Capital One Financial 10-K 2025-12-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

For the fiscal year ended December 31, 2025

OR

For the transition period from to

Commission File No. 001-13300

CAPITAL ONE FINANCIAL CORPORATION

(Exact name of registrant as specified in its charter)

Registrant’s telephone number, including area code: (703) 720-1000

(Not Applicable) (Former name, former address and former fiscal year, if changed since last report)____________________________________

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to section 12(g) of the Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒ Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C.7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of the voting and non-voting stock held by non-affiliates of the registrant as of the close of business on June 30, 2025 was approximately $135.2 billion. As of January 31, 2026, there were 621,931,593 shares of the registrant’s Common Stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

**1.**Portions of the Proxy Statement for the annual meeting of stockholders to be held on May 08, 2026, are incorporated by reference into Part III.

TABLE OF CONTENTS

INDEX OF MD&A AND SUPPLEMENTAL TABLES

PART I

General

Capital One Financial Corporation, a Delaware corporation established in 1994 and headquartered in McLean, Virginia, is a diversified financial services holding company with banking and non-banking subsidiaries. Capital One Financial Corporation and its subsidiaries (the “Company” or “Capital One”) operate as a global payments provider and diversified financial institution, delivering a broad array of financial products and services to consumers, small businesses and commercial clients through digital channels, branch locations, cafés and other distribution channels.

As of December 31, 2025, Capital One Financial Corporation’s principal operating subsidiary was Capital One, National Association (“CONA”). On May 18, 2025 (the “Closing Date”), Discover Financial Services (“Discover”) merged into Capital One and Discover Bank merged into CONA. See “Part II—Item 8. Financial Statements and Supplementary Data—Note 2—Business Combinations and Discontinued Operations” for additional information. The Company is hereafter collectively referred to as “we,” “us” or “our.” CONA is referred to as the “Bank.”

References to “this Report” or our “2025 Form 10-K” or “2025 Annual Report” are to our Annual Report on Form 10-K for the fiscal year ended December 31, 2025. All references to 2025, 2024 and 2023, refer to our fiscal years ended, or the dates, as the context requires, December 31, 2025, December 31, 2024 and December 31, 2023, respectively. Certain business terms used in this document are defined in “Part II—Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”)—Glossary and Acronyms” and should be read in conjunction with the Consolidated Financial Statements included in this Report.

We were the largest issuer of credit cards in the United States of America (“U.S.”) based on the outstanding balance of credit card loans as of December 31, 2025. In addition to credit cards, we also offer debit cards, bank lending, treasury management and depository services, auto loans and other consumer lending products in markets across the U.S. As one of the nation’s largest banks based on deposits as of December 31, 2025, we service banking customer accounts through digital channels and our network of branch locations, cafés, call centers and automated teller machines (“ATMs”). Additionally, through the acquisition of Discover, we acquired new products including personal loans as well as the Discover Network, the PULSE Network, Diners Club International (“Diners Club”) and Network Partners (collectively, the “Global Payment Network”).

The Discover Network processes transactions for credit and debit cards issued on its network and provides payment transaction processing and settlement services. The PULSE Network operates an electronic funds transfer network, providing financial institutions issuing debit cards on the PULSE Network with access to ATMs domestically and internationally, as well as merchant acceptance throughout the U.S. for debit card transactions. Diners Club is a global payments network of licensees, which are generally financial institutions, that issue Diners Club-branded charge cards and/or provide card acceptance services. We also have agreements with a number of financial institutions, financial technology firms, networks and other commercial service providers (collectively, “Network Partners”) for the provision of card issuing, payments processing and related services on the Global Payment Network.

We also offer credit card products and certain other services outside of the U.S. principally through Capital One (Europe) plc (“COEP”), an indirect subsidiary of CONA organized and located in the United Kingdom (“U.K.”), and through a branch of CONA in Canada. Both COEP and our Canadian branch of CONA have the authority to provide credit card loans. In addition, we offer Global Payment Network services globally.

