KeyCorp 10-K 2023-12-31

Table of contents

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

ANNUAL REPORT

PURSUANT TO SECTION 13 OR 15(d)

OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended

December 31, 2023

Commission file number: 1-11302

KeyCorp

Exact name of registrant as specified in its charter:

(216) 689-3000

Registrant’s telephone number, including area code:

SECURITIES REGISTERED PURSUANT TO SECTION 12(b) OF THE ACT:

SECURITIES REGISTERED PURSUANT TO SECTION 12(g) OF THE ACT: NONE

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this Chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previous issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to § 240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

The aggregate market value of voting and non-voting common stock held by nonaffiliates of the Registrant was $8,646,175,313 (based on the June 30, 2023, closing price of KeyCorp Common Shares of $9.24 as reported on the New York Stock Exchange). As of February 20, 2024, there were 933,841,692 Common Shares outstanding.

Certain specifically designated portions of KeyCorp’s definitive Proxy Statement for its 2024 Annual Meeting of Shareholders are incorporated by reference into Part III of this Form 10-K.

Table of contents

Forward-looking Statements

From time to time, we have made or will make forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These statements do not relate strictly to historical or current facts. Forward-looking statements usually can be identified by the use of words such as “goal,” “objective,” “plan,” “expect,” “assume,” “anticipate,” “intend,” “project,” “believe,” “estimate,” “will,” “would,” “should,” “could,” or other words of similar meaning. Forward-looking statements provide our current expectations or forecasts of future events, circumstances, results or aspirations. Our disclosures in this report contain forward-looking statements. We may also make forward-looking statements in other documents filed with or furnished to the SEC. In addition, we may make forward-looking statements orally to analysts, investors, representatives of the media and others.

Forward-looking statements, by their nature, are subject to assumptions, risks, and uncertainties, many of which are outside of our control. Our actual results may differ materially from those set forth in our forward-looking statements. There is no assurance that any list of risks and uncertainties or risk factors is complete. In addition, no assurance can be given that any plan, initiative, projection, goal, commitment, expectation, or prospect set forth in this report can or will be achieved. Factors that could cause our actual results to differ from those described in forward-looking statements include, but are not limited to:

• our concentrated credit exposure in commercial and industrial loans;

• deterioration of commercial real estate market fundamentals;

• defaults by our loan clients or counterparties;

• adverse changes in credit quality trends;

• declining asset prices;

• geopolitical destabilization;

• deterioration of asset quality and an increase in credit losses;

• labor shortages and supply chain constraints, as well as the impact of inflation;

• the extensive regulation of the U.S. financial services industry;

• complex and evolving laws and regulations regarding privacy and cybersecurity;

• changes in accounting policies, standards, and interpretations;

• operational or risk management failures by us or critical third parties;

• breaches of security or failures of our technology systems due to technological or other factors and cybersecurity threats;

• negative outcomes from claims, litigation, investigations, or governmental proceedings;

• failure or circumvention of our controls and procedures;

• the occurrence of natural disasters, which may be exacerbated by climate change;

• societal responses to climate change;

• increased operational risks resulting from remote work;

• evolving capital and liquidity standards under applicable regulatory rules;

• disruption of the U.S. financial system, including the impact of inflation and a potential global economic downturn or recession;

• our ability to receive dividends from our subsidiaries, including KeyBank;

• unanticipated changes in our liquidity position, including but not limited to, changes in our access to or the cost of funding and our ability to secure alternative funding sources;

• downgrades in our credit ratings or those of KeyBank;

• a worsening of the U.S. economy due to financial, political or other shocks;

• our ability to anticipate interest rate changes and manage interest rate risk;

• deterioration of economic conditions in the geographic regions where we operate;

• the soundness of other financial institutions, including instability in the financial industry;

• impairment of goodwill;

• our ability to manage our reputational risks, including ESG-related risks;

• our ability to timely and effectively implement our strategic initiatives;

• increased competitive pressure;

• our ability to adapt our products and services to industry standards and consumer preferences;

• our ability to attract and retain talented executives and employees;

• unanticipated adverse effects of strategic partnerships or acquisitions and dispositions of assets or businesses; and

• our ability to develop and effectively use the quantitative models we rely upon in our business planning.

