UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 10-K

PART I

When we refer to “Huntington,” “we,” “our,” “us,” and “the Company” in this report, we mean Huntington Bancshares Incorporated and our consolidated subsidiaries, unless the context indicates that we refer only to the parent company, Huntington Bancshares Incorporated. When we refer to the “Bank” in this report, we mean our only bank subsidiary, The Huntington National Bank, and its subsidiaries.

Item 1: Business

We are a multi-state diversified regional bank holding company organized under Maryland law in 1966 and headquartered in Columbus, Ohio. We have 15,578 average full-time equivalent employees. Through the Bank, we are committed to making people’s lives better, helping businesses thrive, and strengthening the communities we serve, and we have over 150 years ofbeen servicing the financial needs of our customers.customers since 1866. Through our subsidiaries, we provide full-service commercial and consumer deposit, lending, and other banking services,services. These include, but are not limited to, payments, mortgage banking, services, automobile, financing, recreational vehicle and marine financing, investment banking, capital markets, advisory, equipment financing, distribution finance, investment management, trust, services, brokerage, services, insurance, products and services, and other financial products and services. AtAs of December 31, 2020, the Bank had 112023, our 999 full-service branches and private client group offices and 828 branchesare primarily located in Ohio, Colorado, Illinois, Indiana, Kentucky, Michigan, Minnesota, Pennsylvania, West Virginia, and West Virginia.Wisconsin. Select financial services and other activities are also conducted in various other states. International banking services are available through the headquarters office in Columbus, Ohio. Our foreign banking activities, in total or with any individual country, are not significant.

Our business segments are based on our internally-aligned segment leadership structure, which is how we monitor results and assess performance. For each of our four business segments,segment, we expect the combination of our business model, investment in products and capabilities, and exceptional service to provide a competitive advantage that supports revenue and earnings growth. Our business model emphasizes the delivery of a complete set of banking products and services offered by larger banks but distinguished by local delivery and customer service.

A key strategic emphasis has been for our business segments to operate in cooperation to provide products and services to our customers and to build stronger and more profitable relationships using our OCR sales and service process.process, which aligns to our vision to be the leading people-first, digitally powered bank. The objectives of OCR are to:

Following is a description of our four business segments and the Treasury / Other function:

We compete with other banks and financial services companies such as savings and loans, credit unions, and finance and trust companies, as well as mortgage banking companies, equipment and automobile financing companies (including captive automobile finance companies), insurance companies, mutual funds, investment advisors, and brokerage firms, and non-bank lenders both within and outside of our primary market areas. Financial Technology Companies, or FinTechs, are also providing nontraditional, but increasingly strong, competition for our borrowers, depositors, and other customers.

We compete for loans primarily on the basis of a combination of value and service by building customer relationships as a result ofthrough addressing our customers’ entire suite of banking needs, demonstrating expertise, and providing convenience to our customers.convenience. We also consider the competitive pricing pressureslevels in each of our markets.

Many of our nonfinancial institution competitors have fewer regulatory constraints, broader geographic service areas, greateraccess to a larger pool of capital to deploy, and, in some cases, lower cost structures. In addition, competition for quality customers has intensified as a result of changes in regulation, advances in technology and product delivery systems, and consolidation among financial service providers.

FinTechs continue to emerge in key areas of banking. In addition, larger established technology platform companies continue to evaluate, and in some cases, create businesses focused on banking products. We are closely monitoringmonitor activity in the marketplace to ensure that our products and services are technologically competitive. Further, we continue to invest in and evolve our innovation program to develop, incubate, and launch new products and services driving ongoing differentiated value for our customers. Our overall strategy involves an active corporate development program that seeks to identify partnership and possible investment opportunities in technology-driven companies that can augment our distribution and product capabilities.

Regulatory Environment

The banking industry is highly regulated. We are subject to supervision, regulation, and examination by various federal and state regulators, including the Federal Reserve, OCC, SEC, CFPB, FDIC, FINRA, and various state regulatory agencies. The statutory and regulatory framework that governs us is generally intended to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole.

Banking statutes, regulations, and policies are continually under review by Congress, state legislatures, and federal and state regulatory agencies. In addition to laws and regulations, state and federal bank regulatory agencies may issue policy statements, interpretive letters, and similar written guidance applicable to Huntington and its subsidiaries. Any change in the statutes, regulations, or regulatory policies applicable to us, including changes in their interpretation or implementation, could have a material effect on our business or organization.

On May 24, 2018, the Economic Growth Act was signed into law, which amended, among other regulatory changes, various sections of the Dodd-Frank Act. In October 2019, the Federal Reserve adopted the EPS Tailoring Rule pursuant to the Economic Growth Act, which adjusted the thresholds at which certain enhanced prudential standards apply to U.S. BHCs with $100 billion or more in total consolidated assets.  Also in October 2019, the Federal Reserve, OCC, and FDIC adopted the Capital and Liquidity Tailoring Rule, which similarly adjusted the thresholds at which certain other capital and liquidity standards apply to U.S. BHCs and banks with $100 billion or more in total consolidated assets.  Under the Tailoring Rules, these BHCs and banks, including Huntington and the Bank, are placed into one of four risk-based categories based on the banking organization’s size, status as a global systemically important bank (or not), cross-jurisdictional activity, weighted short-term wholesale funding, nonbank assets, and off-balance sheet exposure.  The extent to which enhanced prudential standards and certain other capital and liquidity standards apply to these BHCs and banks depends on the banking organization’s category.  Under the Tailoring Rules, Huntington and the Bank each qualify as a Category IV banking organization subject to the least restrictive of the requirements applicable to firms with $100 billion or more in total consolidated assets.

We are also subject to the disclosure and regulatory requirements of the Securities Act of 1933, as amended, and the Securities Exchange Act of 1934, as amended, both as administered by the SEC, as well as the rules of Nasdaq that apply to companies with securities listed on the Nasdaq Global Select Market.

The following discussion describes certain elements of the comprehensive regulatory framework applicable to us. This discussion is not intended to describe all laws and regulations applicable to Huntington, the Bank, and Huntington’s other subsidiaries.

Huntington is registered as a BHC with the Federal Reserve under the BHC Act and qualifies for andthat has elected to becomebe a FHC under the GLBA. As a FHC, Huntington is permitted toFHC. FHCs may engage in, and be affiliated with, companies engaging in a broader range of activities than those permitted for a BHC. BHCsBHC, so long as such activities are generally restricted to engaging in the business of banking, managing or controlling banks, and certain other activities determined by the Federal Reserve to be closely related to banking. FHCs may also engage in activities that are considered to be(i) financial in nature as well as thoseor incidental to such financial activity or (ii) complementary to a financial activity and that do not pose a substantial risk to the safety and soundness of a depository institution or to the financial system generally. These activities includinginclude, for example, securities underwriting, securities dealing, and making marketsa market in securities, and making merchant banking investments in non-financial companies. Huntingtoncompanies, and the Bankengaging in insurance underwriting and agency activities. To become and remain eligible for FHC status, a BHC and its subsidiary depository institutions must each remain “well-capitalized”meet certain criteria, including capital, management, and “well managed”CRA requirements. Failure to meet such criteria could result, depending on which requirements were not met, in order for Huntingtonrestrictions on new financial activities or acquisitions, or being required to maintain its status as a FHC. In addition, the Bank must receive a CRA rating of at least “Satisfactory” at its most recent examination for Huntington to engage in the full range ofdiscontinue existing activities that are not generally permissible for FHCs.BHCs.

Huntington is subject to primary supervision, regulation, and examination by the Federal Reserve, which serves as the primary regulator of our consolidated organization. The primary regulators of our non-bank subsidiaries

The Bank as a National Bank

A principal objective of the U.S. bank regulatory regime is to protect depositors and customers, the DIF, the U.S. banking and financial system, and financial markets as a whole by ensuring the financial safety and soundness of BHCs and banks, including Huntington and the Bank. Bank regulators regularly examine the operations of BHCs and banks. In addition, BHCs and banks are subject to periodic reporting and filing requirements.