Business Developments

We regularly explore and evaluate opportunities to acquire financial products and services as well as financial assets, including credit card and other loan portfolios, and enter into strategic partnerships as part of our growth strategy. We also explore opportunities to acquire technology companies and related assets to improve our information technology infrastructure and to deliver on our digital strategy. We may issue equity or debt to fund our acquisitions. In addition, we regularly consider the potential disposition of certain of our assets, branches, partnership agreements or lines of business.

Discover Acquisition

On February 19, 2024, the Company entered into an agreement and plan of merger (the “Merger Agreement”), by and among Capital One, Discover, a Delaware corporation and Vega Merger Sub, Inc., a Delaware corporation and a direct, wholly owned subsidiary of the Company (“Merger Sub”). On May 18, 2025, the Company closed the acquisition of Discover, pursuant to which (a) Merger Sub merged with and into Discover, with Discover as the surviving entity in the merger (the “Merger”); (b) immediately following the Merger, Discover, as the surviving entity, merged with and into Capital One, with Capital One as the surviving entity in the second-step merger (the “Second Step Merger”); and (c) immediately following the Second Step Merger, Discover Bank, a Delaware-chartered and wholly owned subsidiary of Discover, merged with and into CONA, with CONA as the surviving entity in the merger (the “CONA Bank Merger,” and collectively with the Merger and the Second Step Merger, the “Transaction”). The Transaction enables the Company to leverage its newly acquired networks, customer base, technology, and data ecosystem to drive value for merchants, consumers and small businesses. The Company has substantially completed the reissuance of legacy Capital One customer debit cards onto the Global Payment Network.

Upon closing, each share of common stock of Discover outstanding immediately prior to the effective time of the Merger, other than certain shares held by Discover or Capital One, was converted into the right to receive 1.0192 shares of common stock of Capital One. Holders of Discover common stock received cash in lieu of fractional shares. At the effective time of the Second Step Merger, each share of Fixed-to-Floating Rate Non-Cumulative Perpetual Preferred Stock, Series C, of Discover, and each share of 6.125% Fixed-Rate Reset Non-Cumulative Perpetual Preferred Stock, Series D, of Discover, in each case outstanding immediately prior to the effective time of the Second Step Merger, was converted into the right to receive a share of newly created Fixed-to-Floating Rate Non-Cumulative Perpetual Preferred Stock, Series O or 6.125% Fixed-Rate Reset Non-Cumulative Perpetual Preferred Stock, Series P of Capital One.

As of the Closing Date, the fair value of purchase consideration transferred was $51.8 billion. The fair value of total identifiable assets acquired was $168.6 billion, which included $108.2 billion of loans held for investment. The fair value of deposits assumed was $106.9 billion. Our results of operations for the year ended December 31, 2025 reflect the activity of Discover’s acquired business operations for the period since the Closing Date. See “Part II—Item 8. Financial Statements and Supplementary Data—Note 2—Business Combinations and Discontinued Operations” for additional information.

On November 24, 2025, we completed the sale of the Discover Home Loan Business. See “Part II—Item 8. Financial Statements and Supplementary Data—Note 2—Business Combinations and Discontinued Operations” for additional information.

Agreement to Acquire Brex

On January 22, 2026, Capital One Financial Corporat

Showing the first 8K of 87K characters. Open the full section

The following discussion sets forth what management currently believes could be the material risks and uncertainties that could impact our businesses, results of operations and financial condition. The events and consequences discussed in these risk factors could, in circumstances we may not be able to accurately predict, recognize or control, have a material adverse effect on our business, growth, reputation, prospects, financial condition, operating results, cash flows, liquidity and stock price. These risk factors do not identify all risks that we face; our operations could also be affected by factors, events or uncertainties that are not presently known to us or that we currently do not consider to present significant risks to our operations. In addition, the global economic and political climate may amplify many of these risks.

Summary of Risk Factors

The following is a summary of the Risk Factors disclosure in this Item 1A. This summary does not address all of the risks that we face. Additional discussion of the risks summarized in this risk factor summary, and other risks that we face, can be found below and should be carefully considered, together with other information in this Form 10-K and our other filings with the SEC, before making an investment decision regarding our securities.

