ITEM 1. BUSINESS

Headquartered in Providence, Rhode Island with $149.5 billion of total assets as of December 31, 2016 , Citizens Financial Group, Inc. was the 12 ^th largest retail bank holding company in the United States. ⁽¹⁾ Our approximately 17,600 colleagues strive to meet the financial needs of customers and prospects through approximately 1,200 branches operating in an 11 -state banking footprint across the New England, Mid-Atlantic and Midwest regions and through our online, telephone and mobile banking platforms. Our branch banking footprint contained approximately 30 million households ⁽²⁾ and 4 million businesses ⁽³⁾ as of December 31, 2016 . We also maintain more than 100 retail and commercial non-branch offices located in our branch banking footprint and in other states and the District of Columbia, which are largely contiguous with our footprint. We deliver a comprehensive range of retail and commercial banking products and services to more than five million individuals, institutions and companies. As of December 31, 2016 , approximately 70% of our loans were to customers in our footprint and in the five contiguous states where we maintain offices.

Our primary subsidiaries are CBNA, a national banking association whose primary federal regulator is the OCC, and CBPA, a Pennsylvania-chartered savings bank regulated by the Department of Banking of the Commonwealth of Pennsylvania and supervised by the FDIC as its primary federal regulator.

Our History

Our history dates to High Street Bank, founded in 1828, which established Citizens Savings Bank in 1871. Citizens Savings Bank acquired a controlling interest in its founder by the 1940s, renaming the entity Citizens Trust Company. By 1981, we had grown to 29 branches in Rhode Island with approximately $1.0 billion of assets, and in 1988 we became a wholly-owned subsidiary of RBS. During the following two decades, we grew substantially through a series of more than 25 strategic bank acquisitions, which greatly expanded our footprint throughout New England and into the Mid-Atlantic and the Midwest, transforming us from a local retail bank into one of the largest U.S. bank holding companies.

In September 2014, Citizens Financial Group (NYSE: CFG) became a publicly traded company in the largest traditional bank IPO in U.S. history and, through a series of follow-on offerings in March, July and November of 2015, Citizens fully separated from RBS.

Business Segments

We offer a broad set of banking products and services through our two operating segments — Consumer Banking and Commercial Banking — with a focus on providing local delivery and a differentiated customer experience. We seek to ensure that customers select us as their primary banking partner by taking the time to understand their banking needs and we tailor our full range of products and services accordingly.

The following table presents selected financial information for our operating segments, other and consolidated:

⁽¹⁾ According to SNL Financial.

⁽²⁾ According to U.S. Census Bureau.

⁽³⁾ According to Hoovers.

⁽⁴⁾ Includes the financial impact of non-core, liquidating loan portfolios and other non-core assets and liabilities, our treasury activities, wholesale funding activities, securities portfolio, community development assets and other unallocated assets, liabilities, capital, revenues, provision for credit losses and expenses not attributed to the Consumer Banking or Commercial Banking segments. For a description of non-core assets, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Analysis of Financial Condition — Loans and Leases — Non-Core Assets” in Part II, Item 7, included in this report.

Consumer Banking Segment

Consumer Banking serves retail customers and small businesses with annual revenues of up to $25 million through a network that as of December 31, 2016 included approximately 1,200 branches operating in an 11 -state footprint across the New England, Mid-Atlantic and Midwest regions, as well as through online, telephone and mobile banking platforms. Consumer Banking products and services include deposit products, mortgage and home equity lending, auto financing, student loans, personal unsecured lines and loans, credit cards, business loans, wealth management and investment services.

Consumer Banking is focused on winning, expanding and retaining customers through its value proposition: “Simple. Clear. Personal.” and is committed to delivering a differentiated experience through convenience and service. We were named one of the “Most Reputable Banks” in the country according to the American Banker/Reputation Institute Survey of Bank Reputations released in 2016, which focused on factors including products, corporate citizenship, financial performance and company leadership.

Consumer Banking accounted for $55.1 billion , or 55% , of average loans and leases (including loans held for sale) in our operating segments as of December 31, 2016 and is organized around our customer products and services as follows:

Distribution: Provides a multi-channel distribution system with a workforce of approximately 6,600 branch colleagues with a network of approximately 1,200 branches, including more than 340 in-store locations, as well as approximately 3,200 ATMs. Our network includes approximately 1,390 specialists covering lending needs, savings and investments and business banking. Our online and mobile capabilities offer customers the convenience of paying bills and transferring money between accounts and from person to person, as well as a host of other everyday transactions.

Everyday Banking: Provides customers with deposit and payment products and services, including checking, savings, money market, certificates of deposit, debit cards, credit cards and overdraft protection. The business included approximately 2.2 million checking households and $55.0 billion in average deposits as of December 31, 2016 .

Residential Mortgage : Our mortgage business is primarily in footprint and in select out-of-footprint states through a direct-to-consumer call center and a mortgage loan officer base of more than 535 professionals as of December 31, 2016 . Full-year 2016 mortgage originations totaled $7.8 billion with a weighted average FICO score of 769 and loan-to-value of 74% compared with 2015 mortgage originations of $5.7 billion with a weighted average FICO score of 763 and loan-to-value of 73%.

Consumer Lending: Provides home equity, auto finance products, student lending and personal unsecured lines and loans.

Home Equity: Offers HELOCs and home equity loans. We originated $5.2 billion of HELOCs in 2016 and were ranked sixth nationally by outstanding balances as of September 30, 2016 ⁽¹⁾ and ranked in the top five in each of our top nine markets for HELOC originations. ⁽²⁾  

Indirect Auto Finance: Provides new- and used-vehicle financing through a network of more than 6,000 automotive dealerships in 43 states as of December 31, 2016 . The business ranked tenth nationally among regulated depository institutions by outstanding balances as of September 30, 2016 ⁽¹⁾ with 2016 organic origination volume of $5.6 billion with a weighted average FICO score of approximately 749.

Student Lending: We launched the Student Lending business in 2009 and have expanded to partner with nearly 2,500 high-quality, not-for-profit higher education schools in all 50 states. InSchool loan origination volume has increased to $476 million in 2016 with a weighted average FICO score of 767 from approximately $112 million of originations in 2010. We launched the Education Refinance Loan (“ERL”) product in January 2014, which provides former students who have entered the workforce a way to refinance or consolidate multiple existing private and federal student loans. We originated approximately $1.4 billion in ERLs in 2016 with a weighted average FICO score of 782.

Unsecured: We launched our unsecured product finance lending business, which is reported in other retail, in third quarter 2015. In 2016, we expanded our unsecured lending business with the launch of an unsecured personal refinance product. We originated approximately $1.2 billion in unsecured loans in 2016 with a weighted average FICO score of 750, an increase of $964 million versus 2015 originations of $265 million with a weighted average FICO score of 755.

Business Banking: Serves businesses with annual revenues of up to $25 million through a combination of branch-based employees and relationship managers. As of December 31, 2016 , we employed a team of more than 300 bankers with average loans outstanding of $2.9 billion and average deposit balances of $14.0 billion.

⁽¹⁾ According to SNL Financial.

⁽²⁾ According to Equifax; origination volume as of September 30, 2016.

Wealth Management: Provides a full range of banking, investment, insurance products and advisory services primarily to clients with investable assets of $100,000 to $25 million through a sales force that includes more than 360 financial consultants, more than 170 premier bankers and ten private banker teams. As of December 31, 2016 , wealth management had approximately $6.3 billion in average assets under management, $17.3 billion in average assets under administration and $42.5 billion in average total client balances.

Commercial Banking Segment

Commercial Banking primarily targets companies and institutions with annual revenues of $25 million to $2.5 billion and strives to be the lead bank for its clients. We offer a broad complement of financial products and solutions, including lending and leasing, deposit and treasury management services, foreign exchange and interest rate risk management solutions, as well as corporate finance, merger and acquisition, and debt and equity capital markets capabilities. Commercial Banking provides thought leadership by leveraging an in-depth understanding of our clients’ and prospects’ businesses to deliver proactive, compelling financial solutions with quality execution. Commercial Banking focuses each business unit in sectors that maximize its ability to be relevant and deliver value-added solutions to our clients. In Middle Market, this involves a business unit highly focused on our 11 -state footprint. In our Mid-Corporate and Industry Verticals businesses, our focus is national within our areas of expertise. As a result, we earned a fifth place ranking for client penetration and a fifth place ranking for number of lead relationships in middle market banking within the footprint. ⁽¹⁾  

Commercial Banking accounted for $45.9 billion , or approximately 45% , of average loans and leases (including loans held for sale) in our operating segments as of December 31, 2016.

