Ally is a Delaware corporation and is registered as a BHC under the BHC Act and an FHC under the GLB Act. Our primary business lines are Dealer Financial Services, which is composed of our Automotive Finance and Insurance operations, Mortgage Finance, and Corporate Finance. Corporate and Other primarily consists of centralized corporate treasury activities, the management of our legacy mortgage portfolio, the activity related to Ally Invest, Ally Lending, and Ally Lending,Credit Card, and reclassifications and eliminations between the reportable operating segments. Beginning in December 2021 with the acquisition of Fair Square, which we rebranded as Ally Credit Card, financial information for our credit-card business is included within Corporate and Other. Ally Bank’s assets and operating results are included within our Automotive Finance, Mortgage Finance, and Corporate Finance segments, as well as Corporate and Other, based on its underlying business activities. As of December 31, 2022,2023, Ally Bank had total assets of $181.9$186.1 billion and total nonaffiliate deposits of $152.3$154.7 billion.

Our long-term strategic objectives are centered around (1) differentiating our company as a relentless ally for the financial well-being forof consumer and commercial customers, (2) leveraging our “Do it Right” culture to drive enhanced value for our customers, communities, employees, and stockholders, (3) growing and diversifying our leading auto,automotive, insurance, and digital-bank platforms through increased scale and expanded product solutions to meet customer needs, (4) driving ongoing customer growth and relationship deepening relationships, (5) operating under efficient, disciplined risk management and capital allocation approaches, (6) out-executing our competition and creating differentiated advantages through continuous investment and evolution among our leading experiences, products and brand, and (7) delivering long-term value through sustainable financial results and stockholder returns. Within our Automotive Finance and Insurance operations, we are focused on strengthening our network of dealer relationships and pursuing digital distribution channels for our products and services, including through our operation of a direct-lending platform and our work with dealers innovating in digital transactions—all while maintaining an appropriate level of risk appetite. Within our other banking operations, including Mortgage Finance and Corporate Finance, we seek to expand our consumer and commercial banking products and services while providing a high level of customer service. We continue to focus on delivering significant growth and retention in deposit customers and balances while optimizing our cost of funds. Ally Lending primarily serves medical and home improvement service providers by enabling promotional and fixed rate installment-loan products through a digital application process at point-of-sale. At Ally Invest, we seek to augment our securities-brokerage and investment-advisory services to more comprehensively assist our customers in managing their savings and growing their wealth. Additionally, we acquired Fair Square in December 2021, which provides us with aAlly Credit Card is our scalable, digital-first credit card platform and advances our evolution as a leading digital consumer bank. Ally Credit Cardthat features leading-edge technology, and a proprietary, analytics-based underwriting model. We believe the addition of credit card to our suite of productsAlly Credit Card enhances our ability to grow and deepen both new and existing customer relationships.

Unless the context otherwise requires, the following definitions apply. The term “loans” means the following consumer and commercial products associated with our direct and indirect financing activities: loans, retail installment sales contracts, lines of credit, and other financing products excluding operating leases. The term “operating leases” means consumer- and commercial-vehicle lease agreements where Ally is the lessor and the lessee is generally not obligated to acquire ownership of the vehicle at lease-end or compensate Ally for the vehicle’s residual value. The terms “lend,” “finance,” and “originate” mean our direct extension or origination of loans, our purchase or acquisition of loans, or our purchase of operating leases, as applicable. The term “consumer” means all consumer products associated with our loan and operating-lease activities and all commercial retail installment sales contracts. The term “commercial” means all commercial products associated with our loan activities, other than commercial retail installment sales contracts. The term “partnerships” means business arrangements rather than partnerships as defined by law.

For further details and information related to our business segments and the products and services they provide, refer to the MD&A in Part II, Item 7 of this report, and Note 26 to the Consolidated Financial Statements.

Many of our competitors have substantial positions nationally or in the markets in which they operate. Some also have significantly greater scale, financial and operational resources, investment capacity, and brand recognition. Our competitors may be subject to different and, in some cases, less stringent legislative, regulatory, and supervisory regimes than Ally. A range of competitors differ from us in their strategic and tactical priorities and, for example, may be willing to suffer meaningful financial losses in the pursuit of disruptive innovation and customer growth or to accept more aggressive business, compliance, and other risks in the pursuit of higher returns and market valuations. Competition affects every aspect of our business, including product and service offerings and features, rates, pricing and fees, credit limits, and customer service. Successfully competing in our markets also depends on our ability to innovate, to invest in technology and infrastructure, to execute transactions reliably and efficiently, to maintain and enhance our reputation, and to attract, retain, and motivate talented employees, all while effectively managing risks and expenses. We expect that competition will only intensify in the future.

We are also subject to direct supervision and periodic examinations by various governmental agencies and industry SROs that are charged with overseeing the kinds of business activities in which we engage, including the FRB, the UDFI, the FDIC, the CFPB, the SEC, FINRA, and a number of state regulatory and licensing authorities such as the NYDFS. These agencies and organizations generally have broad authority and discretion in restricting and otherwise affecting our businesses and operations and may take formal or informal supervisory, enforcement, and other actions against us when, in the applicable agency’s or organization’s judgment, our businesses or operations fail to comply with applicable law, comport with safe and sound practices, or meet its supervisory expectations. We strive to maintain constructive relationships with supervisory authorities.

This system of regulation, supervision, and examination is intended primarily for the protection and benefit of our depositors and other customers, the FDIC’s DIF, the banking and financial systems as a whole, and the broader economy—and not for the protection or benefit of our stockholders (except in the case of securities laws) or non-deposit creditors. The scope, intensity, and focus of this system can vary from time to time for reasons that range from the state of the economic and political environments to the performance of our businesses and operations, but for the foreseeable future, we expect to remain subject to extensive regulation, supervision, and examinations.

This section summarizes some relevant provisions of the principal statutes, regulations, and other laws that apply to us. The descriptions, however, are not complete and are qualified in their entirety by the full text and judicial or administrative interpretations of those laws and other laws that affect us.

The risk-based capital ratios are based on a banking organization’s RWAs, which are generally determined under the standardized approach applicable to Ally and Ally Bank by (1) assigning on-balance-sheet exposures to broad risk-weight categories according to the counterparty or, if relevant, the guarantor or collateral (with higher risk weights assigned to categories of exposures perceived as representing greater risk), and (2) multiplying off-balance-sheet exposures by specified credit conversion factors to calculate credit equivalent amounts and assigning those credit equivalent amounts to the relevant risk-weight categories. The leverage ratio, in contrast, is based on an institution’s average unweighted on-balance-sheet exposures.

Under U.S. Basel III, Ally and Ally Bank must maintain a minimum Common Equity Tier 1 risk-based capital ratio of 4.5%, a minimum Tier 1 risk-based capital ratio of 6%, and a minimum total risk-based capital ratio of 8%. On top of the minimum risk-based capital ratios, Ally and Ally Bank are subject to a capital conservation buffer requirement, which must be satisfied entirely with capital that qualifies as Common Equity Tier 1 capital. Failure to maintain more than the full amount of the capital conservation buffer requirement would result in automatic restrictions on the ability of Ally and Ally Bank to make capital distributions, including dividend payments and stock repurchases and redemptions, and to pay discretionary bonuses to executive officers. U.S. Basel III also subjects Ally and Ally Bank to a minimum Tier 1 leverage ratio of 4%. While the capital conservation buffer requirement for Ally Bank is fixed at 2.5% of RWAs, the capital conservation buffer requirement for a Category IV firm, like Ally, is equal to its stress capital buffer requirement. The stress capital buffer requirement for Ally, in turn, is the greater of 2.5% and the result of the following calculation: (1) the difference between Ally’s starting and minimum projected Common Equity Tier 1 capital ratios under the severely adverse scenario in the supervisory stress test, plus (2) the sum of the dollar amount of Ally’s planned common stock dividends for each of the fourth through seventh quarters of its nine-quarter capital planning horizon, as a percentage of RWAs. As of December 31, 2022,2023, the stress capital buffer requirement for Ally iswas 2.5%.

Ally and Ally Bank are currently subject to the U.S. Basel III standardized approach for counterparty credit risk but not to the U.S. Basel III advanced approaches for credit risk or operational risk. Ally is also not currently subject to the U.S. market-risk capital rule, which applies only to banking organizations with significant trading assets and liabilities. Since Ally and Ally Bank are currently not subject to the advanced approaches risk-based capital rules, we elected to apply a one-time option to exclude most components of accumulated other comprehensive income and loss from regulatory capital. As of December 31, 2023, and December 31, 2022, Ally had $3.8 billion and

The risk-based capital ratios and the Tier 1 leverage ratio play a central role in PCA, which is an enforcement framework used by the U.S. banking agencies to constrain the activities of depository institutions based on their levels of regulatory capital. Five categories have been established using thresholds for the Common Equity Tier 1 risk-based capital ratio, the Tier 1 risk-based capital ratio, the total risk-based capital ratio, and the Tier 1 leverage ratio: well capitalized, adequately capitalized, undercapitalized, significantly undercapitalized, and critically undercapitalized. FDICIA generally prohibits a depository institution from making any capital distribution, including any payment of a cash dividend or a management fee to its BHC, if the depository institution would become undercapitalized after the distribution. An undercapitalized institution is also subject to growth limitations and must submit and fulfill a capital restoration plan. Although BHCs are not subject to the PCA framework, the FRB is empowered to compel a BHC to take measures—such as the execution of financial or performance

At December 31, 2022,2023, Ally and Ally Bank were in compliance with their regulatory capital requirements. For an additional discussion of capital adequacy requirements, refer to Note 20 to the Consolidated Financial Statements.

On January 1, 2020, we adopted CECL. Refer to Note 1 to the Consolidated Financial Statements for additional information about our allowance for loan losses accounting policy. Under a rule finalized by the FRB and other U.S. banking agencies in 2020, we delayed recognizing the estimated impact of CECL on regulatory capital until after a two-year deferral period, which for us extended through December 31, 2021. Beginning on January 1, 2022, we were required to phase in 25% of the previously deferred estimated capital impact of CECL, with an additional 25% to be phased in at the beginning of each subsequent year until fully phased in by the first quarter of 2025. The estimated impact of CECL on regulatory capital that we deferred and began phasing in on January 1, 2022, is generally calculated as the entire day-one impact at adoption plus 25% of the subsequent change in allowance during the two-year deferral period. As of December 31, 2022,2023, the total deferred impact on Common Equity Tier 1 capital related to our adoption of CECL was $887$591 million.