• We may not be able to successfully integrate our businesses associated with the Transaction, or such integration may be more difficult, time-consuming or costly than expected.

• We will continue to incur substantial expenses related to the integration of Discover, and the expenses may be greater than anticipated due to factors, some or all of which may be outside our control.

• We may fail to realize all of the anticipated benefits of the Transaction, or those benefits may take longer to realize than expected due to factors that may be outside our control.

• The integration of Discover may have an adverse effect on our business and results of operations due to the diversion of a substantial portion of the time and attention of our management team as well as potential employee attrition.

• Changes and instability in the macroeconomic environment could disrupt capital markets, reduce consumer and business activity and weaken the labor market, all of which could impact borrowers’ ability to service their debt obligations and adversely impact our financial results.

• Fluctuations in interest rates could adversely affect our business, results of operations and financial condition.

• We may not be able to maintain adequate sources of funding and liquidity to operate our business.

• We may experience increases in delinquencies and credit losses, or we may incorrectly estimate expected losses, which could result in inadequate reserves.

• We may not be able to maintain adequate capital or liquidity levels or may become subject to revised capital or liquidity requirements, which could have a negative impact on our financial results and our ability to return capital to our stockholders.

• Limitations on our ability to receive dividends from our subsidiaries could affect our liquidity and ability to pay dividends and repurchase our common stock.

• A downgrade in our credit ratings could significantly impact our liquidity, funding costs and access to the capital markets.

• We face risks related to our operational, technological and organizational infrastructure.

• A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions.

• We face risks resulting from the extensive use of models and data, as well as from our evolving use of AI.

• Risks of external fraud exceeding our expectations due to larger, more sophisticated, or more frequent fraud attacks, failure to detect and respond to such attacks and/or the reduced capability to recover losses from those incidents. This could result in increased fraud loss, operational cost, customer dissatisfaction, reputational damage and/or constrained revenue growth for us.

• Compliance with new and existing domestic and foreign laws, regulations and regulatory expectations is costly and complex, and any significant changes may adversely affect our business.

• Our required compliance with applicable laws and regulations related to privacy, data protection and data security, in addition to compliance with our own privacy policies and contractual obligations to third parties, may increase our costs, reduce our revenue, increase our legal exposure and limit our ability to pursue business opportunities.

• Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement.

• We face intense competition in all of our markets, which could have a material adverse effect on our business and results of operations.

• A change in market preference towards other operators of payment networks and alternative payment providers could result in reduced transaction volume, limited merchant acceptance of our cards and limited issuance of cards on our networks by third parties, and in turn may impact our revenue margins.

• If we are unsuccessful in creating and maintaining a strong base of network licensees and achieving meaningful global card acceptance, we may be unable to achieve long-term success in our recently acquired international network business.

• Our business, financial condition and results of operations may be adversely affected by legislation, regulation and merchants’ efforts to reduce the fees (including the interchange component) charged by credit and debit card networks and acquirers to facilitate card transactions.

• A reduction in the number of large merchants that accept cards on our recently acquired Discover Network or PULSE Network or in the rates they pay could materially adversely affect our business, financial condition, results of operations and cash flows.

• Defaults or risks from bankruptcies, liquidations, restructurings, consolidations and outages by our network participants may adversely affect our business, financial condition, cash flows and results of operations.

• If we are not able to invest successfully in and introduce digital and other technological developments across all our businesses, our financial performance may suffer.

• We may fail to realize the anticipated benefits of our mergers, acquisitions and strategic partnerships.

• Reputational risk and social factors may impact our results and damage our brand.

• If we are not able to protect our intellectual property rights, or we violate third-party intellectual property rights, our revenue and profitability could be negatively affected.

• Our risk management strategies may not be fully effective in mitigating our risk exposures in all market environments or against all types of risk.

• Our business could be negatively affected if we are unable to attract, develop, retain and motivate key senior leaders and skilled employees.

• We face risks from catastrophic events.

• Climate change manifesting as physical or transition risks could adversely affect our businesses, operations and customers and result in increased costs.

• We face risks from the use of or changes to assumptions or estimates in our financial statements.

Showing the first 8K of 169K characters. Open the full section

None.

