COF, §1A diff (2016 → 2017)

Item 1A. Risk Factors This section highlights specific risks that could affect our business. Although we have tried to discuss all material risks of which we are aware at the time this Report has been filed, other risks may prove to be important in the future, including those that are not currently ascertainable. In addition to the factors discussed elsewhere in this Report, other factors that could cause actual results to differ materially from our forward-looking statements include: General Economic and Market Risks Changes And Instability In The Macroeconomic Environment May Adversely Affect Our Industry, Business, Results Of Operations And Financial Condition. We offer a broad array of financial products and services to consumers, small businesses and commercial clients. We market our credit card products on a national basis throughout the United States, Canada and the United Kingdom and offer banking and other services in many regions within the United States. A prolonged period of economic volatility, slow growth, or a significant deterioration in economic conditions, in the United States or one of these countries could have a material adverse effect on our financial condition and results of operations as customers default on their loans or maintain lower deposit levels or, in the case of credit card accounts, carry lower balances and reduce credit card purchase activity. Some of the risks we may face in connection with adverse changes and instability in macroeconomic environment include the following: • Payment patterns may change, causing increases in delinquencies and default rates, which could have a negative impact on our results of operations. In addition, changes in consumer confidence levels and behavior, including decreased consumer spending, lower demand for credit and a shift in consumer payment behavior towards avoiding late fees, finance charges and other fees, could have a negative impact on our results of operations. • Increases in bankruptcies could cause increases in our charge-off rates, which could have a negative impact on our results of operations. • Our ability to recover debt that we have previously charged-off may be limited, which could have a negative impact on our results of operations. • The process and models we use to estimate our allowance for loan and lease losses may become less reliable if volatile economic conditions, changes in the competitive environment, significant changes in customer behavior or other unexpected variations in key inputs and assumptions cause actual losses to diverge from the projections of our models. As a result, our estimates for credit losses may become increasingly subject to management’s judgment and high levels of volatility over short periods of time, which could negatively impact our results of operations. See “There Are Risks Resulting From The Extensive Use Of Models and Data In Our Business.” • Risks associated with financial market instability and volatility could cause a material adverse effect on our liquidity and our funding costs. For example, increases in interest rates and our credit spreads could negatively impact our results of operations. • Our ability to borrow from other financial institutions or to engage in funding transactions on favorable terms or at all could be adversely affected by disruptions in the capital markets or other events, including actions by rating agencies and deteriorating investor expectations, which could limit our access to funding. • While interest rates have risen from historic lows set in 2016, both shorter-term and longer-term interest rates remain below long-term historical averages and the yield curve has been relatively flat compared to past periods. A flat yield curve combined with low interest rates generally leads to lower revenue and reduced margins because it tends to limit our ability to increase the spread between asset yields and funding costs. Sustained periods of time with a flat yield curve coupled with low interest rates could have a material adverse effect on our earnings and our net interest margin. Regulatory Risk Compliance With New And Existing Laws, Regulations And Regulatory Expectations May Increase Our Costs, Reduce Our Revenue, Limit Our Ability To Pursue Business Opportunities And Increase Compliance Challenges. Legislation and regulation with respect to the financial services industry has increased in recent years, and we expect that oversight of our business may continue to expand in scope and complexity. A wide array of banking and consumer lending laws apply to almost every aspect of our business. Failure to comply with these laws and regulations could result in financial, structural and operational penalties, including significant fines and criminal sanctions, and could result in negative publicity or damage to our reputation with regulators or the public. In addition, establishing systems and processes to achieve compliance with these laws and regulations may increase our costs and limit our ability to pursue certain business opportunities. We are subject to heightened regulatory oversight by the federal banking regulators to ensure that we build systems and processes that are commensurate with the nature of our business and that meet the heightened risk management and enhanced prudential standards issued by our regulators. For example, over the last several years, state and federal regulators have focused on compliance with the Bank Secrecy Act and anti-money laundering laws, data integrity and security, use of service providers, fair lending and other consumer protection issues. In July 2015, Capital One entered into a consent order with the OCC to address concerns about our anti-money laundering (“AML”) program (“AML Program”). Although we are making substantial progress in taking the steps and making the improvements required by the OCC consent order, we expect heightened oversight of our AML Program will continue for the foreseeable future. The Dodd-Frank Act, other regulatory reforms and implementing regulations have increased our need to develop, monitor and maintain compliance processes and infrastructure and to otherwise enhance our risk management throughout all aspects of our business. The cumulative impact of these changes also includes higher expectations for the amount of capital and liquidity we must maintain, as discussed in more detail below under the heading “We May Not Be Able To Maintain Adequate Capital Or Liquidity Levels, Which Could Have A Negative Impact On Our Financial Results And Our Ability To Return Capital To Our Shareholders,” and higher operational costs, which may further increase as regulators continue to implement such reforms. United States government agencies charged with adopting and interpreting laws, rules and regulations, including under the Dodd-Frank Act, may do so in an unforeseen manner, including in ways that potentially expand the impact of such laws, rules or regulations on us more than initially contemplated or currently anticipated. Both Congress and the regulators continue to review the laws and regulations that could have impacts beyond those initially contemplated or currently anticipated. We have a large number of customer accounts in our credit card and auto lending businesses and we have made the strategic choice to originate and service subprime credit cards and auto loans which typically have higher delinquencies and charge-offs than prime customers. Accordingly, we have significant involvement with credit bureau reporting and the collection and recovery of delinquent and charged-off debt, primarily through customer communications, the filing of litigation against customers in default, the periodic sale of charged-off debt and vehicle repossession. The banking industry is subject to enhanced legal and regulatory scrutiny regarding credit bureau reporting and debt collection practices from regulators, courts and legislators. Any future changes to our business practices in these areas, including our debt collection practices, whether mandated by regulators, courts, legislators or otherwise, or any legal liabilities resulting from our business practices, including our debt collection practices, could have a material adverse impact on our financial condition. The legislative and regulatory environment is beyond our control, may change rapidly and unpredictably and may negatively influence our revenue, costs, earnings, growth, liquidity and capital levels. In addition, some rules and regulations may be subject to litigation or other challenges that delay or modify their implementation and impact on us. For example, the Tax Act has resulted in material impacts to our results of operations due to changes to the valuation of our deferred tax assets, the valuation of other tax assets, and tax expense, and may affect customer behavior and our ability to forecast our effective tax rate. Many aspects of the Tax Act are unclear and may not be clarified for some time. As a result, we have not yet been able to determine the full impact of the new laws on our business, operating results and financial condition. For example, in the United Kingdom and Europe, continued regulatory uncertainty or changes arising from Brexit negotiations could adversely affect our U.K. operations. Certain laws and regulations, and any interpretations and applications with respect thereto, may benefit consumers, borrowers and depositors, but not shareholders. Our success depends on our ability to maintain compliance with both existing and new laws and regulations. For a description of the material laws and regulations to which we are subject, please refer to “Part I-Item 1. Business-Supervision and Regulation.” Credit Risk We May Experience Increased Delinquencies, Credit Losses, Inaccurate Estimates And Inadequate Reserves. Like other lenders, we face the risk that our customers will not repay their loans. A customer’s ability and willingness to repay us can be negatively impacted by increases in their payment obligations to other lenders, whether as a result of higher debt levels or rising interest rates, or by restricted availability of credit generally. We may fail to quickly identify customers that are likely to default on their payment obligations and reduce our exposure by closing credit lines and restricting authorizations, which could adversely impact