Item 1A. Risk Factors

Business Risks

This section highlights specific risks that could affect our business. Although we have tried to discuss all material risks of which we are aware at the time this Annual Report on Form 10-K has been filed, other risks may prove to be important in the future, including those that are not currently ascertainable. In addition to the factors discussed elsewhere in this Annual Report, other factors that could cause actual results to differ materially from our forward looking statements include:

The Current Business Environment, Including A Slow or Delayed Economic Recovery, May Adversely Affect Our Industry, Business, Results Of Operations And Capital Levels.

The recent global recession resulted in a general tightening in the credit markets, lower levels of liquidity, reduced asset values (including commercial properties), sharp and prolonged declines in residential home values and sales volumes, reduced business profits, increased rates of business and consumer repayment delinquency, increased rates of business and consumer bankruptcy, and increased and prolonged unemployment, some of which have had a negative impact on our results of operation. Although the overall economic recovery seems to be underway, it has remained modest and fragile. A recovery that is only shallow and very gradual, marked by continued elevated unemployment rates and reduced home prices, or another downturn, may have a material adverse effect on our financial condition and results of operations as customers default on their loans or maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity.

In particular, we may face the following risks in connection with these events:

18

Table of Contents

Compliance With New And Existing Laws, Regulations And Regulatory Expectations May Increase Our Costs, Reduce Our Revenue, Limit Our Ability To Pursue Business Opportunities, And Increase Compliance Challenges.

There has been increased legislation and regulation with respect to the financial services industry in the last few years, and we expect that oversight of our business will continue to expand in scope and complexity. A wide and increasing array of banking and consumer lending laws apply to almost every aspect of our business. Failure to comply with these laws and regulations could result in financial, structural and operational penalties, including receivership, and could result in negative publicity or damage to our reputation with regulators or the public. In addition, establishing systems and processes to achieve compliance with these laws and regulations may increase our costs and limit our ability to pursue certain business opportunities.

The Dodd-Frank Act, as well as the related rules and regulations adopted by various regulatory agencies, could have a significant adverse impact on our business, results of operations or financial condition. The Dodd-Frank Act is a comprehensive financial reform act that requires, among other things, enhanced prudential standards

19

Table of Contents

(including capital and liquidity requirements), enhanced supervision (including stress testing), recovery and resolution planning (often referred to as “living wills”), prohibitions on proprietary trading and increased transparency and regulation of derivatives trading. The Dodd-Frank Act also provides heightened expectations for risk management and regulatory oversight of all aspects of large financial institutions, including us. Many aspects of the law remain to be implemented under the rulemaking and regulatory authority of the SEC, the CFTC and federal banking regulators. Although it is clear that the Dodd-Frank Act and implementing regulations materially impact large financial institutions like us, the rulemaking process has been progressing slowly, and we may not experience the ultimate impact of the Dodd-Frank Act for years. Though some aspects of the Dodd-Frank Act may significantly impact our financial condition or results of operations, other aspects of the law may not apply to us. Nevertheless, the law has increased our need to build new compliance processes and infrastructure and to otherwise enhance our risk management throughout all aspects of our business. The cumulative impact includes higher expectations for capital and liquidity, as discussed in more detail below under the header “We May Not Be Able to Maintain Adequate Capital Levels or Liquidity, Which Could have a Negative Impact on Our Financial Results,” and higher operational costs, which may further increase once regulators fully implement the law. In addition, U.S. government agencies charged with adopting rules and regulations under the Dodd-Frank Act may do so in an unforeseen manner, including ways that potentially expand the reach of the legislation more than was initially contemplated.

There are a number of other provisions in the Dodd-Frank Act that directly or through implementing regulations may impact our business, including:

The Credit CARD Act (amending the Truth-in-Lending Act) and related changes to Regulation Z impose a number of restrictions on credit card practices impacting rates and fees and also update the disclosures required for open-end credit. Overlimit fees may not be imposed without prior consent of the customer, and the number of such fees that can be charged for the same violation is constrained. The amount of any penalty fee or charge must be “reasonable and proportional” to the violation. In addition, the ability of a card issuer to increase rates charged on pre-existing card balances has been significantly restricted. Card issuers are generally prohibited from raising rates on pre-existing balances when generally prevailing interest rates change. Moreover, the circumstances under which a card issuer can raise the interest rate on pre-existing balances of a customer whose risk of default increases are restricted. As a result, the rules implementing the Credit CARD Act could make the card business generally less resilient in future economic downturns.