Commercial Banking is structured along lines of business, as well as product groups. The Capital & Global Markets and the Treasury Solutions product groups support all lines of business. These business lines and product groups work in teams to understand and determine client needs and provide comprehensive solutions to meet those needs. New clients are acquired through a coordinated approach to the market ranging from leveraging deep industry knowledge in specialized banking groups to a geographic coverage model targeting organizations headquartered in our footprint.

Corporate Banking: Targets domestic commercial and industrial clients, serving Middle Market companies with annual gross revenues of $25 million to $500 million and Mid-corporate companies with annual revenues of $500 million to $2.5 billion. The business offers a broad range of products, including secured and unsecured lines of credit, term loans, commercial mortgages, domestic and global treasury management solutions, trade services, interest rate products, foreign exchange services and letters of credit. Corporate Banking is a general lending practice, however, our specialty Industry Verticals business addresses other corporate banking services for U.S. subsidiaries of foreign corporations, technology, government entities, healthcare, oil and gas, not-for-profit and educational institutions, professional firms and franchise finance. Corporate Banking average loans and leases of $27.3 billion increased $2.7 billion from 2015 average loans and leases of $24.6 billion.

Asset Finance: Offers equipment financing term loans and leases for Middle Market and Mid-corporate companies, as well as Fortune 500 companies. All transactions are secured by the assets financed, commitments tend to be fully drawn and most leases and loans are fixed rate. Areas of industry specialization include energy, utilities and chemicals. The business also has expertise in financing corporate aircraft and tax- and non-tax-oriented leases for other long-lived assets such as rail cars.

Commercial Real Estate: Provides customized debt capital solutions for Middle Market operators, institutional developers and investors as well as REITs. Commercial Real Estate provides financing for projects in the office, multi-family, industrial, retail, healthcare and hospitality sectors. Loan types include term debt, lines of credit and construction financing. A majority of loans are secured by commercial real estate properties and are typically non-owner occupied. Owner-occupied commercial real estate is typically originated through our Corporate Banking business. Commercial Real Estate average loans of $9.3 billion increased $1.3 billion from $8.0 billion in 2015.

Capital & Global Markets: Delivers to clients through key product groups including Capital Markets, Corporate Finance, and Global Markets.

In April of 2016, we launched Citizens Capital Markets, Inc. (“CCMI”), our commercial broker-dealer, to advise on or facilitate mergers and acquisitions, tender offers, financial restructurings, asset sales, divestitures or other corporate reorganizations or business combinations.

⁽¹⁾ In-footprint ranking from Greenwich Associates. Rolling four-quarter average as of September 30, 2016 for middle market deals from $25 - $500 million.

Treasury Solutions: Supports Commercial Banking and Business Banking clients with treasury management solutions, including domestic and international cash management, commercial credit cards and trade finance. Treasury Solutions provides products to solve client needs related to receivables, payables, information reporting and liquidity management.

Our Competitive Strengths

Our long operating history, through a range of challenging economic cycles, forms the basis of our competitive strengths. From our community bank roots, we bring a commitment to strong customer relationships, local service and an active involvement in the communities we serve. Our acquisitions enabled us to develop significant scale in highly desirable markets and broad product capabilities. The actions taken since the global financial crisis have resulted in a business model with solid asset quality, a stable core deposit mix and a superior capital position. In particular, we believe that the following strengths differentiate us from our competitors and provide a strong foundation from which to execute our strategy to deliver enhanced growth, profitability and returns.

The following table sets forth information regarding our competitive position in our principal MSAs:

Source: FDIC, June 2016. Excludes “non-retail banks” as defined by SNL Financial. The scope of “non-retail banks” is subject to the discretion of SNL Financial, but typically includes: industrial bank and non-depository trust charters, institutions with more than 20% brokered deposits (of total deposits), institutions with more than 20% credit card loans (of total loans), institutions deemed not to broadly participate in the banking services market and other nonretail competitor banks.

⁽¹⁾ According SNL Financial.

⁽¹⁾ According to Thomson Reuters.

⁽²⁾ Peer group comprises BBT, CMA, FITB, KEY, MTB, PNC, RF, STI and USB.

Business Strategy

Our objective is to be a top-performing bank that delivers value for each of our stakeholders by offering the best possible banking experience for customers. We plan to achieve this by leveraging our strong customer relationships, leading market share rankings in attractive markets, customer-centric colleagues and our high-quality balance sheet.

Our strategy is designed to maximize the full potential of our business and drive sustainable growth and enhanced profitability. As a core measure of success, our medium-term financial targets include a ROTCE ratio of greater than 10% and an efficiency ratio in the 60% range. Our financial targets are based on numerous assumptions, including the yield curve evolving consistent with market-implied forward rates and macroeconomic and competitive conditions that are consistent with those used in our planning assumptions.

While our strategic plan and our ROTCE target and its components are presented with numerical specificity and we believe such targets to be reasonable, given the uncertainties surrounding our assumptions, there are significant risks that these assumptions may not be realized and thus our goals may not be achieved. Accordingly, our actual results may differ from these targets and the differences may be material and adverse, particularly if actual events adversely differ from one or more of our key assumptions. We caution investors not to place undue reliance on any of these assumptions or targets.

We intend to deliver on our strategy by adhering to the following strategic principles:

In order to execute on these principles successfully, we have developed the following strategic priorities, each of which are underpinned by a series of initiatives as summarized below. We continue to make solid progress on our strategic priorities from our initial public offering, but continually re-evaluate them to ensure we maintain a strong value proposition consistent with changing customer preferences and market trends.

Position Consumer Banking to deliver improved capabilities and profitability: Consumer Banking focus is on building strong customer relationships along with a robust product portfolio that is designed to be simple and easy to understand while creating a fair value exchange for our customers and offers a “Simple. Clear. Personal.” value proposition to our customers. While we continue to offer a broad range of banking services for our mass consumer customer base, we have tightened our focus on the Mass Affluent and Affluent customer segments by offering tailored products, services and advice with fewer fees and better rates. This strategy will help us attract, retain and deepen these customer relationships. The following initiatives are being implemented to execute against our strategy:

and efficiency, increasing our origination mix of conforming loans, driving further linkages with the core retail bank for both mortgage referrals and benefits for our wealth management business.

These initiatives have already resulted in a stronger Consumer franchise in 2016 highlighted by prudent balance sheet growth and improved returns. Consumer Banking average loans and leases including loans held for sale of $55.1 billion in 2016 grew $3.6 billion , or 7% , from 2015. Consumer Banking average deposits of $72.0 billion in 2016 increased $2.3 billion , or 3% from 2015. Return on tangible common equity improved by 115 basis points from 5.53% in 2015 to 6.68% in 2016.

Continue the momentum in Commercial Banking: Our Commercial Banking vision is to be the “lead bank” for our customers. We will accomplish this by employing great bankers and specialized industry experts that demonstrate thought leadership, enhancing delivery to our customers by optimizing our coverage model and bringing more client solutions through product and industry-based solutions, and enhancing our tools to support our front-line bankers. We continue to see further build-out of the Commercial Banking business as critical to achieving a balanced business mix, and consequently have grown the contribution of Commercial loans to be 45% of operating segment loans. The initiatives below have enabled Commercial Banking to continue its positive momentum while building upon existing strengths.

energy. These moves are designed to improve returns, while focusing on areas where we have demonstrated a strong balance of risk and returns.

The Commercial Banking business has continued to display solid financial results and executed well on these initiatives. Commercial Banking average loans and leases including loans held for sale of $45.9 billion , grew $4.3 billion or 10% from 2015. Commercial Banking average deposits of $26.8 billion in 2016 increased $3.3 billion , or 14% , from 2015 . Return on tangible common equity remained strong at 12.44%, an increase of 3 basis points from 2015.

Grow the balance sheet to build scale and better leverage our cost base and infrastructure: We have a scalable operating platform that has the capacity to accommodate a significantly larger balance sheet than our current size. Prior to the global financial crisis, we had expanded to nearly $170 billion in assets which was then intentionally contracted in order to reposition the bank and strengthen our business profile through the run off of non-core assets and reduced dependency on wholesale funding. We continue to prudently grow the balance sheet primarily through organic loan growth and selective portfolio purchases:

Develop a high-performing, customer-centric organization and culture: In the midst of an evolving and challenging business environment, we are focused on delivering the best possible banking experience through our colleagues. As such, we strive to ensure that managers and colleagues are customer centric, have a commitment to excellence and live our values and credo every day. To further strengthen the organization’s health, we have embarked on initiatives focused on recruiting, talent management, succession planning, leadership development, organizational structure and incentives. We measure progress through an annual Organizational Health Index (“OHI”) and showed significant improvement in 2016 compared to 2015.