our financial condition and results of operations. Our ability to manage credit risk also may be adversely affected by legal or regulatory changes (such as restrictions on collections, bankruptcy laws, minimum payment regulations and re-age guidance), competitors' actions and consumer behavior, as well as inadequate collections staffing, techniques and models. Rising losses or leading indicators of rising losses (such as higher delinquencies, higher rates of non-performing loans, higher bankruptcy rates, lower collateral values or elevated unemployment rates) may require us to increase our allowance for loan and lease losses, which may degrade our profitability if we are unable to raise revenue or reduce costs to compensate for higher losses. In particular, we face the following risks in this area: • Missed Payments: Our customers may miss payments. Loan charge-offs (including from bankruptcies) are generally preceded by missed payments or other indications of worsening financial condition for our customers. Customers are more likely to miss payments during an economic downturn or prolonged periods of slow economic growth. In addition, we face the risk that consumer and commercial customer behavior may change (for example, an increase in the unwillingness or inability of customers to repay debt, which may be heightened by increasing interest rates or levels of consumer debt generally), causing a long-term rise in delinquencies and charge-offs. • Estimates of Inherent Losses: The credit quality of our portfolio can have a significant impact on our earnings. We allow for and reserve against credit risks based on our assessment of credit losses inherent in our loan portfolios. This process, which is critical to our financial results and condition, requires complex judgments, including forecasts of economic conditions. We may underestimate our inherent losses and fail to hold an allowance for loan and lease losses sufficient to account for these losses. Incorrect assumptions could lead to material underestimations of inherent losses and inadequate allowance for loan and lease losses. In cases where we modify a loan, if the modifications do not perform as anticipated we may be required to build additional allowance on these loans. The build or release of allowances impacts our current financial results. • Underwriting: Our ability to accurately assess the creditworthiness of our customers may diminish, which could result in an increase in our credit losses and a deterioration of our returns. See “Our Risk Management Strategies May Not Be Fully Effective In Mitigating Our Risk Exposures In All Market Environments Or Against All Types Of Risk.” • Business Mix: We engage in a diverse mix of businesses with a broad range of potential credit exposure. Our business mix could change in ways that could adversely affect the credit quality of our portfolio. Because we originate a relatively greater proportion of consumer loans in our loan portfolio compared to other large bank peers and originate both prime and subprime credit card accounts and auto loans, we may experience higher delinquencies and a greater number of accounts charging off compared to other large bank peers, which could result in increased credit losses, operating costs and regulatory scrutiny. • Charge-off Recognition / Allowance for Loan and Lease Losses: We account for the allowance for loan and lease losses according to accounting and regulatory guidelines and rules, including Financial Accounting Standards Board (“FASB”) standards and the Federal Financial Institutions Examination Council (“FFIEC”) Account Management Guidance. In June 2016, the FASB issued revised guidance for impairments on financial instruments. The guidance, which becomes effective on January 1, 2020, with early adoption permitted no earlier than January 1, 2019, requires use of a current expected credit loss (“CECL”) model that is based on expected rather than incurred losses. Adoption of the CECL model could require changes in our account management or allowance for loan and lease losses practices, and may cause our allowance for loan and lease losses and credit losses to change materially. • Industry Developments: Our charge-off and delinquency rates may be negatively impacted by industry developments, including new regulations applicable to our industry. • Collateral: The collateral we have on secured loans could be insufficient to compensate us for loan losses. When customers default on their secured loans, we attempt to recover collateral where permissible and appropriate. However, the value of the collateral may not be sufficient to compensate us for the amount of the unpaid loan, and we may be unsuccessful in recovering the remaining balance from our customers. Decreases in real estate values adversely affect the collateral value for our commercial lending activities, while the auto business is similarly exposed to collateral risks arising from the auction markets that determine used car prices. Therefore, the recovery of such property could be insufficient to compensate us for the value of these loans. Borrowers may be less likely to continue making payments on loans if the value of the property used as collateral for the loan is less than what the borrower owes, even if the borrower is still financially able to make the payments. Trends in home prices are a driver of credit costs in our home loan business as they impact both the probability of default and the loss severity of defaults. Additionally, the potential volatility in the number of defaulted and modified loans from changes in home prices can create material impacts on the servicing costs of the business, fluctuations in credit marks and profitability in acquired portfolios and volatility in mortgage servicing rights valuations. Although home prices have generally appreciated recently, the slow economic recovery, shifts in monetary policy and potentially diminishing demands from investors could threaten or limit the recovery. In our auto business, if vehicle prices experience declines, we could be adversely affected. For example, business and economic conditions that negatively affect household incomes, housing prices, and consumer behavior related to our businesses could decrease (i) the demand for new and used vehicles and (ii) the value of the collateral underlying our portfolio of auto loans, which could cause the number of consumers who become delinquent or default on their loans to increase. • Geographic and Industry Concentration: Although our consumer lending is geographically diversified, approximately 30% of our commercial loan portfolio is concentrated in the tri-state area of New York, New Jersey and Connecticut. The regional economic conditions in the tri-state area affect the demand for our commercial products and services as well as the ability of our customers to repay their commercial loans and the value of the collateral securing these loans. An economic downturn or prolonged period of slow economic growth in, or a catastrophic event that disproportionately affects, the tri-state area could have a material adverse effect on the performance of our commercial loan portfolio and our results of operations. In addition, our Commercial Banking strategy includes an industry-specific focus. If any of the industries that we focus on experience changes, we may experience increased credit losses and our results of operations could be adversely impacted. For example, as of December 31, 2017, energy-related loan balances represented approximately 4% of our total commercial loan portfolio. This amount is comprised of loans to commercial entities in the energy industry, such as exploration and production, oil field services, and pipeline transportation of gas and crude oil, as well as loans to entities in industries that are indirectly impacted by energy prices, such as petroleum wholesalers, oil and gas equipment manufacturing, air transportation, and petroleum bulk stations and terminals. In recent years, oil prices have fluctuated significantly, which has impacted many of the borrowers in this portfolio and the value of the collateral securing our loans to these borrowers. A prolonged period of declining oil prices could impair their ability to service loans outstanding to them and/or reduce demand for loans. If energy-related industries or any of the other industries that we focus on experience adverse changes, we may experience increased credit losses and our results of operations could be adversely impacted. Capital and Liquidity Risk We May Not Be Able To Maintain Adequate Capital Or Liquidity Levels, Which Could Have A Negative Impact On Our Financial Results And Our Ability To Return Capital To Our Shareholders. As a result of the Dodd-Frank Act and the United States implementation of international accords, financial institutions are subject to new and increased capital and liquidity requirements, and we expect further changes to these regulations. Although United States regulators have finalized regulations for many of these requirements, continued uncertainty remains as to the form additional new requirements will take or how and when they will apply to us. As a result, it is possible that we could be required to increase our capital and/or liquidity levels above the levels assumed in our current financial plans. These new requirements could have a negative impact on our ability to lend, grow deposit balances or make acquisitions and limit our ability to make most capital distributions. Higher capital levels also lower our return on equity. In addition, as described further above in “Part I-Item 1. Business-Supervision and Regulation,” for regulatory capital purposes we entered parallel run on January 1, 2015. We will become subject to the Basel III Advanced Approaches framework for purposes of determining our regulatory capital requirements once we receive regulatory approval to do so, although the exact timing of when such approval may be granted is uncertain. Although we have current estimates of risk-weighted asset calculations under that framework, there remains uncertainty around future regulatory interpretations of certain aspects of those calculations. Moreover, the so-called Collins Amendment to the Dodd-Frank Act, as implemented in the Basel III Capital Rule, establishes a capital floor so that organizations subject to the Basel III