The Federal Reserve, OCC, and FDIC have broad supervisory and enforcement authority with regard to BHCs and banks, including the power to conduct examinations and investigations, impose nonpublic supervisory agreements, issue cease and desist orders, impose fines and other civil and criminal penalties, terminate deposit insurance, and appoint a conservator or receiver. In addition, Huntington, the Bank, and other Huntington subsidiaries are subject to supervision, regulation, and examination by the CFPB, which is the primary administrator of most federal consumer financial statutes and Huntington’s primary consumer financial regulator. Supervision and examinations are confidential, and the outcomes of these actions may not be made public.

Bank regulators have various remedies available if they determine that the financial condition, capital resources, asset quality, earnings prospects, management, liquidity, or other aspects of a banking organization’s operations are unsatisfactory. The regulators may also take action if they determine that the banking organization or its management is violating or has violated any law or regulation. The regulators have the power to, among other things, (1) prohibit unsafe or unsound practices, (2) require affirmative actions to correct any violation or practice, (3) issue administrative orders that can be judicially enforced, (4) direct increases in capital, (5) direct the sale of subsidiaries or other assets, (6) limit dividends and distributions, (7) restrict growth, (8) assess civil monetary penalties, (9) remove officers and directors, and (10) terminate deposit insurance.

Engaging in unsafe or unsound practices or failing to comply with applicable laws, regulations, and supervisory agreements could subject the Company, its subsidiaries, and their respective officers, directors, and institution-affiliated parties to the remedies described above, and other sanctions. In addition, the FDIC may terminate a bank’s deposit insurance upon a finding that the bank’s financial condition is unsafe or unsound or that the bank has engaged in unsafe or unsound practices or has violated an applicable rule, regulation, order, or condition enacted or imposed by the bank’s regulatory agency.

In November 2018,Huntington is subject to the Federal Reserve adopted a new rating system, theReserve’s LFI Rating System, to align its supervisory rating system for large financial institutions, including Huntington, with its current supervisory programs for these firms. As compared to the rating system it replaces, which will continue to be used for smaller BHCs, the LFI Rating System places a greater emphasis on capital and liquidity, including related planning and risk management practices. Huntington received its firstpractices, as compared to the supervisory rating under the LFI Rating System in 2020.system applicable to smaller BHCs. These ratings will remainare confidential.

Bank Acquisitions by Huntington

BHCs, such as Huntington, must obtain prior approval of the Federal Reserve in connection with any acquisition that results in the BHC owning or controlling 5% or more of any class of voting securities of a bank or another BHC.

Acquisitions of Ownership of the Company

Acquisitions of Huntington’s voting stock above certain thresholds are subject to prior regulatory notice or approval under federal banking laws, including the BHC Act and the Change in Bank Control Act of 1978. Under the Change in Bank Control Act, a person or entity generally must provide prior notice to the Federal Reserve before

Interstate Banking

Under the Riegle-Neal Act, a BHC may acquire banks in states other than its home state, subject to any state requirement that the bank has been organized and operating for a minimum period of time, not to exceed five years, and the requirement that the BHC not control, prior to or following the proposed acquisition, more than 10% of the total amount of deposits of insured depository institutions nationwide or, unless the acquisition is the BHC’s initial entry into the state, more than 30% of such deposits in the state (or such lesser or greater amount set by the state). The Riegle-Neal Act also authorizes banks to merge across state lines, thereby creating interstate branches. A national bank, such as the Bank, with the approval of the OCC may open a branch in any state if the law of that state would permit a state bank chartered in that state to establish the branch.

BHCs with consolidated assets of more than $100 billion, such as Huntington, are currently subject to certain enhanced prudential standards. As a result, Huntington is subject to more stringent standards, including liquidity and the Bankcapital requirements, leverage limits, stress testing, resolution planning, and risk management standards, than those applicable to smaller institutions. Certain larger banking organizations are subject to certain risk-based capital and leverage ratio requirements under the U.S. Basel III capital rules adopted by the Federal Reserve, for Huntington, and by the OCC, for the Bank. These rules implement the Basel III international regulatory capital standards in the United States, as well as certain provisions of the Dodd-Frank Act. These quantitative calculations are minimums, and the Federal Reserve and OCC may determine thatadditional enhanced prudential standards. As a Category IV banking organization, based on its size, complexity, or risk profile, must maintain a higher level of capital in order to operate in a safe and sound manner.

Liquidity Requirements

Under the Capital and Liquidity Tailoring Rule, Huntington, as a Category IV banking organization with less than $50 billion in weighted short-term wholesale funding, is exempt from the LCR and net stable funding ratio requirements but will continuecontinues to be subject to internal liquidity stress tests and standards.

UnderIn August 2023, the Dodd-Frank Act, as modified by the Economic Growth Act, BHCs with consolidated assets of more than $100 billion,U.S. banking agencies issued a proposed rule that would require certain large banking organizations such as Huntington to comply with long-term debt requirements and “clean holding company requirements” similar to those that currently only apply to U.S. global systemically important banking organizations. This proposal would also impose a long-term debt requirement on certain categories of insured depository institutions that are currently subject to certain enhanced prudential standards. As a result, Huntington is subject to more stringent standards, including liquidity and capital requirements, leverage limits, stress testing, resolution planning, and risk management standards, than those applicable to smaller institutions. Certain largernot consolidated subsidiaries of U.S. global systematically important banking organizations, are subject to additional enhanced prudential standards.

Huntington and the Bank elected to temporarily delay certain effects of CECL on regulatory capital until January 1, 2022, pursuant to a rule that allowed BHCs and banks to delay for two years 100% of the day-one impact of adopting CECL and 25% of the cumulative change in the reported allowance for credit losses since adopting CECL. As of December 31, 2023, we have phased in 50% of the cumulative CECL deferral with the remaining impact to be recognized through the first quarter 2025.

The following table presents the minimum regulatory capital ratios, minimum ratio plus the capital buffer, and well-capitalized minimums compared to enhanced prudential standards that werewith Huntington’s and the Bank’s regulatory capital ratios as of December 31, 2023, calculated using the regulatory capital methodology applicable as of the end of 2023.

Huntington is no longer subjecthas the ability to company-run stress testing requirementsprovide additional capital to the Bank to maintain the Bank’s risk-based capital ratios at levels which would be considered well-capitalized.

As of December 31, 2023, Huntington’s and is subject to supervisory stress tests every other year (as opposed to annually), less frequent internal liquidity stress tests,the Bank’s regulatory capital ratios were above the well-capitalized standards and reduced liquidity risk managementmet the applicable capital buffer requirements. Future rules

In July 2023, the U.S. banking agencies issued a proposed rule to implement the Economic Growth Act may further changeBasel III endgame agreement for large banks (Basel III Endgame Proposal). In addition to calculating risk-weighted assets under the enhanced prudentialcurrent U.S. standardized approach, the proposal introduces a new “expanded risk-based approach.” As compared with the standardized approach, the expanded risk-based approach includes more granular risk weights for credit risk and introduces a new market risk framework. The expanded risk-based approach also includes operational risk and credit valuation adjustment risk-weighted asset components. The proposal also would require the new market risk standards applicablefrom the proposal be applied in the standardized approach.

If adopted as proposed, Huntington would be required to Huntington.calculate its risk-based capital ratios under both the current U.S. standardized approach and the expanded risk-based approach and would be subject to the lower of the two resulting ratios for each risk-based capital ratio. The proposal would also require banking organizations to recognize most elements of AOCI in regulatory capital, including unrealized gains and losses on available-for-sale securities, and lower thresholds for deductions from CET1 capital for mortgage servicing assets and deferred tax assets, among other things. In addition, the proposal would apply the SCB to risk-based capital requirements calculated under both U.S. standardized approach and the expanded risk-based approach. The proposal includes a proposed effective date of July 1, 2025, with three-year transition arrangements until revised standards are fully phased in on July 1, 2028.

