Capital One Financial 10-K 2024-12-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

For the fiscal year ended December 31, 2024

OR

For the transition period from to

Commission File No. 001-13300

CAPITAL ONE FINANCIAL CORPORATION

(Exact name of registrant as specified in its charter)

Registrant’s telephone number, including area code: (703) 720-1000____________________________________

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒ Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C.7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of the voting and non-voting stock held by non-affiliates of the registrant as of the close of business on June 30, 2024 was approximately $52.3 billion. As of January 31, 2025, there were 381,327,698 shares of the registrant’s Common Stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

**1.**Portions of the Proxy Statement for the annual meeting of stockholders to be held on May 08, 2025, are incorporated by reference into Part III.

TABLE OF CONTENTS

INDEX OF MD&A AND SUPPLEMENTAL TABLES

PART I

General

Capital One Financial Corporation, a Delaware corporation established in 1994 and headquartered in McLean, Virginia, is a diversified financial services holding company with banking and non-banking subsidiaries. Capital One Financial Corporation and its subsidiaries (the “Company” or “Capital One”) offer a broad array of financial products and services to consumers, small businesses and commercial clients through digital channels, branch locations, cafés and other distribution channels.

As of December 31, 2024, Capital One Financial Corporation’s principal operating subsidiary was Capital One, National Association (“CONA”). The Company is hereafter collectively referred to as “we,” “us” or “our.” CONA is referred to as the “Bank.”

References to “this Report” or our “2024 Form 10-K” or “2024 Annual Report” are to our Annual Report on Form 10-K for the fiscal year ended December 31, 2024. All references to 2024, 2023 and 2022, refer to our fiscal years ended, or the dates, as the context requires, December 31, 2024, December 31, 2023 and December 31, 2022, respectively. Certain business terms used in this document are defined in “Part II—Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”)—Glossary and Acronyms” and should be read in conjunction with the Consolidated Financial Statements included in this Report.

We were the third largest issuer of Visa® (“Visa”) and MasterCard® (“MasterCard”) credit cards in the U.S. based on the outstanding balance of credit card loans as of December 31, 2024. In addition to credit cards, we also offer debit cards, bank lending, treasury management and depository services, auto loans and other consumer lending products in markets across the U.S. As one of the nation’s largest banks based on deposits as of December 31, 2024, we service banking customer accounts through digital channels and our network of branch locations, cafés, call centers and automated teller machines (“ATMs”).

We also offer products and services outside of the U.S. principally through Capital One (Europe) plc (“COEP”), an indirect subsidiary of CONA organized and located in the United Kingdom (“U.K.”), and through a branch of CONA in Canada. Both COEP and our Canadian branch of CONA have the authority to provide credit card loans.

Agreement to Acquire Discover

On February 19, 2024, the Company entered into an agreement and plan of merger (the “Merger Agreement”), by and among Capital One, Discover Financial Services, a Delaware corporation (“Discover”) and Vega Merger Sub, Inc., a Delaware corporation and a direct, wholly owned subsidiary of the Company (“Merger Sub”), pursuant to which (a) Merger Sub will merge with and into Discover, with Discover as the surviving entity in the merger (the “Merger”); (b) immediately following the Merger, Discover, as the surviving entity, will merge with and into Capital One, with Capital One as the surviving entity in the second-step merger (the “Second Step Merger”); and (c) immediately following the Second Step Merger, Discover Bank, a Delaware-chartered and wholly owned subsidiary of Discover, will merge with and into CONA, with CONA as the surviving entity in the merger (the “CONA Bank Merger,” and collectively with the Merger and the Second Step Merger, the “Transaction”). The Merger Agreement was unanimously approved by the Boards of Directors of each of Capital One and Discover.

At the effective time of the Merger, each share of common stock of Discover outstanding immediately prior to the effective time of the Merger, other than certain shares held by Discover or Capital One, will be converted into the right to receive 1.0192 shares of common stock of Capital One. Holders of Discover common stock will receive cash in lieu of fractional shares. At the effective time of the Second Step Merger, each share of Fixed-to-Floating Rate Non-Cumulative Perpetual Preferred Stock, Series C, of Discover, and each share of 6.125% Fixed-Rate Reset Non-Cumulative Perpetual Preferred Stock, Series D, of Discover, in each case outstanding immediately prior to the effective time of the Second Step Merger, will be converted into the right to receive a share of newly created series of preferred stock of Capital One having terms that are not materially less favorable than the applicable series of Discover preferred stock.