Advanced Approaches may not hold less capital than would be required using the Basel III Standardized Approach capital calculations. Additionally, in December 2017 the Basel Committee on Banking Supervision finalized certain modifications to the international Basel III capital standards which, if implemented by the United States federal banking agencies, could alter regulatory capital requirements. Therefore, we cannot assure you that our current estimates will be correct, and we may need to hold significantly more regulatory capital in the future than we currently estimate to maintain a given capital ratio. In April 2016, the United States federal banking agencies proposed a rule regarding the United States implementation of the net stable funding ratio (“Proposed NSFR”). See “Part I-Item 1. Business-Supervision and Regulation” for further details regarding the Proposed NSFR. The financial and operational impact on us of a final NSFR rule remains uncertain until a final rule is published, and there is uncertainty as to the combined impact of the existing Liquidity Coverage Ratio and any final NSFR on how we manage our business. See “Note 12-Regulatory and Capital Adequacy” and “Part I-Item 1. Business-Supervision and Regulation-Dividends, Stock Repurchases and Transfers of Funds” for additional information regarding recent developments in capital and liquidity requirements. We consider various factors in the management of capital, including the impact of stress on our capital levels, as determined by both our internal modeling and the Federal Reserve’s modeling of our capital position in supervisory stress tests and CCAR. There can be significant differences between our modeling and the Federal Reserve’s estimates for a given scenario and between the capital needs suggested by our internal bank holding company scenarios relative to the supervisory scenarios. Therefore, although our estimated capital levels under stress disclosed as part of the CCAR or DFAST processes may suggest that we have substantial capacity to return capital to shareholders and remain well capitalized under stress, the Federal Reserve’s modeling, our own modeling of another scenario or other factors related to our capital management process may result in a materially lower capacity to return capital to shareholders than that indicated by the projections released in the CCAR or DFAST processes. This in turn could lead to restrictions on our ability to pay dividends and engage in share repurchase transactions. See “Part I-Item 1. Business-Supervision and Regulation” for additional information. Operational Risk We Face Risks Related To Our Operational, Technological And Organizational Infrastructure. Our ability to retain and attract new customers depends on our ability to build or acquire necessary operational, technological and organizational infrastructure or adapt to technological advances involving such infrastructure, which can be a challenge due to the fast pace of digital transformation and advances. We are embedding technology, data and software development deeply into our business model and how we work. Similar to other large corporations, we are exposed to operational risk that can manifest itself in many ways, such as errors related to failed or inadequate processes, inaccurate models, faulty or disabled computer systems, fraud by employees or persons outside of our company and exposure to external events. In addition, we are heavily dependent on the security, capability and continuous availability of the technology systems that we use to manage our internal financial and other systems, interface with our customers and develop and implement effective marketing campaigns. In addition, our businesses are dependent on our ability to process, record and monitor a large number of complex transactions. If any of our financial, accounting or other data processing systems fail or have other significant shortcomings, our business and reputation could be materially adversely affected. We may also be subject to disruptions of our operating systems arising from events that are wholly or partially beyond our control, which may include, for example, computer viruses or electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks, including Distributed Denial of Service (“DDOS”) attacks discussed below, natural disasters, other damage to property or physical assets or events arising from local or larger scale politics, including terrorist acts. Any of these occurrences could diminish our ability to operate our businesses, service customer accounts and protect customers’ information, or result in potential liability to customers, reputational damage, regulatory intervention and customers’ loss of confidence in our businesses, any of which could result in a material adverse effect. We also rely on the business infrastructure and systems of third parties with which we do business and to whom we outsource the maintenance and development of operational and technological functionality. For example, we have migrated a number of, and intend to migrate substantially all, of our core systems and customer-facing applications to third-party cloud infrastructure platforms such as Amazon Web Services, Inc. If we do not execute the transition or administer these new environments in a well-managed, secure and effective manner, we may experience unplanned service disruption or unforeseen costs which may harm our business and operating results. We must successfully develop and maintain information, financial reporting, data-protection and other controls adapted to our reliance on new platforms and providers. In addition, our cloud infrastructure providers, or other service providers, could experience system breakdowns or failures, outages, downtime, cyber-attacks, adverse changes to financial condition, bankruptcy or other adverse conditions, which could have a material adverse effect on our business and reputation. Thus, the substantial amount of our infrastructure that we outsource to “the cloud” or to other third parties may increase our risk exposure. Our ability to develop and deliver new products that meet the needs of our existing customers and attract new ones and to run our business in compliance with applicable laws and regulations depends on the functionality and reliability of our operational and technology systems. Any disruptions, failures or inaccuracies of our operational and technology systems and models, including those associated with improvements or modifications to such systems and models, could cause us to be unable to market and manage our products and services, manage our risk, meet our regulatory obligations or report our financial results in a timely and accurate manner, all of which could have a negative impact on our results of operations. In addition, our ongoing investments in infrastructure, which are necessary to maintain a competitive business, integrate acquisitions and establish scalable operations, may increase our expenses. As our business develops, changes or expands, additional expenses can arise as a result of a reevaluation of business strategies, management of outsourced services, asset purchases or other acquisitions, structural reorganization, compliance with new laws or regulations or the integration of newly acquired businesses. If we are unable to successfully manage our expenses, our financial results will be negatively affected. We Could Incur Increased Costs, Reductions In Revenue And Suffer Reputational Damage And Business Disruptions In The Event Of The Theft, Loss Or Misuse Of Information, Including As A Result Of A Cyber-Attack. Our products and services involve the gathering, management, processing, storage and transmission of sensitive and confidential information regarding our customers and their accounts, our employees and other third parties with which we do business. Our ability to provide such products and services, many of which are web-based, depends upon the management and safeguarding of information, software, methodologies and business secrets. To provide these products and services to, as well as communicate with, our customers, we rely on information systems and infrastructure, including digital technologies, computer and email systems, software, networks and other web-based technologies, that we and third-party service providers operate. We also have arrangements in place with third parties through which we share and receive information about their customers who are or may become our customers. Like other financial services firms, technologies, systems, networks and devices of Capital One or our customers, employees, service providers or other third parties with whom we interact continue to be the subject of attempted unauthorized access, mishandling or misuse of information, denial-of-service attacks, computer viruses, website defacement, hacking, malware, ransomware, phishing or other forms of social engineering, and other forms of cyber-attacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and other events. These threats may derive from human error, fraud or malice on the part of our employees, insiders or third parties or may result from accidental technological failure. Any of these parties may also attempt to fraudulently induce employees, customers or other third-party users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or third parties with whom we interact. Further, cyber and information security risks for large financial institutions like us have generally increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other external parties. In addition, to access our products and services, our customers may use computers, smartphones, tablet PCs and other mobile devices that are beyond our security control systems. As a financial institution, we are subject to and examined for compliance with an array of data protection laws, regulations and guidance, as well as to our own internal privacy and information security policies and programs. However, because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and persist for an extended period of time before being detected, we and our third-party service providers and partners may be unable to anticipate or identify certain attack methods in order to implement effective preventative measures or mitigate or remediate the damages caused in a timely manner. We may also be