Continue to embed risk management throughout the organization and build strong relationships with regulators: We remain committed to embedding a comprehensive enterprise risk management program across key management areas. We continued to refine our capabilities by fully developing policies and risk appetite frameworks and standards, clearly articulating roles and responsibilities across all lines of defense, and enabling a culture that reinforces and rewards risk-based behaviors as we continue to enhance our regulatory relationships.

Focus on Improved Efficiency and Disciplined Expense Management: We believe that continued focus on operational efficiency is critical to our profitability and ability to reinvest in the franchise. We launched the first Tapping our Potential (“TOP”) initiative in late 2014 which was designed to improve the effectiveness, efficiency and competitiveness of the franchise. As part of our continuous improvement efforts, we launched TOP II in mid-2015, which delivered a $105 million pre-tax benefit in 2016. In mid-2016, we began executing on the third phase of efficiency improvements as part of TOP III, which is targeted to achieve a run-rate pre-tax benefit of $100 million to $115 million by the end of 2017.

Modernize technology and operational models to improve delivery, agility and speed-to-market: Modernizing our technology environment has been a key focus so that we can accelerate our speed-to-market and take advantage of technology opportunities in the marketplace. We have prioritized technology investments that provide for open architecture and emphasize cloud computing to help drive technology efficiencies and enhance our risk management culture, including enabling security tools to help maintain a strong defense against cyber-attacks and ways of working that facilitate faster delivery across our technology projects. We are also focused on FinTech partnerships that help deliver differentiated digital experiences for our customers.

2016 Financial performance: Our strategic initiatives are focused on the fundamentals of growing customers, relationships, loans, deposits, total revenue and overall profitability. While the above priorities are designed to enhance performance during the long term, successful execution to date has resulted in improved financial performance in 2016 , as highlighted below:

ROTCE is a key performance metric and adjusted ROTCE is a non-GAAP financial measure. For more information on the computation of non-GAAP financial measures, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Principal Components of Operations and Key Performance Metrics Used by Management — Key Performance Metrics and Non-GAAP Financial Measures” in Part II, Item 7, included in this report.

Competition

The financial services industry is highly competitive. Our branch footprint is in the New England, Mid-Atlantic and Midwest regions, though certain lines of business serve broader, national markets. Within those markets we face competition from community banks, super-regional and national financial institutions, credit unions, savings and loan associations, mortgage banking firms, consumer finance companies, securities brokerage firms, insurance companies and money market funds. Some of our larger competitors may make available to their customers a broader array of product, pricing and structure alternatives while some smaller competitors may have more liberal lending policies and processes. Competition among providers of financial products and services continues to increase, with consumers having the opportunity to select from a growing variety of traditional and nontraditional alternatives. The ability of non-banking financial institutions to provide services previously limited to commercial banks has also intensified competition.

In Consumer Banking, the industry has become increasingly dependent on and oriented toward technology-driven delivery systems, permitting transactions to be conducted through telephone, online and mobile channels. In addition, technology has lowered barriers to entry and made it possible for non-bank institutions to attract funds and provide lending and other financial services in our footprint, despite not having a physical presence within our footprint. Given their lower cost structure, these institutions are often able to offer higher rates on deposit products than what may be average for the market for retail banking institutions with a traditional branch footprint, such as us. The primary factors driving competition for loans and deposits are interest rates, fees charged, customer service levels, convenience, including branch location and hours of operation, and the range of products and services offered. In particular, competition for home equity lines and auto loans has intensified, resulting in pressure on pricing.

In Commercial Banking, there is intense competition for quality loan originations from traditional banking institutions, particularly large regional banks, as well as commercial finance companies, leasing companies and other non-bank lenders, and institutional investors including CLO managers, hedge funds and private equity firms. Some larger competitors, including certain national banks that have a significant presence in our market area, may offer a broader array of products and, due to their asset size, may sometimes be in a position to hold more exposure on their own balance sheet. We compete on a number of factors including, among others, customer service, quality of execution, range of products offered, price and reputation.

Intellectual Property

In the highly competitive banking industry in which we operate, trademarks, service marks, trade names and logos are important to the success of our business. We own and license a variety of trademarks, service marks, trade names, logos and pending registrations and are spending significant resources to develop our stand-alone brands. In connection with our initial public offering, we entered into a trademark license agreement, pursuant to which we were granted a limited license to use the RBS daisywheel trademark for an initial term of five years and, at our option, up to ten years.

Information Technology Systems

We continue to make significant investments in our information technology systems for our banking, lending and cash management activities. Investment is necessary to offer new products and improve our overall customer experience, as well as to provide scale for future growth and acquisitions. The technology investments include replacing systems that support our branch tellers, commercial loans, automobile loans and treasury solutions. Additional investments that are in process include creating an enterprise data warehouse to capture and manage data to better understand our customers, identify our capital requirements and support regulatory reporting and a new mortgage system for our home lending solutions business.

Regulation and Supervision

Our operations are subject to extensive regulation, supervision and examination under federal and state laws. These laws and regulations cover all aspects of our business, including lending practices, safeguarding deposits, customer privacy and information security, capital structure, transactions with affiliates and conduct and qualifications of personnel. These laws and regulations are intended primarily for the protection of depositors, the Deposit Insurance Fund and the banking system as a whole and not for the protection of shareholders or other investors. The discussion below outlines the material elements of selected laws and regulations applicable to us and our subsidiaries. Changes in applicable law or regulation, and in their interpretation and

application by regulatory agencies and other governmental authorities, cannot be predicted, but may have a material effect on our business, financial condition or results of operations.

As described in more detail below, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the “Dodd-Frank Act”) and its implementing regulations significantly restructured the financial regulatory regime in the United States and enhanced supervision and prudential standards for large bank holding companies. The implications of the Dodd-Frank Act for our businesses depend to a large extent on the manner in which its implementing regulations continue to be established and interpreted by the primary U.S. financial regulatory agencies - the FRB, the FDIC, the OCC, the SEC and the Commodity Futures Trading Commission (“CFTC”). Certain aspects of the Dodd-Frank Act remain subject to further rulemaking, take effect over various transition periods, or contain other elements that make it difficult to precisely anticipate their full impact. Recent political developments, including the change in administration in the U.S., have added additional uncertainty to the implementation, scope and timing of regulatory reforms.

Overview

We are a bank holding company under the Bank Holding Company Act of 1956 (“Bank Holding Company Act”). We have elected to be treated as a financial holding company under amendments to the Bank Holding Company Act as effected by GLBA. As such, we are subject to the supervision, examination and reporting requirements of the Bank Holding Company Act and the regulations of the FRB, including through the Federal Reserve Bank of Boston. Under the system of “functional regulation” established under the Bank Holding Company Act, the FRB serves as the primary regulator of our consolidated organization, and the primary regulator of our broker-dealer subsidiary, the SEC, directly regulates the activities of that subsidiary, with the FRB exercising a supervisory role. The Dodd-Frank Act amendments to the Bank Holding Company Act require the FRB to examine the activities of non-depository institution subsidiaries of bank holding companies (that are not functionally regulated) that are engaged in depository institution-permissible activities and provides the FRB with back-up examination and enforcement authority for such activities. The FRB also has the authority to require reports of and examine any holding company subsidiary.

Our principal bank subsidiary, CBNA, is a national banking association. As such, it is subject to regulation, examination and supervision by the OCC as its primary federal regulator and by the FDIC as the insurer of its deposits.

CBPA is a Pennsylvania-chartered savings bank. Accordingly, it is subject to supervision by the Department of Banking of the Commonwealth of Pennsylvania (the “PA Banking Department”), as its chartering agency, and regulation, supervision and examination by the FDIC as the primary federal regulator of state-chartered savings banks and as the insurer of its deposits.

The federal and state banking regulators are given authority to approve or disapprove mergers, acquisitions, consolidations, the establishment of branches and similar corporate actions. These banking regulators also have the power to prevent the continuance or development of unsafe or unsound banking practices or other violations of law. State and federal law govern the activities in which CBNA and CBPA engage, including the investments each makes and the aggregate amount of loans that may be granted to one borrower. Various consumer and compliance laws and regulations also affect their operations. CBNA and CBPA also are affected by the actions of the FRB as it implements monetary policy.

In addition, CBNA and CBPA are subject to regulation, supervision and examination by the CFPB with respect to consumer protection laws and regulations. The CFPB has broad authority to, among other things, regulate the offering and provision of consumer financial products by depository institutions with more than $10 billion in total assets. The CFPB may promulgate rules under a variety of consumer financial protection statutes, including the Truth in Lending Act, the Electronic Funds Transfer Act and the Real Estate Settlement Procedures Act.    