Capital Planning and Stress Testing

Huntington is required to develop, maintain, and submit to the Federal Reserve a capital plan every other year, forwhich is subject to supervisory review in connection with itsthe Federal Reserve’s CCAR process. Huntington is required to include within its capital plan an assessment of the expected uses and sources of capital and a description of all planned capital actions over the nine-quarter planning horizon, a detailed description of the process for assessing capital adequacy, its capital policy, and a discussion of any expected changes to its business plan that are likely to have a material impact on its capital adequacy. Under the stress buffer requirements, final rule adopted in March 2020, the CCAR process is used to determine a BHC’s stress capital bufferSCB requirement. Please refer to the Stress BufferSCB Requirements section below for further details.

SCB Requirements section below for further details.

For risk-based capital requirements, Huntington, as a large BHC, is provided an SCB by the stress capital buffer replaces the existing Capital Conservation Buffer, which was 2.5% as of January 1, 2019. Under the final rule, beginning in the 2020 CCAR cycle, Huntington will be required to calculate a stress capital buffer equal toFederal Reserve that is determined annually based on the greater of (i) the difference between its starting and minimum projected CET1 Risk-Based Capital Ratio under the severely adverse scenario in the supervisory stress test, plus the sum of the dollar amount of Huntington’s planned common stock dividends for each of the fourth through seventh quarters of the planning horizon as a percentage of risk-weighted assets, or (ii) 2.5%. As of December 31, 2020, Huntington’s stress capital buffer is 2.5%.

Huntington is authorized to make capital planning and stress testing process. Among other changes,distributions that are consistent with the revisedrequirements in the Federal Reserve’s capital plan rule, eliminatesinclusive of the assumption that Huntington’s balance sheet assets would increase over the planning horizon. In addition, providedSCB requirement. Provided that Huntington is otherwise in compliance with automatic restrictions on distributions under the Federal Reserve’s capital rules, Huntington willis no longer be required to seek prior approval to make capital distributions in excess of those included in its capital plan.

Restrictions on Dividends

Huntington is a legal entity separate and distinct from its banking and non-banking subsidiaries. Since our consolidated net income consists largely of net income of Huntington’s subsidiaries, our ability to make capital distributions, including paying dividends and repurchasing shares, depends upon our receipt of dividends from these subsidiaries. Under federal law, there are various limitations on the extent to which the Bank can declare and pay dividends to Huntington, including those related to regulatory capital requirements, general regulatory oversight to prevent unsafe or unsound practices, and federal banking law requirements concerning the payment of dividends out of net profits, surplus, and available earnings. Certain contractual restrictions also may limit the ability of the Bank to pay dividends to Huntington. No assurances can be given that the Bank will, in any circumstances, pay dividends to Huntington.

Huntington’s ability to declare and pay dividends to our shareholders is similarly limited by federal banking law and Federal Reserve regulations and policy. As discussed in the Capital Planning section above, in general, a BHC may pay dividends and repurchase stock only in accordance with a capital plan that has been reviewed by the Federal Reserve and as to which the Federal Reserve has not objected. The FRB announced that certain large BHCs, including Huntington, will be permitted to make both dividend and share repurchases during the first quarter of 2021, subject to limits based on the amount of dividends paid in the second quarter of 2020 and the bank's average net income for the four preceding quarters.

Huntington must maintain the applicable stress capital buffer and the Bank must maintain the CET1 Capital Conservation Buffer of 2.5%applicable capital buffer requirements to avoid becoming subject to restrictions on capital distributions, including dividends. For more information on the capital buffer requirements, see the SCB Requirements and the Regulatory Capital Requirements sections above.

Under the Volcker Rule, we are prohibited from (1) engaging in short-term proprietary trading for our own account and (2) having certain ownership interests in and relationships with hedge funds or private equity funds (covered funds). The Volcker Rule regulations contain exemptions for market-making, hedging, underwriting, trading in U.S. government and agency obligations, and also permit certain ownership interests in certain types of covered funds to be retained. They also permit the offering and sponsoring of covered funds under certain conditions. The Volcker Rule regulations impose significant compliance and reporting obligations on banking entities, such as Huntington. We have put in place the compliance programs required by the Volcker Rule and have either divested or received extensions for any holdings in illiquid covered funds.

In past years, Huntington was required to submit annually to the Federal Reserve and the FDICAs a resolution plan for the orderly resolution of Huntington and its significant legal entities under the U.S. Bankruptcy Code or other applicable insolvency laws in a rapid and orderly fashion in the event of future material financial distress or failure. In October 2019, the Federal Reserve and the FDIC adopted amendments to their resolution planning rule, and as a result of these amendments,Category IV banking organization, Huntington is no longernot required to submit a resolution plan to the Federal Reserve andReserve. As an insured depository institution, the FDIC.

Source of Strength

Huntington is required to serve as a source of financial and managerial strength to the Bank and, under appropriate conditions, to commit resources to support the Bank. This support may be required by the Federal Reserve at times when we might otherwise determine not to provide it or when doing so is not otherwise in the interests of Huntington or our shareholders or creditors. The Federal Reserve may require a BHC to make capital injections into a troubled subsidiary bank and may charge the BHC with engaging in unsafe and unsound practices if the BHC fails to commit resources to such a subsidiary bank or if it undertakes actions that the Federal Reserve believes might jeopardize the BHC’s ability to commit resources to such subsidiary bank.

Under these requirements, Huntington may in the future be required to provide financial assistance to the Bank should it experience financial distress. Capital loans by Huntington to the Bank would be subordinate in right of payment to deposits and certain other debts of the Bank. In the event of Huntington’s bankruptcy, any commitment by Huntington to a federal bank regulatory agency to maintain the capital of the Bank would be assumed by the bankruptcy trustee and entitled to a priority of payment.

FDIC as Receiver or Conservator of Huntington

Upon the insolvency of an insured depository institution, such as the Bank, the FDIC may be appointed as the conservator or receiver of the institution. Under the Orderly Liquidation Authority, upon the insolvency of a BHC, such as Huntington, the FDIC may be appointed as conservator or receiver of the BHC, if certain findings are made by the FDIC, the Federal Reserve, and the Secretary of the Treasury, in consultation with the President. Acting as a conservator or receiver, the FDIC would have broad powers to transfer any assets or liabilities of the institution without the approval of the institution’s creditors.

Depositor Preference

The FDIA provides that, in the event of the liquidation or other resolution of an insured depository institution, including the Bank, the claims of depositors of the institution (including the claims of the FDIC as subrogee of insured depositors) and certain claims for administrative expenses of the FDIC as a receiver would have priority over other general unsecured claims against the institution. If the Bank were to fail, insured and uninsured depositors, along with the FDIC, would have priority in payment ahead of unsecured, non-deposit creditors, including Huntington, with respect to any extensions of credit they have made to such insured depository institution.

Transactions between a Bank and its Affiliates

Federal banking laws and regulations impose qualitative standards and quantitative limitations upon certain transactions between a bank and its affiliates, including between a bank and its holding company and companies that the BHC may be deemed to control for these purposes. Transactions covered by these provisions must be on

Lending Standards and Guidance

The federal bank regulatory agencies have adopted uniform regulations prescribing standards for extensions of credit that are secured by liens or interests in real estate or made for the purpose of financing permanent improvements to real estate. Under these regulations, all insured depository institutions, such as the Bank, must adopt and maintain written policies establishing appropriate limits and standards for extensions of credit that are secured by liens or interests in real estate or are made for the purpose of financing permanent improvements to real estate. These policies must establish loan portfolio diversification standards, prudent underwriting standards (including loan-to-value limits) that are clear and measurable, loan administration procedures, and documentation, approval, and reporting requirements. The real estate lending policies must reflect consideration of the federal bank regulatory agencies’ Interagency Guidelines for Real Estate Lending Policies.