unable to hire and develop talent capable of detecting, mitigating or remediating these risks. Although we believe we have a robust suite of authentication and layered information security controls, including our cyber threat analytics, data encryption and tokenization technologies, anti-malware defenses and vulnerability management program, any one or combination of these controls could fail to detect, mitigate or remediate these risks in a timely manner. We may face an increasing number of attempted cyber-attacks as we expand our mobile- and other internet-based products and services, as well as our usage of mobile and cloud technologies and as we provide more of these services to a greater number of retail clients. A disruption or breach, including as a result of a cyber-attack, or media reports of perceived security vulnerabilities at Capital One or at third-party service providers, could result in significant legal and financial exposure, regulatory intervention, remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business. We and other U.S. financial services providers continue to be targeted with evolving and adaptive cybersecurity threats from sophisticated third parties. Although we have not experienced any material losses relating to cyber incidents, there can be no assurance that unauthorized access or cyber incidents will not occur or that we will not suffer such losses in the future. Unauthorized access or cyber incidents could occur more frequently and on a more significant scale. If future attacks like these are successful or if customers are unable to access their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete financial transactions for our customers or otherwise operate any of our businesses or services. In addition, a breach or attack affecting one of our third-party service providers or partners could harm our business even if we do not control the service that is attacked. In addition, the increasing prevalence and the evolution of cyber-attacks and other efforts to breach or disrupt our systems or those of our partners, retailers or other market participants has led, and will likely continue to lead, to increased costs to us with respect to preventing, mitigating and remediating these risks, as well as any related attempted fraud. We may be required to expend significant additional resources to continue to modify or strengthen our protective security measures, investigate and remediate any vulnerabilities of our information systems and infrastructure or invest in new technology designed to mitigate security risks. For example, various retailers have continued to be victims of cyber-attacks in which customer data, including debit and credit card information, was obtained. In these situations, we incur a variety of costs, including those associated with replacing the compromised cards and remediating fraudulent transaction activity. Further, successful cyber-attacks at other large financial institutions or other market participants, whether or not we are impacted, could lead to a general loss of customer confidence in financial institutions that could negatively affect us, including harming the market perception of the effectiveness of our security measures or the financial system in general which could result in reduced use of our financial products. Though we have insurance against some cyber-risks and attacks, it may not be sufficient to offset the impact of a material loss event. Our Exposure To Potential Data Protection and Privacy Incidents, And Our Required Compliance With Regulations Related To These Areas, May Increase Our Costs, Reduce Our Revenue And Limit Our Ability To Pursue Business Opportunities. If our information systems or infrastructure or those of our customers, partners, service providers or other market participants experience a significant disruption or breach, it could lead, depending on the nature of the disruption or breach, to the unauthorized access to and release, gathering, monitoring, misuse, loss or destruction of personal or confidential data about our customers, employees or other third parties in our possession. Any party that obtains this personal or confidential data through a breach or disruption may use this information for ransom, to be paid by us or a third-party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes. Further, such disruption or breach could also result in unauthorized access to our proprietary information, intellectual property, software, methodologies and business secrets and in unauthorized transactions in Capital One accounts or unauthorized access to personal or confidential information maintained by those entities. For example, there has been a significant proliferation of consumer information available on the Internet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. While Capital One was not directly involved in these third-party breach events, the stolen information can create a vulnerability for our customers if their Capital One log-in credentials are the same as or similar to the credentials that have been compromised on other sites. This vulnerability could include the risk of unauthorized account access, data loss and fraud. The use of automation software, or “bots,” can increase the velocity and efficacy of these types of attacks. A data protection incident, or media reports of perceived security vulnerabilities at Capital One or at third-party service providers, could result in significant legal and financial exposure, regulatory intervention, remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business. We regularly move data across national borders to conduct our operations, and consequently are subject to a variety of continuously evolving and developing laws and regulations in the United States and abroad regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, and security of personal data. Significant uncertainty exists as privacy and data protection laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements. For example, the GDPR, which becomes effective in May 2018, extends the scope of the EU data protection law to all companies processing data of EU residents, regardless of the company’s location. The law requires companies to meet new requirements regarding the handling of personal data, including new rights such as the “portability” of personal data. Our efforts to comply with GDPR and other privacy and data protection laws may entail substantial expenses, may divert resources from other initiatives and projects, and could limit the services we are able to offer. Furthermore, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. The enactment of more restrictive laws, rules, regulations, or future enforcement actions or investigations could impact us through increased costs or restrictions on our business, and noncompliance could result in regulatory penalties and significant legal liability. Legal Risk Our Businesses Are Subject To The Risk Of Increased Litigation, Government Investigations And Regulatory Enforcement. Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the focus of state and federal prosecutors on banks and the financial services industry, the structure of the credit card industry and business practices in the mortgage business. Given the inherent uncertainties involved in litigation, government investigations and regulatory enforcement decisions, and the very large or indeterminate damages sought in some matters asserted against us, there can be significant uncertainty as to the ultimate liability we may incur from these kinds of matters. The finding, or even the assertion, of substantial legal liability against us could have a material adverse effect on our business and financial condition and could cause significant reputational harm to us, which could seriously harm our business. In addition, financial institutions, including us, have faced significant regulatory scrutiny over the past several years, which has increasingly led to public enforcement actions. We and our subsidiaries are subject to comprehensive regulation and periodic examination by the Federal Reserve, the SEC, OCC, FDIC and CFPB. We have been subject to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including governmental inquiries, investigations and enforcement proceedings, including by the Department of Justice and state Attorneys General. We expect that regulators and governmental enforcement bodies will continue taking formal enforcement actions against financial institutions in addition to addressing supervisory concerns through non-public supervisory actions or findings, which could involve restrictions on our activities, among other limitations that could adversely affect our business. In addition, a violation of law or regulation by another financial institution is likely to give rise to an investigation by regulators and other governmental agencies of the same or similar practices by us. For example, various regulatory and governmental agencies initiated an industry-wide supervisory initiative regarding sales practices and sales incentive compensation structures following a public enforcement action at another financial institution. In addition, a single event may give rise to numerous and overlapping investigations and proceedings. These and other initiatives from governmental authorities and officials may subject us to further judgments, settlements, fines or penalties, or cause us to restructure our operations and activities or to cease offering certain products or services, all of which could harm our reputation or lead to higher operational costs. Litigation, government investigations and other regulatory actions could involve restrictions on our activities, generally subject us to significant fines, increased expenses, restrictions on our activities and damage to our reputation and our brand, and could adversely affect our business, financial condition and results of operations. Other Business Risks We Face Intense Competition In All Of Our Markets. We operate in a highly competitive environment, whether in making loans, attracting deposits or in the global payments industry, and we expect competitive conditions to continue to intensify with respect to most of our products. We compete on the basis of the rates we pay on deposits and the rates and other terms we charge on the loans we originate or purchase, as well