In December 2017,April 2023, in a statement accompanying the Basel Committee approvedreview of the FRB’s supervision and regulation of SVB, FRB Vice Chair for Supervision Barr highlighted a plan to revisit the Tailoring Rules and develop stronger capital, liquidity, stress-testing, and other standards for Category IV firms like Ally. In July 2023, the U.S. banking agencies issued a proposed rule to customize and implement revisions to the global Basel III capital framework that were approved by the Basel Committee in December 2017 (commonly known as the Basel III endgame or as Basel IV), many. For regulatory capital, the proposed rule would eliminate the effect of which—the Tailoring Rules by requiring the recognition of most elements of accumulated other comprehensive income and loss and the application of deductions, limitations, and criteria for specified capital investments, minority interests, and TLAC holdings. For each of the risk-based capital ratios, a large banking organization, like Ally, would calculate and be bound by the lower of two alternatives: one version of the ratio based on an expanded risk-based approach prescribed in the proposed rule and one version of the ratio based on the standardized approach as modified by the proposed rule. All capital buffer requirements, including the stress capital buffer requirement, would apply regardless of whether the expanded risk-based approach or the standardized approach produces the lower ratio. Under the expanded risk-based approach, total RWAs would equal the sum of the RWAs for credit risk, equity risk, operational risk, market risk, and CVA risk as set forth in the proposed rule minus any amount of the banking organization’s adjusted allowance for credit losses that is not included in Tier 2 capital and any amount of allocated transfer risk reserves. Under the standardized approach, total RWAs would be calculated using the existing rules with a revised methodology for determining RWAs for market risk, and a required application of the standardized approach for counterparty credit risk for derivative exposures. Category IV firms would be further required under the proposed rule to project their risk-based capital ratios under baseline conditions in their capital plans and related reports using the RWA-calculation approach that results in their binding risk-based capital ratios as of the start of the projection horizon. The proposed rule also would roll back additional elements of the Tailoring Rules by applying to Category IV firms the supplementary leverage ratio, the countercyclical capital buffer, and enhanced public disclosure and reporting requirements. Under the proposed rule, a three-year transition period from July 1, 2025, to June 30, 2028, would apply to the recognition of accumulated other comprehensive income and loss in regulatory capital and the use of the expanded risk-based approach. The phase-in of accumulated other comprehensive income and loss is expected to significantly affect our levels of regulatory capital. While we believe that this would be manageable, we also anticipate that our levels of regulatory capital would need to be gradually increased in advance of and during the proposed transition period. As for the proposed changes to RWAs, while we continue to evaluate the effects of individual provisions and the interplay among them as well as potential management actions in response, the impact is not currently expected to be significant in the aggregate if the proposed rule were adopted in its existing form. Since the United States—could heighten regulatory capital standards. Whileproposed rule was issued, we have been engaged with research and advocacy groups to inform the rulemaking process and better understand the impacts of the proposed rule on banking organizations of various sizes and complexities—as well as the competitive environment more broadly—and likewise encourage the U.S. banking agencies to closely study these revisions were planned for implementation by member countries by January 1,impacts and their wider implications.

Whether and when final rules related to these proposals may be adopted and take effect, as well as what changes to the proposed rules may be reflected in any final rules after the comment periods, remain unclear. Also, beyond these proposed rules, more stringent and less tailored liquidity, stress-testing, and other standards for Category IV firms, like Ally, may be forthcoming, including those that may reinstate the LCR, require more rigorous liquidity stress testing, and return Ally to supervisory stress testing on an annual cycle.

Ally Bank’s deposits are insured by the FDIC in the standard insurance amounts per depositor for each account ownership category as prescribed by the FDI Act. Insured depository institutions with two million or more deposit accounts, including Ally Bank, are required by the FDIC to establish and maintain systems and processes designed to facilitate prompt payment of FDIC-insured deposits in the event of a failure. Deposit insurance is funded through assessments on Ally Bank and other insured depository institutions. The FDIC assesses premiums from each institution based on its average consolidated total assets minus its average tangible equity, while utilizing a scorecard method to determine each institution’s risk to the DIF. The FDIC may take action to increase insurance premiums if the DIF is not funded to its regulatory-mandated DRR. Currently, the FDIC is required to maintain a DRR of 1.35% under the FDI Act. In October 2022, the FDIC finalized a rule to increasethat increased the initial base deposit insurance assessment rate schedules for all insured depository institutions by two basis points, beginning with the first quarterly assessment period of 2023. The increased assessment rate is intended to improve the likelihood that the DRR will reach the required minimum of 1.35% by the statutory deadline of September 30, 2028. On November 16, 2023, the FDIC finalized a rule that imposes a special assessment to recover the costs to the DIF resulting from the FDIC’s use, in March 2023, of the systemic risk exception to the least-cost resolution test under the FDI Act in connection with the receiverships of SVB and Signature. The FDIC estimated in approving the rule that those assessed losses total approximately $16.3 billion. The rule provides that this loss estimate will be periodically adjusted, which will affect the amount of the special assessment. Under the rule, the assessment base is the estimated uninsured deposits that an IDI reported in its Consolidated Reports of Condition and Income (“Call Report”) at December 31, 2022, excluding the first $5 billion in estimated uninsured deposits. The special assessments will be collected at an annual rate of approximately 13.4 basis points per year (3.36 basis points per quarter) over eight quarters in 2024 and 2025, with the first assessment period beginning January 1, 2024. Because the estimated loss pursuant to the systemic risk determination will be periodically adjusted, the FDIC retains the ability to cease collection early, extend the special assessment collection period, and impose a final shortfall special assessment on a one-time basis. Ally expects the special assessments to be tax deductible. The total of the assessments for Ally, based on Ally Bank’s uninsured deposits as of December 31, 2022, is estimated at $38 million, and such amount was recorded as an expense in the quarter of adoption (the quarter ending December 31, 2023).

If an insured depository institution, like Ally Bank, were to become insolvent or if other specified events were to occur relating to its financial condition or the propriety of its actions, the FDIC may be appointed as conservator or receiver for the institution. In that capacity, the FDIC would have the power to (1) transfer assets and liabilities of the institution to another person or entity without the approval of the institution’s creditors; (2) require that its claims process be followed and to enforce statutory or other limits on damages claimed by the institution’s creditors; (3) enforce the institution’s contracts or leases according to their terms; (4) repudiate or disaffirm the institution’s contracts or leases; (5) seek to reclaim, recover, or recharacterize transfers of the institution’s assets or to exercise control over assets in which the institution may claim an interest; (6) enforce statutory or other injunctions; and (7) exercise a wide range of other rights, powers, and authorities, including those that could impair the rights and interests of all or some of the institution’s creditors. In addition, the administrative expenses of the conservator or receiver could be afforded priority over all or some of the claims of the institution’s creditors, and under the FDI Act, the claims of depositors (including the FDIC as subrogee of depositors) would enjoy priority over the claims of the institution’s unsecured creditors.

Ally Invest Forex LLC (Ally Invest Forex) is registered with the CFTC as an introducing broker and is a member of the NFA, which is the primary SRO for the U.S. futures industry. The firm is subject to similarly expansive requirements under the Commodity Exchange Act, CFTC and NFA rules governing introducing brokers and their personnel, and CFTC retail forex rules.

Regulators conduct periodic examinations of Ally Invest Securities Ally Invest Forex, and Ally Invest Advisors and regularly review reports that the firms are required to submit on an ongoing basis. Violations of relevant regulatory requirements could result in adverse consequences for the firms and their personnel, including censure, penalties and fines, the issuance of cease-and-desist orders, and restriction, suspension or expulsion from the securities or commodity-futures industries.

Our people-first human capital approach is guided by a philosophy that emphasizes care for our employees through professional and personal support, and offerings that drive them to better care for our customers and positively impact our communities. These components combine to propel better operational and financial results. We emphasize a working environment and company culture that embrace diverse talents, backgrounds, and perspectives and where colleagues feel valued as both individuals and members of the team. We had approximately 11,600 and 10,500 employees as of December 31, 2022, and 2021, respectively, which consisted primarily of full-time employees in the United States. Our employee growth for the year ended December 31, 2022, was primarily attributable to expansion in the overall business and our information technology organization.

Our annual, CEO-sponsored enterprise-wide recognition program, “LEADing the Way,” is designed to recognize employees whose leadership and performance consistently model our core values in one or more of the following areas: innovation, risk culture, corporate citizenship, customer experience, DE&I, process improvement, or other attributes that reflect our overall culture. This award is one of the highest recognitions an employee can receive at Ally. In 2022, 802023, 83 team members were recognized with this award. Recipients are nominated based on exceeding their LEAD core value performance objective, which is required for all employees. Additionally, employees can nominate colleagues for the quarterly peer-to-peer “I’m An Ally” award recognition program that provides employees the opportunity to recognize the hard work of individuals across the entire organization. These recognition programs reinforce our continued commitment to our culture.

We have a deliberate focus on DE&I with an intentional emphasis on inclusion, which expands beyond traditional definitions of diversity. Notably, our company-wide employee engagement survey score for belonging improved by two points in 2022 and remains eightis five points above the financial services industry benchmark and within the top 10% of all global companies, as measured by our third-party provider. The importance of DE&I starts at the top with our CEO and Board, who consistently stress the value in leveraging our differences. In June 2017, our CEO was among the first 150 CEOs who signed on to the CEO Action Pledge for Diversity and Inclusion, and this commitment has been renewed every year since. Our Board and Executive Council have also publicly pledged our continuing support for all groups with a heightened focus on Black, Hispanic, and Latino colleagues, suppliers, partners, and communities in the promotion of equity and equality.

Our DE&I Council provides executive leadership on DE&I and promotes belonging at Ally and in our communities. A subset of our commitment to DE&I is a Financial and Social Inclusion Framework that is built upon four pillars: Employees, Community, Customers, Employees, and Suppliers.

These four pillars are championed by our employees, which empowers us to advance DE&I efforts in meaningful ways beyond Ally. Additionally, these efforts are further supported by our Chief Diversity Officer, and 1816 full-time employees designated to advance DE&I within Ally. While our Financial and Social Inclusion Framework is focused on addressing the wealth gap, specifically in Black, Hispanic, and Latino communities, the four pillars are reflective of our DE&I efforts more broadly as further discussed below.

We maintain eight ERGs sponsored by members of Ally’s Executive Council and chaired by leaders from multiple levels of management across Ally. These ERGs consist of: Aliados, Asian/Middle Eastern, Black/African American, Diverse Abilities, Generational, Pride, Veteran, and Women ALLYs. Membership in our ERGs is voluntary and open to all employees, whether they identify with the ERG or view themselves as an ally to the group. As we celebrated the fifthsixth anniversary of ERGs in 2022,2023, employee participation grew to more than 50%59% of our workforce belonging to at least one ERG as of December 31, 2022,2023, as compared to 43%more than 50% as of December 31, 2021.2022. Our ERGs may offer employees a sense of belonging, enhanced networking, and opportunities to learn and grow. Through dedicated focus months, each ERG has delivered cultural education and awareness that expands understanding and collaboration throughout the organization. Through volunteerism, fundraising, and supporting nonprofits and community organizations, our ERGs are committed to giving back to the communities where we live and work. Beyond our ERGs, our Technology Organization also launched two diversity-focused groups that explore the obstacles to inclusivity that exist specifically within the technology industry. These two groups were Women in Technology (WiT) and Black, Hispanic and BrownLatino in Technology (BBiT).(BHLiT) and, like our ERGs, are open to all employees. Our objective across all the groups is to foster a workplace environment where all employees have a sense of belonging and know their opinions count.