Financial Regulatory Reform

The Dodd-Frank Act represents a significant overhaul of many aspects of the regulation of the financial services industry, addressing, among other things, systemic risk, capital adequacy, deposit insurance assessments, consumer financial protection, regulation of derivatives and securities markets, restrictions on an insured bank’s transactions with its affiliates, lending limits and mortgage-lending practices. Moreover, as a general matter, the federal banking regulators (the FRB, the OCC and the FDIC) as well as the CFPB have taken a more stringent approach to supervising and regulating financial institutions and financial products and services over which they exercise their respective supervisory authorities, including with respect to enforcement matters. Our two banking subsidiaries and our products and services have been subject to greater supervisory scrutiny and enhanced supervisory requirements and expectations in recent years.

Sections 165 and 166 of the Dodd-Frank Act direct the FRB to establish enhanced prudential standards and early remediation requirements applicable to large financial institutions with total consolidated assets of $50 billion or more. The FRB has adopted final rules implementing three aspects of Sections 165 and 166 - liquidity requirements, stress testing of capital, and overall risk management requirements. The final rules’ liquidity requirements are described below under “—Liquidity Standards” and their stress testing requirements are described below under “—Capital Planning and Stress Testing Requirements”.

Section 165 of the Dodd-Frank Act also requires bank holding companies with total consolidated assets of $50 billion or more to submit resolution plans to the FRB and FDIC providing for the company’s strategy for rapid and orderly resolution in the event of its material financial distress or failure. In September 2011, these agencies issued a joint final resolution plan rule implementing this requirement. The FDIC issued a separate such rule applicable to insured depository institutions of $50 billion or more in total assets, such as CBNA. We submitted our most recent resolution plan to the FRB and FDIC in December 2016; CBNA submitted its most recent resolution plan to the FDIC in December 2015. If the FRB and the FDIC determine that these plans are not credible and we do not cure the deficiencies, the FRB and the FDIC may impose more stringent capital, leverage or liquidity requirements or restrictions on our growth, activities or operations.

The FRB has not yet adopted final rules implementing two key requirements of Section 165 and 166 - single counterparty credit limits (“SCCL”) and early remediation requirements. In March 2016 the FRB issued a re-proposal of its SCCL rules, initially published for comment in 2014. As re-proposed, we and our controlled entities would be prohibited from having an aggregate net credit exposure to any counterparty (as broadly defined in the proposed rule to include certain related entities to the entity that is the direct obligor) exceeding 25% of our tier 1 capital. The SCCL rules, when finalized, may affect our ability to enter into transactions, including as hedges for other exposures, with other financial institutions.

The Basel III rules, summarized briefly below, have impacted our level of capital, and may influence the types of business we may pursue and how we pursue business opportunities. Among other things, the Basel III rules raised the required minimums for certain capital ratios, added a common equity ratio, included capital buffers, and restricted what constitutes capital. The capital and risk weighting requirements became effective for us on January 1, 2015.

Many of the provisions of the Dodd-Frank Act and other laws are subject to further rulemaking, guidance and interpretation by the applicable federal regulators. We will continue to evaluate the impact of any changes in law and any new regulations promulgated, including changes in regulatory costs and fees, modifications to consumer products or disclosures required by the CFPB and the requirements of the enhanced supervision provisions, among others.

Financial Holding Company Regulation

The Bank Holding Company Act generally restricts bank holding companies from engaging in business activities other than (i) banking, managing or controlling banks, (ii) furnishing services to or performing services for subsidiaries and (iii) activities that the FRB has determined to be so closely related to banking as to be a proper incident thereto. For so long as they continue to meet the eligibility requirements for financial holding company status, financial holding companies may engage in a broader range of activities, including, among other things, securities underwriting and dealing, insurance underwriting and brokerage, merchant banking and other activities that are determined by the FRB, in cooperation with the Treasury Department, to be “financial in nature or incidental thereto” or that the FRB determines unilaterally to be “complementary” to financial activities. In addition, a financial holding company may conduct permissible new financial activities or acquire permissible non-bank financial companies with after-the-fact notice to the FRB.

As noted above, we have elected to be treated as a financial holding company under amendments to the Bank Holding Company Act as effected by GLBA. To maintain financial holding company status, a financial holding company and all of its insured depository institution subsidiaries must remain well capitalized and well managed (as described below under “Federal Deposit Insurance Act”), and maintain a CRA rating of at least “Satisfactory.” If a financial holding company ceases to meet these requirements, the FRB’s regulations provide that the financial holding company must enter into an agreement with the FRB to comply with all applicable capital and management requirements. Until the financial holding company returns to compliance, the FRB may impose limitations or conditions on the conduct of its activities, and the company may not commence any of the broader financial activities permissible for financial holding companies or acquire a company engaged in such financial activities without prior approval of the FRB. In addition, the failure to meet such requirements could result in other material restrictions on the activities of the financial holding company, may also adversely affect the financial holding company’s ability to enter into certain transactions, including acquisition transactions, or obtain necessary approvals in connection therewith, and may result in the bank holding company losing financial holding company status. Any restrictions imposed on our activities by the FRB may not necessarily be made known to the public. If the company does not return to compliance within 180 days, the FRB may require the financial holding company to divest its subsidiary depository institutions or to discontinue or divest investments in companies engaged in activities permissible only for a bank holding company electing to be treated as a financial holding company. Bank holding companies and banks must also be both well capitalized and well managed in order to acquire banks located outside their home state.

Currently under the Bank Holding Company Act, we may not be able to engage in certain categories of new activities or acquire shares or control of other companies other than in connection with internal reorganizations.

Financial Subsidiary Compliance Requirements

A financial subsidiary of a national bank is permitted to engage in a broader range of activities, similar to those of a financial holding company, than those permissible for a national bank itself. CBNA has two financial subsidiaries, Citizens Securities, Inc., a registered broker-dealer, and RBS Citizens Insurance Agency, Inc., a dormant entity. On March 13, 2014, the OCC determined that CBNA no longer met the conditions to own a financial subsidiary - namely that CBNA must be both well capitalized and well managed. CBNA entered into an agreement with the OCC pursuant to which it developed and submitted to the OCC a remediation plan setting forth the specific actions it will take to bring itself back into compliance with the conditions to own a financial subsidiary. CBNA has completed its undertakings under the plan, which have been validated by our internal audit team and submitted to the OCC for review and approval. However, until the plan has been approved by the OCC, CBNA will be subject to restrictions on its ability to acquire control or hold an interest in any new financial subsidiary and to commence new activities in any existing financial subsidiary without the prior consent of the OCC.

Our bank subsidiaries are also making improvements to their compliance management systems, fair lending compliance, risk management, identity theft and debt cancellation add-on product practices, overdraft fees and deposit reconciliation practices, mortgage servicing, third-party payment processor activities, oversight of third-party providers, consumer compliance program, policies, procedures and training, information security, and consumer complaints process in order to address deficiencies in those areas. These efforts require us to make investments in additional resources and systems and also require a significant commitment of managerial time and attention.

We are also required to make improvements to our overall compliance and operational risk management programs and practices to comply with enhanced supervisory requirements and expectations and to address weaknesses in retail credit risk management, liquidity risk management, model risk management, outsourcing and vendor risk management and related oversight and monitoring practices and tools.

Capital

We must comply with the FRB’s capital adequacy rules. CBNA and CBPA must comply with similar capital adequacy rules of the OCC and FDIC, respectively. The capital adequacy rules of all three agencies are based on the Basel III framework. For more detail on our regulatory capital, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Capital” in Part II, Item 7, included in this report.

Prior to January 1, 2015, the risk-based capital standards applicable to us and our bank subsidiaries (the “general risk-based capital rules”) were based on the 1988 Capital Accord, known as Basel I, of the Basel Committee. In July 2013, the federal bank regulators approved final capital rules implementing the Basel III framework as well as certain provisions of the Dodd-Frank Act. The Basel III-based U.S. final rules substantially revised the risk-based capital requirements applicable to bank holding companies and their depository institution subsidiaries, including the Parent Company, CBNA and CBPA, as compared to the general risk-based capital rules. The U.S. Basel III final rules became effective for the Parent Company, CBNA and CBPA on January 1, 2015 (subject to a phase-in period for certain provisions).

The U.S. Basel III final rules, among other things, (i) introduced a new capital measure called common equity tier 1 capital, or “CET1 capital”, (ii) specified that tier 1 capital consists of CET1 capital and “Additional tier 1 capital” instruments meeting certain revised requirements, (iii) defined CET1 capital narrowly by requiring that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital, and (iv) expanded the scope of the deductions/adjustments to capital as compared to existing regulations.