Table of contents

Any forward-looking statements made by us or on our behalf speak only as of the date they are made, and we do not undertake any obligation to update any forward-looking statement to reflect the impact of subsequent events or circumstances, except as required by applicable securities laws. Before making an investment decision, you should carefully consider all risks and uncertainties disclosed in our SEC filings, including this report on Form 10-K and our subsequent reports on Forms 10-Q and 8-K and our registration statements under the Securities Act of 1933, as amended, all of which are or will upon filing be accessible on the SEC’s website at www.sec.gov and on our website at www.key.com/ir.

Terminology

Throughout this discussion, references to “Key,” “we,” “our,” “us,” and similar terms refer to the consolidated entity consisting of KeyCorp and its subsidiaries. “KeyCorp” refers solely to the parent holding company, and “KeyBank” refers solely to KeyCorp’s subsidiary bank, KeyBank National Association. “KeyBank (consolidated)” refers to the consolidated entity consisting of KeyBank and its subsidiaries.

We want to explain some industry-specific terms at the outset so you can better understand the discussion that follows.

• We use the phrase continuing operations in this document to mean all of our businesses other than our government-guaranteed and private education lending business, which are accounted for as discontinued operations.

• We engage in capital markets activities primarily through business conducted by our Commercial Bank segment*.* These activities encompass a variety of products and services. Among other things, we trade securities as a dealer, enter into derivative contracts (both to accommodate clients’ financing needs and to mitigate certain risks), and conduct transactions in foreign currencies (to accommodate clients’ needs).

• For regulatory purposes, capital is divided into two classes. Federal regulations currently prescribe that at least one-half of a bank or BHC’s total risk-based capital must qualify as Tier 1 capital. Both total and Tier 1 capital serve as bases for several measures of capital adequacy, which is an important indicator of financial stability and condition. Banking regulators evaluate a component of Tier 1 capital, known as Common Equity Tier 1, under the Regulatory Capital Rules. The “Capital” section of this report under the heading “Capital adequacy” provides more information on total capital, Tier 1 capital, and the Regulatory Capital Rules, including Common Equity Tier 1, and describes how these measures are calculated.

Table of contents

The acronyms and abbreviations identified below are used throughout this report, including in the Notes to Consolidated Financial Statements and in the Management’s Discussion and Analysis of Financial Condition and Results of Operations. You may find it helpful to refer back to this page as you read this report.

Table of contents

KEYCORP

2023 FORM 10-K ANNUAL REPORT

TABLE OF CONTENTS

Table of contents

PART I

Overview

KeyCorp, organized in 1958 under the laws of the State of Ohio, is headquartered in Cleveland, Ohio. We are a BHC under the BHCA and one of the nation’s largest bank-based financial services companies, with consolidated total assets of approximately $188.3 billion at December 31, 2023. KeyCorp is the parent holding company for KeyBank National Association, its principal subsidiary, through which most of our banking services are provided. Through KeyBank and certain other subsidiaries, we provide a wide range of retail and commercial banking, commercial leasing, investment management, consumer finance, student loan refinancing, commercial mortgage servicing and special servicing, and investment banking products and services to individual, corporate, and institutional clients through two major business segments: Consumer Bank and Commercial Bank.

As of December 31, 2023, these services were provided across the country through KeyBank’s 959 full-service retail banking branches and a network of 1,217 ATMs in 15 states, as well as additional offices, online and mobile banking capabilities, including our national digital bank, Laurel Road, and a telephone banking call center. Additional information pertaining to our two business segments is included in the “Business Segment Results” section in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of this report, and in Note 25 (“Business Segment Reporting”) of the Notes to Consolidated Financial Statements presented in Item 8. Financial Statements and Supplementary Data, which are incorporated herein by reference.