Our commitment to inclusion emphasizes representation, transparency, accountability, and action for our employees. As of December 31, 2022,2023, our gender representation is approximately 51% men and 49% women. We increased or maintained representation of women and people of color in our manager and above roles, and redesigned programs to create more opportunities for early talent.individuals new to their roles in the company.

The following table presents our employee representation of women, and Black or African American, Latino or Hispanic, or Asian individuals as a percentage of all employees.

We believe equal access to earning potential is essential in attracting, retaining, and inspiring top talent. Our external hiring practices are based on market rates for roles, experience, and performance. To the same end, we do not and have not requested salary history from candidates since 2017, and we regularly benchmark our compensation against other companies, both within and outside our industry. Pay rates for all positions are routinely reviewed, supporting equitable pay across the organization. On February 1, 2021, we established anOur internal minimum hourly wage for our U.S. employees of $17, which increased to $20 and $23, on September 13, 2021, and November 7, 2022, respectively.is currently $23. Beginning January 1, 2023, in concurrence with laws in multiple municipalities in which we operate, we began proactively including pay ranges in job postings nationwide.

Beginning inSince 2022, we have observed Juneteenth as a paid holiday for U.S. employees to commemorate the emancipation of millions of people from slavery and our Canadian employees observed National Day for Truth and Reconciliation as a paid holiday to honor the Native children, survivors, families, and communities affected by residential schools.

Since the program’s inception, we have created operational processes to include diverse suppliers in our bidding and contracting opportunities. This has resulted in an increase in both first-tier and second-tier diverse supplier expenditures. In 2022,2023, we achieved $135directed approximately $176 million of directfirst-tier diversity expenditures composed ofto certified Minority and Women-Owned Business Enterprises and Small Business, and classified diverse spend,Businesses, surpassing directfirst-tier diverse expenditures in 20212022 by $30$41 million. Approximately 10050% of our largest suppliers, in terms of dollars spent, participated in second-tier expenditure reporting during the year ended December 31, 2022.2023. As a result, these suppliers have allowed us to capture our second-tier diverse supplier expenditures, which provides a more holistic view of our economic impact within our communities. In all instances, regardless of diversity status, we seek to award procurement contracts to the suppliers who demonstrate they are the optimum partner for such business opportunities based on a combination of decision factors including but not limited to total cost of ownership, compliance with applicable third-party risk, legal and regulatory requirements, ability to meet or exceed our operational and functional requirements and robustness of service quality commitments.

Our dedicated Supplier Diversity team assists our business lines and procurement teams in identifying a mix of certified diverse suppliers with the proper credentials and capabilities to adhere to our third-party risk, operational, commercial, legal and performance standards. As part of our initial supplier due diligence process, our Supplier Diversity and procurement teams partner to research qualified diverse suppliers capable of meeting our standards in Request for Proposal events. This allows us to integrate consideration of diverse business enterprises in third-party purchasing opportunities. Our comprehensive sourcing network pairs our needs with the business strengths of a diverse mix of large and small suppliers, who then may participate in our bidding and selection processes.

In February 2022,2023, we hosted more than 50 diverse-owned businesses at our Ally Charlotte Center office for the second-annual3rd annual Supplier Diversity Symposium, which facilitatedSymposium. The day featured interactive breakout sessions and a fireside chat with our CEO to increase access, create connections, and explore opportunities to expand relationships with diverse suppliers. In addition to our annual Supplier Symposium, we also hosted quarterly diverse supplier spotlight events as part of our ongoing commitment to supplier diversity. These events engaged diverse suppliers through interactive mock sales pitches and provided immediate coaching and feedback. As a result of this access, many of the participating diverse suppliers went on to connect with our supply chain department and business line executives to explore potential opportunities to work with us. OurAdditionally, in July 2023 we celebrated Ally’s Supplier Diversity Month was createdMonth. Established in July 2021 as part of our ongoing commitment to creating access and opportunities2022, the month-long celebration features events for diverse suppliers. During 2022, we featured more than 50 diverse-owned businesses through our Supplier Diversity Symposium, quarterly spotlight events, and Supplier Diversity Month.highlights the accomplishments of employees, companies and industry professionals who have contributed to advancing inclusion for all suppliers.

In 2022,2023, we made the Forbes’ lists as a best place to work for diversity, new grads, women veterans, new graduates, and diversity.veterans. We also were named to Diversity Inc.’s Top 50 companies for diversity list for a secondthird consecutive year, and as a best place to work for disability inclusion by the following organizations: American Association of People with Disabilities, and Disability:IN. Additionally, the Human Rights Campaign FoundationFinally, Newsweek named us a best place to workone of America’s Greatest Workplaces 2023 for LGBTQ+ equality, the sixth straight year we have achieved this recognition.Diversity.

OurIn 2023, Ally’s Supplier Diversity Program was acknowledged during 2022. We received the TOP Corporations Award fromrecognized as a “Top Corporation” by the Greater Women’s Business Council for the second consecutive year and the Allyreceived Disability:IN’s Top Corporation for Excellence inDisability-Owned Business Award. Our Senior Director for Supplier Diversity award from& Sustainability was also honored as the Carolina's LGBTQ+ Chamber2023 Advocate of Commerce.the Year by the Greater Women’s Business Council.

The following table indicates our company-wide engagement survey results as measured by our third-party provider, based on a 100-point scale, as well as our participation ratesCompensation, Nominating, and Governance Committee of the Board is responsible for the survey.oversight of our human capital management. This Committee and Ally’s Executive Council biannually review organizational health metrics and progress toward cultural priorities including our DE&I efforts and engagement efforts. Annually, the Board reviews and approves Ally’s Code of Conduct and Ethics, which is the framework for our culture including how employees must conduct themselves. This is required to be attested to by all employees on an annual basis. Additionally, at least quarterly, our Chief Diversity Officer conducts a diversity council session with senior leaders.

The participation rate benchmark fromHR leadership team reports to Ally’s Chief HR Officer and includes our third-party provider decreasedChief Diversity Officer, Chief Ethics Officer, and other direct reports that work with our leaders to 75% in 2022, comparedidentify human capital metrics designed to 80% in 2021.promote and sustain the health of our organization.

While the scope, intensity, and focus of governmental oversight can vary from time to time, we expect a highly demanding environment for the foreseeable future. Recently,In recent years, regulatory and other governmental agencies have taken a host of actions that create more challenging and volatile financial and operating conditions for financial-services companies, including through formal rulemakings that change the law or interpretations of the law, supervisory expectations and public statements that are designed to informally compel changes in industry practices, and more aggressive approaches to enforcement that are accompanied by increasingly severe penalties. These actions are comprehensive in their coverage, such as rulemakings on climate-related disclosures, cybersecurity risk governance (including incident disclosure), CRA reform, credit-card fees (such as the CFPB’s proposed rule to cap late fees), and personal-financial-data rights as well as guidance and statements on mergers and acquisitions, regulatory capital, resolution planning, automotive financing and insurance, fees for financial services, and UDAAP. Further, following the failures of three large banks in 2023, banking regulators have proposed changes, or indicated the potential for changes, regarding the regulation and supervision of banking organizations, in particular those, such as Ally, with $100 billion or more in assets. The introduction of new or more stringent regulatory requirements, as well as heightened supervisory expectations, could require Ally to maintain additional capital or liquidity or incur significant expenses. Governmental oversight of this kind may increase our operating costs or reduce our revenues, limit the types of financial services and products we may offer, alter the investments we may make, affect the manner in which we conduct our business and operations, increase our litigation and regulatory costs, and enhance the ability of others to offer more competitive financial services and products. We continue to devote substantial time and resources to risk management, compliance, regulatory-change management, and cybersecurity and other technology initiatives, each of which—whether successful or not—also may adversely affect our ability to operate profitably or to pursue advantageous business opportunities.

Ally has elected to be treated as an FHC, which permits us to engage in a number of financial and related activities—including securities, advisory, insurance, and merchant-banking activities—beyond the business of banking. Ally and Ally Bank are subject to ongoing requirements for Ally to qualify as an FHC. If a BHC or any of its insured depository institutions is found not to be well capitalized or well managed, as defined under applicable law, the BHC can be restricted from engaging in the broader range of financial and related activities permitted for FHCs, including the ability to acquire companies engaged in those activities, and can be required to discontinue these activities or even divest any of its insured depository institutions. In addition, if an insured-depository-institution subsidiary of a BHC fails to achieve a satisfactory or better rating under the CRA, the ability of the BHC to expand its financial and related activities or make acquisitions could be restricted.

In connection with their continuous supervision and examinations of us, the FRB, the UDFI, the CFPB, the SEC, FINRA, the NYDFS, or other regulatory agencies may explicitly or implicitly require changes in our business or operations. Such a requirement may be judicially enforceable or impractical for us to contest, and if we are unable to comply with the requirement in a timely and effective manner, we could become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives. The financial-services industry continues to face scrutiny from supervisory authorities in the examination process, including through an increasing use of horizontal reviews from a broader industry perspective as well as strict enforcement of laws at federal, state, and local levels—particularly in connection with business and other practices that may harm or appear to harm consumers and compliance with anti-money-laundering, sanctions, and related laws. Because of the regulatory and supervisory framework, financial institutions often are less inclined to litigate with governmental authorities. In general, the amounts paid by financial institutions in settling proceedings or investigations and the severity of other terms of regulatory settlements are likely to remain elevated. In some cases, governmental authorities have required criminal pleas or other extraordinary terms, including admissions of wrongdoing and the imposition of monitors, as part of settlements. Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business or make acquisitions, our flexibility in conducting operations, and our ability to pay dividends or utilize capital. Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence.confidence, and a prior enforcement action may also increase the risk that regulators and governmental authorities pursue formal enforcement actions in connection

Much of our business and operations is conducted by Ally Bank, which is a direct bank with no branch network, and a primary component of our business strategy is its continued growth. This growth includes expanding our consumer and commercial lending and increasing our deposit customers and balances while optimizing our cost of funds. If regulatory agencies raise concerns about any aspect of our business strategy for Ally Bank or the way in which we implement it, we may be obliged to limit or even reverse the growth of Ally Bank or otherwise alter our strategy, which could have an adverse effect on our business, financial condition, results of operations, or prospects. In addition, if we are compelled to retain or shift any of our business activities in or to nonbank affiliates, our funding costs for those activities—such as unsecured funding in the capital markets—could be more expensive than our cost of funds at Ally Bank.