Under the various state and federal statutes and regulations, we are required to observe various data security and privacy-related requirements, including establishing information security and data security breach response programs and properly authenticating customers before processing or enabling certain types of transactions or interactions. Future federal and state legislation and regulation could further restrict how we collect, use, share

20

Table of Contents

and secure customer information. The failure to observe any one or more of these requirements could subject us to litigation or enforcement actions and impact some of our current or planned business initiatives.

In 2012, we were party to several consent orders and settlement agreements with certain federal agencies. On July 17, 2012, COBNA entered into consent orders with each of the OCC and the CFPB relating to oversight of our vendor sales practices of payment protection and credit monitoring products. On July 26, 2012, the Banks each entered into consent orders with each of the Department of Justice and the OCC relating to compliance with the Servicemembers Civil Relief Act, or the SCRA, and, in the case of the OCC orders, third-party management.

In addition, in the first quarter of 2012, we closed the ING Direct acquisition. In its order approving the acquisition, the Federal Reserve Board required Capital One to enhance our risk-management systems and policies enterprise-wide to account for the changes to our business lines that would result from the acquisitions of ING Direct and HSBC’s credit card operations in the U.S. Among other things, we are implementing enhancements to our compliance risk management programs on an enterprise-wide basis in the following primary areas:

We are continuing to make significant changes to our systems and processes in order to enhance our enterprise-wide compliance risk management programs. There will continue to be heightened regulatory oversight by the federal banking regulators to ensure that we build systems and processes that are commensurate with the nature of our business, and we expect this heightened oversight will continue for the foreseeable future until we meet the expectations of our regulators and can demonstrate that such systems and processes are sustainable.

The legislative and regulatory environment is beyond our control, may change rapidly and unpredictably and may negatively influence our revenue, costs, earnings, growth and capital levels. Certain laws and regulations, and any interpretations and applications with respect thereto, may benefit consumers, borrowers and depositors, but not stockholders. Our success depends on our ability to maintain compliance with both existing and new laws and regulations. For a description of the laws and regulations to which we are subject, please refer to “Supervision and Regulation” in “Item 1. Business.”

We May Experience Increased Delinquencies And Credit Losses.

Like other lenders, we face the risk that our customers will not repay their loans. Rising losses or leading indicators of rising losses (such as higher delinquencies, higher rates of non-performing loans, higher bankruptcy rates, lower collateral values or elevated unemployment rates) may require us to increase our allowance for loan and lease losses, which may degrade our profitability if we are unable to raise revenue or reduce costs to compensate for higher losses. In particular, we face the following risks in this area:

21

Table of Contents

We May Experience Increased Losses Associated With Mortgage Repurchases and Indemnification Obligations.

Certain of our subsidiaries, including GreenPoint Mortgage Funding, Inc. (“GreenPoint”), Capital One Home Loans and Capital One, N.A., as successor to Chevy Chase Bank, may be required to repurchase mortgage loans that have been sold to investors in the event there are breaches of certain representations and warranties contained within the sales agreements. We may be required to repurchase mortgage loans that we sell to investors in the event that there

22

Table of Contents

was improper underwriting or fraud or in the event that the loans become delinquent shortly after they are originated. These subsidiaries also may be required to indemnify certain purchasers and others against losses they incur in the event of breaches of representations and warranties and in various other circumstances, including securities fraud or other public disclosure-related claims, and the amount of such losses could exceed the repurchase amount of the related loans. Consequently, we may be exposed to credit risk associated with sold loans.