as the quality and range of our customer service, products, innovation and experience. This increasingly competitive environment is primarily a result of changes in technology, product delivery systems and regulation, as well as the emergence of new or significantly larger financial service providers, all of which may affect our customers’ expectations and demands. Some of our competitors, including new and emerging competitors in the digital and mobile payments space and other financial technology providers, are not subject to the same regulatory requirements or legislative scrutiny to which we are subject, which also could place us at a competitive disadvantage, in particular in the development of new technology platforms or the ability to rapidly innovate. We compete with many forms of payments offered by both bank and non-bank providers, including a variety of new and evolving alternative payment mechanisms, systems and products, such as aggregators and web-based and wireless payment platforms or technologies, digital currencies, prepaid systems and payment services targeting users of social networks and online gaming (including, for example, those offering payment through mobile phone accounts). If we are unable to continue to keep pace with innovation, our business and results of operations could be adversely affected. Some of our competitors are substantially larger than we are, which may give those competitors advantages, including a more diversified product and customer base, the ability to reach out to more customers and potential customers, operational efficiencies, broad-based local distribution capabilities, lower-cost funding and larger existing branch networks. Many of our competitors are also focusing on cross-selling their products and developing new products or technologies, which could affect our ability to maintain or grow existing customer relationships or require us to offer lower interest rates or fees on our lending products or higher interest rates on deposits. Price competition for loans might result in origination of fewer loans or earning less on our loans. As of December 31, 2017, we operate the largest online direct bank in the U.S. by deposits. While direct banking represents a significant opportunity to attract new customers that value greater and more flexible access to banking services at reduced costs, we face strong competition in the direct banking market. Aggressive pricing throughout the industry may adversely affect the retention of existing balances and the cost-efficient acquisition of new deposit funds and may affect our growth and profitability. In addition, the effects of a competitive environment may be exacerbated by the flexibility of direct banking and the increasing financial and technological sophistication of our customer base. Customers could also close their online accounts or reduce balances or deposits in favor of products and services offered by competitors for other reasons. These shifts, which could be rapid, could result from general dissatisfaction with our products or services, including concerns over pricing, online security or our reputation. In our credit card business, competition for rewards customers may result in higher rewards expenses, or we may fail to attract new customers or retain existing rewards customers due to increasing competition for these consumers. We have expanded our credit card partnership business over the past several years with the additions of a number of credit card partnerships. The market for key business partners, especially in the credit card business, is very competitive, and we may not be able to grow or maintain these partner relationships. We face the risk that we could lose partner relationships, even after we have invested significant resources, time and expense into acquiring and developing the relationships. The loss of any of our key business partners could have a negative impact on our results of operations, including lower returns, excess operating expense and excess funding capacity. Some of our competitors have developed, or may develop, substantially greater financial and other resources than we have, may offer richer value propositions or a wider range of programs and services than we offer or may use more effective advertising, marketing or cross-selling strategies to acquire and retain more customers, capture a greater share of spending and borrowings, attain and develop more attractive cobrand card programs and maintain greater merchant acceptance than we have. We may not be able to compete effectively against these threats or respond or adapt to changes in consumer spending habits as effectively as our competitors. In such a competitive environment, we may lose entire accounts or may lose account balances to competing firms, or we may find it more costly to maintain our existing customer base. Customer attrition from any or all of our lending products, together with any lowering of interest rates or fees that we might implement to retain customers, could reduce our revenues and therefore our earnings. Similarly, unexpected customer attrition from our deposit products, in addition to an increase in rates or services that we may offer to retain deposits, may increase our expenses and therefore reduce our earnings. Our Business, Financial Condition And Results Of Operations May Be Adversely Affected By Merchants’ Increasing Focus On The Fees Charged By Credit Card Networks And By Regulation And Legislation Impacting Such Fees. Credit card interchange fees are generally one of the largest components of the costs that merchants pay in connection with the acceptance of credit cards and are a meaningful source of revenue for our credit card businesses. Interchange fees are the subject of significant and intense global legal, regulatory and legislative focus, and the resulting decisions, regulations and legislation may have a material adverse impact on our overall business, financial condition and results of operations. Regulators and legislative bodies in a number of countries are seeking to reduce credit card interchange fees through legislation, competition-related regulatory proceedings, central bank regulation and or litigation. Interchange reimbursement rates in the United States are set by credit card networks such as MasterCard and Visa. In some jurisdictions, such as Canada and certain countries in the European Union, interchange fees and related practices are subject to regulatory activity that have limited the ability of certain networks to establish default rates, including in some cases imposing caps on permissible interchange fees. We have already experienced these impacts in our international credit card portfolio. Legislators and regulators around the world are aware of each other’s approaches to the regulation of the payments industry. Consequently, a development in one country, state or region may influence regulatory approaches in another, such as our primary market, the United States. In addition to this regulatory activity, merchants are also seeking avenues to reduce interchange fees. During the past few years, merchants and their trade groups have filed numerous lawsuits against Visa, MasterCard, American Express and their card-issuing banks, claiming that their practices toward merchants, including interchange and similar fees, violate federal antitrust laws. In 2005, a number of entities filed antitrust lawsuits against MasterCard and Visa and several member banks, including our subsidiaries and us, alleging among other things, that the defendants conspired to fix the level of interchange fees. In December 2013, the U.S. District Court for the Eastern District of New York granted final approval of the proposed class settlement. The settlement provided, among other things, that merchants would be entitled to join together to negotiate lower interchange fees. The settlement was appealed to the Second Circuit Court of Appeals, which rejected the settlement in June 2016; this litigation remains ongoing. See “Note 19-Commitments, Contingencies, Guarantees and Others” for further details. Some major retailers may have sufficient bargaining power to independently negotiate lower interchange fees with MasterCard and Visa, which could, in turn, result in lower interchange fees for us when our cardholders undertake purchase transactions with these retailers. In 2016, some of the largest merchants individually negotiated lower interchange rates with MasterCard and/or Visa. These and other merchants also continue to lobby aggressively for caps and restrictions on interchange fees and there can be no assurance that their efforts will not be successful or that they will not in the future bring legal proceedings against us or other credit card and debit card issuers and networks. Beyond pursuing litigation, legislation and regulation, merchants may also promote forms of payment with lower fees, such as ACH-based payments, or seek to impose surcharges at the point of sale for use of credit or debit cards. New payment systems, particularly mobile-based payment technologies, could also gain widespread adoption and lead to issuer transaction fees or the displacement of credit card accounts as a payment method. The heightened focus by merchants and regulatory and legislative bodies on the fees charged by credit and debit card networks, and the ability of certain merchants to successfully negotiate discounts to interchange fees with MasterCard and Visa or develop alternative payment systems could result in a reduction of interchange fees. Any resulting loss in income to us could have a material adverse effect on our business, financial condition and results of operations. If We Are Not Able To Invest Successfully In And Introduce Digital And Other Technological Developments Across All Our Businesses, Our Financial Performance May Suffer. Our industry is subject to rapid and significant technological changes and our ability to meet our customers’ needs and expectations is key to our ability to grow revenue and earnings. We expect digital technologies to have a significant impact on banking over time. Consumers increasingly expect robust digital experiences from their financial services providers. The ability for customers to access their accounts and conduct financial transactions using digital technology, including mobile applications, is an