Risk Management and Strategy

As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data, including information about us, our customers, transactions processed on our networks or on third-party networks on our behalf, or third parties with which we do business. While no organization can eliminate cybersecurity and technology risk entirely, we devote significant resources to a cybersecurity program designed to identify, assess and manage such risks. For further discussion of cybersecurity and technology risk, and related risks for our business, see “Item 1A. Risk Factors.”

We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under “Part II—Item 7. MD&A—Risk Management” in this Report, which uses a three lines of defense model. Our cybersecurity and technology risks are managed programmatically under the “operational risk” category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.

These operational risks are managed within a governance structure that consists of defined roles and responsibilities, formal governance bodies, and processes, policies and standards.

Our policies and procedures define an enterprise-wide approach for managing cybersecurity and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:

1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential cybersecurity and technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed.

2.Assessment, Measurement and Response: Management assesses identified risks to estimate such risk’s potential severity and the likelihood of occurrence. Once a risk is identified and measured, management determines the appropriate response, including determining whether to accept the risk in accordance with our established risk appetite, or alternatively to implement new controls, enhance existing controls, and/or develop additional mitigation strategies to reduce the impact of the risk.

3.Monitoring and Testing: Management is required to evaluate the effectiveness of risk management practices and controls through monitoring of key risk indicator metrics, testing and other activities. Identified issues are remediated, addressed via mitigation plans, or escalated, in line with our risk appetite.

4.Aggregation, Reporting and Escalation: Management collects and aggregates risks across the Company in order to support strategic decision-making and to measure overall risk performance against risk appetite metrics. Management also establishes processes designed to escalate, report, and address risks and deficiencies within different business

lines, according to the requirements of our policies. For additional information regarding the escalation of these risks to the Board of Directors, see “Governance” below.

Our policies and procedures collectively help execute a risk management approach designed to account for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers, network participants, including merchants and other third parties. For example, our third-party risk management policy is designed to help enable timely and effective identification, measurement and management of third-party risks throughout the lifecycle of such relationships, which includes planning, due diligence, and third-party selection, contracting, risk-based monitoring and termination. We also assess, identify and manage cybersecurity and technology risks associated with our merger and acquisition activities. See “Governance” below for more information.

As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques designed to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection and response. When appropriate, we leverage partnerships with relevant government entities, law enforcement agencies and industry information sharing forums, such as the Financial Services Information Sharing and Analysis Center (“FS-ISAC”), to further inform our understanding of the threat environment and how to effectively defend the Company against such threats. These defenses include, among other things, a range of cyber educational initiatives that we design and deliver to employees across the enterprise to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data and facilities. Employees are required to annually certify their completion of training on both cybersecurity and data privacy, and our cyber education program implements targeted testing and training focused on high-risk populations and responding to an evolving threat landscape.

We also maintain an Enterprise Cyber Response Plan (“ECRP”) designed to handle suspected or actual cybersecurity events that could impact us and our personnel, data, systems, transactions processed on our networks, customers and third parties with which we do business. The ECRP defines the roles and responsibilities of various teams, individuals and stakeholders in performing this enterprise response, guides decision making for taking actions and escalations to our executive management and the Board of Directors, as appropriate, and helps to plan follow-on actions that seek to reduce the likelihood of similar events’ recurrence in the future. The ECRP is reviewed and refined periodically and refinement is informed in part by a series of table-top exercises that we conduct over the course of the year.

With respect to our recent acquisition of Discover, we have been actively integrating the Discover cybersecurity program into ours in accordance with our Framework, while continuing to identify, assess, and manage cybersecurity and technology risks that may arise as part of our ongoing integration processes. See “Item 1A. Risk Factors—Risks Relating to the Transaction and Integration of Discover” for more information.

We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the 2019 Cybersecurity Incident, have materially affected our overall business strategy, results of operations or financial condition. For further discussion of cybersecurity, and related risks for our business, see “Item 1A. Risk Factors” under the headings “We face risks related to our operational, technological and organizational infrastructure” and “A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions.”