We have established reserves in our consolidated financial statements for potential losses that are considered to be both probable and reasonably estimable related to the mortgage loans sold by our originating subsidiaries. The adequacy of the reserve and the ultimate amount of losses incurred will depend on, among other things, the actual future mortgage loan performance, the actual level of future repurchase and indemnification requests, the actual success rate of claimants, developments in litigation related to us and the industry, actual recoveries on the collateral and macroeconomic conditions (including unemployment levels and housing prices). Due to uncertainties relating to these factors, there can be no assurance that our reserves will be adequate or that the total amount of losses incurred will not have a material adverse effect upon our financial condition or results of operations. For additional information related to our mortgage loan repurchase and indemnification obligations and related reserves and our estimate of the reasonably possible future losses from representation and warranty claims beyond the current accrual levels as of December 31, 2012, see “Note 21—Commitments, Contingencies and Guarantees.”

We May Not Be Able to Maintain Adequate Capital Levels or Liquidity, Which Could Have a Negative Impact on Our Financial Results.

As a result of the Dodd-Frank Act and international accords, financial institutions will become subject to new and increased capital and liquidity requirements. Although U.S. regulators have proposed regulations for some of these requirements, there remains uncertainty as to the form the new requirements will take or how and when they will apply to us. As a result, it is possible that we could be required to increase our capital levels above the levels in our current financial plans. These new requirements could have a negative impact on our ability to lend, grow deposit balances or make acquisitions and on our ability to make capital distributions in the form of increased dividends or share repurchases. Higher capital levels could also lower our return on equity.

Recent developments in capital and liquidity requirements that may impact us include the following:

23

Table of Contents

See “Item 1. Business—Supervision and Regulation” for additional information.

We Face Risk Related To Our Operational, Technological And Organizational Infrastructure.

Our ability to grow and compete is dependent on our ability to build or acquire necessary operational, technological and organizational infrastructure. We are in the process of completing significant development projects to complete the systems integration of prior acquisitions and to build a scalable infrastructure in both our Retail Banking and Commercial Banking businesses. For example, we are investing in infrastructure in the Commercial Banking business intended to assist with effective execution of key analytical processes and improve loan origination and underwriting platforms. In addition, we have made and anticipate continuing to make additional infrastructure changes and upgrades in connection with the integrations of both the ING Direct and 2012 U.S. card acquisitions. The 2012 U.S. card acquisition involved the transfer of intellectual property, servicing platforms, infrastructure, contact centers and a significant number of employees. The decoupling and transitioning of these assets, infrastructure and systems from HSBC’s current systems and operations and integrating them into our own business operations has been, and we expect it to continue to be, a highly complex process. These infrastructure changes, upgrades and integrations may cause disruptions to our existing and acquired businesses, including, but not limited to, systems interruptions, transaction processing errors, interruptions to collection processes and system conversion delays, all of which could have a negative impact on us. In addition, we have entered into numerous transitional service arrangements with HSBC entities that will provide for services associated with the decoupling and transition of the business. Under these arrangements, HSBC provides certain services to us and we provide certain services to HSBC. These transitional service arrangements will continue for various dates until the separation of the business from HSBC is complete,

24

Table of Contents

and during that time we will rely on the ability of the applicable HSBC entities to provide these services. The complexities and requirements of these arrangements will increase the operational risk associated with the transition and integration of the business, and this increased risk could lead to unanticipated expenses, disruptions to our operations or other adverse consequences.

Similar to other large corporations, we are exposed to operational risk that can manifest itself in many ways, such as errors related to failed or inadequate processes, inaccurate models, faulty or disabled computer systems, fraud by employees or persons outside of our company and exposure to external events. In addition, we are heavily dependent on the strength and capability of our technology systems which we use to manage our internal financial and other systems, interface with our customers and develop and implement effective marketing campaigns. We also depend on models to measure risks, estimate certain financial values and determine pricing on certain products. Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones and to run our business in compliance with applicable laws and regulations depends on the functionality and reliability of our operational and technology systems. Any disruptions, failures or inaccuracies of our operational and technology systems and models, including those associated with improvements or modifications to such systems and models, could cause us to be unable to market and manage our products and services, manage our risk or to report our financial results in a timely and accurate manner, all of which could have a negative impact on our results of operations.