The FRB may require us to revise and resubmit our capital plan in specified circumstances, including if the FRB determines that our capital plan is incomplete, our capital plan or internal capital adequacy process contains material weaknesses, or there has been, or will likely be, a material change in our risk profile (including a material change in our business strategy or any risk exposure), financial condition, or corporate structure. While a resubmission is pending, without prior approval of the FRB, we would generally be prohibited from paying dividends, repurchasing our common stock, or making other capital distributions. For example, in response to the outbreak of COVID-19, the FRB determined that changes in financial markets or the macroeconomic outlook could have a material effect on the risk profiles and financial conditions of firms subject to the capital-plan rule and that, as a result, the firms (including Ally) were required to resubmit capital plans as well as, for a period of time, suspend nearly all common-stock repurchases and restrict common-stock dividends.

Depending on the circumstances, to satisfy the FRB in its review of our capital plan, we may be required to further cease or limit capital distributions or to issue capital instruments that could be dilutive to stockholders. The FRB also may prevent us from maintaining or expanding lending or other business activities. Any of these developments, including the mere fact of being required by the FRB to revise or resubmit our capital plan and especially if unique to us or a group of firms like us, may damage our reputation and result in a loss of customer or investor confidence.

Further, we may be required to raise capital if we are at risk of failing to satisfy our minimum regulatory capital ratios or related supervisory requirements, whether due to inadequate operating results that erode capital, future growth that outpaces the accumulation of capital through earnings, changes in regulatory capital standards, changes in accounting standards that affect capital (such as CECL), or otherwise. In addition, we may elect to raise capital for strategic reasons even when we are not required to do so. Our ability to raise capital on favorable terms or at all will depend on general economic and market conditions, which are outside of our control, and on our operating and financial performance. Accordingly, we cannot be assured of being able to raise capital when needed or on favorable terms. An inability to raise capital when needed and on favorable terms could damage the performance and value of our business, prompt supervisory actions and private litigation, harm our reputation, and cause a loss of customer or investor confidence, and if the condition were to persist for any appreciable period of time, our viability as a going concern could be threatened. Even if we are able to raise capital but do so by issuing common stock or convertible securities, the ownership interest of our existing stockholders could be diluted, and the market price of our common stock could decline.

The enhanced prudential standards also require Ally, as a Category IV firm, to conduct quarterly liquidity stress tests, to maintain a buffer of unencumbered highly liquid assets to meet projected net stressed cash outflows over a 30-day planning horizon, to adopt a contingency funding plan that would address liquidity needs during various stress events, and to implement specified liquidity risk management and corporate governance measures. These enhanced liquidity standards could constrain our ability to originate or invest in longer-term or less liquid assets or to take advantage of other profitable opportunities and, therefore, may adversely affect our business, results of operations, and prospects.

Ally Bank is a key part of our funding strategy, and we place great reliance on deposits at Ally Bank as a source of funding. Competition for deposits and deposit customers, however, is fierce.intense. Further, recent increases in short-term interest rates have resulted in, and are expected to continue to result in, more intense competition in deposit pricing.pricing and with respect to non-deposit financial products. Ally Bank does not have a branch network but, instead, obtains its deposits through online and other digital channels, from other business lines including customers of Ally Invest, and through deposit brokers. Brokered deposits may be more price sensitive than other types of deposits and may become less available if alternative investments offer higher returns. BrokeredOur brokered deposits totaled $12.6$11.0 billion at December 31, 2022,2023, which represented 8.3%7.1% of Ally Bank’s total deposits.deposit liabilities. In addition, our ability to maintain, grow, or favorably price deposits may be constrained by our lack of in-personfocus on online and mobile banking, services, gaps in our product and service offerings, changes in consumer trends, our smaller scale relative to other financial institutions, competition from fintech companies and emerging financial-services providers, any failures or deterioration in our customer service, or any loss of confidence in our brand or our business. Our level and cost of deposits also could be adversely affected by regulatory or supervisory restrictions, including any applicable prior approval requirements or limits on our offered rates or brokered deposit growth, and by changes in monetary or fiscal policies that influence deposit or other interest rates. Perceptions of our existing and future financial strength or the financial strength of the financial-services industry generally, rates or returns offered by other financial institutions or third parties, and other competitive factors beyond our control, including returns on alternative investments, will also impact the size and cost of our deposit base. For example, Ally Bank could be subject to sudden withdrawals of deposits, including as a result of negative media coverage, which may be spread through social media, regarding us or the financial services industry generally. Online and mobile banking have made it easier for customers to withdraw their deposits or transfer funds to other accounts with short notice. This may make retaining deposits during periods of stress more difficult. In addition, depositors of certain types of deposits, such as uninsured or uncollateralized deposits, may be more likely to withdraw their deposits or do so more quickly. Any such withdrawals could result in higher funding costs for us as we lose a lower cost source of funding, and significant unanticipated withdrawals could materially and adversely affect our liquidity, financial condition, and results of operations. Approximately 93% of total deposits at Ally Bank, excluding affiliate and intercompany deposits, were FDIC-insured as of December 31, 2023.

If Ally or Ally Bank were to fail to satisfy its regulatory capital requirements, significant regulatory sanctions could result, such as a bar on capital distributions, limitations on acquisitions and new activities, restrictions on our acceptance of brokered deposits, a loss of our status as an FHC, or informal or formal enforcement and other supervisory actions. Such a failure also could irrevocably damage our reputation, prompt a loss of customer and investor confidence, prompt private litigation, and even lead to our resolution or receivership. Any of these consequences could have an adverse effect on our business, results of operations, financial condition, or prospects.

In December 2017, the Basel Committee approved revisions to the global Basel III capital framework (commonly known as the Basel III endgame or as Basel IV), manyand on July 27, 2023, the FRB and FDIC issued a proposed rule to implement the Basel Committee’s 2017 standards and make other changes to regulatory capital rules for banking organizations with total consolidated assets of which—$100 billion or more. Further, on August 29, 2023, the FRB and the FDIC issued a proposed rule that would require Category II through Category IV BHCs and IDIs with $100 billion or more in consolidated assets (as well as their IDI affiliates) to maintain minimum amounts of eligible long-term debt (generally, debt that is unsecured, has a maturity greater than one year from issuance and satisfies additional criteria). The long-term debt proposal, if adopted, in the United States—could heighten regulatory capital standards. While these revisions were planned for implementation by member countries by January 1, 2023, the U.S. banking agencies have yetwould require Ally to propose rules to do so. At this time, how the revisions will be harmonizedmaintain more long-term debt than it does currently, which would adversely affect interest expense, net interest income, and finalized in the United States remains unclear, and no assurance can be provided that they would not further impact our business, results of operations, financial condition, or prospects in an adverse way.net interest margin.

A fractious or volatile political environment in the United States, including any related social unrest, could negatively impact business and market conditions, economic growth, financial stability, and business, consumer, investor, and regulatory sentiments, any one or more of which in turn could cause our business and financial results to suffer. In addition, disruptions in the foreign relations of the United States could adversely affect the automotive and other industries on which our business depends and our tax positions and other dealings in foreign countries. We also could be negatively impacted by political scrutiny of the financial-services industry in general or our business or operations in particular, whether or not warranted, and by an environment where criticizing financial-services providers or their activities is politically advantageous.

Additionally, changes to tax policies could have a significant impact on our results of operations and financial condition. For example, in August 2022, the Inflation Reduction Act was signed into law in the United States and, in part, imposes a 15% corporate alternative minimum tax on certain large corporations, such as Ally, and a surcharge on stock repurchases. Tax and other fiscal policies, moreover, impact not only general economic and market conditions but also give rise to incentives or disincentives that affect how we and our customers prioritize objectives, deploy resources, and run households or operate businesses. Both the timing and the nature of any changes in monetary or fiscal

Cybersecurity and data-privacy risks have received heightened legislative and regulatory attention. For example, in 2021 the U.S. banking agencies have adopted a final rule requiring us to notify the FRB within 36 hours of any significant computer security incident and have proposed enhanced cyber risk management standards applicable to us and our service providers that would address cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. In addition, rulemakings by the SEC and the CFPB have commenced to further regulate cybersecurity risk governance (including incident disclosure) and personal-financial-data rights, respectively. Several states and their governmental agencies, such as the NYDFS, also have adopted or proposed cybersecurity and data-privacy laws. Privacy laws in the State of California, for example, require regulated entities to establish measures to identify, manage, secure, track, produce, and delete personal information.

Legislation and regulations on cybersecurity and data privacy may compel us to enhance or modify our systems and infrastructure, invest in new systems and infrastructure, change our service providers, augment our scenario and vulnerability testing, or alter our business practices or our policies on security, data governance, and privacy. If any of these outcomes were to occur, the complexity and costs of our operations could increase significantly. In addition, if governmental authorities were to conclude that we or our service providers had not adequately implemented laws on cybersecurity and data privacy or had not otherwise met related supervisory expectations, we could be subject to enforcement and other supervisory actions, related litigation by private plaintiffs, reputational damage, or a loss of customer or investor confidence.

Governments and policymakers at the federal, state and international levels are intenselyincreasingly focused on the effects of climate change and related environmental, issues. For example, since December 2020,social and governance issues, and the FRB has become a member of the Network of Central Banks and Supervisorspotential for Greening the Financial System, created a Supervision Climate Committee to identify and assess financial risks from climate change and to develop a program to ensure the resilience of supervised firms to those risks, and created a Financial Stability Climate Committee to identify, assess, and address climate-related risks to impact the safety and soundness of large financial stability. The FRB also proposedinstitutions. For example, in December 2022 a high-level framework for the safe and sound management of exposures to climate-related financial risks for large banking organizations, such as Ally, after announcing in September 2022 that six of the nation’s largest banks will participate in a pilot climate-scenario-analysis exercise designed to enhance the ability of supervisors and firms to measure and manage climate-related financial risks. In addition,2021, President Biden has issued an Executive Order on Climate-Related Financial Risks, which in part directsdirected the U.S. Treasury Secretary to work with other members of the Financial Stability Oversight Council to consider a number of actions. Included among them areMore recently, in 2023, the Financial Stability Oversight Council’s assessmentFRB conducted a pilot climate scenario analysis exercise involving six of the nation’s largest banks designed to enhance the ability of supervisors and firms to measure and manage climate-related financial riskrisks. The results of this exercise may result in future changes to the stabilityFRB’s supervisory activities and expectations with respect to Ally. Further, several states in which Ally operates, such as California, have enacted or proposed statutes or regulations addressing climate change and other ESG issues. As a result of these and similar future developments at the federal, governmentstate and the U.S. financial system, facilitation of the sharing of climate-related financial risk datainternational levels, we may become subject to different and information among its memberspotentially conflicting requirements and other executive departments and agencies, and issuance of a report on any efforts by its members to integrate consideration of climate-related financial risk in their policies and programs. Further, the SEC has created a Climate and ESG Task Forceexpectations in the Division of Enforcement, whosevarious jurisdictions in which we operate. Further, it is possible that government responses to actual or perceived changes in climate and related environmental risks, including expectations regarding the purpose includes proactively identifying ESG-related misconduct such as material gaps or misstatements in the disclosure of climate risks.scenario analysis, may occur more rapidly than we (or third parties on whom we rely for certain climate- or other sustainability-related information or services) are able to adapt. Our ability to comply with these requirements and expectations, including responses to any inquiry or investigation from a regulatory agency, could have a material adverse effect on our operations, reputation and our financial results.

