukraine war and the Israel-Hamas war on global transportation and the availability of materials; •Recessionary pressures on other major international economies, such as China, that may impact the broader global and our domestic economy; 27 Table of contents •Labor-supply constraints, including as a result of further changes to U.S. immigration policies and laws and immigration enforcement, leading to slowing job growth and rising wages along with inflation (wage-price spiral); and •Negative real GDP growth, as a result of, in part, the Federal Reserve’s monetary policy to arrest inflationary pressures within the broader economy.”

Annual report 2025A · The company itself

“Recurring extreme weather events could also reduce or eliminate the availability or increase the cost of insurance to Key and our customers.”

Annual report 2025A · The company itself

“However, potential headwinds (labor market, geo-political, rate environment) could impact the real estate markets and Key’s portfolio moving forward. A large portion of our clients are active in real estate, with most focused on the multifamily space, which has been the best performing real estate sector over the cycle.”

Annual report 2025A · The company itself

“We may need to incur substantial expenses to address issues with a service provider, and if the issues cannot be acceptably resolved, we may not be able to timely or effectively replace the service provider due to contractual restrictions, the unavailability of acceptable alternative providers, or other reasons. Further, regardless of how much we can influence our service providers, issues of concern with them could result in supervisory actions and private litigation against us and could harm our reputation, business, and financial results.”

Annual report 2025A · The company itself

“As of December 31, 2025, these services were provided across the country through KeyBank’s 940 full-service retail banking branches and a network of 1,120 ATMs in 15 states, as well as additional offices, online and mobile banking capabilities, and a telephone banking call center.”

Annual report 2025A · The company itself

“Our profitability depends upon economic conditions in the geographic regions where we have significant operations and in certain market segments in which we conduct significant business. We have concentrations of loans and other business activities in geographic regions where our bank branches are located — Washington; Oregon/Alaska; Rocky Mountains; Indiana/Northwest Ohio/Michigan; Central/Southwest Ohio; East Ohio/Western Pennsylvania; Atlantic; Western New York; Eastern New York; and New England — and additional exposure to geographic regions outside of our branch footprint.”

Annual report 2025A · The company itself