In some cases, we and the businesses we are acquiring outsource the maintenance and development of operational and technological functionality to third parties. These third parties may experience errors or disruptions that could adversely impact us and over which we may have limited control. Any increase in the amount of our infrastructure that we outsource to third parties may increase our exposure to these risks.

In addition, our on-going investments in infrastructure, which may be necessary to maintain a competitive business, integrate recent acquisitions, such as ING Direct and the 2012 U.S. card acquisitions, and establish scalable operations, may increase our expenses. Further, as our business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business strategies, management of outsourced services, asset purchases or other acquisitions, structural reorganization, compliance with new laws or regulations or the integration of newly acquired businesses. If we are unable to successfully manage our expenses, our financial results will be negatively affected.

We Could Incur Increased Costs or Reductions In Revenue Or Suffer Reputational Damage And Business Disruptions In the Event Of The Theft, Loss or Misuse Of Information, Including As A Result Of A Cyber-Attack.

Our products and services involve the gathering, storage and transmission of sensitive information regarding our customers and their accounts. Our ability to provide such products and services, many of which are web-based, relies upon the management and safeguarding of information, software, methodologies and business secrets. To provide these products and services, we use information systems and infrastructure that we and third party service providers operate. We also have arrangements in place with retail partners and other third parties where we share and receive information about their customers who are or may become our customers. As a financial institution, we also are subject to and examined for compliance with an array of data protection laws, regulations and guidance, as well as to our own internal privacy and information security policies and programs. If unauthorized persons were somehow to get access to personal, confidential or proprietary information, including customer information, in our possession or to our proprietary information, software, methodologies and business secrets, it could result in significant legal and financial exposure, supervisory liability, damage to our reputation or a loss of confidence in the security of our systems, products and services that could adversely affect our business.

Information security risks for large financial institutions like us have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to

25

Table of Contents

conduct financial transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other external parties. As noted above, our operations rely on the secure processing, transmission and storage of confidential information in our computer systems and networks. Our businesses rely on our digital technologies, computer and email systems, software and networks to conduct their operations. In addition, to access our products and services, our customers may use computers, smartphones, tablet PCs and other mobile devices that are beyond our security control systems. Although we believe we have a robust suite of authentication and layered information security controls, our technologies, systems, networks and our customers’ devices may become the target of cyber-attacks or other attacks that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of our or our customers’ confidential, proprietary or other information, including their access credential to accounts with online functionality, or that could result in disruptions to the business operations of us or our customers or other third parties. For example, Capital One and other U.S. financial services providers were targeted recently on several occasions with distributed denial-of-service attacks from sophisticated third parties. On at least one occasion, these attacks successfully disrupted consumer online banking services for a period of time. If these attacks are successful, or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services online. In addition, a breach or attack affecting one of our third-party service providers or partners could impact us through no fault of our own.

Because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently and often are not fully recognized or understood until after they have been launched, we and our third-party service providers and partners may be unable to anticipate certain attack methods in order to implement effective preventative measures. Should a cyber-attack against us succeed on any material scale, market perception of the effectiveness of our security measures could be harmed, and we could face the aforementioned risks. Though we have insurance against some cyber-risks and attacks, it may not be sufficient to offset the impact of a material loss event.

The Growth Of Our Direct Banking Business Presents Certain Risks.

As a result of our strategic decisions and acquisition of ING Direct, we have grown our direct banking business significantly over the past few years. Today, we operate the largest online direct banking institution in the U.S., with approximately $109 billion in deposits as of December 31, 2012. While direct banking represents a significant opportunity to attract new customers that value greater and more flexible access to banking services at reduced costs, it also presents significant risks. In addition to the software, infrastructure and cyber-attack risks discussed above, we face risks related to direct banking, including:

Our direct banking business is dependent on our ability to process, record and monitor a large number of complex transactions. If any of our financial, accounting, or other data processing systems fail or have other

26

Table of Contents

significant shortcomings, we could be materially adversely affected. Third parties with which we do business could also be sources of operational risk, particularly in the event of breakdowns or failures of such parties’ own systems. We may also be subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control, which may include, for example, computer viruses or electrical or telecommunications outages, cyber-attacks, including distributed denial-of-service attacks discussed above, natural disasters, other damage to property or physical assets or events arising from local or larger scale politics, including terrorist acts. Any of these occurrences could diminish our ability to operate our direct banking business, service customer accounts, and protect customers’ information, or result in potential liability to customers, reputational damage, regulatory intervention and customers’ loss of confidence in our direct banking business, any of which could result in a material adverse effect.