Governance

The Board of Directors is responsible for providing oversight of our Framework. The Risk Committee of the Board of Directors (“Risk Committee”) assists the full Board of Directors in discharging these responsibilities.

The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments, which, in the aggregate, are intended to present an overall view on the status of our cybersecurity program and the Company’s compliance with applicable legal and regulatory requirements.

The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.

At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the Chief Information Officer (“CIO”); reviews our cybersecurity program with the Chief Information Security Officer (“CISO”) and the Chief Technology Risk Officer (“CTRO”); and approves our cybersecurity policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.

We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model. For cybersecurity and technology risks,

our first line of defense includes the following:

• Chief Information Security Officer:** The CISO establishes and manages the enterprise-wide cybersecurity program.

• Chief Information Officer:** The CIO oversees the establishment of appropriate governance, processes and accountabilities within each business area to comply with our internal policies.

our second line of defense includes the following:

• Chief Technology Risk Officer:** The CTRO provides independent oversight of our cybersecurity programs and challenges of first line risk management and risk-taking activities pertaining to cybersecurity and technology risk.

• The Executive Risk Committee:** This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.

our third line of defense is comprised of:

• Internal Audit:** Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our cybersecurity and technology risk management processes are designed and working as intended.

In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications. In particular, our CISO has more than 30 years of cybersecurity and information technology experience, including for nearly five years as CISO at a major global technology company before joining the Company, and holds a CISO Certificate from Carnegie Mellon’s Heinze College. Our CTRO has been in cybersecurity for approximately 25 years and spent over three years as the global CISO of a G-SIB. Prior to that, he served as a senior executive in cybersecurity in the U.S. government. He holds a degree in computer science from the Georgia Institute of Technology and a doctorate in computer security from the University of Cambridge. Our CIO has been with the Company for approximately 20 years, during which he has overseen multiple technology transformation initiatives, including the Company’s transition to the public cloud. He holds degrees in physics and business administration from Harvard University.

Our corporate and banking real estate portfolio consists of approximately 12.3 million square feet of owned or leased office and retail space, which is used to support our business. Of this overall portfolio, approximately 10.4 million square feet of space is dedicated for various corporate office uses and approximately 1.9 million square feet of space is for bank branches and cafés.

Our 10.4 million square feet of corporate office space consists of approximately 7 million square feet of owned space and 3.4 million square feet of leased space. We maintain corporate office space primarily in Virginia, New York, Texas and Illinois, including our headquarters located in McLean, Virginia.

Our 1.9 million square feet for bank branches and cafés is located primarily across New York, Louisiana, Texas, Maryland, Virginia, New Jersey and the District of Columbia and consists of approximately 1.4 million square feet of leased space and

476 thousand square feet of owned space. See “Part II—Item 8. Financial Statements and Supplementary Data—Note 8—Premises, Equipment and Leases” for information about our premises.

The information required by Item 103 of Regulation S-K is included in “Part II—Item 8. Financial Statements and Supplementary Data—Note 19—Commitments, Contingencies, Guarantees and Others.”

Not applicable.

PART II

Market Information

Our common stock is listed on the NYSE and is traded under the symbol “COF.” As of January 31, 2026, there were 39,599 holders of record of our common stock.

Securities Authorized for Issuance Under Equity Compensation Plans

Information relating to compensation plans under which our equity securities are authorized for issuance is presented in this Report under “Part III—Item 12. Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters.”

Common Stock Performance Graph

The following graph shows the cumulative total stockholder return on our common stock compared to an overall stock market index, the S&P Composite 500 Stock Index (“S&P 500 Index”), and a published industry index, the S&P Financial Composite Index (“S&P Financial Index”), over the five-year period commencing December 31, 2020 and ended December 31, 2025. The stock performance graph assumes that $100 was invested in our common stock and each index and that all dividends were reinvested. The stock price performance on the graph below is not necessarily indicative of future performance.

Recent Sales of Unregistered Securities

We did not have any sales of unregistered equity securities in 2025.

Issuer Purchases of Equity Securities

The following table presents information related to repurchases of shares of our common stock for each calendar month in the fourth quarter of 2025. Commission costs are excluded from the amounts presented below.