Under the U.S. Basel III final rules, the minimum capital ratios are:

• 4.5% CET1 capital to risk-weighted assets;

• 6.0% tier 1 capital (that is, CET1 capital plus Additional tier 1 capital) to risk-weighted assets;

• 8.0% Total capital (that is, tier 1 capital plus tier 2 capital) to risk-weighted assets; and

The U.S. Basel III final rules also introduced a new capital conservation buffer (“CCB”), composed entirely of CET1 capital, on top of three minimum risk-weighted asset ratios. Under existing rules, the CCB when fully phased-in on January 1, 2019 will be 2.5%. Banking institutions with a ratio of CET1 capital, tier 1 capital or Total capital to risk-weighted assets below the effective minimum once the CCB is taken into account (that is, 7.0%, 8.5% and 10.5% for the three ratios, respectively, once the CCB is fully-phased in) will be subject to constraints on capital distributions, including dividends and share repurchases, and certain discretionary executive compensation based on the amount of the shortfall. The implementation of the CCB began on January 1, 2016 at the 0.625% level and will increase by 0.625% on each subsequent January 1, until the buffer reaches its fully

phased in level of 2.5% on January 1, 2019. For more details see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Capital” in Part II, Item 7, included in this report.

We are also subject to the FRB's risk-based capital requirements for market risk.  See “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Market Risk — Market Risk Regulatory Capital” in Part II, Item 7, included in this report for further discussion.

The U.S. Basel III final rules also provided for a number of deductions from, and adjustments to, CET1 capital. For example, these include the requirement that certain deferred tax assets and significant investments in non-consolidated financial entities be deducted from CET1 capital to the extent that any one such category exceeds 10% of CET1 capital or all such items, in the aggregate, exceed 15% of CET1 capital. Implementation of the deductions and other adjustments to CET1 capital began on January 1, 2015 and is being phased-in over a four-year period (beginning at 40% on January 1, 2015 and adding an additional 20% in each year thereafter).

The U.S. Basel III final rules prescribed a new standardized approach for risk weightings of assets that expanded the risk-weighting categories from the general risk-based capital rules to a much larger and more risk-sensitive number of categories, depending on the nature of the assets. These categories generally range from 0% for U.S. government and agency securities, to 600% for certain equity exposures, and result in higher risk weights for a variety of asset categories.

With respect to CBNA and CBPA, the U.S. Basel III final rules also revise the “prompt corrective action” regulations pursuant to Section 38 of the Federal Deposit Insurance Act, as discussed below in “Federal Deposit Insurance Act.”

Liquidity Standards

Historically, the FRB evaluated our liquidity as part of the supervisory process, without required formulaic measures. Liquidity risk management and supervision have become increasingly important since the 2008 financial crisis. In September 2014, the FRB, OCC and FDIC issued a final rule to implement the Basel III-based U.S. LCR, which is a quantitative liquidity metric designed to ensure that a covered bank or bank holding company maintains an adequate level of unencumbered high-quality liquid assets to cover expected net cash outflows over a 30-day time horizon under an acute liquidity stress scenario. The LCR rule, as adopted, applies in its most comprehensive form only to advanced approaches bank holding companies (that is, those with $250 billion or more in total consolidated assets or $10 billion or more in on-balance sheet foreign exposures) and depository institutions subsidiaries of such bank holding companies and, in a modified form, to bank holding companies having $50 billion or more in total consolidated assets but less than the thresholds for the advanced approaches. The U.S. LCR differs in certain respects from the Basel Committee’s version of the LCR, including a narrower definition of high-quality liquid assets, different prescribed cash inflow and outflow assumptions for certain types of instruments and transactions, and a shorter phase-in schedule that began on January 1, 2015. As of January 1, 2017, the rule has been fully phased in. The modified LCR requires us to maintain a ratio of high-quality liquid assets to 70% of net cash outflows (compared to 100% in the comprehensive LCR for advanced approaches bank holding companies). At December 31, 2016, our LCR on the modified basis was above the minimum requirement.

As a modified LCR company, we are required to calculate our LCR on a monthly basis. If a covered company fails to meet the minimum required LCR, it must promptly notify its primary federal banking regulator and may be required to take remedial actions. In December 2016, the FRB issued a final rule that requires bank holding companies to disclose publicly, on a quarterly basis, quantitative and qualitative information about certain components of our LCR beginning for modified LCR bank holding companies on October 1, 2018.

The Basel III framework also included a second liquidity standard, the NSFR, which is designed to promote more medium- and long-term funding of the assets and activities of banks over a one-year time horizon. In May 2016, the federal banking regulators issued a proposed rule that would implement the NSFR for large U.S. banking organizations. Under the proposed rule, the most stringent requirements would apply to advanced approaches bank holding companies, and would require such organizations to maintain a minimum NSFR of 1.0 on an ongoing basis, calculated by dividing the organization’s available stable funding (“ASF”) by its required stable funding (“RSF”). Bank holding companies with more than $50 billion but that are not advanced approaches bank holding companies would be subject to a modified NSFR requirement which would require such bank holding companies to maintain a minimum NSFR of 0.7 on an ongoing basis. Under the proposed rule, a banking organization’s ASF would be calculated by applying specified standard weightings to its equity and liabilities based on their expected stability over a one-year time horizon and its RSF would be calculated by applying specified standardized weightings to its assets, derivative exposures and commitments based on their liquidity characteristics over the same one-year time horizon. If implemented as proposed, the NSFR rule would take effect on January 1, 2018. We continue to evaluate the potential effects of this proposal on our operations.

Finally, per the liquidity rules included in the FRB’s enhanced prudential standards adopted pursuant to Section 165 of the Dodd-Frank Act (referred to above under “—Financial Regulatory Reform”) we are required to maintain a buffer of highly liquid assets based on projected funding needs for 30 days. The liquidity buffer is in addition to the federal banking regulators’ LCR rule and is described by the FRB as being “complementary” to the LCR and NSFR.

      Capital Planning and Stress Testing Requirements

Bank holding companies with $50 billion or more in total consolidated assets are required to develop and maintain a capital plan, and to submit the capital plan to the FRB for review under its CCAR process. CCAR is designed to evaluate the capital adequacy, capital adequacy process and planned capital distributions, such as dividend payments and common stock repurchases, of a bank holding company subject to CCAR. As part of CCAR, the FRB evaluates whether a bank holding company has sufficient capital to continue operations under various hypothetical scenarios of economic and financial market stress (both bank holding company- and FRB- developed, including an “adverse” and “severely adverse” stress scenario developed by the Federal Reserve). The FRB will also evaluate whether the bank holding company has robust, forward-looking capital planning processes that account for its unique risks.

The capital plan must cover a “planning horizon” of at least nine quarters (beginning with the quarter preceding the submission of the plan, or January 1, 2017 for the capital plans required to be filed on or before April 5, 2017). Bank holding companies are also subject to an ongoing requirement to revise and resubmit their capital plans upon the occurrence of certain events specified by rule, or when required by the FRB. In addition to other limitations, our ability to make any capital distributions (including dividends and share repurchases) is contingent on the FRB’s non-objection to our capital plan under quantitative tests requiring that we demonstrate that we will continue to meet all minimum capital requirements applicable to us over the nine-quarter planning horizon under all applicable scenarios. For capital plans in CCAR submissions before the April 5, 2017 submission, the FRB was able to object to the capital plan of any bank holding company subject to CCAR under quantitative tests as well as qualitative tests (such as concerns with the assumptions, analysis or methodologies of the capital plan).

The FRB recently amended its capital plan rule to eliminate its ability to object to the capital plan of a “large and noncomplex” bank holding company (that is, one that has less than $250 billion in total consolidated assets, less than $75 billion in nonbank assets, and that is not classified as a global systemically important bank holding company under the FRB’s capital rules) on qualitative grounds. However, the FRB will incorporate an assessment of the qualitative aspects of the firm’s capital planning process into regular, ongoing supervisory activities and through targeted, horizontal assessments of particular aspects of capital planning.

Should the FRB object to a capital plan, a bank holding company may not make any capital distribution other than those capital distributions that the FRB has indicated its non-objection to in writing. Participating firms are required to submit their capital plans and stress testing results to the FRB on or before April 5 ^th of each year, and the FRB will publish the results of its supervisory CCAR review of submitted capital plans by June 30 ^th of each year. In addition, the FRB will separately publish the results of its supervisory stress test under both the supervisory severely adverse and adverse scenarios. The information to be released will include, among other things, the FRB’s projection of company-specific information, including post-stress capital ratios and the minimum value of these ratios over the planning horizon.