We May Fail To Realize All Of The Anticipated Benefits Of Our Mergers And Acquisitions.

We have engaged in merger and acquisition activity over the past several years and may continue to engage in such activity in the future. For example, in 2012, we closed the ING Direct and 2012 U.S. card acquisitions. We continue to evaluate and anticipate engaging in, among other merger and acquisition activity, additional strategic partnerships and selected acquisitions of financial institutions and other financial assets, including credit card and other loan portfolios.

Any merger, acquisition or strategic partnership we undertake will entail certain risks, which may materially and adversely affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our existing operations or are not able to achieve the anticipated benefits of any merger, acquisition or strategic partnership, including cost savings and other synergies, our business could be negatively affected. In addition, it is possible that the ongoing integration processes could result in the loss of key employees, errors or delays in systems implementation, the disruption of our ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect our ability to maintain relationships with partners, clients, customers, depositors and employees or to achieve the anticipated benefits of any merger, acquisition or strategic partnership. Integration efforts also may divert management attention and resources. These integration matters may have an adverse effect on us during any transition period.

In addition, we may face the following risks in connection with any merger, acquisition or strategic partnership:

27

Table of Contents

Reputational Risk and Social Factors May Impact Our Results.

Our ability to originate and maintain accounts is highly dependent upon the perceptions of consumer and commercial borrowers and deposit holders and other external perceptions of our business practices or our financial health. Adverse perceptions regarding our reputation in the consumer, commercial and funding markets could lead to difficulties in generating and maintaining accounts as well as in financing them. In particular, negative perceptions regarding our reputation could lead to decreases in the levels of deposits that consumer and commercial customers and potential customers choose to maintain with us. Negative public opinion could result from actual or alleged conduct in any number of activities or circumstances, including lending practices,

28

Table of Contents

regulatory compliance, inadequate protection of customer information, or sales and marketing, and from actions taken by regulators or other persons in response to such conduct. In addition, third parties with whom we have important relationships may take actions over which we have limited control that could negatively impact perceptions about us.

In addition, a variety of social factors may cause changes in borrowing activity, including credit card use, payment patterns and the rate of defaults by accountholders and borrowers domestically and internationally. These social factors include changes in consumer confidence levels, the public’s perception regarding consumer debt, including credit card use, and changing attitudes about the stigma of bankruptcy. If consumers develop or maintain negative attitudes about incurring debt, or if consumption trends decline, our business and financial results will be negatively affected.

Damage To Our Brands Could Impact Our Financial Performance.

Our brands have historically been very important to us. As with many financial services institutions, maintaining and enhancing our brand will depend largely on our ability to be a technology leader and to continue to provide high-quality products and services. Negative public perception of our brands could result from actual or alleged conduct in any number of activities, including lending practices, corporate governance, regulatory compliance and the use and protection of customer information, as well as from actions taken by government regulators and community organizations in response to that conduct. If we fail to maintain and enhance our brands, or if we incur excessive expenses in this effort, our business, results of operations and financial condition could be materially and adversely affected. Our online banking brands may also be negatively impacted by a number of factors, including service outages, including as a result of a cyber-attack, integration difficulties from recent acquisitions, product malfunctions, data privacy, lack of training and security issues.

We Face Intense Competition in All of Our Markets.