On February 18, 2025, Capital One and Discover each held a special meeting of their respective stockholders. During the respective meetings, Capital One stockholders approved by the requisite vote the issuance of Capital One common stock as

merger consideration to the holders of Discover common stock, and Discover stockholders adopted by the requisite vote the Merger Agreement. The closing of the Transaction remains subject to the satisfaction of other customary closing conditions, including the receipt of required regulatory approvals.

Walmart Program Agreement Termination

On May 21, 2024, our credit card program agreement with Walmart terminated (“Walmart Program Termination”). Pursuant to terms of the termination, Capital One retained ownership and servicing of the existing credit card portfolio and is nearing completion of converting eligible customers into Capital One branded card products.

Other Business Developments

We regularly explore and evaluate opportunities to acquire financial products and services as well as financial assets, including credit card and other loan portfolios, and enter into strategic partnerships as part of our growth strategy. We also explore opportunities to acquire technology companies and related assets to improve our information technology infrastructure and to deliver on our digital strategy. We may issue equity or debt to fund our acquisitions. In addition, we regularly consider the potential disposition of certain of our assets, branches, partnership agreements or lines of business.

Additional Information

Our common stock trades on the New York Stock Exchange (“NYSE”) under the symbol “COF” and is included in the Standard & Poor’s (“S&P”) 100 Index. We maintain a website at www.capitalone.com. Documents available under “Governance & Leadership” in the Investor Relations section of our website include:

• our Certificate of Incorporation, Bylaws, Corporate Governance Guidelines, and Code of Conduct; and

• charters for the Audit, Compensation, Governance and Nominating, and Risk Committees of the Board of Directors.

These documents also are available in print to any stockholder who requests a copy. We intend to disclose any future amendments to, or waivers from, our Code of Conduct on the website following the date of any such amendment or waiver.

In addition, we make available free of charge through our website all of our U.S. Securities and Exchange Commission (“SEC”) filings, including our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as soon as reasonably practicable after electronically filing or furnishing such material to the SEC at www.sec.gov. We also routinely post financial and other information, which could be deemed to be material to investors, on our investor relations website. Information regarding our corporate social responsibility and environmental sustainability initiatives is also available on our website. The content of any of our websites referred to in this Report is not incorporated by reference into this Report or any other filings with the SEC.

Showing the first 8K of 86K characters. Open the full section

The following discussion sets forth what management currently believes could be the material risks and uncertainties that could impact our businesses, results of operations and financial condition. The events and consequences discussed in these risk factors could, in circumstances we may not be able to accurately predict, recognize, or control, have a material adverse effect on our business, growth, reputation, prospects, financial condition, operating results, cash flows, liquidity, and stock price. These risk factors do not identify all risks that we face; our operations could also be affected by factors, events, or uncertainties that are not presently known to us or that we currently do not consider to present significant risks to our operations. In addition, the global economic and political climate may amplify many of these risks.

Summary of Risk Factors

The following is a summary of the Risk Factors disclosure in this Item 1A. This summary does not address all of the risks that we face. Additional discussion of the risks summarized in this risk factor summary, and other risks that we face, can be found below and should be carefully considered, together with other information in this Form 10-K and our other filings with the SEC, before making an investment decision regarding our securities.

• The consummation of the Transaction is contingent upon the satisfaction of a number of conditions, including regulatory approvals, that may be outside either party’s control and that either party may be unable to satisfy or obtain or which may delay the consummation of the Transaction or result in the imposition of conditions that could reduce the anticipated benefits from the Transaction or cause the parties to abandon the Transaction.

• We expect to incur substantial expenses related to the Transaction and to the integration of Discover, and the expenses may be greater than anticipated due to unexpected events.

• We may fail to realize all of the anticipated benefits of the Transaction, or those benefits may take longer to realize than expected due to factors that may be outside our control or Discover’s control. We may also encounter significant difficulties in integrating Discover.