Heightened Governance and Risk Management Standards

Anti-Money Laundering

The Bank Secrecy Act and the Patriot Act contain anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act, as amended by the Patriot Act, requires depository institutions and their holding companies to undertake activities, including maintaining an AML program, verifying the identity of customers, verifying the identity of certain beneficial owners for legal entity customers, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies. The Bank is subject to the Bank Secrecy Act and, therefore, is required to provide its employees with AML training, designate an AML compliance officer, and undergo an annual, independent audit to assess the effectiveness of its AML program. The Bank has implemented policies, procedures, and internal controls that are designed to comply with these AML requirements. Bank regulators are focusing their examinations on AML compliance, and we will continue to monitor and augment, where necessary, our AML compliance programs. The federal banking agencies are required, when reviewing bank and BHC acquisition or merger applications, to take into account the effectiveness of the AML activities of the applicant.

The Anti-Money Laundering Act of 2020, enacted on January 1, 2021 as part of the National Defense Authorization Act, does not directly impose new requirements on banks, but requires the U.S. Treasury Department to issue National Anti-Money Laundering and Countering the Financing of Terrorism Priorities, and conduct studies and issue regulations that may, over the next few years, significantly alter some of the due diligence, recordkeeping and reporting requirements that the Bank Secrecy Act and USA PATRIOTPatriot Act impose on banks. The Anti-Money Laundering Act of 2020 also contains provisions that promote increased information-sharing and use of technology and increases penalties for violations of the Bank Secrecy Act and includes whistleblower incentives, both of which could increase the prospect of regulatory enforcement.

OFAC Regulation

OFAC is responsible for administering economic sanctions that affect transactions with designated foreign countries, nationals, and others, as defined by various Executive Orders and in various legislation. OFAC-administered sanctions take many different forms. For example, sanctions may include: (1) restrictions on trade with or investment in a sanctioned country, including prohibitions against direct or indirect imports from and exports to a sanctioned country and prohibitions on U.S. persons engaging in financial transactions relating to, making investments in, or providing investment-related advice or assistance to, a sanctioned country; and (2) a blocking of assets in which the government or “specially designated nationals” of the sanctioned country have an interest by prohibiting transfers of property subject to U.S. jurisdiction, including property in the possession or control of U.S. persons. OFAC also publishes lists of persons, organizations, and countries suspected of aiding, harboring, or engaging in terrorist acts, known as Specially Designated Nationals and Blocked Persons. Blocked assets, for example property and bank deposits, cannot be paid out, withdrawn, set off, or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Data Privacy

Federal and state law contains extensive consumer privacy protection provisions. The GLBA requires financial institutions to periodically disclose their privacy policies and practices relating to sharing such information and enables retail customers to opt out of our ability to share information with unaffiliated third parties under certain circumstances. Other federal and state laws and regulations impact our ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. These security and privacy policies and procedures for the protection of personal and confidential information are in effect across all businesses and geographic locations as applicable. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means.

Data privacy and data protection are areas of increasing state legislative focus. For example, in June of 2018,under California state law, the GovernorCCPA broadly defines personal information and substantially increases the rights of California signed into law the CCPA. The CCPA, which became effective on January 1, 2020, appliesresidents to for-profitunderstand how their personal information is collected, used, and otherwise processed by commercial businesses, that conduct business in California and meet certain revenue or data collection thresholds. The CCPA gives consumerssuch as affording them the right to request disclosure of information collected about them,access and whether that information has been sold or shared with others, the right to request deletion of personaltheir information (subject to certain exceptions), the rightand to opt out of the salecertain sharing and sales of personal information. The CCPA contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation and includes a private right of action (permitting lawsuits to be brought by private individuals instead of the consumer’sstate Attorney General or other government actor for certain breaches). In addition, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach. Moreover, the U.S. Congress has recently considered, and the right notis currently considering, various proposals for more comprehensive data privacy and security legislation, to be discriminated against for exercising these rights. The CCPA contains several exemptions, including that many, but not all, requirements of the CCPA are inapplicable to information that is collected, processed, sold, or disclosed pursuant to the GLBA. California voters also recently passed the California Privacy Rights Act, which will take effect on January 1, 2023, and significantly modifies the CCPA, including imposing additional obligations on covered companies and expanding California consumers’ rights with respect to certain sensitive personal information, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. In California, the CCPAwe may be interpreted or applied in a manner inconsistent with our understanding or similar laws may be adopted by other states where we operate. The federal government may also pass data privacy or data protection legislation.subject if passed.

Like other lenders, the Bank and other of our subsidiaries use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on us and our subsidiaries.

FDIC Insurance

The DIF provides insurance coverage for certain deposits, up to a standard maximum deposit insurance amount of $250,000 per depositor, and is funded through assessments on insured depository institutions, based on the risk each institution poses to the DIF. The Bank accepts customer deposits that are insured by the DIF and, therefore, must pay insurance premiums. The FDIC may increase the Bank’s insurance premiums based on various factors, including the FDIC’s assessment of its risk profile.

As of June 30, 2020, the DIF reserve ratio fell to 1.30%. The FDIC, as required under the Federal Deposit Insurance Act,FDIA, established a plan on September 15, 2020, to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35% within eight years. TheThis plan did not include an increase in the deposit insurance assessment rate. Based on the FDIC’s restoration plan projectsrecent projections, however, the FDIC determined that the DIF reserve ratio to exceed 1.35%is at risk of not reaching the statutory minimum by the statutory deadline of September 30, 2028 without increasing the deposit insurance assessment rates. In October 2022, the FDIC adopted a final rule to increase initial base deposit insurance assessment rate schedules uniformly by 2 basis points, beginning on January 1, 2023. The FDIC also concurrently maintained the Designated Reserve Ratio for the DIF at 2%.

In November 2023, the FDIC issued a final rule to implement a special assessment to recoup losses to the DIF associated with bank failures in the first half of 2023. Under the final rule, the assessment base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion of uninsured deposits. The final rule provides that the FDIC will collect the special assessment at a quarterly rate of 3.36 basis points over eight quarterly assessment periods, subject to ongoing monitoring overchange depending on any adjustments to the next eight years.loss estimate, mergers or failures, or amendments to reported estimates of uninsured deposits. Based on the Bank’s reported uninsured deposits as of December 31, 2022, the entire estimated amount of approximately $214 million was recognized as an accrued liability and related expense in the fourth quarter of 2023. The FDIC could increasefinal rule becomes effective April 1, 2024, and the deposit insurance assessmentsfirst collection will be reflected on the invoice for certain insured depository institutions, including the Bank, iffirst quarterly assessment period of 2024, with the DIF reserve ratio is not restored as projected.first payment due on June 28, 2024.

Compensation

Cybersecurity

The GLBA requires financial institutions to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information.

The CISA is intended to improve cybersecurity in the United StatesU.S. by enhanced sharing of information about security threats among the U.S. government and private sector entities, including financial institutions. The CISA also authorizes companies to monitor their own systems notwithstanding any other provision of law and allows companies to carry out defensive measures on their own systems from cyber-attacks. The law includes liability protections for companies that share cyber threatcyber-threat information with third parties so long as such sharing activity is conducted in accordance with CISA.

In October 2016, the federal bank regulatory agencies issued an ANPR regarding enhanced cyber risk management standards which would apply to a wide range of large financial institutions and their third-party service providers, including us and the Bank. The proposed rules would expand existing cybersecurity regulations and guidance to focus on cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. In addition, the proposal contemplates more stringent standards for institutions with systems that are critical to the financial sector. The Federal Reserve announced in May 2019 that it would revisit the ANPR in the future.

Community Reinvestment Act

The CRA is intended to encourage banks to help meet the credit needs of their service areas, including low- and moderate-income neighborhoods, consistent with safe and soundness practices. The relevant federal bank regulatory agency, the OCC in the Bank’s case, examines each bank and assigns it a public CRA rating. A bank’s record of fair lending compliance is part of the resulting CRA examination report.

The CRA requires the relevant federal bank regulatory agency to consider a bank’s CRA assessment when considering the bank’s application to conduct certain mergers or acquisitions or to open or relocate a branch office. The Federal Reserve also must consider the CRA record of each subsidiary bank of a BHC in connection with any acquisition or merger application filed by the BHC. An unsatisfactory CRA record could substantially delay or result in the denial of an approval or application by Huntington or the Bank. The Bank received athe highest possible overall CRA rating of “Outstanding” in its most recent examination.