increasingly important aspect of the financial services industry and it impacts our ability to deliver products and services to our customers. To that end, financial institutions are rapidly introducing new digital and other technology-driven products and services, which aim to offer a better customer experience and to reduce costs. We continue to invest in digital technology designed to attract new customers, facilitate the ability of existing customers to conduct financial transactions and enhance the customer experience related to our products and services. Our continued success depends, in part, upon our ability to address the needs of our customers by using digital technology to provide products and services that efficiently meet their expectations in a cost-effective manner. The development and launch of new digital products and services depends in large part on our capacity to invest in and build the technology platforms that can enable them. We continue to actively invest in such technology platforms, however, we may fail to implement the correct technology, or may fail to do so in a timely manner as discussed in more detail above under the headings “We Face Intense Competition In All Of Our Markets” and “We Face Risks Related To Our Operational, Technological And Organizational Infrastructure.” Some of our competitors are substantially larger than we are, which may allow those competitors to invest more money into their technology infrastructure and digital innovation than we do. In addition, we face intense competition from smaller companies which experience lower cost structures and different regulatory requirements and scrutiny than we do, and which may allow them to innovate more rapidly than we can. See “We Face Intense Competition In All Of Our Markets.” Further, our success depends on our ability to attract and retain strong digital and technology leaders, engineers and other talent, and competition for such talent is intense. If we are unable to attract and retain digital and technology talent, our ability to offer digital products and services and build the necessary technology infrastructure could be negatively affected, which could negatively impact our business and financial results. A failure to maintain or enhance our competitive position with respect to digital products and services, whether because we fail to anticipate customer expectations or because our technological developments fail to perform as desired or are not implemented in a timely or successful manner, could negatively impact our business and financial results. We May Fail To Realize All Of The Anticipated Benefits Of Our Mergers, Acquisitions And Strategic Partnerships. We have engaged in merger and acquisition activity and entered into strategic partnerships over the past several years and may continue to engage in such activity in the future. We continue to evaluate and anticipate engaging in, among other merger and acquisition activity, additional strategic partnerships and selected acquisitions of financial institutions and other financial assets, including credit card and other loan portfolios. There can be no assurance that we will be able to identify and secure future acquisition targets on terms and conditions that are acceptable to us, or successfully complete proposed mergers, acquisitions and strategic partnerships, which could impair our growth. Any merger, acquisition or strategic partnership we undertake entails certain risks, which may materially and adversely affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our existing operations, or are not able to achieve the anticipated benefits of any merger, acquisition or strategic partnership, including cost savings and other synergies, our business could be negatively affected. In addition, it is possible that the ongoing integration processes could result in the loss of key employees, errors or delays in systems implementation, the disruption of our ongoing businesses or inconsistencies in standards, controls, procedures and policies that adversely affect our ability to maintain relationships with partners, clients, customers, depositors and employees or to achieve the anticipated benefits of any merger, acquisition or strategic partnership. Integration efforts also may divert management attention and resources. These integration matters may have an adverse effect on us during any transition period. In addition, we may face the following risks in connection with any merger, acquisition or strategic partnership: • New Businesses and Geographic or Other Markets: Our merger, acquisition or strategic partnership activity may involve our entry into new businesses and new geographic areas or other markets which present risks resulting from our relative inexperience in these new businesses or markets. These new businesses or markets may change the overall character of our consolidated portfolio of businesses and could react differently to economic and other external factors. We face the risk that we will not be successful in these new businesses or in these new markets. • Identification and Assessment of Merger and Acquisition Targets and Deployment of Acquired Assets: We cannot assure you that we will identify or acquire suitable financial assets or institutions to supplement our organic growth through acquisitions or strategic partnerships. In addition, we may incorrectly assess the asset quality and value of the particular assets or institutions we acquire. Further, our ability to achieve the anticipated benefits of any merger, acquisition or strategic partnership will depend on our ability to assess the asset quality and value of the particular assets or institutions we partner with, merge with or acquire. We may be unable to profitably deploy any assets we acquire. • Accuracy of Assumptions: In connection with any merger, acquisition or strategic partnership, we may make certain assumptions relating to the proposed merger, acquisition or strategic partnership that may be, or may prove to be, inaccurate, including as a result of the failure to realize the expected benefits of any merger, acquisition or strategic partnership. The inaccuracy of any assumptions we may make could result in unanticipated consequences that could have a material adverse effect on our results of operations or financial condition. • Target-specific Risk: Assets and companies that we acquire, or companies that we enter into strategic partnerships with, will have their own risks that are specific to a particular asset or company. These risks include, but are not limited to, particular or specific regulatory, accounting, operational, reputational and industry risks, any of which could have a material adverse effect on our results of operations or financial condition. Indemnification rights, if any, may be insufficient to compensate us for any losses or damages resulting from such risks. In addition to regulatory approvals discussed above, certain of our merger, acquisition or partnership activity may require third-party consents in order for us to fully realize the anticipated benefits of any such transaction. • Conditions to Regulatory Approval: Certain acquisitions may not be consummated without obtaining approvals from one or more of our regulators. We cannot be certain when or if, or on what terms and conditions, any required regulatory approvals will be granted. Consequently, we might be required to sell portions of acquired assets as a condition to receiving regulatory approval or we may not obtain regulatory approval for a proposed acquisition on acceptable terms or at all, in which case we would not be able to complete the acquisition despite the time and expenses invested in pursuing it. Reputational Risk And Social Factors May Impact Our Results And Damage Our Brand. Our ability to originate and maintain accounts is highly dependent upon the perceptions of consumer and commercial borrowers and deposit holders and other external perceptions of our business and compliance practices or our financial health. In addition, our brand has historically been, and we expect it to continue to be, very important to us. Maintaining and enhancing our brand will depend largely on our ability to continue to provide high-quality products and services. Adverse perceptions regarding our reputation in the consumer, commercial and funding markets could lead to difficulties in generating and maintaining accounts as well as in financing them. In particular, negative public perceptions regarding our reputation could lead to decreases in the levels of deposits that consumer and commercial customers and potential customers choose to maintain with us or significantly increase the costs of attracting and retaining customers. In addition, negative perceptions regarding certain industries or clients could also prompt us to cease business activities associated with those industries or clients. Negative public opinion or damage to our brand could also result from actual or alleged conduct in any number of activities or circumstances, including lending practices, regulatory compliance, security breaches (including the use and protection of customer information), corporate governance, and sales and marketing, and from actions taken by regulators or other persons in response to such conduct. Such conduct could fall short of our customers’ and the public’s heightened expectations of companies of our size with rigorous data, privacy and compliance practices, and could further harm our reputation. In addition, third parties with whom we have important relationships may take actions over which we have limited control that could negatively impact perceptions about us or the financial services industry. The proliferation of social media may increase the likelihood that negative public opinion from any of the events discussed above will impact our reputation and business. In addition, a variety of social factors may cause changes in borrowing activity, including credit card use, payment patterns and the rate of defaults by accountholders and borrowers domestically and internationally. These social factors include changes in consumer confidence levels, the public’s perception regarding the banking industry and consumer debt, including credit card use, and changing attitudes about the stigma of bankruptcy. If consumers develop or maintain negative attitudes about