• Our future results may suffer if we do not effectively manage our expanded operations following the Transaction.

• While the Transaction is pending, we will be subject to business uncertainties and contractual restrictions that could adversely affect our business and operations.

• Changes and instability in the macroeconomic environment could disrupt capital markets, reduce consumer and business activity, and weaken the labor market, all of which could impact borrowers’ ability to service their debt obligations and adversely impact our financial results.

• Fluctuations in interest rates could adversely affect our business, results of operations and financial condition.

• We may not be able to maintain adequate sources of funding and liquidity to operate our business.

• We may experience increases in delinquencies and credit losses, or we may incorrectly estimate expected losses, which could result in inadequate reserves.

• We may not be able to maintain adequate capital or liquidity levels or may become subject to revised capital or liquidity requirements, which could have a negative impact on our financial results and our ability to return capital to our stockholders.

• Limitations on our ability to receive dividends from our subsidiaries could affect our liquidity and ability to pay dividends and repurchase our common stock.

• A downgrade in our credit ratings could significantly impact our liquidity, funding costs and access to the capital markets.

• We face risks related to our operational, technological and organizational infrastructure**.**

• A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions**.**

• We face risks resulting from the extensive use of models and data, as well as from our evolving use of AI**.**

• Fraudulent activity associated with our products could cause our fraud losses to increase, the use of our products to decrease and our brands to suffer reputational damage, all of which could have a material adverse effect on our business.

• Compliance with new and existing domestic and foreign laws, regulations and regulatory expectations is costly and complex, and any significant changes may adversely affect our business.

• Our required compliance with applicable laws and regulations related to privacy, data protection and data security, in addition to compliance with our own privacy policies and contractual obligations to third parties, may increase our costs, reduce our revenue, increase our legal exposure and limit our ability to pursue business opportunities.

• Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement.

• We face intense competition in all of our markets, which could have a material adverse effect on our business and results of operations.

• Our business, financial condition and results of operations may be adversely affected by legislation, regulation and merchants’ efforts to reduce the interchange fees charged by credit and debit card networks to facilitate card transactions.

• If we are not able to invest successfully in and introduce digital and other technological developments across all our businesses, our financial performance may suffer.

• We may fail to realize the anticipated benefits of our mergers, acquisitions and strategic partnerships.

• Reputational risk and social factors may impact our results and damage our brand.

• If we are not able to protect our intellectual property rights, or we violate third-party intellectual property rights, our revenue and profitability could be negatively affected.

• Our risk management strategies may not be fully effective in mitigating our risk exposures in all market environments or against all types of risk.

• Our business could be negatively affected if we are unable to attract, develop, retain and motivate key senior leaders and skilled employees.

• We face risks from catastrophic events.

• Climate change manifesting as physical or transition risks could adversely affect our businesses, operations and customers and result in increased costs.

• We face risks from the use of or changes to assumptions or estimates in our financial statements.

• The soundness of other financial institutions and other third parties, actual or perceived, could adversely affect us.

Risks Relating to the Acquisition of Discover

We have identified certain additional risk factors in connection with the Merger Agreement and the proposed Transaction. For additional information concerning these risks, uncertainties and assumptions, please refer to the section entitled “Risk Factors” included in our joint proxy statement/prospectus included in the registration statement declared effective by the SEC on January 6, 2025.

**The consummation of the Transaction is contingent upon the satisfaction of a number of conditions, including regulatory approvals, that may be outside either party’s control and that either party may be unable to satisfy or obtain or wh

Showing the first 8K of 136K characters. Open the full section

None.

Risk Management and Strategy

As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data. While no organization can eliminate cybersecurity and technology risk entirely, we devote significant resources to a cybersecurity program designed to mitigate such risks. For further discussion of cybersecurity and technology risk, and related risks for our business, see “Item 1A. Risk Factors.”

We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under “Part II—Item 7. MD&A—Risk Management” in this Report, which uses a three lines of defense model. Our cybersecurity and technology risks are managed programmatically under the “operational risk” category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.

These operational risks are managed within a governance structure that consists of defined roles and responsibilities, formal governance bodies, and processes, policies and standards.