The FRB’s capital planning and stress testing rules generally limit our ability to make quarterly capital distributions-that is, dividends and share repurchases-if the amount of our actual cumulative quarterly capital issuances of instruments that qualify as regulatory capital are less than we had indicated in our submitted capital plan as to which we receive a non-objection from the FRB. Due to the importance and intensity of the stress tests and the CCAR process, we have dedicated significant resources to comply with stress testing and capital planning requirements and expect to continue to do so in the future.

Standards for Safety and Soundness

The FDIA requires the FRB, OCC and FDIC to prescribe operational and managerial standards for all insured depository institutions, including CBNA and CBPA. The agencies have adopted regulations and interagency guidelines which set forth the safety and soundness standards used to identify and address problems at insured depository institutions before capital becomes impaired. If an agency determines that a bank fails to satisfy any standard, it may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans. If, after being notified to submit a compliance plan, an institution fails to submit an acceptable compliance plan or fails in any material respect to implement an acceptable compliance plan, the agency must issue an order directing action to correct the deficiency and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the FDIA. See “Federal Deposit Insurance Act” below. If an institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties.

CBPA is also subject to supervision by the PA Banking Department. The PA Banking Department may order any Pennsylvania-chartered savings bank to discontinue any violation of law or unsafe or unsound business practice. It may also order the termination of any trustee, officer, attorney or employee of a savings bank engaged in objectionable activity.

Federal Deposit Insurance Act

The FDIA requires, among other things, that the federal banking regulators take “prompt corrective action” with respect to depository institutions that do not meet minimum capital requirements, as described above in “Capital.” The FDIA sets forth

the following five capital categories: “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.” The federal banking regulators must take certain mandatory supervisory actions, and are authorized to take other discretionary actions, with respect to institutions which are undercapitalized, significantly undercapitalized or critically undercapitalized, with the actions becoming more restrictive and punitive the lower the institution’s capital category. A depository institution’s capital category will depend upon how its capital levels compare with various relevant capital measures and certain other factors that are established by regulation, and the severity of mandatory and discretionary supervisory actions depends upon the capital category in which the institution is placed. Under existing rules, an institution that is not an advanced approaches institution is deemed to be “well capitalized” if it has (i) a CET1 ratio of at least 6.5%, (ii) a tier 1 capital ratio of at least 8%, (iii) a Total capital ratio of at least 10%, and (iv) a tier 1 leverage ratio of at least 5%.

The FDIA’s prompt corrective action provisions only apply to depository institutions and not to bank holding companies. The FRB’s regulations applicable to bank holding companies separately define “well capitalized” for bank holding companies to require maintaining a tier 1 capital ratio of at least 6% and a Total capital ratio of at least 10%. As described above under “—Financial Holding Company Regulation”, a financial holding company that is not well-capitalized and well-managed (or whose bank subsidiaries are not well capitalized and well managed) under applicable prompt corrective action standards may be restricted in certain of its activities and ultimately may lose financial holding company status.

As of December 31, 2016, the Parent Company, CBNA and CBPA were well-capitalized.

The FDIA prohibits insured banks from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is “well-capitalized,” or it is “adequately capitalized” and receives a waiver from the FDIC. A bank that is “adequately capitalized” and that accepts brokered deposits under a waiver from the FDIC may not pay an interest rate on any deposit in excess of 75 basis points over certain prevailing market rates. The FDIA imposes no such restrictions on a bank that is “well-capitalized.”

Deposit Insurance

The FDIA requires CBNA and CBPA to pay deposit insurance assessments. FDIC assessment rates for large institutions are calculated based on one of two scorecards, one for most large institutions that have more than $10 billion in assets and another for “highly complex” institutions that have over $50 billion in assets and are fully owned by a parent with over $500 billion in assets. Each scorecard has a performance score and a loss-severity score that are combined to produce a total score, which is translated into an initial assessment rate. In calculating these scores, the FDIC utilizes the CAMELS ratings, as well as forward-looking financial measures to assess an institution’s ability to withstand asset-related stress and funding-related stress. The FDIC has the ability to make discretionary adjustments to the total score, up or down, based upon significant risk factors that are not adequately captured in the scorecard. The total score is then translated to an initial base assessment rate on a non-linear, sharply-increasing scale. As of July 1, 2016, for large institutions the initial base assessment rate ranges from 3 to 30 basis points on an annualized basis (basis points representing cents per $100). After the effect of potential base-rate adjustments, the total base assessment rate could range from 1.5 to 40 basis points on an annualized basis.

The deposit insurance assessment is calculated based on average consolidated total assets less average tangible equity of the insured depository institution during the assessment period. Deposit insurance assessments are also affected by the minimum reserve ratio with respect to the Deposit Insurance Fund (“DIF”). In March 2016, the FDIC issued a final rule that imposes on insured depository institutions with at least $10 billion in assets, including CBNA and CBPA, a surcharge of 4.5 basis points per annum until the earlier of the quarter that the DIF reaches the required reserve ratio of 1.35% and December 31, 2018, which the FDIC estimates will take approximately two years. Under the rule, if the reserve ratio does not reach 1.35% by December 31, 2018, the FDIC will impose a shortfall assessment on larger depository institutions, including CBNA and CBPA, in the first quarter of 2019 to be collected on June 30, 2019. The rule has resulted in higher deposit insurance assessments for both CBNA and CBPA.

Under the FDIA, banks may also be held liable by the FDIC for certain losses incurred, or reasonably expected to be incurred, by the DIF. Either CBNA or CBPA may be liable for losses caused by the other’s default and also may be liable for any assistance provided by the FDIC to the other if in danger of default.

Dividends

Various federal and statutory provisions and regulations, as well as regulatory expectations, limit the amount of dividends that we and our subsidiaries may pay.

Our payment of dividends to our stockholders is subject to the oversight of the FRB. In particular, the dividend policies and share repurchases of a large bank holding company are reviewed by the FRB based on capital plans submitted as part of the CCAR process and stress tests as submitted by the bank holding company, as discussed above, and will be assessed against, among other things, the bank holding company’s ability to achieve the required capital ratios under the Basel III- based U.S. revised capital rules as they are phased in by U.S. regulators. In addition to other limitations, our ability to make any capital distributions (including

dividends and share repurchases) is contingent on the FRB’s non-objection to such planned distributions included in our submitted capital plan. See “Capital” and “Capital Planning and Stress Testing Requirements” above.

Dividends payable by CBNA, as a national bank subsidiary, are limited to the lesser of the amount calculated under a “recent earnings” test and an “undivided profits” test. Under the recent earnings test, a dividend may not be paid if the total of all dividends declared by a bank in any calendar year is in excess of the current year’s net income combined with the retained net income of the two preceding years, less any required transfers to surplus, unless the national bank obtains the approval of the OCC. Under the undivided profits test, a dividend may not be paid in excess of the entity’s “undivided profits” (generally, accumulated net profits that have not been paid out as dividends or transferred to surplus). Federal bank regulatory agencies have issued policy statements which provide that FDIC-insured depository institutions and their holding companies should generally pay dividends only out of their current operating earnings. Under Pennsylvania law, CBPA may declare and pay dividends only out of accumulated net earnings and only if (i) any required transfer to surplus has been made prior to declaration of the dividend and (ii) payment of the dividend will not reduce surplus.

Support of Subsidiary Banks

Under Section 616 of the Dodd-Frank Act, which codifies the FRB’s long-standing “source of strength” doctrine, we must serve as a source of financial and managerial strength for our depository institution subsidiaries. The statute defines “source of financial strength” as the ability to provide financial assistance in the event of the financial distress at the insured depository institution. The FRB may require that we provide such support at times even when we may not have the financial resources to do so, or when doing so may not serve our interests or those of our shareholders or creditors. In addition, any capital loans by a bank holding company to its subsidiary bank are subordinate in right of payment to deposits and to certain other indebtedness of such subsidiary bank. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal bank regulatory agency to maintain the capital of a subsidiary bank will be assumed by the bankruptcy trustee and entitled to a priority of payment.

Transactions with Affiliates and Insiders

Sections 23A and 23B of the Federal Reserve Act and related FRB rules, including its Regulation W, restrict our bank subsidiaries from extending credit to, or engaging in certain other transactions with, us and our non-bank subsidiaries. These restrictions place limits on certain specified “covered transactions” between these subsidiary banks and their affiliates, which must be limited to 10% of a bank’s capital and surplus for any one affiliate and 20% for all affiliates. Furthermore, within the foregoing limitations as to amount, certain covered transactions must meet specified collateral requirements ranging from 100% to 130%. Covered transactions are defined to include, among other things, a loan or extension of credit, as well as a purchase of securities issued by an affiliate, a purchase of assets (unless otherwise exempted by the FRB) from the affiliate, the acceptance of securities issued by the affiliate as collateral for a loan, derivatives transactions and securities lending transactions where the bank has credit exposure to an affiliate, and the issuance of a guarantee, acceptance or letter of credit on behalf of an affiliate. All covered transactions, including certain additional transactions (such as transactions with a third party in which an affiliate has a financial interest), must be conducted on market terms. The Dodd-Frank Act significantly enhanced and expanded the scope and coverage of these limitations, in particular, by including within its scope derivative transactions by and between CBNA or CBPA or their subsidiaries and the Parent Company or its other subsidiaries. The Federal Reserve enforces these restrictions and we are audited for compliance.