How governments act to mitigateaddress climate and related environmental risks, as well as associated changes in the behavior and preferences of businesses and consumers, could have an adverse effect on our business and financial results. The FRB has announced its developmentFor example, physical and transition risks associated with climate change could affect households, communities, businesses, and governments, which could impede business activity, affect household incomes, and alter the value of a program of scenario analysis to evaluate the potential economicassets and financialliabilities. These risks posed by different climate outcomes, and especially because of our concentration in automotive finance and insurance, this could have the effect of directly or indirectly compelling us to alter our businesses or operations in ways that would be detrimental to our results of operations and prospects. Such a program, moreover, could be followed by an incorporation of climate and related environmental risks into the FRB’s supervisory stress tests, which may negatively impact us and our future capital plans. Further, we may be compelledpropagated through the economy and financial

Our business is centered around lending and banking with an emphasis on our digital platform, and a significant percentage of our assets are composed of loans, operating leases, and securities. As a result, in the ordinary course of business, credit risk is one of our most significant risks.

We continue to have exposure to nonprime consumer automotive financing and used vehicle financing. We define nonprime consumer automotive loans primarily as those loans with a FICO® Score (or an equivalent score) at origination of less than 620. Customers that finance used vehicles tend to have lower FICO® Scores as compared to new vehicle customers, and defaults resulting from vehicle breakdowns are more likely to occur with used vehicles as compared to new vehicles that are financed. The carrying value of our nonprime consumer automotive loans before allowance for loan losses was $8.7 billion, or approximately 10.3% of our total consumer automotive loans at December 31, 2023, as compared to $8.8 billion, or approximately 10.6% of our total consumer automotive loans at December 31, 2022, as compared to $8.8 billion, or approximately 11.3% of our total consumer automotive loans at December 31, 2021.2022. At December 31, 2023, and 2022, and 2021, $302$258 million and $294$302 million, respectively, of nonprime consumer automotive loans were considered nonperforming as they had been placed on nonaccrual status in accordance with our accounting policies. Refer to the Nonaccrual Loans section of Note 1 to the Consolidated Financial Statements for additional information. Additionally, the carrying value of our consumer automotive used vehicle loans before allowance for loan losses was $57.6 billion, or approximately 68.3% of our total consumer automotive loans at December 31, 2023, as compared to $55.7 billion, or approximately 67.0% of our total consumer automotive loans at December 31, 2022, as compared to $49.3 billion, or approximately 63.0% of our total consumer automotive loans at December 31, 2021.2022. If our exposure to nonprime consumer automotive loans or used vehicle financing continue to increase over time, our credit risk will increase to a possibly significant degree.

As part of the underwriting process, we rely heavily upon information supplied by applicants and other third parties, such as credit reporting agencies, automotive dealers and retailers (in the case of automotive consumer and commercial loans), and service providers (in the case of unsecured personal loans). If any of this information is intentionally or negligently misrepresented and the misrepresentation is not detected before completing the transaction, we may experience increased credit risk.

Regulatory agencies periodically review our allowance for loan losses, as well as our methodology and models used for calculating our allowance for loan losses, and from time to time may insist on an increase in the allowance for loan losses or the recognition of additional

A number of trends are affecting the automotive industry and the role of dealers within it. These include challenges to the dealer’s role as intermediary between manufacturers and purchasers, shifting financial and other pressures exerted by manufacturers on dealers, the rise of vehicle sharing and ride hailing, the development of autonomous and alternative-energy vehicles, the impact of demographic shifts on attitudes and behaviors toward vehicle ownership and use, changing consumer and regulatory expectations around the vehicle buying experience, adjustments in the geographic distribution of new and used vehicle sales, and advancements in communications technology. While it is not currently clear how and how quickly these trends may develop, any one or more of them could adversely affect the key role of dealers and their business models, profitability, and viability, and if this were to occur, our dealer-centric automotive finance and insurance businesses could suffer as well.

Our share of commercial wholesale financing remains at risk of decreasing in the future as a result of intense competition and other factors. The number of dealers with whom we have wholesale relationships decreased approximately 4%5% as of December 31, 2022,2023, compared to December 31, 2021.2022. If we are not able to maintain existing relationships with significant automotive dealers or if we are not able to develop new relationships for any reason—including if we are not able to provide services on a timely basis, offer products and services that meet the needs of the dealers, compete successfully with the products and services of our competitors, or effectively counter the influence that captive automotive finance companies have in the marketplace or the exclusivity privileges that some competitors have with automotive manufacturers—our wholesale funding volumes, and the number of dealers with whom we have retail funding relationships, could decline in the future. If this were to occur, our business, results of operations, financial condition, or prospects could be adversely affected.

While we continue to diversify our automotive finance and insurance businesses and to expand into other financial services, GM and Stellantis dealers and their retail customers still constitute a significant portion of our customer base. In 2023, 28% of our new vehicle dealer inventory financing and 23% of our consumer automotive financing volume were transacted for GM dealers and customers, and 53% of our new vehicle dealer inventory financing and 20% of our consumer automotive financing volume were transacted for Stellantis dealers and customers. In 2022, 31% of our new vehicle dealer inventory financing and 22% of our consumer automotive financing volume were transacted for GMGM-franchised dealers and customers, and 55% of our new vehicle dealer inventory financing and 22% of our consumer automotive financing volume were transacted for Stellantis dealers and customers. In 2021, 31% of our new vehicle dealer inventory financing and 21% of our consumer automotive financing volume were transacted for GM-franchised dealers and customers, and 48% of our new vehicle dealer inventory financing and 26% of our consumer automotive financing volume were transacted for Stellantis dealers and customers. GM, Stellantis, and their captive finance companies compete vigorously with us and could take further actions that negatively impact the amount of business that we do with GM and Stellantis dealers and their customers. A significant adverse change in GM’s or Stellantis’ business—including, for example, in the production or sale of GM or Stellantis vehicles, the quality or resale value of GM or Stellantis vehicles, GM’s or Stellantis’ relationships with its key suppliers, or the rate or volume of recalls of GM or Stellantis vehicles—could negatively impact our GM and Stellantis dealer and retail customer bases and the value of collateral securing our extensions of credit to them. Any future reductions in GM and Stellantis business that we are not able to offset could adversely affect our business and financial results. Refer to Note 29 to the Consolidated Financial Statements for additional information.

Our automotive finance and insurance businesses can be impacted by the sales volume for new and used vehicles. Vehicle sales are impacted, in turn, by several economic and market conditions, including employment levels, household income and savings, interest rates, credit availability, inventory levels, customer preferences, and fuel costs. For example, new vehicle sales decreased dramatically during the economic crisis that began in 2007–2008 and did not rebound significantly until 2012 and 2013. More recently, automotive manufacturers have continued to experience shortagesA meaningful rise in their supply of semiconductor chips and other supply chain delays, which have materiallyinflation during 2021

During the year ended December 31, 2022,2023, approximately 58% of our average earning assets were composed of vehicle loans or operating leases and related residual securitization interests. If we experience higher losses on the sale of repossessed vehicles or lower or more volatile residual values for off-lease vehicles, our business or financial results could be adversely affected.

General economic conditions, the supply of off-lease and other vehicles to be sold, the levels of demand for vehicle ownership and use, relative market prices for new and used vehicles, perceived vehicle quality, the shift from gasoline to electric vehicles, overall vehicle prices, the vehicle disposition channel, volatility in gasoline or diesel fuel prices, levels of household income and savings, interest rates, and other factors outside of our control heavily influence used vehicle prices. Consumer confidence levels and the strength of automotive manufacturers, dealers, and retailers can also influence the used vehicle market. For example, during the economic crisis that began in 2007–2008, sharp declines in used vehicle demand and sale prices adversely affected our remarketing proceeds and financial results.

Our expectation of the residual value of a vehicle subject to an automotive operating lease contract is a critical element used to determine the amount of the operating lease payments under the contract at the time the customer enters into it. As a result, to the extent that the actual residual value of the vehicle—as reflected in the sale proceeds received upon remarketing at lease termination—is less than the expected residual value for the vehicle at lease inception, we will incur additional depreciation expense and lower profit on the operating lease transaction than our priced expectations. Our expectation of used vehicle values is also a factor in determining our pricing of new loan and operating lease originations. In stressed economic environments, residual-value risk may be even more volatile than credit risk. To the extent that used vehicle prices are significantly lower than our expectations, our profit on vehicle loans and operating leases could be substantially less than our expectations, even more so if our estimate of loss frequency is underestimated as well. In addition, we could be adversely affected if we fail to efficiently process and effectively market off-lease vehicles and repossessed vehicles and, as a consequence, incur higher-than-expected disposal costs or lower-than-expected proceeds from the vehicle sales.

We are highly dependent on net interest income, which is the difference between interest income on earning assets (such as loans and investments) and interest expense on deposits and borrowings. Net interest income is significantly affected by market rates of interest, which in turn are influenced by monetary and fiscal policies, general economic and market conditions (including high or increasing levels of inflation), the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future (including future changes in interest rates). We may be adversely affected by policies, laws, and events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), depressing the interest rates associated with our earning assets to levels near the rates associated with our interest expense, increasing the volatility of market rates of interest (including the rate of change), or changing the spreads among different interest rate indices. As of December 31, 2022,2023, we remain liability sensitive and expect increasingview the balance sheet as being modestly asset-sensitive in the near-term to changes in interest rates, as we expect the assumed repricing of our floating-rate assets and pay-fixed swaps to havemodestly outpace the assumed repricing of our liabilities, primarily retail deposits. Within a negative impact12-month horizon, we expect the balance sheet to our near-term net interest income.revert to liability sensitive.