Our policies and procedures define an overall, enterprise-wide approach for managing cybersecurity and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:

1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential cybersecurity and technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed.

2.Assessment, Measurement and Response: Management assesses identified risks to estimate such risk’s potential severity and the likelihood of occurrence. Once a risk is identified and measured, management determines the appropriate response, including determining whether to accept the risk in accordance with our established risk appetite, or alternatively to implement new controls, enhance existing controls, and/or develop additional mitigation strategies to reduce the impact of the risk.

3.Monitoring and Testing: Management is required to evaluate the effectiveness of risk management practices and controls through monitoring of key risk indicator metrics, testing and other activities. Identified issues are remediated, addressed via mitigation plans, or escalated, in line with our risk appetite.

4.Aggregation, Reporting and Escalation: Management collects and aggregates risks across the Company in order to support strategic decision-making and to measure overall risk performance against risk appetite metrics. Management also establishes processes designed to escalate, report, and address risks and deficiencies within different business lines, according to the requirements of our policies. For additional information regarding the escalation of these risks to the Board of Directors, see “Governance” below.

Our policies and procedures collectively help execute a risk management approach designed to account for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers and other third parties. For example, our third-party risk management policy is designed to help enable timely and effective identification, measurement, and management of third-party risks throughout the lifecycle of such relationships, which includes planning, due diligence and third-party selection, contracting, risk-based monitoring, and termination. We also assess, identify, and manage cybersecurity and technology risks associated with our merger and acquisition activities. See “Governance” below for more information.

As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques designed to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection, and response. When appropriate, we leverage partnerships with relevant government entities, law enforcement agencies, and industry information sharing forums,

such as the Financial Services Information Sharing and Analysis Center (“FS-ISAC”), to further inform our understanding of the threat environment and how to effectively defend the Company against such threats. These defenses include, among other things, a range of cyber educational initiatives that we design and deliver to employees across the enterprise to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data, and facilities. Employees are required to annually certify their completion of training on both cybersecurity and data privacy, and our cyber education program implements targeted testing and training focused on high-risk populations and responding to an evolving threat landscape.

We also maintain an Enterprise Cyber Response Plan (“ECRP”) designed to handle potential or actual cybersecurity events that could impact us and our personnel, data, systems and customers. The ECRP defines the roles and responsibilities of various teams, individuals, and stakeholders in performing this enterprise response, guides decision making for taking actions and escalations to our executive management and the Board of Directors, as appropriate, and helps to plan follow-on actions that seek to reduce the likelihood of similar events’ recurrence in the future. The ECRP is reviewed and refined periodically and refinement is informed in part by a series of table-top exercises that we conduct over the course of the year.

We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the 2019 Cybersecurity Incident, have materially affected our overall business strategy, results of operations, or financial condition. For further discussion of cybersecurity, and related risks for our business, see “Item 1A. Risk Factors” under the headings “We face risks related to our operational, technological and organizational infrastructure,” and “A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions.”

Governance

The Board of Directors is responsible for providing oversight of our Framework. The Risk Committee of the Board of Directors (“Risk Committee”) assists the full Board of Directors in discharging these responsibilities.

The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, and key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments, which, in the aggregate, are intended to present an overall view on the status of our cybersecurity program and the Company’s compliance with applicable legal and regulatory requirements.

The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.

At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the Chief Information Officer (“CIO”); reviews our cybersecurity program with the Chief Information Security Officer (“CISO”) and the Chief Technology Risk Officer (“CTRO”); and approves our cybersecurity policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.

We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model. For cybersecurity and technology risks,

our first line of defense includes the following:

• Chief Information Security Officer:** The CISO establishes and manages the enterprise-wide cybersecurity program.

• Chief Information Officer:** The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.

our second line of defense includes the following:

• Chief Technology Risk Officer:** The CTRO provides independent oversight of our cybersecurity programs and challenges of first line risk management and risk-taking activities pertaining to cybersecurity and technology risk.

• The Executive Risk Committee:** This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment, and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.

our third line of defense is comprised of:

• Internal Audit:** Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our cybersecurity and technology risk management processes are designed and working as intended.