Section 23B prohibits an institution from engaging in certain transactions with affiliates unless the transactions are on terms substantially the same, or at least as favorable to the bank, as those prevailing at the time for comparable transactions with non-affiliated companies. Except for limitations on low-quality asset purchases and transactions that are deemed to be unsafe or unsound, Regulation W generally excludes affiliated depository institutions from treatment as affiliates. Transactions between a bank and any of its subsidiaries that are engaged in certain financial activities may be subject to the affiliated transaction limits. The FRB also may designate banking subsidiaries as affiliates.

Pursuant to FRB Regulation O, we are also subject to quantitative restrictions on extensions of credit to executive officers, directors, principal stockholders and their related interests. In general, such extensions of credit (i) may not exceed certain dollar limitations, (ii) must be made on substantially the same terms, including interest rates and collateral, as those prevailing at the time for comparable transactions with third parties and (iii) must not involve more than the normal risk of repayment or present other unfavorable features. Certain extensions of credit also require the approval of our Board.

Volcker Rule

The Dodd-Frank Act prohibits banks and their affiliates from engaging in proprietary trading and investing in, sponsoring and having certain relationships with private funds such as hedge funds or private equity funds that would be an investment company for purposes of the Investment Company Act of 1940 but for the exclusions in sections 3(c)(1) or 3(c)(7) of that act, both subject to certain limited exceptions. The statutory provision is commonly called the “Volcker Rule.” In December 2013, the FRB, OCC, FDIC, the SEC and the CFTC issued final rules to implement the Volcker Rule, which became effective in July 2015. The

final rules also require that large bank holding companies design and implement compliance programs to ensure adherence to the Volcker Rule’s prohibitions. Development and monitoring of the required compliance program may require the expenditure of resources and management attention.

Consumer Financial Protection Regulations

The retail activities of banks are subject to a variety of statutes and regulations designed to protect consumers and promote lending to various sectors of the economy and population. These laws include, but are not limited to, the Equal Credit Opportunity Act, the Fair Debt Collection Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Home Mortgage Disclosure Act, the Service Members Civil Relief Act, the Expected Funds Availability Act, the Right to Financial Privacy Act, the Truth in Savings Act, the Electronic Funds Transfer Act, and their respective federal regulations and state law counterparts.

In addition to these federal laws and regulations, the guidance and interpretations of the various federal agencies charged with the responsibility of implementing such regulations also influences loan and deposit operations.

The CFPB has broad rulemaking, supervisory, examination and enforcement authority over various consumer financial protection laws, including the laws referenced above, fair lending laws and certain other statutes. The CFPB also has examination and primary enforcement authority with respect to depository institutions with $10 billion or more in assets, including the authority to prevent unfair, deceptive or abusive practices in connection with the offering of consumer financial products.

The Dodd-Frank Act permits states to adopt stricter consumer protection laws and standards that are more stringent than those adopted at the federal level and in certain circumstances, permits state attorneys general to enforce compliance with both the state and federal laws and regulations. State regulation of financial products and potential enforcement actions could also adversely affect our business, financial condition or results of operations.

The CFPB has finalized a number of significant rules which will impact nearly every aspect of the life cycle of a residential mortgage. The final rules require banks to, among other things: (i) develop and implement procedures to ensure compliance with a new “ability to repay” standard and identify whether a loan meets a new definition for a “qualified mortgage;” (ii) implement new or revised disclosures, policies and procedures for servicing mortgages including, but not limited to, early intervention with delinquent borrowers and specific loss mitigation procedures for loans secured by a borrower’s principal residence; (iii) comply with additional restrictions on mortgage loan originator hiring and compensation; (iv) comply with new disclosure requirements and standards for appraisals and certain financial products; and (v) maintain escrow accounts for “higher priced mortgage loans” for a longer period of time. We are continuing to analyze the impact that such rules have on our business.

In addition, we and our banking subsidiaries are currently subject to consent orders issued in 2015 by certain of our regulators in connection with past deposit reconciliation and billing practices, under which the applicable regulators have provided non-objections to, among other things, restitution plans for affected customers. All financial penalties associated with these regulatory enforcement matters have been paid, and substantially all remediation related to such legacy matters was resolved as of December 31, 2016.

Protection of Customer Personal Information and Cybersecurity

The privacy provisions of GLBA generally prohibit financial institutions, including us, from disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes (primarily marketing) unless customers have the opportunity to opt-out of the disclosure. The Fair Credit Reporting Act restricts information sharing among affiliates for marketing purposes. Both the Fair Credit Reporting Act and Regulation V, issued by the FRB, govern the use and provision of information to consumer reporting agencies.

In March 2015, federal regulators issued two related statements regarding cybersecurity. One statement indicates that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing Internet-based services of the financial institution. The other statement indicates that a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. For a further discussion of risks related to cybersecurity, see “Risk Factors” in Part I, Item 1A, included in this report.

In October 2016, federal regulators jointly issued an advance notice of proposed rulemaking on enhanced cyber risk management standards that are intended to increase the operational resilience of large and interconnected entities under their supervision. Once established, the enhanced cyber risk management standards would help to reduce the potential impact of a cyber-attack or other cyber-related failure on the financial system. The advance notice of proposed rulemaking addresses five categories of cyber standards: (1) cyber risk governance; (2) cyber risk management; (3) internal dependency management; (4) external

dependency management; and (5) incident response, cyber resilience, and situational awareness. We will continue to monitor any developments related to this proposed rulemaking.

Community Reinvestment Act Requirements

The CRA requires banking regulators to evaluate us and our banking subsidiaries in meeting the credit needs of our local communities, including providing credit to individuals residing in low- and moderate- income neighborhoods. The CRA requires each appropriate federal bank regulatory agency, in connection with its examination of a depository institution, to assess such institution’s record in assessing and meeting the credit needs of the community served by that institution and assign ratings. The regulatory agency’s assessment of the institution’s record is made available to the public. These evaluations are also considered in evaluating mergers, acquisitions and applications to open a branch or facility and, in the case of a bank holding company that has elected financial holding company status, a CRA rating of “satisfactory” is required to commence certain new financial activities or to acquire a company engaged in such activities. We received a rating of “satisfactory” in our most-recent CRA evaluation.

Compensation

Our compensation practices are subject to oversight by the FRB. The federal banking regulators have provided guidance designed to ensure that incentive compensation arrangements at banking organizations take into account risk and are consistent with safe and sound practices. The guidance sets forth the following three key principles with respect to incentive compensation arrangements: (i) the arrangements should provide employees with incentives that appropriately balance risk and financial results in a manner that does not encourage employees to expose their organizations to imprudent risk; (ii) the arrangements should be compatible with effective controls and risk management; and (iii) the arrangements should be supported by strong corporate governance. The guidance provides that supervisory findings with respect to incentive compensation will be incorporated, as appropriate, into the organization’s supervisory ratings, which can affect its ability to make acquisitions or perform other actions. The guidance also provides that enforcement actions may be taken against a banking organization if its incentive compensation arrangements or related risk management, control or governance processes pose a risk to the organization’s safety and soundness.

During the second quarter of 2016, the U.S. financial regulators, including the FRB and the SEC, proposed revised rules on incentive-based payment arrangements at specified regulated entities having at least $1 billion in total assets (including the Parent Company and CBNA). The proposed revised rules would establish general qualitative requirements applicable to all covered entities, additional specific requirements for entities with total consolidated assets of at least $50 billion and further, more stringent requirements for those with total consolidated assets of at least $250 billion. The general qualitative requirements include (i) prohibiting incentive arrangements that encourage inappropriate risks by providing excessive compensation; (ii) prohibiting incentive arrangements that encourage inappropriate risks that could lead to a material financial loss; (iii) establishing requirements for performance measures to appropriately balance risk and reward; (iv) requiring board of director oversight of incentive arrangements; and (v) mandating appropriate record-keeping. For larger financial institutions the proposed revised rules would also introduce additional requirements applicable only to “senior executive officers” and “significant risk-takers” (as defined in the proposed rules), including (i) limits on performance measures and leverage relating to performance targets; (ii) minimum deferral periods; and (iii) subjecting incentive compensation to possible downward adjustment, forfeiture and clawback. If the rules are adopted in the form proposed, they may restrict our flexibility with respect to the manner in which we structure compensation and adversely affect our ability to compete for talent.