The levels of or changes in interest rates could adversely affect us beyond our net interest income, including by increasing the cost or decreasing the availability of deposits or other variable-rate funding instruments, reducing the return on or demand for loans or increasing the prepayment speed of loans, increasing customer or counterparty delinquencies or defaults, negatively impacting our ability to remarket off-lease and repossessed vehicles, and reducing the value of our loans, retained interests in securitizations, and fixed-income securities in our investment portfolio and the efficacy of our hedging strategies. For example, recent increases in interest rates have resulted in, and could in the future further result in, unrealized losses in our investment securities portfolio, which are recognized in accumulated other comprehensive loss within the Consolidated Balance Sheet. We recognize the accumulated change in estimated fair value of these fixed-income securities in net income when we realize a gain or loss upon the sale of the security.

We seek to distinguish ourselves as a customer-centric company that delivers passionate customer service and innovative financial solutions and that is relentlessly focused on “Doing it Right.” Third-party service providers, however, are key to much of our business and operations, including online and mobile banking, mortgage finance, personal lending, credit cards, brokerage, customer service, and operating systems and infrastructure. While we have implemented a supplier-risk-management program and can exert varying degrees of influence over our service providers, we do not control them, their actions, or their businesses. Our contracts with service providers, moreover, may not require or sufficiently incent them to perform at levels and in ways that we would choose to act on our own. Despite our supplier-risk-management program, service providers have not always met our requirements and expectations, and no assurance can be provided that in the future they will perform to our standards, adequately represent our brand, comply with applicable law, appropriately manage their own risks (including cybersecurity), remain financially or operationally viable, abide by their contractual obligations, or continue to provide us with the services that we require. In such a circumstance, our ability to deliver products and services to customers, to satisfy customer expectations, and to otherwise successfully conduct our business and operations have been and, in the future, could be adversely affected. In addition, we may need to incur substantial expenses to address issues of concern with a service provider, and if the issues cannot be acceptably resolved, we may not be able to timely or effectively replace the service provider due to contractual restrictions, the unavailability of acceptable alternative providers, or other reasons. Further, regardless of how much we can influence our service providers, issues of concern with them could result in supervisory actions and private litigation against us and could harm our reputation, business, and financial results.

As a financial-services company, we are regularly involved in pending or threatened legal proceedings and other matters and are or may be subject to potential liability in connection with them. These legal matters may be formal or informal and include litigation and arbitration with one or more identified claimants, certified or purported class actions with yet-to-be-identified claimants, and regulatory or other governmental information-gathering requests, examinations, investigations, and enforcement proceedings. Our legal matters exist in varying stages of adjudication, arbitration, negotiation, or investigation and span our business lines and operations. Claims may be based in law or equity—such as those arising under contracts or in tort and those involving banking, consumer-protection, securities, tax, employment, and other laws—and some can present novel legal theories and allege substantial or indeterminate damages. In addition, our income tax positions have been and could continue to be challenged by taxing authorities, and any adverse results could materially impact our business, results of operations, and financial condition.

The course and outcome of legal matters are inherently unpredictable. This is especially so when a matter is still in its early stages, the damages sought are indeterminate or unsupported, significant facts are unclear or disputed, novel questions of law or other meaningful legal uncertainties exist, a request to certify a proceeding as a class action is outstanding or granted, multiple parties are named, or regulatory or other governmental entities are involved. Other contingent exposures and their ultimate resolution are similarly unpredictable for reasons that can vary based on the circumstances. As a result, we often are unable to determine how or when threatened or pending legal matters and other contingent exposures will be resolved and what losses may be incrementally and ultimately incurred. Actual losses may be higher or lower

Skilled employees are our most important resource, and competition for talented people is intense. Even though compensation and benefits expense is among our highest costs, we may not be able to locate and hire the best people, keep them with us, or properly motivate them to perform at a high level. This risk may be exacerbated due to some of our competitors having significantly greater scale, financial and operational resources, and brand recognition. While we strive to mitigate human-capital risks, our senior executives and other key leaders have deep and broad industry experience and would be difficult to replace without some degree of disruption. For example, in October 2023 our former CEO provided notice of his intent to retire, and the search for a permanent replacement remains ongoing. In addition, our former General Counsel provided his notice of resignation and left the company in December 2023 and our current President of Consumer and Commercial Banking has provided notice of her intent to retire effective July 1, 2024. As a result of these departures, we may face disruption in our business as we seek to identify and transition permanent successors into these roles. In addition, we may experience competition in retaining employees based on remote or other flexible work arrangements, and our ability to attract or retain qualified employees may be adversely affected if our work arrangements are perceived as less favorable than those of our competitors. Continued scrutiny of compensation practices, especially in the financial services industry, has made this competition for talent only more difficult. In addition, many parts of our business are particularly dependent on key personnel, and retaining talented people in certain areas, such as technology, has been challenging. Further, growth in our businesses, through acquisitions or otherwise, will further increase our need for skilled employees. If we were to lose

Acquisitions involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower-than-expected performance, higher-than-expected costs, difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with customers or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes. An acquisition also could be dilutive to our existing stockholders if we were to issue common stock to fully or partially pay or fund the purchase price. We, moreover, may not be successful in identifying appropriate acquisition candidates, integrating acquired companies or businesses, or realizing expected value from acquisitions. There is significant competition for valuable acquisition targets, and we may not be able to acquire other companies or businesses on attractive terms. No assurance can be given that we will pursue future acquisitions, and our ability to grow and successfully compete may be impaired if we choose not to pursue or are unable to successfully make acquisitions.

Liquidity is the ability to fund increases in assets and meet obligations as they come due, all without incurring unacceptable losses. Banks are especially vulnerable to liquidity risk because of their role in the maturity transformation of demand or short-term deposits into longer-term loans or other extensions of credit. We, like other financial services companies, rely to a significant extent on external sources of funding (such as deposits and borrowings) for the liquidity needed to conduct our business and operations. A number of factors beyond our control, however, could have a detrimental impact on the availability or cost of that funding and thus on our liquidity. These include market disruptions, changes in our credit ratings or the sentiment of our investors, the state of the regulatory environment and monetary and fiscal policies, competitive dynamics, reputational damage, the confidence of depositors in us or the financial-services industry generally, financial or systemic shocks, and significant counterparty failures. For example, in August 2023, the U.S. banking agencies issued a proposed rule that would require Category II, III, and IV firms, their large consolidated banks, and other institutions to issue and maintain minimum amounts of long-term debt that is most readily able to absorb losses in a resolution proceeding. Due to the current structure and amount of debt instruments issued by Ally and Ally Bank, this proposal would significantly affect us. Refer to Note 20 to the Consolidated Financial Statements for further discussion. Weak business or operational performance, unexpected declines or limits on dividends or other distributions from our subsidiaries, and other failures to execute our strategic plan also could adversely affect Ally’s liquidity position.

We have significant maturities of unsecured debt each year. While we have reduced our reliance on unsecured funding as our deposits have grown to 88% of our total funding profile as of December 31, 2023, it remains an important component of our capital structure and financing plans. At December 31, 2022,2023, approximately $2.1$1.5 billion in principal amount of total outstanding consolidated unsecured debt is scheduled to mature in 2023,2024, and approximately $1.5$2.5 billion and $2.5 billion$149 million is scheduled to mature in 20242025 and 2025,2026, respectively. We also utilize secured funding. At December 31, 2022,2023, approximately $2.4$2.9 billion in principal amount of total outstanding consolidated secured long-term debt is scheduled to mature in 2023,2024, approximately $2.9$1.9 billion is scheduled to mature in 2024,2025, and approximately $1.4$1.7 billion is scheduled to mature in 2025.2026. Furthermore, at December 31, 2022,2023, approximately $26.1$43.5 billion in certificates of deposit at Ally Bank are scheduled to mature in 2023,2024, which is not included

At times we may rely on our ability to borrow from other financial institutions, and bank facilities are generally up for renewal on a yearly basis. Any weakness in market conditions, tightening of credit availability, or other events referenced earlier in this risk factor could have a negative effect on our ability to refinance any existing facilities and could increase the costs of bank funding. Ally and Ally Bank also continue to access the securitization markets. While those markets have stabilized following the liquidity crisis that commenced in 2007–2008, there can be no assurances that these sources of liquidity will remain available to us.

We have a significant amount of indebtedness apart from deposit liabilities. At December 31, 2022,2023, we had approximately $18.6$18.3 billion in principal amount of indebtedness outstanding (including $7.7$7.1 billion in secured indebtedness). Interest expense on our indebtedness was equal to approximately 8% of our total financing revenue and other interest income for the year ended December 31, 2022.2023. We also have the ability to create additional indebtedness.

If our debt service obligations increase, whether due to the increased cost of existing indebtedness or the incurrence of additional indebtedness, more of our cash flow from operations would need to be allocated to the payment of principal of, and interest on, our indebtedness, which would reduce the funds available for other purposes. Our indebtedness also could limit our ability to execute our strategic plan and withstand competitive pressures and could reduce our flexibility in responding to changing business and economic conditions. In addition, if we are unable to satisfy our indebtedness and other obligations in full and on time, our business, reputation, and value as a going concern could be profoundly and perhaps inexorably damaged.

The cost and availability of our funding are meaningfully affected by our short- and long-term credit ratings. Each of Standard & Poor’s Rating Services, Moody’s Investors Service, Inc., Fitch, Inc., and Dominion Bond Rating Service rates some or all of our debt, and these ratings reflect the rating agency’s opinion of our financial strength, operating performance, strategic position, and ability to meet our obligations. Agency ratings are not a recommendation to buy, sell, or hold any security and may be revised or withdrawn at any time. Each agency’s rating should be evaluated independently of any other agency’s rating.

FutureIn August 2023, citing macroeconomic trends impacting the banking industry, such as increased costs of funding and rapid tightening in monetary policy, Moody’s downgraded the credit ratings of a number of banks. Additionally, Moody’s downgraded the outlook of a number of banks, including Ally, where the outlook was lowered from Stable to Negative. Any future downgrades to our credit ratings or their failure to meet investor expectations may result in higher non-deposit borrowing costs, reduced access to the banking and capital markets, more restrictive terms and conditions being added to any new or replacement financing arrangements.

Our businesses are driven by robust economic and market activity, monetary and fiscal stability, and positive investor, business, and consumer sentiment. A downturn in economic conditions, disruptions in the equity or debt markets, high unemployment or underemployment, depressed vehicle or housing prices, unsustainable debt levels, high inflation, high interest rates, unfavorable changes in interest rates, declines in household incomes or savings, deteriorating consumer or business sentiment, consumer or commercial bankruptcy filings, or declines in the strength of national or local economies could decrease demand for our products and services, increase the amount and rate of delinquencies and losses, raise our operating and other expenses, and negatively impact the returns on and the value of our loans, investment portfolio, and other assets. Further, if a significant and sustained increase in fuel prices or other adverse conditions were to lead to diminished new and used vehicle purchases or prices, our automotive finance and insurance businesses could suffer considerably. In addition, concerns about the pace of economic growth and uncertainty about fiscal and monetary policies can result in significant volatility in the financial markets and could impact our ability to obtain cost-effective funding. If any of these events were to occur or worsen, our business, results of operation, and financial condition could be adversely affected.

