KeyCorp (KEY)

Criticisms on file

No material criticisms on file for this pillar.

Disclosed initiatives

• Risk Management and Cybersecurity Infrastructure

  Investment in technology and information security systems to support operations and client protection; ongoing capital allocation to computer processing and business services.

  Operational resilience; indirect support for energy-efficient data management, though not explicitly framed as climate-related.

Criticisms on file

No material criticisms on file for this pillar.

Disclosed initiatives

• Competitive Total Rewards and Career Development

  Dollar-for-dollar 401k matching up to 7%, up to 10 weeks paid parental leave, tuition reimbursement, wellness programs, lifestyle reimbursement account, Discounted Stock Purchase Plan, employee volunteer programs (Neighbors Make the Difference Day), Employee Matching Gift Program.

  Enhanced employee retention and engagement; supports workforce wellbeing and inclusive culture.
• Formal Mentoring and Leadership Development

  MentorMe at Key (enterprise-wide formal mentoring program), Key Business Impact and Networking Groups (KBINGs) open to all employees, internal leadership development programs, formal learning curricula.

  Supports career growth and development of diverse talent pipeline; fosters inclusive culture.
• Workforce Composition and Flexibility

  95% of employees earn $20/hour or more; flexible benefits structure; focus on fair and inclusive environment.

  Supports living wage commitment for majority of workforce; demonstrates commitment to equitable compensation.

Criticisms on file

• CFPB Dismantling and Regulatory Uncertainty: The current U.S. presidential administration has announced intention to close or substantially downsize the CFPB, issued a stop work order, terminated CFPB employees, and reduced funding. A preliminary injunction was issued on March 25, 2025, to prevent dismantling, but was vacated on August 15, 2025. On December 17, 2025, the D.C. Court of Appeals granted an en banc rehearing. This regulatory uncertainty impacts KeyCorp's compliance obligations and the stability of consumer protection oversight.

  Source: KeyCorp 10-K, Item 1A Risk Factors, Consumer Financial Protection Bureau section; Federal filings and court dockets referenced in disclosure.
• Section 1071 Small Business Loan Data Reporting Rule Delays and Uncertainty: The CFPB issued a final rule on March 30, 2023, requiring detailed data reporting on small business loan applications. Multiple lawsuits challenged the rule; on April 3, 2025, the CFPB requested to hold the lawsuit in abeyance and planned new rulemaking. On October 2, 2025, the CFPB issued a final rule delaying compliance; on November 13, 2025, a proposal was issued to streamline and scale back the rule with compliance delayed until January 1, 2028. This ongoing regulatory flux creates uncertainty for KeyCorp's reporting obligations.

  Source: KeyCorp 10-K, Item 1A Risk Factors, Data collection and reporting for small business loans section.
• Personal Financial Data Rights (Section 1033 Rule) Litigation and Implementation Uncertainty: The CFPB issued a final rule on October 22, 2024, to implement Section 1033 of the Dodd-Frank Act requiring financial institutions to provide consumer financial data in electronic form. Two trade associations and a national bank filed a lawsuit challenging the rule. On May 23, 2025, the CFPB agreed with the plaintiffs on statutory authority concerns. On July 29, 2025, litigation was stayed. On August 21, 2025, the CFPB issued an advance notice of proposed rulemaking. KeyCorp is monitoring developments regarding a revamped 1033 interim final rule.

  Source: KeyCorp 10-K, Item 1A Risk Factors, Personal financial data rights section.

Disclosed initiatives

• Cybersecurity Governance and Risk Management

  Chief Information Security Officer (CISO) oversees Information Security Program with responsibility for identifying and managing cybersecurity risks. Board Risk Committee and Technology Committee provide oversight; CISO reports to Board Audit and Risk Committees. Three Lines of Defense framework: First Line (Lines of Business and Support Functions), Second Line (Risk Management and Compliance), Third Line (Internal Audit). Regular cybersecurity tabletop exercises, mandatory annual cybersecurity training, third-party security assessments against NIST Cybersecurity Framework and Cyber Risk Institute Profile.

  Robust governance structure for cybersecurity risk; proactive identification and remediation of information security gaps.
• Enhanced Prudential Standards and Capital Planning

  As Category IV BHC, subject to Federal Reserve's Regulatory Capital Rules, stress testing, and capital conservation requirements. Annual Comprehensive Capital Analysis and Review (CCAR), supervisory stress testing every other year, stress capital buffer requirement (3.2% as of Oct 1, 2025). Board oversight of capital adequacy and liquidity risk management.

  Ensures financial stability, adequate capital reserves, and resilience to adverse economic scenarios.
• Risk Committee Oversight and Enterprise Risk Management

  Board Risk Committee exercises primary oversight over enterprise-wide risk including credit, market, liquidity, operational, and compliance risks. Enterprise Risk Management (ERM) Committee chaired by Chief Risk Officer reports to Board Risk Committee. Operational Risk Committee oversees operational and technology risks with subcommittees including Security & Technology Committee.

  Structured governance for comprehensive risk identification, measurement, and mitigation across all business lines.
• Regulatory Compliance and Supervisory Framework

  KeyCorp complies with extensive federal and state banking regulations, including those of Federal Reserve, OCC, FDIC, CFPB, SEC, FINRA, and state regulators. Subject to regular supervisory examinations, resolution planning requirements (KeyBank only, as of June 2024 rule change), and recovery planning guidelines. Maintains Bank Secrecy Act compliance, OFAC sanctions compliance, and anti-money laundering programs.

  Ensures adherence to safety and soundness standards, consumer protection laws, and systemic financial stability requirements.