In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications. In particular, our CISO has more than 30 years of cybersecurity and information technology experience, including for nearly five years as CISO at a major global technology company before joining the Company, and holds a CISO Certificate from Carnegie Mellon’s Heinze College. Our CTRO has been in cybersecurity for approximately 25 years and spent over three years as the global CISO of a G-SIB. Prior to that, he served as a senior executive in cybersecurity in the U.S. government. Our CIO has been with the Company for approximately 20 years, during which he has overseen multiple technology transformation initiatives, including the Company’s transition to the public cloud. He holds degrees in physics and business administration from Harvard University.

Our corporate and banking real estate portfolio consists of approximately 10.2 million square feet of owned or leased office and retail space, which is used to support our business. Of this overall portfolio, approximately 8.4 million square feet of space is dedicated for various corporate office uses and approximately 1.8 million square feet of space is for bank branches and cafés.

Our 8.4 million square feet of corporate office space consists of approximately 5.9 million square feet of owned space and 2.5 million square feet of leased space. We maintain corporate office space primarily in Virginia, New York and Texas including our headquarters located in McLean, Virginia.

Our 1.8 million square feet for bank branches and cafés is located primarily across New York, Louisiana, Texas, Maryland, Virginia, New Jersey and the District of Columbia and consists of approximately 1.1 million square feet of leased space and 713 thousand square feet of owned space. See “Part II—Item 8. Financial Statements and Supplementary Data—Note 8—Premises, Equipment and Leases” for information about our premises.

The information required by Item 103 of Regulation S-K is included in “Part II—Item 8. Financial Statements and Supplementary Data—Note 19—Commitments, Contingencies, Guarantees and Others.”

Not applicable.

PART II

Market Information

Our common stock is listed on the NYSE and is traded under the symbol “COF.” As of January 31, 2025, there were 8,201 holders of record of our common stock.

Securities Authorized for Issuance Under Equity Compensation Plans

Information relating to compensation plans under which our equity securities are authorized for issuance is presented in this Report under “Part III—Item 12. Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters.”

Common Stock Performance Graph

The following graph shows the cumulative total stockholder return on our common stock compared to an overall stock market index, the S&P Composite 500 Stock Index (“S&P 500 Index”), and a published industry index, the S&P Financial Composite Index (“S&P Financial Index”), over the five-year period commencing December 31, 2019 and ended December 31, 2024. The stock performance graph assumes that $100 was invested in our common stock and each index and that all dividends were reinvested. The stock price performance on the graph below is not necessarily indicative of future performance.

Recent Sales of Unregistered Securities

We did not have any sales of unregistered equity securities in 2024.

Issuer Purchases of Equity Securities

The following table presents information related to repurchases of shares of our common stock for each calendar month in the fourth quarter of 2024. Commission costs are excluded from the amounts presented below.

(1)In April 2022, our Board of Directors authorized the repurchase of up to $5.0 billion of shares of our common stock. There were 69,439 shares withheld in November, to cover taxes on restricted stock awards whose restrictions lapsed. See “Item 7. MD&A—Capital Management—Dividend Policy and Stock Purchases” for more information.

This discussion contains forward-looking statements that are based upon management’s current expectations and are subject to significant uncertainties and changes in circumstances. Please review “Part I—Item 1. Business—Forward-Looking Statements” for more information on the forward-looking statements in this Report. All statements that address operating performance, events or developments that we expect or anticipate will occur in the future are forward-looking statements. Our actual results may differ materially from those included in these forward-looking statements due to a variety of factors including, but not limited to, those described in “Part I—Item 1A. Risk Factors” in this Report. Unless otherwise specified, references to notes to our consolidated financial statements refer to the notes to our consolidated financial statements as of December 31, 2024 included in this Report.