incurring debt, or if consumption trends decline or if we fail to maintain and enhance our brand, or we incur significant expenses in this effort, our business and financial results could be materially and negatively affected. If We Are Not Able To Protect Our Intellectual Property, Our Revenue And Profitability Could Be Negatively Affected. We rely on a variety of measures to protect and enhance our intellectual property, including copyrights, trademarks, trade secrets, patents and certain restrictions on disclosure, solicitation and competition. We also undertake other measures to control access to and distribution of our other proprietary information. These measures may not prevent misappropriation of our proprietary information or infringement of our intellectual property rights and a resulting loss of competitive advantage. In addition, our competitors or other third parties may file patent applications for innovations that are used in our industry or allege that our systems, processes or technologies infringe on their intellectual property rights. If our competitors or other third parties are successful in obtaining such patents or prevail in intellectual property-related litigation against us, we could lose significant revenues, incur significant license, royalty or technology development expenses, or pay significant damages. There Are Risks Resulting From The Extensive Use Of Models and Data In Our Business. We rely on quantitative models, and our ability to manage data and our ability to aggregate data in an accurate and timely manner, to assess and manage our various risk exposures and to estimate certain financial values. Models may be used in such processes as determining the pricing of various products, grading loans and extending credit, measuring interest rate and other market risks, predicting losses, assessing capital adequacy and calculating economic and regulatory capital levels, as well as to estimate the value of financial instruments and balance sheet items. Our risk reporting and management, including business decisions based on information incorporating models, depend on the effectiveness of our models and our policies, programs, processes and practices governing how data is acquired, validated, stored, protected, processed and analyzed. Any issues with the quality or effectiveness of our data aggregation and validation procedures, as well as the quality and integrity of data inputs, could result in ineffective risk management practices or inaccurate risk reporting. For example, models based on historical data sets might not be accurate predictors of future outcomes and their ability to appropriately predict future outcomes may degrade over time. While we continuously update our policies, programs, processes and practices, many of our data management and aggregation processes are manual and subject to human error or system failure. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risk, to produce accurate financial, regulatory and operational reporting as well as to manage changing business needs. If our risk management framework proves ineffective, we could suffer unexpected losses which could materially adversely affect our results of operation or financial condition. Also, information we provide to the public or to our regulators based on poorly designed or implemented models could be inaccurate or misleading. Some of the decisions that our regulators make, including those related to capital distribution to our shareholders, could be affected adversely due to the perception that the quality of the models used to generate the relevant information is insufficient. Our Risk Management Strategies May Not Be Fully Effective In Mitigating Our Risk Exposures In All Market Environments Or Against All Types Of Risk. Management of risk, including market, credit, liquidity, compliance and strategic risks, requires, among other things, policies and procedures to properly record and verify a large number of transactions and events. See “MD&A-Risk Management” for further details. We have devoted significant resources to developing our risk management policies and procedures and expect to continue to do so in the future. Nonetheless, our risk management strategies may not be fully effective in identifying and mitigating our risk exposure in all market environments or against all types of risk, including risks that are unidentified or unanticipated, even if our models for assessing risk are properly designed and implemented. Some of our methods of managing risk are based upon our use of observed historical market behavior and management’s judgment. These methods may not accurately predict future exposures, which could be significantly greater than the historical measures indicate. For example, market conditions during the financial crisis involved unprecedented dislocations and highlight the limitations inherent in using historical information to manage risk. In addition, credit risk is inherent in the financial services business and results from, among other things, extending credit to customers. Our ability to assess the creditworthiness of our customers may be impaired if the models and approaches we use to select, manage and underwrite our consumer and commercial customers become less predictive of future charge-offs (due, for example, to rapid changes in the economy, including the unemployment rate). While we employ a broad and diversified set of risk monitoring and risk mitigation techniques, those techniques and the judgments that accompany their application cannot anticipate every economic and financial outcome or the timing of such outcomes. For example, our ability to implement our risk management strategies may be hindered by adverse changes in the volatility or liquidity conditions in certain markets and as a result, may limit our ability to distribute such risks (for instance, when we seek to syndicate exposure in bridge financing transactions we have underwritten). We may, therefore, incur losses in the course of our risk management or investing activities. Changes In Consumer Behavior And Their Adoption of Digital Technology May Change Retail Distribution Strategies And May Adversely Impact Our Investments In Our Bank Premises And Equipment And Other Retail Distribution Assets, Lead To Increased Expenditures And Expose Us To Additional Risk. We have significant investments in bank premises and equipment for our branch network and other branch banking assets including our banking centers, parcels of land held for the development of future banking centers and our retail work force. Advances in technology such as digital and mobile banking, in-branch self-service technologies, proximity or remote payment technologies, as well as progressively changing customer preferences for these other methods of banking, could decrease the value of our branch network or other retail distribution assets. As a result, we may need to further change our retail distribution strategy and close, sell and/or renovate additional branches or parcels of land held for development and restructure or reduce our remaining branches and work force. These actions could lead to losses on these assets or could adversely impact the carrying value of other long-lived assets, reduce our revenues, increase our expenditures, dilute our brand and/or reduce customer demand for our products and services. Further, to the extent that we change our retail distribution strategy and as a result expand into new business areas, we may face more competitors with more experience in the new business areas and more established relationships with relevant customers, regulators and industry participants, which could adversely affect our ability to compete. Our competitors may also be subject to less burdensome regulations. See “We Face Intense Competition In All Our Markets.” Fluctuations In Market Interest Rates Or Volatility In The Capital Markets Could Adversely Affect Our Income And Expense, The Value Of Assets And Obligations, Our Regulatory Capital, Cost Of Capital Or Our Liquidity. Like other financial institutions, our business may be sensitive to market interest rate movement and the performance of the capital markets. Disruptions, uncertainty or volatility across the capital markets could negatively impact market liquidity and limit our access to funding required to operate and grow our business. In addition, changes in interest rates or in valuations in the debt or equity markets could directly impact us. For example, we borrow money from other institutions and depositors, which we use to make loans to customers and invest in debt securities and other earning assets. We earn interest on these loans and assets and pay interest on the money we borrow from institutions and depositors. The interest rates that we pay on the securities we have issued are also influenced by, among other things, applicable credit ratings from recognized rating agencies. A downgrade to any of these credit ratings could affect our ability to access the capital markets, increase our borrowing costs and have a negative impact on our results of operations. Increased charge-offs, rising London Interbank Offering Rate (“LIBOR”) and other events may cause our securitization transactions to amortize earlier than scheduled, which could accelerate our need for additional funding from other sources. Fluctuations in interest rates, including changes in the relationship between short-term rates and long-term rates and in the relationship between our funding basis rate and our lending basis rate, may have negative impacts on our net interest income and therefore our earnings. In addition, interest rate fluctuations and competitor responses to those changes may affect the rate of customer prepayments for mortgage, auto and other term loans and may affect the balances customers carry on their credit cards. Although recent increases in interest rates may reduce prepayment risk, debt service requirements for some of our borrowers will increase, which may adversely affect those borrowers’ ability to pay as contractually obligated. This could result in additional delinquencies or charge-offs and negatively impact our results of operations. These changes can reduce the overall yield on our earning asset portfolio. Changes in interest rates and competitor responses to these changes may also impact customer decisions