We operate in a highly competitive environment, and we expect competitive conditions to continue to intensify. We face intense competition both in making loans and attracting deposits. We compete on the basis of the rates we pay on deposits and the rates and other terms we charge on the loans we originate or purchase, as well as the quality of our customer service. Price competition for loans might result in origination of fewer loans or earning less on our loans. We expect that competition will continue to increase with respect to most of our products. Some of our competitors are substantially larger than we are, which may give those competitors advantages, including a more diversified product and customer base, the ability to reach out to more customers and potential customers, operational efficiencies, more versatile technology platforms, broad-based local distribution capabilities, lower-cost funding and larger existing branch networks. In addition, some of our competitors, including new and emerging competitors in the digital and mobile payments space, are not subject to the same regulatory requirements or legislative scrutiny to which we are subject, which also could place us at a competitive disadvantage.

We have significantly expanded our partnership business over the past several years with the additions of a number of credit card partnerships from the 2012 U.S. card acquisition and credit card partnerships with Kohl’s, HBC and Sony. The market for key business partners, especially in the Card business, is very competitive, and we cannot assure you that we will be able to grow or maintain these partner relationships. We face the risk that we could lose partner relationships, even after we have invested significant resources, time and expense in acquiring and developing the relationships. The loss of any of our business partners could have a negative impact on our results of operations, including lower returns, excess operating expense and excess funding capacity.

In such a competitive environment, we may lose entire accounts or may lose account balances to competing firms, or we may find it more costly to maintain our existing customer base. Customer attrition from any or all of our lending products, together with any lowering of interest rates or fees that we might implement to retain

29

Table of Contents

customers, could reduce our revenues and therefore our earnings. Similarly, customer attrition from our deposit products, in addition to an increase in rates or services that we may offer to retain those deposits, may increase our expenses and therefore reduce our earnings.

If We Do Not Adjust to Rapid Changes in the Financial Services Industry, Our Financial Performance May Suffer.

Our ability to deliver to stockholders strong financial performance and returns on investment will depend in part on our ability to expand the scope of available financial services to meet the needs and demands of our customers. With our recent ING Direct and 2012 U.S. card acquisitions, we have begun to market new products to our larger customer base. Our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings. Many of our competitors are focusing on cross-selling their products and developing new products or technologies, which could affect our ability to maintain or grow existing customer relationships or require us to offer lower interest rates or fees on our lending products or higher interest rates on deposits. This increasingly competitive environment is primarily a result of changes in regulation, changes in technology and product delivery systems, as well as the accelerating pace of consolidation among financial service providers, all of which may affect our customers’ expectations and demands. If we do not successfully anticipate and adjust to changes in the financial service industry, our business and financial results will be negatively affected.

Fluctuations in Market Interest Rates Or Volatility in the Capital Markets Could Adversely Affect Our Revenue and Expense, the Value of Assets and Obligations, Our Cost of Capital or Our Liquidity.

Like other financial institutions, our business may be sensitive to market interest rate movement and the performance of the capital markets. Changes in interest rates or in valuations in the debt or equity markets could directly impact us. For example, we borrow money from other institutions and depositors, which we use to make loans to customers and invest in debt securities and other earning assets. We earn interest on these loans and assets and pay interest on the money we borrow from institutions and depositors. Fluctuations in interest rates, including changes in the relationship between short-term rates and long-term rates and in the relationship between our funding basis rate and our lending basis rate, may have negative impacts on our net interest income and therefore our earnings. In addition, interest rate fluctuations and competitor responses to those changes may affect the rate of customer prepayments for mortgage, auto and other term loans and may affect the balances customers carry on their credit cards. These changes can reduce the overall yield on our earning asset portfolio. Changes in interest rates and competitor responses to these changes may also impact customer decisions to maintain balances in the deposit accounts they have with us. In addition, changes in valuations in the debt and equity markets could have a negative impact on the assets we hold in our investment portfolio. Finally, such market changes could also have a negative impact on the valuation of assets for which we provide servicing.

We assess our interest rate risk by estimating the effect on our earnings under various scenarios that differ based on assumptions about the direction and the magnitude of interest rate changes. We take risk mitigation actions based on those assessments. We face the risk that changes in interest rates could materially reduce our net interest income and our earnings, especially if actual conditions turn out to be materially different than those we assumed. See “MD&A—Market Risk Management” for additional information.

Our Business Could Be Negatively Affected If We Are Unable to Attract, Retain and Motivate Skilled Senior Leaders.

Our success depends, in large part, on our ability to retain key senior leaders, and competition for such senior leaders can be intense in most areas of our business. The executive compensation provisions of the Dodd-Frank Act and the regulations issued thereunder, and any further legislation, regulation or regulatory guidance restricting executive compensation, may limit the types of compensation arrangements that we may enter into with our most senior leaders and could have a negative impact on our ability to attract, retain and motivate such

30

Table of Contents

leaders in support of our long-term strategy. These laws and regulations may not apply in the same manner to all financial institutions, and we therefore may face more restrictions than other institutions and companies with whom we compete for talent. If we are unable to retain talented senior leadership, our business could be negatively affected.

Our Businesses are Subject to the Risk of Increased Litigation.

Our businesses are subject to increased litigation risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry, the structure of the credit card industry and business practices in the mortgage lending business. Substantial legal liability against us could have a material adverse effect or cause significant reputational harm to us, which could seriously harm our business. For a description of the litigation risks that we face, see “Note 21—Commitments, Contingencies and Guarantees.”

We Face Risks from Unpredictable Catastrophic Events.

Despite our substantial business contingency plans, the impact from natural disasters and other catastrophic events, including terrorist attacks, may have a negative effect on our business and infrastructure, including our information technology systems. In addition, if a natural disaster or other catastrophic event occurs in certain regions where our business and customers are concentrated, such as the New York metropolitan area, we could be disproportionately impacted as compared to our competitors. The impact of such events and other catastrophes on the overall economy may also adversely affect our financial condition and results of operations.

We Face Risks from the Use of or Changes to Estimates in Our Financial Statements.

Pursuant to generally accepted accounting principles in the U.S. (“U.S. GAAP”), we are required to use certain assumptions and estimates in preparing our financial statements, including, but not limited to, estimating our allowance for loan and lease losses and the fair value of certain assets and liabilities. In addition, the Financial Accounting Standards Board (“FASB”), the SEC and other regulatory bodies may change the financial accounting and reporting standards, including those related to assumptions and estimates we use to prepare our financial statements, in ways that we cannot predict and that could impact our financial statements. If the assumptions or estimates underlying our financial statements are incorrect or if financial accounting and reporting standards are changed, we may experience unexpected material losses. For a discussion of our use of estimates in the preparation of our consolidated financial statements, see “Note 1—Summary of Significant Accounting Policies.”

Our Ability To Receive Dividends From Our Subsidiaries Could Affect Our Liquidity And Ability To Pay Dividends.

We are a separate and distinct legal entity from our subsidiaries. Dividends to us from our direct and indirect subsidiaries, including our bank subsidiaries, have represented a major source of funds for us to pay dividends on our common stock, make payments on corporate debt securities and meet other obligations. There are various federal law limitations on the extent to which the Banks can finance or otherwise supply funds to us through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. If our subsidiaries’ earnings are not sufficient to make dividend payments to us while maintaining adequate capital levels, our liquidity may be affected and we may not be able to make dividend payments to our common stockholders, to make payments on outstanding corporate debt securities or meet other obligations, each and any of which could have a material adverse impact on our results of operations, financial position or perception of financial health.

31

Table of Contents

The Soundness of Other Financial Institutions Could Adversely Affect Us.

Our ability to engage in routine funding and other transactions could be adversely affected by the stability and actions of other financial services institutions. Financial services institutions are interrelated as a result of trading, clearing, servicing, counterparty and other relationships. With our recent ING Direct and 2012 U.S. card acquisitions, we have increased exposure to financial institutions and counterparties. These counterparties include institutions and counterparties that may be exposed to various risks over which we have little or no control, including European or U.S. sovereign debt that is currently or may become in the future subject to significant price pressure, rating agency downgrade or default risk.

In addition, we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients, resulting in a significant credit concentration with respect to the financial services industry overall. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions.

Likewise, adverse developments affecting the overall strength and soundness of our competitors, the financial services industry as a whole and the general economic climate or sovereign debt could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. In addition, adverse developments with respect to third parties with whom we have important relationships also could negatively impact perceptions about us. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face.