Management monitors a variety of key indicators to evaluate our business results and financial condition. The following MD&A is intended to provide the reader with an understanding of our results of operations and financial condition, including capital and liquidity management, by focusing on changes from year to year in certain key measures used by management to evaluate performance, such as profitability, growth and credit quality metrics. MD&A is provided as a supplement to, and should be read in conjunction with, our audited consolidated financial statements as of and for the year ended December 31, 2024 and accompanying notes. MD&A is organized in the following sections:

The following table presents selected consolidated financial data and performance metrics for the three-year period ended December 31, 2024, 2023 and 2022. We also provide selected key metrics we use in evaluating our performance, including certain metrics that are computed using non-GAAP measures. We consider these metrics to be key financial measures that management uses in assessing our operating performance, capital adequacy and the level of returns generated. We believe these non-GAAP metrics provide useful insight to investors and users of our financial information as they provide an alternate measurement of our performance and assist in assessing our capital adequacy and the level of return generated. These non-GAAP measures should not be viewed as a substitute for reported results determined in accordance with generally accepted accounting principles in the United States of America (“U.S. GAAP”), nor are they necessarily comparable to non-GAAP measures that may be presented by other companies.

Three-Year Summary of Selected Financial Data

Showing the first 8K of 352K characters. Open the full section

For a discussion of the quantitative and qualitative disclosures about market risk, see “Item 7. MD&A—Market Risk Profile.”

MANAGEMENT’S REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

The management of Capital One Financial Corporation (the “Company” or “Capital One”) is responsible for establishing and maintaining adequate internal control over financial reporting and for the assessment of the effectiveness of internal control over financial reporting. Internal control over financial reporting is a process designed by, or under the supervision of, the Company’s principal executive and principal financial officers, or persons performing similar functions, and effected by the Company’s Board of Directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external reporting purposes in accordance with U.S. generally accepted accounting principles.

Capital One’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the Company’s assets; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that the Company’s receipts and expenditures are being made only in accordance with authorizations of the Company’s management and directors; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Company’s assets that could have a material effect on its financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management conducted an assessment of the effectiveness of the Company’s internal control over financial reporting as of December 31, 2024, based on the framework in “2013 Internal Control—Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”), commonly referred to as the “2013 Framework.”

Based on this assessment, management concluded that, as of December 31, 2024, the Com

Showing the first 8K of 513K characters. Open the full section

None.

Overview

We are required under applicable laws and regulations to maintain controls and procedures, which include disclosure controls and procedures as well as internal control over financial reporting, as further described below.

(a) Disclosure Controls and Procedures

Disclosure controls and procedures refer to controls and other procedures designed to provide reasonable assurance that information required to be disclosed in our financial reports is recorded, processed, summarized and reported within the time periods specified by SEC rules and forms and that such information is accumulated and communicated to management, including our Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), as appropriate, to allow timely decisions regarding our required disclosure. In designing and evaluating our disclosure controls and procedures, we recognize that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and we must apply judgment in evaluating and implementing possible controls and procedures.

Evaluation of Disclosure Controls and Procedures

As required by Rule 13a-15 of the Securities Exchange Act of 1934 (“Exchange Act”), our management, including the CEO and CFO, conducted an evaluation of the effectiveness of our disclosure controls and procedures (as that term is defined in Rules 13a-15(e) and 15d-15(e) of the Exchange Act) as of December 31, 2024, the end of the period covered by this Report. Based upon that evaluation, the CEO and CFO concluded that our disclosure controls and procedures were effective as of December 31, 2024, at a reasonable level of assurance, in recording, processing, summarizing and reporting information required to be disclosed within the time periods specified by the SEC rules and forms.

(b) Changes in Internal Control Over Financial Reporting

We regularly review our disclosure controls and procedures and make changes intended to ensure the quality of our financial reporting. There have been no changes in internal control over financial reporting that occurred in the fourth quarter of 2024 that materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

(c) Management’s Report on Internal Control Over Financial Reporting

Management’s Report on Internal Control Over Financial Reporting is included in “Item 8. Financial Statements and Supplementary Data” and is incorporated herein by reference. The Report of Independent Registered Public Accounting Firm on Internal Control Over Financial Reporting also is included in “Item 8. Financial Statements and Supplementary Data” and incorporated herein by reference.

Rule 10b5-1 and Non-Rule 10b5-1 Trading Arrangements

During the three months ended December 31, 2024, no director or officer of the Company adopted or terminated a “Rule 10b5-1 trading arrangement” or “non-Rule 10b5-1 trading arrangement,” as each term is defined in Item 408(a) of Regulation S-K.