Geopolitical conditions, government shutdowns, military conflicts (including Russia’s invasion of Ukraine)Ukraine and the conflicts in the Middle East), acts or threats of terrorism, natural disasters, pandemics (including the COVID-19 pandemic), and other conditions or events beyond our control may adversely affect our business, results of operations, financial condition, or prospects. For example, military conflicts, acts or threats of terrorism, and political, financial, or military actions taken in response could adversely affect general economic, business, or market conditions and, in turn, us, especially as an intermediary within the financial system. In addition, nation states engaged in warfare or other hostile actions may directly or indirectly use cyberattacks against financial systems and financial-services companies like us to exert pressure on one another or other countries with influence or interests at stake. We also could be negatively impacted if our key personnel, a significant number of our employees, or our systems or infrastructure were to become unavailable or damaged due to a pandemic, natural disaster, war, act of terrorism, accident, or similar cause. Furthermore, a shutdown of the United States government could adversely affect the economy and increase the risk of economic instability and market volatility, which could have an adverse impact on our business, financial condition, liquidity, and results of operations. These same risks and uncertainties arise too for the service providers and counterparties on whom we depend as well as their own third-party service providers and counterparties.

TheFor example, the most notable impact of COVID-19 on our results of operations was a significant increase in our provision expense for credit losses during the year ended December 31, 2020. This was primarily driven by incremental reserves associated with a deterioration in macroeconomic conditions, such as unemployment, following the onset of the pandemic. In the case of Russia’s invasion of Ukraine and the current conflicts in the Middle East, security risks as well as increases in fuel and other commodity costs, supply-chain disruptions, and associated inflationary pressures have impacted our business the most. These conditions and events and others like them are highly complex and inherently uncertain, and their effect on our business, results of operations, financial condition, and prospects in the future cannot be reliably predicted.

Our financial statements are subject to the application of U.S. GAAP, which are periodically revised or expanded. The application of U.S. GAAP is also subject to varying interpretations over time. Accordingly, we are required to adopt new or revised accounting standards or comply with revised interpretations that are issued from time to time by various parties, including accounting standard setters and those who interpret the standards, such as the FASB, the SEC, banking agencies, and our independent registered public accounting firm. Those changes are beyond our control but could adversely affect our revenues, expenses, profitability, or financial condition. For example, the adoption of CECL effective January 1, 2020, resulted in a significant increase to our allowance for loan losses in 2020. Refer to Note 1 to the Consolidated Financial Statements for financial accounting standards issued by the FASB, but not yet adopted by the Company.

We are exposed to portfolio concentrations in some states, including California, Texas, and Florida. Factors adversely affecting the economies and applicable laws in these states, including public policies that have the effect of drawing financial-services companies into contentious political or social issues, could have an adverse effect on our business, results of operations, and financial condition.

The performance and value of our business could be negatively impacted by any reputational harm that we may suffer, especially as an intermediary within the financial system. This harm could arise from negative publicity outside of our control or our failure to adequately address issues arising from our conduct or in connection with the financial services industry generally. Risks to our reputation could arise in any number of contexts—for example, stricter regulatory or supervisory environments, cyber incidents and other security breaches, inabilities to meet customer expectations, political controversies and social trends involving financial-services, mergers and acquisitions, lending or banking practices, actual or perceived conflicts of interest, failures to prevent money laundering, inappropriate conduct by employees, inadequate corporate governance, and any similar issues affecting our service providers.

Governments, investors, customers, and the general public are increasingly focused on ESG practices, oversight, and disclosures. For us and others in the financial-services industry, this focus extends to the practices and disclosures of the customers, counterparties, and service providers with whom we choose to do business. For example, while we have a smaller carbon footprint as a digital financial services company, and do not have commercial-lending relationships with a host of sensitive industries (such as those whose products are or are

Our operating systems and infrastructure, as well as those of our service providers or others on whom we rely, are subject to security risks that are rapidly evolving and increasing in scope, complexity, and frequency. This is due, in part, to the introduction of new technologies, the continued expansion of the use of internet and telecommunications technologies (including mobile devices) to conduct financial and other business transactions, and the increased sophistication and activities of hostile state-sponsored actors, organized crime, perpetrators of fraud, hackers, terrorists, and others. We, along with other financial institutions, our service providers, and others on whom we rely, have been and are expected to continue to be the target of cyberattacks, which could include computer viruses, malware, malicious or destructive code, social engineering (including phishing or spear phishing attacks), denial-of-service or denial-of-information attacks, ransomware, identity theft, access violations by employees or vendors, attacks on the personal email of employees, and ransom demands accompanied by threats to expose security vulnerabilities. Risks relating to cyberattacks on our service providers and other third parties, including supply-chain attacks affecting our software and information-technology providers, have been rising as such attacks become increasingly frequent and severe. The development of new technologies, as well as the utilization of decentralized technology infrastructures (such as our increased utilization of cloud computing) and software-defined networks, could expose us to additional cybersecurity risks. Further, the use of artificial intelligence by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our service providers and others on whom we rely. We, our service providers, and others on whom we rely are also exposed to more traditional security threats to physical facilities and personnel.

These security risks could result in business, reputational, financial, regulatory, and other harm to us, which could be particularly pronounced due to our being a digital financial-services company with a meaningful dependence on service providers. For example, if sensitive, confidential, or proprietary data or other information about us or our customers, employees, or third parties were improperly disclosed, accessed, or destroyed because of a security breach, we could experience severe business or operational disruptions, reputational damage, contractual claims, supervisory actions, or litigation by private plaintiffs. As a digital financial-services company and a direct bank with no branch network, we may face heightened pressure to resolve security breaches more expeditiously to prevent or mitigate a loss of depositor or customer confidence, and if we were to fail to do so, our viability as a going concern could be threatened. As threats inevitably evolve, we expect to continue experiencing increased scrutiny of our security frameworks and protocols by supervisory authorities and others and to continue expending significant resources to enhance our defenses, to educate our employees, to monitor and support the defenses established by our service providers and others on whom we rely, and to investigate and remediate incidents and vulnerabilities as they arise or are identified. Even so, we may not be able to anticipate or implement effective preventive measures against all security breaches, especially because techniques change frequently, attacks can be launched with no warning from a wide variety of sources around the globe, and attackers often need few resources to extensively probe and exploit vulnerabilities over lengthy periods of time. A sophisticated breach, moreover, may not be identified until well after the attack has occurred and the damage has been caused.

We also could be adversely affected by security risks faced by others. For example, a cyberattack or other security breach affecting a service provider or another entity on whom we rely could negatively impact us and our ability to conduct business and operations just as much as a breach affecting us directly. Further, in such a circumstance, we may not receive timely notice of or sufficient information about the breach or be able to exert any meaningful control or influence over how and when the breach is addressed. In addition, a security threat affecting the business community, the markets, or parts of them may cycle or cascade through the financial system and harm us. The mere perception of a security breach involving us or any part of the financial services industry, whether or not true, also could damage our business, operations, or reputation.

We rely heavily upon communications, data management, and other operating systems and infrastructure—including cloud-based services—to conduct our business and operations, which creates meaningful operational risk for us. For example, during 2021, there were a number of widely publicized cases of outages in connection with access to cloud service providers. Any failure of or interruption in these systems or infrastructure or those of our service providers or others on whom we rely—including as a result of inadequate or failed technology or processes, unplanned or unsuccessful updates to technology, sudden increases in transaction volume, human errors, fraud or other misconduct, deficiencies in the integration of acquisitions or the commencement of new businesses, energy or similar infrastructure outages, disruptions in communications networks or systems, natural disasters, catastrophic events, pandemics, acts of terrorism, political or social unrest, external or internal security breaches, acts of vandalism, cyberattacks such as computer viruses and malware, misplaced or lost data, or breakdowns in business continuity plans—could cause failures or delays in receiving applications for loans and operating leases, underwriting or processing loan or operating-lease applications, servicing loans and operating leases, accessing online accounts, processing transactions, executing brokerage orders, communicating with our customers, managing our investment portfolio, or otherwise conducting our business and operations. These adverse effects could be exacerbated if systems or infrastructure need to be taken offline or meaningfully repaired, if backup systems or infrastructure are not adequately redundant and effective for the conduct of our business and operations, or if technological or other solutions do not exist or are slow to be developed. Further, to the extent that the systems or infrastructure of service providers or others are involved, we may have little or no knowledge, control, or influence over how and when failures or delays are addressed. As a digital financial-services company with a meaningful dependence on service providers, we are susceptible to business, reputational, financial, regulatory, and other harm as a result of these risks.

In the ordinary course of our business, we collect, store, process, and transmit sensitive, confidential, or proprietary data and other information, including business information, intellectual property, and the personally identifiable information of customers and employees. The secure collection, storage, processing, and transmission of this information are critical to our business and reputation, and if any of this information were mishandled, misused, improperly accessed, altered, lost, or stolen or if related operations were disabled or otherwise disrupted, we could suffer significant business, reputational, financial, regulatory, and other damage.

Even when a failure of or interruption in operating systems or infrastructure is timely resolved, we may need to expend substantial resources in doing so, may be required to take actions that could adversely affect customer satisfaction or behavior, and may be exposed to reputational damage. We also could be exposed to contractual claims, supervisory actions, or litigation by private plaintiffs.

As a digital financial-services company and a direct bank with no branch network, we significantly depend on technology to deliver our products and services and to otherwise conduct our business and operations. To remain technologically competitive and operationally efficient, we invest in system upgrades, new solutions, cloud-based services, and other technology initiatives. Many of these initiatives take a significant amount of time to develop and implement, are tied to critical systems, and require substantial financial, human, and other resources.resources, and our utilization of artificial intelligence technologies could result in content or analyses that are inaccurate or deficient. Although we take steps to mitigate the risks and uncertainties associated with these initiatives, they are not always implemented on time, within budget, or without negative financial, operational, or customer impact and do not always perform as we or our customers expect, and no assurance can be provided that initiatives in the future will be or will do so. We also may not succeed in anticipating or keeping pace with future technology needs, the technology demands of customers, or the competitive landscape for technology. If we were to misstep in any of these areas, our business, financial results, or reputation could be negatively impacted. Our use of systems and other technologies also depends on rights or interests in the underlying intellectual property, which we or our service providers may own or license. If we or a service provider were alleged or found to be infringing on the intellectual-property rights of another person or entity, we could be liable for significant damages for past infringement, substantial fees for continued use, and deprivation of access for limited or extended periods of time without the practical availability of an alternative.

From time to time we have made, and in the future will make, forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These statements can be identified by the fact that they do not relate strictly to historical or current facts. Forward-looking statements often use words such as “believe,” “expect,” “anticipate,” “intend,” “pursue,” “seek,” “continue,” “estimate,” “project,” “outlook,” “forecast,” “potential,” “target,” “objective,” “trend,” “plan,” “goal,” “initiative,” “priorities,” or other words of comparable meaning or future-tense or conditional verbs such as “may,” “will,” “should,” “would,” or “could.” Forward-looking statements conveyOur long-term strategic objectives are centered around (1) differentiating our expectations, intentions, or forecasts about future events, circumstances, or results.

Unless the context otherwise requires, the following definitions apply. The term “loans” means the following consumer and commercial products associated with our direct and indirect financing activities: loans, retail installment sales contracts, lines of credit, and other financing products excluding operating leases. The term “operating leases” means consumer- and commercial-vehicle lease agreements where Ally is the lessor and the lessee is generally not obligated to acquire ownership of the vehicle at lease-end or compensate Ally for the vehicle’s residual value. The terms “lend,” “finance,” and “originate” mean our direct extension or origination of loans, our purchase or

Ally Invest Advisors Inc.(Ally Invest Advisors) is registered as an investment adviser with the SEC. As a result, the firm is subject to a host of requirements governing investment advisers and their personnel under the Investment Advisers Act of 1940, as amended, and related rules and regulations, including certain fiduciary and other obligations with respect to its relationships with its consolidated subsidiaries unlessinvestment advisory clients.

Regulators conduct periodic examinations of Ally Invest Securities and Ally Invest Advisors and regularly review reports that the context otherwisefirms are required to submit on an ongoing basis. Violations of relevant regulatory requirements could result in adverse consequences for the firms and their personnel, including censure, penalties and fines, the issuance of cease-and-desist orders, and restriction, suspension or expulsion from the securities or commodity-futures industries.

Our annual, CEO-sponsored enterprise-wide recognition program, “LEADing the Way,” is designed to recognize employees whose leadership and performance consistently model our core values in one or our)more of the following areas: innovation, risk culture, corporate citizenship, customer experience, DE&I, process improvement, or other attributes that reflect our overall culture. This award is one of the highest recognitions an employee can receive at Ally. In 2023, 83 team members were recognized with this award. Recipients are nominated based on exceeding their LEAD core value performance objective, which is required for all employees. Additionally, employees can nominate colleagues for the quarterly peer-to-peer “I’m An Ally” award recognition program that provides employees the opportunity to recognize the hard work of individuals across the entire organization. These recognition programs reinforce our continued commitment to our culture.

While the scope, intensity, and focus of governmental oversight can vary from time to time, we expect a highly demanding environment for the foreseeable future. In recent years, regulatory and other governmental agencies have taken a host of actions that create more challenging and volatile financial and operating conditions for financial-services companies, including through formal rulemakings that change the law or interpretations of the law, supervisory expectations and public statements that are designed to informally compel changes in industry practices, and more aggressive approaches to enforcement that are accompanied by increasingly severe penalties. These actions are comprehensive in their coverage, such as rulemakings on climate-related disclosures, cybersecurity risk governance (including incident disclosure), CRA reform, credit-card fees (such as the CFPB’s proposed rule to cap late fees), and personal-financial-data rights as well as guidance and statements on mergers and acquisitions, regulatory capital, resolution planning, automotive financing and insurance, fees for financial services, and UDAAP. Further, following the failures of three large banks in 2023, banking regulators have proposed changes, or indicated the potential for changes, regarding the regulation and supervision of banking organizations, in particular those, such as Ally, with $100 billion or more in assets. The introduction of new or more stringent regulatory requirements, as well as heightened supervisory expectations, could require Ally to maintain additional capital or liquidity or incur significant expenses. Governmental oversight of this kind may increase our operating costs or reduce our revenues, limit the types of financial services and products we may offer, alter the investments we may make, affect the manner in which we conduct our business drivenand operations, increase our litigation and regulatory costs, and enhance the ability of others to offer more competitive financial services and products. We continue to devote substantial time and resources to risk management, compliance, regulatory-change management, and cybersecurity and other technology initiatives, each of which—whether successful or not—also may adversely affect our ability to operate profitably or to pursue advantageous business opportunities.

In connection with their continuous supervision and examinations of us, the FRB, the UDFI, the CFPB, the SEC, FINRA, the NYDFS, or other regulatory agencies may explicitly or implicitly require changes in our business or operations. Such a requirement may be judicially enforceable or impractical for us to contest, and if we are unable to comply with the requirement in a timely and effective manner, we could become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives. The financial-services industry continues to face scrutiny from supervisory authorities in the examination process, including through an increasing use of horizontal reviews from a broader industry perspective as well as strict enforcement of laws at federal, state, and local levels—particularly in connection with business and other practices that may harm or appear to harm consumers and compliance with anti-money-laundering, sanctions, and related laws. Because of the regulatory and supervisory framework, financial institutions often are less inclined to litigate with governmental authorities. In general, the amounts paid by financial institutions in settling proceedings or investigations and the severity of other terms of regulatory settlements are likely to remain elevated. In some cases, governmental authorities have required criminal pleas or other extraordinary terms, including admissions of wrongdoing and the imposition of monitors, as part of settlements. Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business or make acquisitions, our flexibility in conducting operations, and our ability to pay dividends or utilize capital. Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a missionloss of customer or investor confidence, and a prior enforcement action may also increase the risk that regulators and governmental authorities pursue formal enforcement actions in connection

Our regulatory and supervisory environments—whether at federal, state, or local levels—are not static. No assurance can be given that applicable statutes, regulations, and other laws will not be amended or construed differently, that new laws will not be adopted, that any of these laws will not be enforced more aggressively, or that applicable laws, or the interpretation or enforcement thereof, may overlap, diverge or conflict across jurisdictions. Changes in the regulatory and supervisory environments could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, and restricting our ability to make acquisitions or pursue other profitable opportunities. Further, our noncompliance with applicable laws—whether as a relentless allyresult of changes in interpretation or enforcement, system or human errors, or otherwise and, in some cases, regardless of whether noncompliance was inadvertent—could result in the suspension or revocation of licenses or registrations that we need to operate and in the initiation of enforcement and other supervisory actions or private litigation.

Much of our business and operations is conducted by Ally Bank, which is a direct bank with no branch network, and a primary component of our business strategy is its continued growth. This growth includes expanding our consumer and commercial lending and increasing our deposit customers and communities. The Company serves customers through a full rangebalances while optimizing our cost of online banking services (including deposits, mortgage lending, point-of-sale personal lendingfunds. If regulatory agencies raise concerns about any aspect of our business strategy for Ally Bank or the way in which we implement it, we may be obliged to limit or even reverse the growth of Ally Bank or otherwise alter our strategy, which could have an adverse effect on our business, financial condition, results of operations, or prospects. In addition, if we are compelled to retain or shift any of our business activities in or to nonbank affiliates, our funding costs for those activities—such as unsecured funding in the capital markets—could be more expensive than our cost of funds at Ally Bank.

We are currently subject to enhanced prudential standards that offers capital for equity sponsors and middle-market companies.have been established by the FRB. Under the Tailoring Rules, Ally is a Delaware corporationCategory IV firm and, as such, is generally subject to supervisory stress testing on a two-year cycle and is registeredrequired to submit an annual capital plan to the FRB.

Further, we may be required to raise capital if we are at risk of failing to satisfy our minimum regulatory capital ratios or related supervisory requirements, whether due to inadequate operating results that erode capital, future growth that outpaces the accumulation of capital through earnings, changes in regulatory capital standards, changes in accounting standards that affect capital (such as CECL), or otherwise. In addition, we may elect to raise capital for strategic reasons even when we are not required to do so. Our ability to raise capital on favorable terms or at all will depend on general economic and market conditions, which are outside of our control, and on our operating and financial performance. Accordingly, we cannot be assured of being able to raise capital when needed or on favorable terms. An inability to raise capital when needed and on favorable terms could damage the performance and value of our business, prompt supervisory actions and private litigation, harm our reputation, and cause a loss of customer or investor confidence, and if the condition were to persist for any appreciable period of time, our viability as a BHCgoing concern could be threatened. Even if we are able to raise capital but do so by issuing common stock or convertible securities, the ownership interest of our existing stockholders could be diluted, and the market price of our common stock could decline.

Our expectation of the residual value of a vehicle subject to an automotive operating lease contract is a critical element used to determine the amount of the operating lease payments under the BHC Act,contract at the time the customer enters into it. As a result, to the extent that the actual residual value of the vehicle—as reflected in the sale proceeds received upon remarketing at lease termination—is less than the expected residual value for the vehicle at lease inception, we will incur additional depreciation expense and lower profit on the operating lease transaction than our priced expectations. Our expectation of used vehicle values is also a factor in determining our pricing of new loan and operating lease originations. In stressed economic environments, residual-value risk may be even more volatile than credit risk. To the extent that used vehicle prices are significantly lower than our expectations, our profit on vehicle loans and operating leases could be substantially less than our expectations, even more so if our estimate of loss frequency is underestimated as well. In addition, we could be adversely affected if we fail to efficiently process and effectively market off-lease vehicles and repossessed vehicles and, as a consequence, incur higher-than-expected disposal costs or lower-than-expected proceeds from the vehicle sales.

The level of and changes in market rates of interest—and, as a result, these risks and uncertainties—are beyond our control. The dynamics among these risks and uncertainties are also challenging to assess and manage. For example, while an FHCaccommodative monetary policy may benefit us to some degree by spurring economic activity among our customers, such a policy may ultimately cause us more harm by inhibiting our ability to grow or sustain net interest income. A rising interest rate environment can pose different challenges, such as potentially slowing the demand for credit, increasing delinquencies and defaults, and reducing the values of our loans and fixed-income securities. Market volatility in interest rates, including the rate of change, can create particularly difficult conditions. Following a prolonged period in which the federal funds rate was stable or decreasing, the FRB increased this benchmark rate on a number of occasions during 2017 and 2018 and began to end its quantitative-easing program and reduce the size of its balance sheet. During 2019, however, the FRB reversed course and reduced the federal funds rate several times and, in March 2020, reduced the target range for the federal funds rate to zero to 0.25 percent. A meaningful rise in inflation during 2021 and through 2022 prompted the FRB to sharply increase the federal funds rate more than expected. The federal funds target range reached 5.25–5.50% in 2023. However, FRB officials have signaled that decreases are likely for