(1)On October 20, 2025, our Board of Directors authorized the repurchase of up to $16 billion of shares of the Company’s common stock, effective October 21, 2025. This new authorization replaces the Company’s prior authorization to repurchase its common stock approved by our Board of Directors in April 2022. During the fourth quarter, we repurchased $614 million under the prior authorization and $1.9 billion under the new authorization. There were 1,954, 77,361 and 14,507 shares withheld in October, November and December, respectively, to cover taxes on restricted stock awards whose restrictions lapsed. See “Item 7. MD&A—Capital Management—Dividend Policy and Stock Purchases” for more information.

This discussion contains forward-looking statements that are based upon management’s current expectations and are subject to significant uncertainties and changes in circumstances. Please review “Part I—Item 1. Business—Forward-Looking Statements” for more information on the forward-looking statements in this Report. All statements that address operating performance, events or developments that we expect or anticipate will occur in the future are forward-looking statements. Our actual results may differ materially from those included in these forward-looking statements due to a variety of factors including, but not limited to, those described in “Part I—Item 1A. Risk Factors” in this Report. Unless otherwise specified, references to notes to our consolidated financial statements refer to the notes to our consolidated financial statements as of December 31, 2025 included in this Report.

Management monitors a variety of key indicators to evaluate our business results and financial condition. The following MD&A is intended to provide the reader with an understanding of our results of operations and financial condition, including capital and liquidity management, by focusing on changes from year to year in certain key measures used by management to evaluate performance, such as profitability, growth and credit quality metrics. MD&A is provided as a supplement to, and should be read in conjunction with, our audited consolidated financial statements as of and for the year ended December 31, 2025 and accompanying notes. MD&A is organized in the following sections:

The following table presents selected consolidated financial data and performance metrics for the three-year period ended December 31, 2025, 2024 and 2023. We also provide selected key metrics we use in evaluating our performance, including certain metrics that are computed using non-GAAP measures. We consider these metrics to be key financial measures that management uses in assessing our operating performance, capital adequacy and the level of returns generated. We believe these non-GAAP metrics provide useful insight to investors and users of our financial information as they provide an alternate measurement of our performance and assist in assessing our capital adequacy and the level of return generated. These non-GAAP measures should not be viewed as a substitute for reported results determined in accordance with U.S. GAAP, nor are they necessarily comparable to non-GAAP measures that may be presented by other companies.

Three-Year Summary of Selected Financial Data

Showing the first 8K of 364K characters. Open the full section

For a discussion of the quantitative and qualitative disclosures about market risk, see “Item 7. MD&A—Market Risk Profile.”

MANAGEMENT’S REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING

The management of Capital One Financial Corporation (the “Company” or “Capital One”) is responsible for establishing and maintaining adequate internal control over financial reporting and for the assessment of the effectiveness of internal control over financial reporting. Internal control over financial reporting is a process designed by, or under the supervision of, the Company’s principal executive and principal financial officers, or persons performing similar functions, and effected by the Company’s Board of Directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external reporting purposes in accordance with U.S. generally accepted accounting principles.

Capital One’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the Company’s assets; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that the Company’s receipts and expenditures are being made only in accordance with authorizations of the Company’s management and directors; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Company’s assets that could have a material effect on its financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management conducted an assessment of the effectiveness of the Company’s internal control over financial reporting as of December 31, 2025, based on the framework in “2013 Internal Control—Integrated Framework” issued by the Committee of Sponsoring Organizations of the Tr

Showing the first 8K of 577K characters. Open the full section

None.

Overview

We are required under applicable laws and regulations to maintain controls and procedures, which include disclosure controls and procedures as well as internal control over financial reporting, as further described below.

(a) Disclosure Controls and Procedures

Disclosure controls and procedures refer to controls and other procedures designed to provide reasonable assurance that information required to be disclosed in our financial reports is recorded, processed, summarized and reported within the time periods specified by SEC rules and forms and that such information is accumulated and communicated to management, including our CEO and Chief Financial Officer (“CFO”), as appropriate, to allow timely decisions regarding our required disclosure. In designing and evaluating our disclosure controls and procedures, we recognize that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and we must apply judgment in evaluating and implementing possible controls and procedures.