In May 2020,October 2023, the OCC finalized amendments to its CRA rules, which apply to national banks, including the Bank. The OCC’sU.S. banking agencies issued a final rule clarifies and expandsto amend their regulations implementing the types of activities that qualify for positiveCRA. The rule materially revises the current CRA consideration, updates how banks determineframework, including the assessment areas in which they area bank is evaluated establishes objective performance standardsto include activities associated with online and mobile banking, the tests used to evaluate CRA performancethe Bank in its assessment areas, new methods of calculating credit for lending, investment, and imposes more comprehensive CRA-relatedservice activities, and additional data collection and reporting requirements. The Bank must complyrule is expected to result in a significant increase in the thresholds for large banks to receive “Outstanding” ratings in the future. The rule is expected to take effect on April 1, 2024, with most of these amended requirements byits provisions becoming applicable on January 1, 2023.

Debit Interchange Fees

Consumer Protection Regulation and Supervision

based decisions affecting whole categories or classesHuntington has additionally developed a Lift Local Business® program, and made a commitment of $100 million, which supports entrepreneurs who have been historically under-resourced, particularly minority-, woman-, and veteran-owned small businesses throughout the business life cycle. This program offers loans, business planning support, free financial education courses delivered through Operation HOPE, and other services to help small business owners achieve their goals. Through October 31, 2023, we have reached $89 million of this commitment.

At Huntington, we have taken steps to ensure our values, beliefs, and behaviors align with those of our colleagues. We have highly engaged colleagues committed to looking out for each other and our customers with a balanced focus on “what we do” and “how we do it.” This synergy has proven to positively impact colleague performance and satisfaction. 2023 marked the tenth consecutive year we conducted a company-wide engagement survey to measure our colleagues’ experience with a strategic focus on culture, trust, and engagement – and the results were reaffirming. In 2023, 85%, 82%, and 84% of colleagues responded favorably on trust, culture, and engagement, respectively. These results place Huntington in the top quartile of favorability for Culture and Trust among our benchmark peer group. 81% of colleagues responded they would recommend Huntington as a great place to work.

The annual company-wide engagement survey is just one element of our continual colleague feedback program, which includes requiring banksquick colleague pulse, new hire, manager-specific, and exit surveys. These surveys enhance leader understanding of the colleague experience, position Huntington to make each financial servicerespond to colleague needs, and provide strong support to colleagues as they offer available to all personsdeliver performance in the geographic market served by them on proportionally equal terms. The rule is scheduledspirit of our Purpose and Values.

We have created specialized programs to help our colleagues grow and develop. These programs include an online library which allows colleagues to take effect on April 1, 2021. However,ownership of their development via direct access to role-based content. The content is divided into three key areas of development: learning and growth, maximizing performance, and protecting the OCC announced that the next confirmed Comptrollercompany. All of the Currency will reviewprogramming offered includes diversity, equity, and inclusion content. During 2023, colleagues at Huntington completed more than 500,000 training hours. Huntington also provided a High-Potential Talent Development Program to top talent colleagues, so that they may further develop and accelerate their career growth. Additionally, we offer our full-time colleagues the final rule,ability to obtain post-secondary education with reimbursement of eligible tuition. In addition to these programs, Huntington has also launched a program to capture the skills of all colleagues and match colleagues to internal job opportunities based on those skills.

At the end of 2023, our Board consisted of 15 directors, comprised of our Chairman/President/CEO, our Huntington National Bank Chairman, and 13 independent directors. Our key risk and governance committees require at least three directors who are independent and are chaired by an independent director with the knowledge and expertise to lead the committee. Each year, the Board evaluates its future remains uncertain.leadership organization to ensure it is best structure to provide oversight of the Company and execute against our strategy objectives. As of December 31, 2023, our ELT and Board were 50% and 47% diverse, respectively.

In addition to the other information included or incorporated by reference into this report, readers should carefully consider that the following important factors, among others, could negatively impact our business, future results of operations, and future cash flows materially.

Continued economic uncertainty and a recessionary or stagnant economy could adversely affect our business, financial condition, and results of operations. Our performance could be negatively affected to the extent there is deterioration in business and economic conditions, including persistent inflation, rising interest rates, supply chain issues or labor shortages, which have direct or indirect material adverse impacts on us, our customers, and our counterparties. These conditions could result in one or more of the following:

The markets we serve are dependent on industrial and manufacturing businesses and, thus, are particularly vulnerable to adverse changes in economic conditions affecting these sectors.

Market Risks:

Our results of operations depend substantially on net interest income, which is the difference between interest earned on interest earning assets (such as investments and loans) and interest paid on interest bearing liabilities (such as deposits and borrowings). Interest rates are highly sensitive to many factors, including governmental monetary policies, inflation, and domestic and international economic and political conditions. Conditions such as inflation, deflation, recession, unemployment, money supply, and other factors beyond our control may also affect interest rates. In addition, decisions by the Federal Reserve to increaseReserve’s monetary policies, including changes in the federal funds rate and increasing or reducereducing the size of its balance sheet, may also affect

Changes in interest rates can affect the value of loans, securities, assets under management, and other assets, including mortgage servicing rights. An increase in interest rates that adversely affects the ability of borrowers to pay the principal or interest on loans and leases may lead to an increase in NPAs and a reduction of income recognized, which could have a material adverse effect on our results of operations and cash flows. When we place a loan on nonaccrual status, we reverse any accrued but unpaid interest receivable, which decreases interest income. However, we continue to incur interest expense as a cost of funding NALs without any corresponding interest income. In addition, transactional income, including trust income, brokerage income, and gain on sales of loans can vary significantly from period-to-period based on a number of factors, including the interest rate environment. A decline in interest rates along with a flattening yield curve limits our ability to reprice deposits given the current historically low level of interest rates and could result in declining net interest margins if longer duration assets reprice faster than deposits.

Certain investment securities, notably mortgage-backed securities, are sensitive to rising and falling rates. Generally, when rates rise, prepayments of principal and interest will decrease, and the duration of mortgage-backed securities will increase. Conversely, when rates fall, prepayments of principal and interest will increase, and the duration of mortgage-backed securities will decrease. In either case, interest rates have a significant impact on the value of mortgage-backed securities.

MSR fair values are sensitive to movements in interest rates, as expected future net servicing income depends on the projected outstanding principal balances of the underlying loans, which can be reduced by prepayments. Prepayments usually increase when mortgage interest rates decline and decrease when mortgage interest rates rise.

In response to the economic consequences of the COVID-19 pandemic, the Federal Reserve lowered its target for the federal funds rate to a range of 0% to 0.25%. Such low rates increase the risk in the U.S. of a negative interest rate environment in which interest rates drop below zero, either broadly or for some types of instruments. For example, yields on one-month and three-month Treasuries briefly dropped below zero in March 2020. Such an occurrence would likely further reduce the interest we earn on loans and other earning assets, while also likely requiring us to pay more to maintain our deposits with the Federal Reserve Bank. Although, we have evaluated our systems and have made appropriate changes, our systems may not be able to adequately handle a negative interest rate environment and not all variable rate instruments are designed for such a circumstance. We cannot predict the nature or timing of future changes in monetary policies in response to the outbreak or the precise effects that they may have on our activities and financial results.

Liquidity Risks:

Liquidity is the ability to meet cash flow needs on a timely basis at a reasonable cost. The Bank uses its liquidity to extend credit and to repay liabilities as they become due or as demanded by customers.

Our primary source of liquidity is our large supply of deposits from consumer and commercial customers. The continued availability of this supply depends on customer willingness to maintain deposit balances with banks in general, and us in particular. The availability of deposits can also be impacted by regulatory changes (e.g., changes in FDIC insurance, liquidity requirements, etc.), changes in the financial condition of Huntington, other banks, or the banking industry in general, changes in the interest rates our competitors pay on their deposits, and other events which can impact the perceived safety or economic benefits of bank deposits. While we make significant efforts to consider and plan for hypothetical disruptions in our deposit funding, market related,market-related, geopolitical, or other events could impact the liquidity derived from deposits.