Anti-Money Laundering

The USA PATRIOT Act, enacted in 2001 and renewed in 2006, substantially broadened the scope of U.S. anti-money laundering laws and regulations by imposing significant new compliance and due diligence obligations, creating new crimes and penalties and expanding the extra-territorial jurisdiction of the United States. Institutions must maintain anti-money laundering programs that include established internal policies, procedures and controls; a designated compliance officer; an ongoing employee training program; and testing of the program by an independent audit function. We are prohibited from entering into specified financial transactions and account relationships and must meet enhanced standards for due diligence in dealings with foreign financial institutions and foreign customers. We also must take reasonable steps to conduct enhanced scrutiny of account relationships to guard against money laundering and to report any suspicious transactions. Recent laws provide law enforcement authorities with increased access to financial information maintained by banks.

The USA PATRIOT Act also provides for the facilitation of information sharing among governmental entities and financial institutions for the purpose of combating terrorism and money laundering. The statute also creates enhanced information collection tools and enforcement mechanics for the U.S. government, including: (i) requiring standards for verifying customer identification at account opening; (ii) promulgating rules to promote cooperation among financial institutions, regulators and law enforcement entities in identifying parties that may be involved in terrorism or money laundering; (iii) requiring reports by non-financial trades and businesses filed with the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) for transactions exceeding $10,000; and (iv) mandating the filing of suspicious activities reports if a bank believes a customer may be violating U.S. laws and regulations. The statute also requires enhanced due diligence requirements for financial institutions that administer, maintain or manage private

bank accounts or correspondent accounts for non-U.S. persons. Bank regulators routinely examine institutions for compliance with these obligations and are required to consider compliance in connection with the regulatory review of applications.

In 2014, FinCEN, which drafts regulations implementing the USA PATRIOT Act and other anti-money laundering and bank secrecy act legislation, proposed a rule that would require financial institutions to obtain beneficial ownership information with respect to legal entities with which such institutions conduct business, subject to certain exclusions and exemptions. In May 2016, FinCEN issued its final rules with respect to customer due diligence requirements, and financial institutions that are subject to these final rules are required to comply by May 2018. Bank regulators are focusing their examinations on anti-money laundering compliance, and we continue to monitor and augment, where necessary, our anti-money laundering compliance programs.

Office of Foreign Assets Control Regulation

The U.S. has imposed economic sanctions that affect transactions with designated foreign countries, nationals and others. These are typically known as the “OFAC” rules based on their administration by the U.S. Treasury Department Office of Foreign Assets Control. The OFAC-administered sanctions targeting countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (ii) a blocking of assets in which the government or specially designated nationals of the sanctioned country have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the possession or control of U.S. persons). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. OFAC publishes, and routinely updates, lists of names of persons and organizations suspected of aiding, harboring or engaging in terrorist acts, including the Specially Designated Nationals and Blocked Persons. We are responsible for, among other things, blocking accounts of and transactions with, such targets and countries, prohibiting unlicensed trade and financial transactions with them and reporting blocked transactions after their occurrence. If we find a name on any transaction, account or wire transfer that is on an OFAC list, we must freeze such account, file a suspicious activity report and notify the appropriate authorities. Failure to comply with these sanctions could have serious legal and reputational consequences.

Regulation of Broker-Dealers

Our subsidiary CCMI is a registered broker-dealer with the SEC and, as a result, is subject to regulation and examination by the SEC, FINRA and other self-regulatory organizations. These regulations cover a broad range of issues, including capital requirements; sales and trading practices; use of client funds and securities; the conduct of directors, officers and employees; record-keeping and recording; supervisory procedures to prevent improper trading on material non-public information; qualification and licensing of sales personnel; and limitations on the extension of credit in securities transactions. In addition to federal registration, state securities commissions require the registration of certain broker-dealers.

      Heightened Risk Governance Standards

In September 2014, the OCC finalized guidelines that establish heightened governance standards for large national banks with average total consolidated assets of $50 billion or more, including CBNA. The guidelines set forth minimum standards for the design and implementation of a bank’s risk governance framework, and minimum standards for oversight of that framework by a bank’s board of directors. The guidelines are an extension of the OCC’s “heightened expectations” for large banks that the OCC began informally communicating to certain banks in 2010. The guidelines are intended to protect the safety and soundness of covered banks and improve bank examiners’ ability to assess compliance with the OCC’s expectations. Under the guidelines, a bank could use certain components of its parent company’s risk governance framework, but the framework must ensure that the bank’s risk profile is easily distinguished and separate from the parent for risk management and supervisory purposes. A bank’s board of directors is required to have two members who are independent of the bank and parent company management. A bank’s board of directors is responsible for ensuring that the risk governance framework meets the standards in the guidelines, providing active oversight and a credible challenge to management’s recommendations and decisions and ensuring that the parent company decisions do not jeopardize the safety and soundness of the bank.

Anti-Tying Restrictions

Generally, a bank may not extend credit, lease, sell property or furnish any services or fix or vary the consideration for them on the condition that (1) the customer obtain or provide some additional credit, property or services from or to that bank or its bank holding company or their subsidiaries or (2) the customer not obtain some other credit, property or services from a competitor, except to the extent reasonable conditions are imposed to assure the soundness of the credit extended. A bank may however, offer combined-balance products and may otherwise offer more favorable terms if a customer obtains two or more traditional bank products. Certain foreign transactions are exempt from the general rule.

Commercial Real Estate Lending

Lending operations that involve concentrations of commercial real estate loans are subject to enhanced scrutiny by federal banking regulators. Regulators have advised financial institutions of the risks posed by commercial real estate lending concentrations. Such loans generally include land development, construction loans and loans secured by multifamily property and nonfarm, nonresidential real property where the primary source of repayment is derived from rental income associated with the property. The relevant regulatory guidance prescribes the following guidelines for examiners to help identify institutions that are potentially exposed to concentration risk and may warrant greater supervisory scrutiny:

In addition, the Dodd-Frank Act contains provisions that may cause us to reduce the amount of our commercial real estate lending and increase the cost of borrowing, including rules relating to risk retention of securitized assets. Section 941 of the Dodd-Frank Act and implementing rules adopted by the U.S. financial services regulators, including the federal banking regulators and the SEC, require, among other things, a loan originator or a securitizer of asset-backed securities to retain a percentage of the credit risk of securitized assets.

      Other Regulatory Matters

We and our subsidiaries and affiliates are subject to numerous examinations by federal and state banking regulators, as well as the SEC, FINRA and various state insurance and securities regulators. In some cases, regulatory agencies may take supervisory actions that may not be publicly disclosed, and such actions may restrict or limit our activities or activities of our subsidiaries. As part of our regular examination process, our and our banking subsidiaries’ respective regulators may advise us or our banking subsidiaries to operate under various restrictions as a prudential matter. We and our subsidiaries have periodically received requests for information from regulatory authorities at the federal and state level, including from state insurance commissions, state attorneys general, federal agencies or law enforcement authorities, securities regulators and other regulatory authorities, concerning their business practices. Such requests are considered incidental to the normal conduct of business.

In order to remedy certain weaknesses, including weaknesses cited by our regulators, and to meet our significant regulatory and supervisory challenges, we believe we need to continue to make improvements to our processes, systems and controls. We expect to continue to dedicate significant resources and managerial time and attention to and to make significant investments in enhanced processes, systems and controls. This may increase our operational costs and limit our ability to implement aspects of our strategic plan or otherwise pursue certain business opportunities. We also expect to make restitution payments to our banking subsidiaries’ customers, which could be significant, arising from certain customer compliance deficiencies and may be required to pay civil money penalties in connection with certain of these deficiencies. We have established reserves in respect of these future payments, but the amounts that we are ultimately obligated to pay could be in excess of our reserves. Moreover, if we are unsuccessful in remedying these weaknesses and meeting the enhanced supervisory requirements and expectations that apply to us and our banking subsidiaries, we could remain subject to existing restrictions or become subject to additional restrictions on our activities, supervisory actions or public enforcement actions, including the payment of civil money penalties.

  Employees

As of December 31, 2016 , we had approximately 17,600 FTEs, which included our approximately 17,200 full-time colleagues, 200 part-time colleagues and approximately 200 positions filled by temporary employees. None of our employees are parties to a collective bargaining agreement. We consider our relationship with our employees to be good and have not experienced interruptions of operations due to labor disagreements.