to maintain balances in the deposit accounts they have with us. An inability to attract or maintain deposits could materially affect our ability to fund our business and our liquidity position. Many other financial institutions have increased their reliance on deposit funding and, as such, we expect continued competition in the deposit markets. We cannot predict how this competition will affect our costs. If we are required to offer higher interest rates to attract or maintain deposits, our funding costs will be adversely impacted. Changes in valuations in the debt and equity markets could have a negative impact on the assets we hold in our investment portfolio. Such market changes could also have a negative impact on the valuation of assets for which we provide servicing. Finally, the Basel III Capital Rule requires that most amounts reported in Accumulated Other Comprehensive Income (“AOCI”), including unrealized gains and losses on securities designated as available for sale, be included in our regulatory capital calculations. Changes in interest rates or market valuations that result in unrealized losses on components of AOCI could therefore impact our regulatory capital ratios negatively. As a result of recent regulatory and other legal proceedings, actions by regulators or law enforcement agencies may result in changes to the manner in which LIBOR is determined or the establishment of alternative reference rates for floating rate debt. Uncertainty as to the nature of potential changes, alternative reference rates or other reforms may adversely affect the trading market for LIBOR-based securities. In addition, any changes in the method pursuant to which LIBOR is determined may result in a sudden or prolonged increase or decrease in LIBOR. If that were to occur, the level of interest payments and the value of LIBOR-indexed debt may be affected. Uncertainty as to the extent and manner of future changes may adversely affect the current trading market for LIBOR based securities. We assess our interest rate risk by estimating the effect on our earnings under various scenarios that differ based on assumptions about the direction and the magnitude of interest rate changes. We take risk mitigation actions based on those assessments. We face the risk that changes in interest rates could materially reduce our net interest income and our earnings, especially if actual conditions turn out to be materially different than those we assumed. See “MD&A-Market Risk Profile” for additional information. Our Business Could Be Negatively Affected If We Are Unable To Attract, Retain And Motivate Skilled Senior Leaders. Our success depends, in large part, on our ability to retain key senior leaders, and competition for such senior leaders is intense. The executive compensation provisions of the Dodd-Frank Act and the regulations issued thereunder, and any further legislation, regulation or regulatory guidance restricting executive compensation, may limit the types of compensation arrangements that we may enter into with our most senior leaders and could have a negative impact on our ability to attract, retain and motivate such leaders in support of our long-term strategy. These laws and regulations may not apply in the same manner to all financial institutions, and we therefore may face more restrictions than other institutions and companies with which we compete for talent. These laws and regulations may also hinder our ability to compete for talent with other industries. If we are unable to retain talented senior leadership, our business could be negatively affected. We Face Risks From Unpredictable Catastrophic Events. Despite the business contingency plans we have in place, there can be no assurance that such plans will fully mitigate all potential business continuity risks to us. The impact from natural disasters and other catastrophic events may have a negative effect on our business and infrastructure, including our information technology systems and those of third-parties that we rely on. Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our business and the communities where we are located, which are concentrated in the Northern Virginia and New York metropolitan areas, as well as Richmond, Virginia and Plano, Texas. This may include a disruption involving physical site access, cyber incidents, terrorist activities, disease pandemics, catastrophic events, natural disasters, extreme weather events, electrical outage, environmental hazard, computer servers, communications or other services we use, our employees or third parties with whom we conduct business. In addition, if a natural disaster or other catastrophic event occurs in certain regions where our business and customers are concentrated, such as the mid-Atlantic, New York or Texas metropolitan areas, we could be disproportionately impacted as compared to our competitors. The impact of such events and other catastrophes on the overall economy may also adversely affect our financial condition and results of operations. We Face Risks From The Use Of Or Changes To Assumptions Or Estimates In Our Financial Statements. Pursuant to generally accepted accounting principles in the U.S. (“U.S. GAAP”), we are required to use certain assumptions and estimates in preparing our financial statements, including determining our allowance for loan and lease losses, the fair value of certain assets and liabilities, and asset impairment, among other items. In December 2017, Congress passed and the President signed into law the Tax Act, that made significant changes to the U.S. federal tax laws. Many aspects of the new legislation are unclear and may not be clarified for some time. As a result, we have relied on reasonable estimates and provisional accounting entries in our accounting for income taxes. The ultimate impact of the Tax Act may differ from our estimates due to changes in the interpretations and assumptions, as well as additional regulatory guidance that may be issued. In addition, the FASB, the SEC and other regulatory bodies may change the financial accounting and reporting standards, including those related to assumptions and estimates we use to prepare our financial statements, in ways that we cannot predict and that could impact our financial statements. For example, in June 2016, the FASB issued revised guidance for impairments on financial instruments. The guidance, which becomes effective on January 1, 2020 with early adoption permitted no earlier than January 1, 2019, requires use of a CECL model that is based on expected rather than incurred losses. We are currently assessing the potential impact of this guidance, which may be material to our accounting for credit losses on financial instruments. If actual results differ from the assumptions or estimates underlying our financial statements or if financial accounting and reporting standards are changed, we may experience unexpected material losses. For a discussion of our use of estimates in the preparation of our consolidated financial statements, see “MD&A-Critical Accounting Policies and Estimates” and “Note 1-Summary of Significant Accounting Policies.” Limitations On Our Ability To Receive Dividends From Our Subsidiaries Could Affect Our Liquidity And Ability To Pay Dividends And Repurchase Common Stock. We are a separate and distinct legal entity from our subsidiaries, including the Banks. Dividends to us from our direct and indirect subsidiaries, including the Banks, have represented a major source of funds for us to pay dividends on our common and preferred stock, repurchase common stock, make payments on corporate debt securities and meet other obligations. There are various federal law limitations on the extent to which the Banks can finance or otherwise supply funds to us through dividends and loans. These limitations include minimum regulatory capital requirements, federal banking law requirements concerning the payment of dividends out of net profits or surplus, Sections 23A and 23B of the Federal Reserve Act and Regulation W governing transactions between an insured depository institution and its affiliates, as well as general federal regulatory oversight to prevent unsafe or unsound practices. If our subsidiaries’ earnings are not sufficient to make dividend payments to us while maintaining adequate capital levels, our liquidity may be affected and we may not be able to make dividend payments to our common or preferred stockholders, repurchase our common stock, make payments on outstanding corporate debt securities or meet other obligations, each and any of which could have a material adverse impact on our results of operations, financial position or perception of financial health. The Soundness Of Other Financial Institutions And Other Third Parties Could Adversely Affect Us. Our ability to engage in routine funding and other transactions could be adversely affected by the stability and actions of other financial services institutions. Financial services institutions are interrelated as a result of trading, clearing, servicing, counterparty and other relationships. We have exposure to an increasing number of financial institutions and counterparties. These counterparties include institutions that may be exposed to various risks over which we have little or no control, including European or U.S. sovereign debt that is currently or may become in the future subject to significant price pressure, rating agency downgrade or default risk. In addition, we routinely execute transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients, resulting in a significant credit concentration with respect to the financial services industry overall. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by us or by other institutions. Likewise, adverse developments affecting the overall strength and soundness of our competitors, the financial services industry as a whole and the general economic climate or sovereign debt could have a negative impact on perceptions about the strength and soundness of our business even if we are not subject to the same adverse developments. In addition, adverse developments with respect to third parties with whom we have important relationships also could negatively impact perceptions about us. These perceptions about us could cause our business to be negatively affected and exacerbate the other risks that we face. Item 1B.