Evaluation of Disclosure Controls and Procedures

As required by Rule 13a-15 of the Securities Exchange Act of 1934 (“Exchange Act”), our management, including the CEO and CFO, conducted an evaluation of the effectiveness of our disclosure controls and procedures (as that term is defined in Rules 13a-15(e) and 15d-15(e) of the Exchange Act) as of December 31, 2025, the end of the period covered by this Report. Based upon that evaluation, the CEO and CFO concluded that our disclosure controls and procedures were effective as of December 31, 2025, at a reasonable level of assurance, in recording, processing, summarizing and reporting information required to be disclosed within the time periods specified by the SEC rules and forms.

(b) Changes in Internal Control Over Financial Reporting

We regularly review our disclosure controls and procedures and make changes intended to ensure the quality of our financial reporting. As a result of the Transaction, we are in the process of incorporating Discover into our internal control over financial reporting. As permitted by the SEC, we have excluded Discover from our evaluation of the effectiveness of internal control over financial reporting as of December 31, 2025. See “Item 8. Financial Statements and Supplementary Data—Note 2—Business Combinations and Discontinued Operations” for further information. Other than those related to the Transaction, there have been no changes in our internal control over financial reporting during that occurred in the fourth quarter of 2025 that materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

(c) Management’s Report on Internal Control Over Financial Reporting

Management’s Report on Internal Control Over Financial Reporting is included in “Item 8. Financial Statements and Supplementary Data” and is incorporated herein by reference. As permitted by the SEC, management’s assessment of and conclusion on the effectiveness of the Company’s internal control over financial reporting as of December 31, 2025, did not include the internal controls of Discover, which was acquired by the Company on May 18, 2025. Discover’s businesses constituted approximately 21% of total assets and 20% of total net revenues as of and for the year ended December 31, 2025. The Report of Independent Registered Public Accounting Firm on Internal Control Over Financial Reporting also is included in “Item 8. Financial Statements and Supplementary Data” and incorporated herein by reference.

Rule 10b5-1 and Non-Rule 10b5-1 Trading Arrangements

During the three months ended December 31, 2025, certain of our directors and officers adopted or terminated a “Rule 10b5-1 trading arrangement” or “non-Rule 10b5-1 trading arrangement,” as each term is defined in Item 408(a) of Regulation S-K as follows:

Robert M. Alexander, our Chief Information Officer, entered into a pre-arranged stock trading plan on October 29, 2025. Mr. Alexander’s plan provides for the associated sale of up to 8,241 shares of Capital One common stock in amounts and prices set forth in the plan and terminates on the earlier of the date all shares under the plan are sold and October 23, 2026.

Neal Blinde, our President, Commercial Banking, entered into a pre-arranged stock trading plan on November 14, 2025. Mr. Blinde’s plan provides for the associated sale of up to 36,488 shares of Capital One common stock, in amounts and prices set forth in the plan and terminates on the earlier of the date all shares under the plan are sold and August 17, 2026.

Jason P. Hanson, our President, Global Payment Network, entered into a pre-arranged stock trading plan on November 14, 2025. Mr. Hanson’s plan provides for the associated sale of up to 11,937.89 shares of Capital One common stock, in amounts and prices set forth in the plan and terminates on the earlier of the date all shares under the plan are sold and May 27, 2026.

Mark Daniel Mouadeb, our President of Card, entered into a pre-arranged stock trading plan on November 14, 2025. Mr. Mouadeb’s plan provides for the associated sale of up to 7,832 shares of Capital One common stock in amounts and prices set forth in the plan and terminates on the earlier of the date all shares under the plan are sold and December 31, 2026.

Each of the trading plans was entered into during an open insider trading window and is intended to satisfy the affirmative defense of Rule 10b5-1(c) under the Exchange Act and Capital One’s policies regarding transactions in its securities.

Not applicable.

PART III

The information required by Item 10 will be included in our Proxy Statement for the 2026 Annual Stockholder Meeting (“Proxy Statement”) under the headings “Election of Directors,” “Executive Officers,” “Process for Stockholder Recommendations of Director Candidates; Director Nominations from Stockholders,” “Delinquent Section 16(a) Reports” and “Board Committees,” and is incorporated herein by reference. The Proxy Statement will be filed with the Securities and Exchange Commission pursuant to Regulation 14A within 120 days of the end of our 2025 fiscal year. In addition, please see “Part I—Item 1. Business—Overview.”

Insider Trading Policy

We maintain insider trading policies and procedures governing the purchase, sale and/or other dispositions of our company’s securities by directors, officers, employees and other covered persons that we believe are reasonably designed to promote compliance with insider trading laws, rules, and regulations, as well as New York Stock Exchange (“NYSE”) listing standards. A copy of our insider trading policy is filed as Exhibit 19 to this Annual Report on Form 10-K.

The information required by Item 11 will be included in the Proxy Statement under the headings “Director Compensation,” “Compensation Discussion and Analysis,” “NEO Compensation” and “Compensation Committee Report,” and is incorporated herein by reference.

The information required by Item 12 will be included in the Proxy Statement under the headings “Security Ownership” and “Equity Compensation Plans,” and is incorporated herein by reference.

The information required by Item 13 will be included in the Proxy Statement under the headings “Related Person Transactions” and “Director Independence,” and is incorporated herein by reference.

The information required by Item 14 will be included in the Proxy Statement under the heading “Ratification of the Selection of Ernst & Young LLP as Our Independent Registered Public Accounting Firm for 2026,” and is incorporated herein by reference.

PART IV

(a) Financial Statement Schedules

The following documents are filed as part of this Annual Report in Part II, Item 8 and are incorporated herein by reference.

(1) Management’s Report on Internal Control Over Financial Reporting

Report of Independent Registered Public Accounting Firm on Internal Control Over Financial Reporting

Report of Independent Registered Public Accounting Firm on the Consolidated Financial Statements

Consolidated Financial Statements:

Consolidated Statements of Income for the years ended December 31, 2025, 2024 and 2023

Consolidated Statements of Comprehensive Income for the years ended December 31, 2025, 2024 and 2023

Consolidated Balance Sheets as of December 31, 2025 and 2024

Consolidated Statements of Changes in Stockholders’ Equity for the years ended December 31, 2025, 2024 and 2023

Consolidated Statements of Cash Flows for the years ended December 31, 2025, 2024 and 2023

Notes to Consolidated Financial Statements

(2) Schedules

None.

(b) Exhibits

An index to exhibits has been filed as part of this Report and is incorporated herein by reference.

Not applicable.

ANNUAL REPORT ON FORM 10-K

DATED DECEMBER 31, 2025

Commission File No. 001-13300

The following exhibits are incorporated by reference or filed herewith. References to (i) the “2002 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2002, filed on March 17, 2003; (ii) the “2003 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2003, filed on March 5, 2004; (iii) the “2011 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2011, filed on February 28, 2012; (iv) the “2012 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2012, filed on February 28, 2013; (v) the “2013 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2013, filed on February 27, 2014; (vi) the “2015 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2015, filed on February 25, 2016; (vii) the “2016 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2016, filed on February 23, 2017; (viii) the “2022 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2022, filed on February 24, 2023, and (ix) the “2023 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2023, filed on February 23, 2024, (x) the “2024 Form 10-K” are to the Company’s Annual Report on Form 10-K for the year ended December 31, 2024, filed on February 20, 2025.

SIGNATURES

Pursuant to the requirements of Section 13 of 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.

POWER OF ATTORNEY

We, the undersigned, hereby severally constitute Andrew M. Young, Timothy P. Golden and Matthew W. Cooper, and each of them singly, our true and lawful attorneys with full power to them and each of them to sign for us, and in our names in the capacities indicated below, any and all amendments to the annual report on Form 10-K filed with the Securities and Exchange Commission, hereby ratifying and confirming our signatures as they may be signed by our said attorneys to any and all amendments to said annual report on Form 10-K.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the registrant and in the capacities and on the dates indicated.