Wholesale funding sources can include securitization, federal funds purchased, securities sold under repurchase agreements, non-core deposits, and long-term debt. The Bank is also a member of the FHLB, which provides members access to funding through advances collateralized with mortgage-related assets. We maintain a portfolio of highly-rated, marketable securities that is available as a source of liquidity.

Capital markets disruptions can directly impact the liquidity of Huntington and the Bank.  The inability to access capital markets funding sources as needed could adversely impact our financial condition, results of operations, cash flows, and level of regulatory-qualifying capital.  We may, from time-to-time, consider using our existing liquidity position to opportunistically retire outstanding securities in privately negotiated or open market transactions.

The credit rating agencies regularly evaluate Huntington and the Bank, and credit ratings are based on a number of factors, including our financial strength and ability to generate earnings, as well as factors not entirely within our control, including conditions affecting the financial services industry, the economy, and changes in rating methodologies. There can be no assurance that we will maintain our current credit ratings. A downgrade of the credit ratings of Huntington or the Bank could adversely affect our access to liquidity and capital, and could significantly increase our cost of funds, trigger additional collateral or funding requirements, and decrease the number of investors and counterparties willing to lend to us or purchase our securities. This could affect our growth, profitability, and financial condition, including liquidity.

Operational Risks:

The potential for operational risk exposure exists throughout our business and, as a result of our interactions with, and reliance on, third parties, is not limited to our own internal operational functions. Our operational and security systems and infrastructure, including our computer systems, data management, and internal processes, as well as those of third parties, are integral to our performance. We rely on our employees and third parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance, failure, or breach of our or of third-party systems or infrastructure, expose us to risk. For example, our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact or upon whom we rely. Our financial, accounting, data processing, backup, or other operating or security systems and infrastructure may fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our control, which could adversely affect our ability to process transactions or provide services. Such events may include: sudden increases in customer transaction volume; electrical, telecommunications, or other major physical infrastructure outages; disease pandemics; cyber-attacks; and events arising from local or larger scale political or social matters, including wars and terrorist attacks. Additional events beyond our control that could impact our business directly or indirectly include natural disasters such as earthquakes and weather events, including tornadoes, hurricanes, and floods. Neither the occurrence nor the potential impact of these events can be predicted, and the frequency and severity of weather events may be impacted by climate changes. In addition, we may need to take our systems off-line if they become infected with malware or a computer virus or as a result of another form of cyber-attack. In the event that backup systems are utilized, they may not process data as quickly as our primary systems and some data might not have been saved to backup systems, potentially resulting in a temporary or permanent loss of such data. In addition, our ability to implement backup systems and other safeguards with respect to third-party systems is more limited than with respect to our own systems. We frequently update our systems to support our operations and growth and to remain compliant with applicable laws, rules, and regulations. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions. Implementation and testing of controls related to our computer systems, security monitoring, and retaining and training personnel required to operate our systems also entail significant costs. Operational risk exposures could adversely impact our operations, liquidity, and financial condition, as well as cause reputational harm. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption.

Our computer systems and network infrastructure and those of third parties, on which we are highly dependent, are subject to security risks and could be susceptible to cyber-attacks, such as denial of service attacks, hacking, terrorist activities, or identity theft. Our business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products, and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment and are subject to their own cybersecurity risks.

We, our customers, regulators, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks. These cyber-attacks include computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, improper access by employees or vendors, attacks on personal email of employees, ransom demands to not expose security vulnerabilities in our systems or the systems of third parties or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, or destruction of confidential, proprietary, and other information of ours, our employees, our customers, or of third parties, damage our systems or otherwise materially disrupt our or our customers’ or other third parties’ network access or business operations. As cyber-threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of our systems and implement controls, processes, policies, and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement sufficient preventive measures against such security breaches, which may result in material losses or consequences for us.

Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications. In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of organized crime affiliates, terrorist organizations, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. Due to increasing geopolitical tensions, nation state cyber attackscyber-attacks and ransomware are both increasing in sophistication and prevalence. Targeted social engineering and email attacks (i.e., “spear phishing” attacks) are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, customers, or other users of our systems to disclose sensitive information in order to gain access to itsour data or that of itsour clients. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently, may not be recognized until launched, and may not be recognized until well after a breach has occurred. The speed at which new vulnerabilities are discovered and exploited often before security patches are published continues to rise. Remote work further increases the risk that we may experience cyber incidents as a result of our employees, vendors, and other third parties with which we interact working remotely on less secure systems and environments.

The risk of a security breach caused by a cyber-attack at a vendor or by unauthorized vendor access has also increased in recent years. Additionally, the existence of cyber-attacks or security breaches at third-party vendors with access to our data may not be disclosed to us in a timely manner. Further, our ability to monitor our vendors’ cybersecurity practices is limited. Although we generally have agreements relating to cybersecurity and data privacy in place with our vendors, we cannot guarantee that such agreements will prevent a cyber-incident impacting our systems or information or enable us to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber-incidents attributed to our vendors as they relate to the information we share with them.

We also face indirect technology, cybersecurity, and operational risks relating to the customers, clients, and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators, and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence, and complexity of financial entities and technology systems, a technology failure, cyber-attack, or other information or security breach that significantly degrades, deletes, or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation, interconnectivity,

Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business. Hacking of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause us serious negative consequences, including ourincluding: loss of customers and business opportunities,opportunities; costs associated with maintaining business relationships after an attack or breach; significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential information, intellectual property, funds, and/or those of our customers; or damage to our or our customers’ and/or third parties’ computers or systems, andsystems. The occurrence of any of these events could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition. In addition, we may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

We may become subject to new legislation or regulation concerning cybersecurity or the privacy of personally identifiable information and personal financial information or of any other information we may store or maintain. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to alter our systems or require changes to our business practices or privacy policies. If cybersecurity, data privacy, data protection, data transfer, or data retention laws are implemented, interpreted, or applied in a manner inconsistent with our current practices, we may be subject to fines, litigation, or regulatory enforcement actions or ordered to change our business practices, policies, or systems in a manner that adversely impacts our operating results.

We are exposed to many types of operational risks, including the risk of fraud or theft by colleagues or outsiders, unauthorized transactions by colleagues or outsiders, operational errors by colleagues, business disruption, and system failures. Huntington executes against a significant number of controls, a large percent of which are manual and dependent on adequate execution by colleagues and third-party service providers. There is inherent risk that unknown single points of failure through the execution chain could give rise to material loss through inadvertent errors or malicious attack. These operational risks could lead to financial loss, expensive litigation, and loss of confidence by our customers, regulators, and the capital markets.

Moreover, negative public opinion can result from our actual or alleged conduct in any number of activities, including clients, products, and business practices; corporate governance; acquisitions; and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect our ability to attract and retain customers and can also expose us to litigation and regulatory action.

Relative to acquisitions, we incur risks and challenges associated with the integration of employees, accounting systems, and technology platforms from acquired businesses and institutions in a timely and efficient manner, and we cannot guarantee that we will be successful in retaining existing customer relationships or achieving anticipated operating efficiencies expected from such acquisitions. Acquisitions may be subject to the receipt of approvals from certain governmental authorities, including the Federal Reserve, the OCC, and the United StatesU.S. Department of Justice, as well as the approval of our shareholders and the shareholders of companies that we seek to acquire. These approvals for acquisitions may not be received, may take longer than expected, or may impose conditions that are not presently anticipated or that could have an adverse effect on the combined company following the acquisitions. Subject to requisite regulatory approvals, future business acquisitions may result in the issuance and payment of additional shares of stock, which would dilute current shareholders’ ownership interests. Additionally, acquisitions may involve the payment of a premium over book and market values. Therefore, dilution of our tangible book value and net income per common share could occur in connection with any future transaction.

Effective internal controls over financial reporting are necessary to provide reliable financial reports and prevent fraud. We are subject to regulation that focuses on effective internal controls and procedures. Such controls and procedures are modified, supplemented, and changed from time-to-time as necessitated by our growth and in reaction to external events and developments. Any failure to maintain an effective internal control environment could impact our ability to report our financial results on an accurate and timely basis, which could result in regulatory actions, loss of investor confidence, and an adverse impact on our business and our stock price.

Quantitative models may be used to help manage certain aspects of our business and to assist with certain business decisions, including estimating expected lifetime credit losses, measuring the fair value of financial instruments when reliable market prices are unavailable, estimating the effects of changing interest rates and other market measures on our financial condition and results of operations, managing risk, and for capital planning purposes (including during the CCAR capital planning and capital adequacy process). Our measurement methodologies rely on many assumptions, historical analyses, and correlations. These assumptions may not capture or fully incorporate conditions leading to losses, particularly in times of market distress, and the historical correlations on which we rely may no longer be relevant. Additionally, as businesses and markets evolve, our measurements may not accurately reflect this evolution. Even if the underlying assumptions and historical correlations used in our models are adequate, our models may be deficient due to errors in computer code, inaccurate data, misuse of data, or the use of a model for a purpose outside the scope of the model’s design.

All models have certain limitations. Reliance on models presents the risk that our business decisions based on information incorporated from models will be adversely affected due to incorrect, missing, or misleading information. In addition, our models may not capture or fully express the risks we face, may suggest that we have

Banking regulators continue to focus on the models used by banks and bank holding companies in their businesses. Some of our decisions that the regulators evaluate, including distributions to our shareholders, could be affected adversely due to their perception that the quality of the models used to generate the relevant information are insufficient.

We rely on third-party service providers, both domestically and offshore, to leverage subject matter expertise and industry best practice, provide enhanced products and services, and reduce costs. Although there are benefits in entering into third-party relationships with vendors and others, there are risks associated with such activities. When entering a third-party relationship, the risks associated with that activity are not passed to the third-party but remain our responsibility. The TechnologyRisk Oversight Committee of the boardBoard of directorsDirectors provides oversight related to the overall risk management process associated with third-party relationships. Management is accountable for the review and evaluation of all new and existing third-party relationships. Management is responsible for ensuring that adequate controls are in place to protect us and our customers from the risks associated with vendor relationships.

Increased risk could occur based on poor planning, oversight, control, and inferior performance or service on the part of the third-party and may result in legal costs or loss of business. While we have implemented a vendor management program to actively manage the risks associated with the use of third-party service providers, any problems caused by third-party service providers could adversely affect our ability to deliver products and services to our customers and to conduct our business. Replacing a third-party service provider could also take a long period of time and result in increased expenses.

The FASB, regulatory agencies, and other bodies that establish accounting standards periodically change the financial accounting and reporting standards governing the preparation of our financial statements. Additionally, those bodies that establish and interpret the accounting standards (such as the FASB, SEC, and banking regulators) may change prior interpretations or positions on how these standards should be applied.

Our goodwill could become impaired in the future. If goodwill were to become impaired, it could limit the ability of the Bank to pay dividends to Huntington, adversely impacting Huntington liquidity and ability to pay dividends or repay debt. The most significant assumptionsAssumptions affecting our goodwill impairment evaluation are variables including the market price of our Common Stock,include earnings projections, of earnings, the discount rates used in the income approach to measure fair value, and observed peer multiples used in estimating the control premium above our current stock price that an acquirer would pay to obtain control of us.fair value under the market approach. We are required to test goodwill for impairment at least annually or when impairment indicators are present. If an impairment determination is made in a future reporting period, our earnings and book value of goodwill will be reduced by the amount of the impairment. If an impairment loss is recorded, it will have little or no impact on the tangible book value of our Common Stock, or our regulatory capital levels, but such an impairment loss could significantly reduce the Bank’s earnings and thereby restrict the Bank’s ability to make dividend payments to us without prior regulatory approval, because Federal Reserve policy states the bank holding company dividends should be paid from current earnings.which in turn could impact our ability to pay dividends. At December 31, 2020,2023, the book value of our goodwill was $2.0$5.6 billion, substantially all of which was recorded at the Bank. Any such write down of goodwill or other acquisition related intangibles will reduce Huntington’s earnings, as well.

Compliance Risks:

Both the scope of the laws and regulations and the intensity of the supervision to which we are subject increasedmay increase in response to thetimes of financial crisis, as well as a result of other factors such as technological and market changes. Regulatory enforcement and fines have also increased across the banking and financial services sector. Compliance with these laws and regulations have resulted in and will continue to result in additional costs, which could be significant, and may have a material and adverse effect on our results of operations. In addition, if we do not appropriately comply with current or future legislation and regulations, especially those that apply to our consumer operations, which has been an area of heightened focus, we may be subject to fines, penalties or judgments, or material regulatory restrictions on our businesses, which could adversely affect operations and, in turn, financial results.

We expect that the Biden Administrationcurrent administration will seekcontinue to implement a regulatory reform agenda that is significantly different than that of the Trump Administration.former administration. This reform agenda could include a heightened focus on consumer protection, fair lending, the regulation of loan portfolios and credit concentrations to borrowers impacted by climate change, heightened scrutiny on Bank Secrecy Act and AML requirements, topics related to social equity, executive compensation, and increased capital and liquidity, as well as limits on share buybacks and dividends. In addition, mergers and acquisitions could be dampened by increased antitrust scrutiny. We also expect reform proposals for the short-term wholesale markets. It is too early for usThe evolving regulatory and supervisory environment and uncertainty about the timing and scope of future laws, regulations and policies may contribute to assessdecisions we may make to suspend, reduce, or withdraw from existing businesses, activities, or initiatives, which if anymay result in potential lost revenue or significant restructuring or related costs or exposures.

In addition, regulatory responses in connection with severe market downturns or unforeseen stress events may alter or disrupt our planned future strategies and actions. Adverse developments affecting the overall strength and soundness of these policies, would be implementedother financial institutions, the financial services industry as a whole, and what theirthe general economic climate and U.S. Treasury market could have a negative impact on perceptions about the strength and soundness of our business would be.

We face legal risks in our businesses, and the volume of claims and amount of damages and penalties claimed in litigation and regulatory proceedings against financial institutions remain high. Substantial legal liability against us could have material adverse financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects. It is possible that the ultimate resolution of these matters, if unfavorable, may be material to the results of operations for a particular reporting period.

The Bank Secrecy Act and the Patriot Act contain anti-money laundering and financial transparency provisions intended to detect and prevent the use of the U.S. financial system for money laundering and terrorist financing activities. The Bank Secrecy Act, as amended by the Patriot Act, requires depository institutions and their holding companies to undertake activities including maintaining an anti-money laundering program, verifying the identity of clients, monitoring for and reporting suspicious transactions, reporting on cash transactions exceeding specified thresholds, and responding to requests for information by regulatory authorities and law enforcement agencies. FinCEN, a unit of the Treasury Department that administers the Bank Secrecy Act, is authorized to impose significant civil money penalties for violations of those requirements and has recently engaged in coordinated enforcement efforts with the federal bank regulatory agencies, as well as the United StatesU.S. Department of Justice, Drug Enforcement Administration, and IRS.

There is also increased scrutiny of compliance with the rules enforced by the OFAC. If our policies, procedures, and systems are deemed deficient or the policies, procedures, and systems of the financial institutions that we have already acquired or may acquire in the future are deficient, we would be subject to liability, including fines and regulatory actions such as restrictions on our ability to pay dividends and the necessity to obtain regulatory approvals to proceed with certain planned business activities, including acquisition plans, which would negatively impact our business, financial condition, and results of operations. Failure to maintain and implement adequate programs to combat money laundering and terrorist financing could also have serious reputational consequences for us.

Strategic Risk:

We are subject to intense competition from both other financial institutions and from non-bank entities, including FinTech companies. Technology has lowered the barriers to entry, with customers having a growing variety of traditional and nontraditional alternatives, including crowdfunding, digital wallets, and money transfer services. The continuous widespread adoption of new technologies, including internet services and mobile applications, and advanced ATM functionality, is influencing how individuals and firms conduct their financial affairs and is changing the delivery channels for financial services. Our “People-First, Digitally-Powered” strategic plan considers the implications of these changes in technology. Additionally, these changes require us to adapt our product and services, as well as our distribution of them, to evolving industry standards and customer preferences. Failure to address competitive pressures could make it more difficult for us to attract and retain customers across our businesses.

Our success depends, in part, on our ability to successfully implement our strategic plan as well as adapt existing products and services and develop competitive new products and services demanded by our customers. The widespread adoption of technologies will continue to require substantial investments to modify or adapt existing products and services and to develop new product or services. Additionally, we may not be successful in executing

We believe that our continued growth and future success will depend in large part on the skills of our management team and our ability to motivate and retain these individuals and other key personnel. The loss of service of one or more of our executive officers or key personnel could reduce our ability to successfully implement our long-term business strategy, our business could suffer, and the value of our stock could be materially adversely affected. Leadership changes will occur from time to time, and we cannot predict whether significant resignations will occur or whether we will be able to recruit additional qualified personnel. We believe our management team possesses valuable knowledge about the banking industry and that their knowledge and relationships would be very difficult to replicate. Our success also depends on the experience of our branch managers and lending officers and on their relationships with the customers and communities they serve. The loss of these key personnel could negatively impact our banking operations. The loss of key personnel, or the inability to recruit and retain qualified personnel in the future, could have an adverse effect on our business, financial condition, or operating results.

The Federal Reserve administers CCAR, a periodic forward-looking quantitative assessment of Huntington’s capital adequacy and planned capital distributions and a review of the strength of Huntington’s practices to assess capital needs. The Federal Reserve makes a quantitative assessment of capital based on supervisory-run stress tests that assess the ability to maintain capital levels above each minimum regulatory capital ratio after making all capital actions included in Huntington’s capital plan, under baseline and stressful conditions throughout a nine-quarter planning horizon. The CCAR process is also used to determine Huntington’s stress capital bufferSCB requirement. There can be no assurance that the Federal Reserve or OCC will respond favorably to our capital plans, planned capital actions, or stress test results, and the Federal Reserve, OCC, or other regulatory capital requirements may limit or otherwise restrict how we utilize our capital, including common stock dividends and stock repurchases.

We are also required to maintain minimum capital ratios and the Federal Reserve and OCC may determine that Huntington and/or the Bank, based on size, complexity, or risk profile, must maintain capital ratios above these minimums in order to operate in a safe and sound manner. In the event we are required to raise capital to maintain required minimum capital and leverage ratios or ratios above the required applicable minimums, we may be forced to do so when market conditions are undesirable or on terms that are less favorable to us than we would otherwise require. Furthermore, in order to prevent becoming subject to restrictions on our ability to distribute capital or make certain discretionary bonus payments to management, the Bank must maintain a Capital Conservation BufferCCB of 2.5%, and Huntington must maintain the applicable stress capital bufferSCB determined as part of the CCAR process, which are in addition to our required minimum capital ratios.

Reputation Risk:

Our ability to attract and retain customers, clients, investors, and employees is affected by our reputation. Significant harm to our reputation can arise from various sources, including officer, director, or employee misconduct, actual or perceived unethical behavior, conflicts of interest, security breaches, litigation or regulatory outcomes, compensation practices, failing to deliver minimum or required standards of service and quality, failing to address customer and agency complaints, compliance failures, unauthorized release of personal, proprietary or confidential information due to cyber-attacks or otherwise, perception of our environmental, social, and governance practices and disclosures, and the activities of our clients, customers, and counterparties, including vendors. Actions by the financial service industry generally or by institutions or individuals in the industry can adversely affect our reputation indirectly by association. In addition, adverse publicity or negative information posted on social media, whether or not factually correct, may affect our business prospects. All of these could adversely affect our growth, results of operation, and financial condition.

None.

Item 2: Properties

Our headquarters, as well as the Bank’s, is located in the Huntington Center, a thirty-seven story office building located in Columbus, Ohio. Of the building’s total office space available, we lease approximately 22%. The lease term expires in 2030, with six five-year renewal options for up to 30 years but with no purchase option. The Bank has an indirect minority equity interest of 18% in the building.

Item 3: Legal Proceedings

Item 4: Mine Safety Disclosures

Not applicable.

Item 5: Market for Registrant’s Common Equity, Related Shareholder Matters and Issuer Purchases of Equity Securities

The common stock of Huntington Bancshares Incorporated is traded on the Nasdaq Global Stock Market under the symbol “HBAN”.“HBAN.” As of January 31, 2021,2024, we had 27,38429,674 shareholders of record.

The following graph shows the changes, over the five-year period, in the value of $100 invested in (i) shares of Huntington’s Common Stock; (ii) the Standard & Poor’s 500 Stock Index (the S&P 500 Index) and (iii) Keefe, Bruyette & Woods Bank Index, for the period December 31, 2015,2018, through December 31, 2020.2023. The KBW Bank Index is a market capitalization-weighted bank stock index published by Keefe, Bruyette & Woods. The index is composed of the largest banking companies and includes all money center banks and many regional banks, including Huntington. An investment of $100 on December 31, 2015,2018, and the reinvestment of all dividends, are assumed. The plotted points represent the cumulative total return on the last trading day of the fiscal year indicated.

INTRODUCTION

EXECUTIVE OVERVIEW

In 2020,2023, we reported net income of $817$2.0 billion, a $287 million, a 42%or 13%, decrease from the prior year. Earnings per common share on a diluted basis for the year were $0.69,$1.24, down 46%14% from the prior year.

General

Our general business objectives are:are to:

Inflation continues to trend lower while remaining at levels above the Federal Reserve’s long run target. The Federal Reserve has shifted policy to a more balanced interest rate view and other permitted purposes in accordance withcontinues to further evaluate the requirementsimpact of their monetary tightening and the overall health of the PPP.  These loans carry a fixed rateeconomy. The economy has continued to expand with fourth quarter of 1.00% and terms of two or five years, if not forgiven, in whole or in part. The loans also require deferral of principal and interest repayment. The loans are 100% guaranteed by the SBA.  The SBA pays the originating bank a processing fee ranging2023 growth trending towards 2.0%. Equity markets have remained buoyant anticipating easier policy from 1% to 5%, based on the size of the loan.  In addition, the FRB has implemented a liquidity facility available to financial institutions participating in the PPP (“PPPLF”).  In conjunction with the PPP, the PPPLF will allow the Federal Reserve Banksin 2024. Further banking regulation has been delayed as recent regulatory proposals have been in their comment periods for an extended amount of time, with clarity on proposed amendments to lendthe regulatory capital rule and long-term debt requirements for banks anticipated.

The consensus economic outlook assumes a soft landing through the first half of 2024 with modest growth in the second half of 2024. Inflation is expected to member banks on a non-recourse basis with PPP loanscontinue to fall, approaching target levels of 2% by the third quarter of 2024, as collateral.the Federal Reserve actions will likely result in lower GDP growth and higher unemployment.

Additionally,Our 2023 results reflect the CARES Act provides for relief on existingexecution of our growth strategy and new SBA loansleveraging the strength of our balance sheet, delivered through Small Business Debt Relief. As part of the SBA Small Business Debt Relief, the SBA will automatically pay principal, interest and fees of certain SBA loans for a period of six months for both existing loans and new loans issued prior to September 27, 2020. To aid small- and medium-sized businessessustained deposit growth, bolstered capabilities across our footprint in 2020,payments and other fee revenue areas, and expansion of our CET1. We have continued our disciplined management of credit consistent with our aggregate moderate-to-low, through-the-cycle risk appetite. With our disciplined and proactive approach, we funded more than 38,000 loans in the amount of $6.6 billionbelieve Huntington is well positioned to manage through the SBA’s PPP. As of December 31, 2020, we have an outstanding PPP loan balance of $6.1 billionuncertain economic outlook on the horizon. We remain focused on delivering profitable growth and have received PPP forgiveness payments of $225 million from the SBA. Between January 1, 2021 and February 19, 2021, we have received PPP forgiveness payments of an additional $1.2 billion from the SBA.

Legislative and Regulatory