Not applicable.

PART III

The information required by Item 10 will be included in our Proxy Statement for the 2025 Annual Stockholder Meeting (“Proxy Statement”) under the headings “Election of Directors,” “Executive Officers,” “Process for Stockholder Recommendations of Director Candidates; Directors Nominations from Stockholders,” and “Board Committees,” and is incorporated herein by reference. The Proxy Statement will be filed with the Securities and Exchange Commission pursuant to Regulation 14A within 120 days of the end of our 2024 fiscal year. In addition, please see “Part I—Item 1. Business—Overview.”

Insider Trading Policy

We maintain insider trading policies and procedures governing the purchase, sale, and/or other dispositions of our company’s securities by directors, officers, employees and other covered persons that we believe are reasonably designed to promote compliance with insider trading laws, rules, and regulations, as well as New York Stock Exchange (“NYSE”) listing standards. A copy of our insider trading policy is filed as Exhibit 19 to this Annual Report on Form 10-K.

The information required by Item 11 will be included in the Proxy Statement under the headings “Director Compensation,” “Compensation Discussion and Analysis,” “NEO Compensation” and “Compensation Committee Report,” and is incorporated herein by reference.

The information required by Item 12 will be included in the Proxy Statement under the headings “Security Ownership” and “Equity Compensation Plans,” and is incorporated herein by reference.

The information required by Item 13 will be included in the Proxy Statement under the headings “Related Person Transactions” and “Director Independence,” and is incorporated herein by reference.

The information required by Item 14 will be included in the Proxy Statement under the heading “Ratification of the Selection of Our Independent Registered Public Accounting Firm,” and is incorporated herein by reference.

PART IV

(a) Financial Statement Schedules

The following documents are filed as part of this Annual Report in Part II, Item 8 and are incorporated herein by reference.

(1) Management’s Report on Internal Control Over Financial Reporting

Report of Independent Registered Public Accounting Firm on Internal Control Over Financial Reporting

Report of Independent Registered Public Accounting Firm on the Consolidated Financial Statements

Consolidated Financial Statements:

Consolidated Statements of Income for the years ended December 31, 2024, 2023 and 2022

Consolidated Statements of Comprehensive Income for the years ended December 31, 2024, 2023 and 2022

Consolidated Balance Sheets as of December 31, 2024 and 2023

Consolidated Statements of Changes in Stockholders’ Equity for the years ended December 31, 2024, 2023 and 2022

Consolidated Statements of Cash Flows for the years ended December 31, 2024, 2023 and 2022

Notes to Consolidated Financial Statements

(2) Schedules

None.

(b) Exhibits

An index to exhibits has been filed as part of this Report and is incorporated herein by reference.

Not applicable.

ANNUAL REPORT ON FORM 10-K

DATED DECEMBER 31, 2024

Commission File No. 001-13300

The following exhibits are incorporated by reference or filed herewith. References to (i) the “2002 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2002, filed on March 17, 2003; (ii) the “2003 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2003, filed on March 5, 2004; (iii) the “2011 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2011, filed on February 28, 2012; (iv) the “2012 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2012, filed on February 28, 2013; (v) the “2013 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2013, filed on February 27, 2014; (vi) the “2015 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2015, filed on February 25, 2016; (vii) the “2016 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2016, filed on February 23, 2017; (ix) t the “2021 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2021, filed on February 25, 2022; (x) the “2022 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2022, filed on February 24, 2023, and (xi) the “2023 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2023, filed on February 23, 2024.

SIGNATURES

Pursuant to the requirements of Section 13 of 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

POWER OF ATTORNEY

We, the undersigned, hereby severally constitute Andrew M. Young, Timothy P. Golden and Matthew W. Cooper, and each of them singly, our true and lawful attorneys with full power to them and each of them to sign for us, and in our names in the capacities indicated below, any and all amendments to the annual report on Form 10-K filed with the Securities and Exchange Commission, hereby ratifying and confirming our signatures as they may be signed by our said attorneys to any and all amendments to said annual report on Form 10-K.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated.