CAPITAL ONE FINANCIAL CORP (COF) Risk Factors

Recent key developments

Concrete developments — dated events, named agreements and instruments, legal proceedings — that CAPITAL ONE FINANCIAL CORP surfaced in its latest filing.

• In January 2025, Capital One experienced a multi-day system outage due to a technical issue experienced by FIS, a third-party service provider, which temporarily impacted certain services for some customers.January 2025
• 2019 Cybersecurity Incident: outside individual gained unauthorized access on March 22-23, 2019, obtaining personal information of credit card applicants and customers, resulting in fines, litigation, consent orders, settlements, government investigations and other regulatory enforcement inquiries.March 22-23, 2019
• Federal Reserve released an October 2023 notice of proposed rulemaking to further reduce the cap on debit card interchange fees.October 2023
• North Dakota district court vacated Regulation II in August 2025 but stayed the vacatur pending appeal, potentially allowing the 2023 proposed rule to take effect; Kentucky district court upheld Regulation II as within statutory authority, creating conflicting rulings.August 2025
• In December 2025, the OCC issued a report of preliminary findings of its ongoing supervisory review, in accordance with Executive Order 14331, of the nine largest OCC-regulated banks, including the Bank, to determine whether those banks may have debanked or discriminated against customers on the basis of political or religious beliefs or lawful business activities. The OCC states that its review is ongoing and, once concluded, it intends to hold the banks reviewed accountable for any unlawful debanking activities, including by making referrals to the Attorney General.December 2025
• Merchants filed antitrust lawsuits since 2005 against Mastercard, Visa, and member banks including Capital One, alleging conspiracy to fix interchange fee levels.2005
• Silicon Valley Bank, Signature Bank and First Republic Bank were closed in 2023 and placed under FDIC receivership.2023
• The FDIC's special assessment following the closures of Silicon Valley Bank and Signature Bank.
• Acquisition of Discover's Global Payment Network, including Diners Club international network business, exposing Capital One to competition with Visa and Mastercard and requiring integration of Discover's operations, systems, and compliance frameworks.
• Capital One committed to a $265 billion Community Benefits Plan over five years as part of the acquisition of Discover.
• Merchants' antitrust lawsuits and competitive pressures on interchange fees, including the potential application of Regulation II to debit cards on the Global Payment Network, which could impact anticipated network revenue synergies from the Transaction.
• Visa and Mastercard have entered into long-term arrangements with financial institutions, some exclusive or nearly exclusive, limiting Capital One's ability to conduct material business with these institutions.
• U.K. caps interchange fees for both consumer credit and debit card transactions; Visa and Mastercard have entered voluntary agreements with Canada's Department of Finance to maintain an agreed-upon average interchange rate.
• Regulatory scrutiny and potential changes related to debit card interchange fees under Regulation II, including proposed rulemaking and litigation.
• Outcome of legal or regulatory proceedings, including those related to the Card Product Misclassification, may impact achieving benefits of the Transaction.
• Capital One is the legal successor to Discover and has assumed risks relating to actions against Discover, including ongoing litigation disputes, claims, government agency investigations and enforcement actions.
• The Company measures its allowance for credit losses under the CECL standard.
• The Company is currently classified as a Category III institution; if total consolidated assets reach $700 billion or more or cross-jurisdictional activity reaches $75 billion or more, it becomes a Category II institution subject to enhanced requirements.
• The acquisition of Discover could increase total consolidated assets and affect regulatory classification.
• Capital One has substantially migrated primarily all aspects of its core information technology infrastructure and systems and customer-facing applications to third-party cloud infrastructure platforms, principally AWS.
• The Transaction introduced new and different sources of risk, including inherited control gaps and risk exposures from Discover, and complexities in integrating Discover's products, services, and operations into Capital One's framework.
• Integration of Discover data, including personal information, into Capital One's systems may increase regulatory and compliance risks.
• Merchants filed antitrust lawsuits since 2005 against Mastercard, Visa, and member banks including Capital One, alleging conspiracy to fix interchange fee levels.2005
• Silicon Valley Bank, Signature Bank and First Republic Bank were closed in 2023 and placed under FDIC receivership; the FDIC imposed a special assessment following those closures.2023
• The Company is currently classified as a Category III institution; thresholds for Category II at $700 billion assets or $75 billion cross-jurisdictional activity, with enhanced LCR, NSFR, reporting, and capital requirements.