In addition to the customary banking services of accepting deposits and making loans, our bank and its trust company subsidiary offer personal and institutional trust custody services, personal financial and planning services, access to mutual funds, treasury services, and international banking services. Through our bank, trust company, and registered investment adviser subsidiaries, we provide investment management services to clients that include large corporate and public retirement plans, foundations and endowments, high-net-worth individuals, and multi-employer trust funds established for providing pension or other benefits to employees.

We provide other financial services — both within and outside of our primary banking markets — through various nonbank subsidiaries. These services include community development financing, securities underwriting, investment banking and capital markets products, and brokerage. We also provide merchant services to businesses.

KeyCorp is a legal entity separate and distinct from its banks and other subsidiaries. Accordingly, the right of KeyCorp, its security holders, and its creditors to participate in any distribution of the assets or earnings of its banks and other subsidiaries is subject to the prior claims of the creditors of such banks and other subsidiaries, except to the extent that KeyCorp’s claims in its capacity as a creditor may be recognized.

We derive the majority of our revenues within the United States from customers domiciled in the United States. Revenue from foreign countries and external customers domiciled in foreign countries was immaterial to our consolidated financial statements.

Demographics

Our management structure and basis of presentation is divided into two business segments, Consumer Bank and Commercial Bank. Note 25 (“Business Segment Reporting”) describes the products and services offered by each of these business segments and provides more detailed financial information pertaining to the segments, including changes in basis of presentation.

The Consumer Bank serves individuals and small businesses throughout our 15-state branch footprint and through our Laurel Road digital brand by offering a variety of deposit and investment products, personal finance and financial wellness services, lending, student loan refinancing, mortgage and home equity, credit card, treasury services, and business advisory services. In addition, wealth management and investment services are offered to assist non-profit and high-net-worth clients with their banking, trust, portfolio management, charitable giving, and related needs.

The Commercial Bank consists of the Commercial and Institutional operating segments. The Commercial operating segment is a full-service, commercial banking platform that focuses primarily on serving the borrowing, cash

Table of contents

management, and capital markets needs of middle market clients within Key’s 15-state branch footprint. It is also a significant, national, commercial real estate lender and third-party servicer of commercial mortgage loans and special servicer of CMBS. The Institutional operating segment operates nationally in providing lending, equipment financing, and banking products and services to large corporate and institutional clients. The industry coverage and product teams have established expertise in the following sectors: Consumer, Energy, Healthcare, Industrial, Public Sector, Real Estate, and Technology. The operating segment includes the KBCM platform which provides a broad suite of capital markets products and services including syndicated finance, debt and equity capital markets, derivatives, foreign exchange, financial advisory, public finance, commercial payments, equipment finance, and commercial mortgage banking. Additionally, KBCM provides fixed income and equity sales and trading services to investor clients.

Additional Information

Our executive offices are located at 127 Public Square, Cleveland, Ohio 44114-1306, and our telephone number is (216) 689-3000. Our website is www.key.com, and the investor relations section of our website may be reached through www.key.com/ir. We make available free of charge, on or through the investor relations section of our website, annual reports on Form 10-K, quarterly reports on Form 10-Q, and current reports on Form 8-K, and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), as well as proxy statements, as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC. Also posted on our website, and available in print upon request from any shareholder to our Investor Relations Department, are the charters for our Technology Committee, Audit Committee, Compensation and Organization Committee, Executive Committee, Nominating and Corporate Governance Committee, and Risk Committee; our Corporate Governance Guidelines; the Code of Business Conduct and Ethics for our directors, officers, and employees; our Standards for Determining Independence of Directors; our policy for Review of Transactions Between KeyCorp and Its Directors, Executive Officers and Other Related Persons; our Statement of Political Activity; and our Corporate Responsibility Report. Within the time period required by the SEC and the NYSE, we will post on our website any amendment to the Code of Ethics and any waiver applicable to any senior executive officer or director. We also make available a summary of filings made with the SEC of statements of beneficial ownership of our equity securities filed by our directors and officers under Section 16 of the Exchange Act. The “Regulatory Disclosures & Filings” section under the “Financials” tab of the investor relations section of our website includes public disclosures concerning our historic annual and mid-year stress-testing activities under the Dodd-Frank Act and our quarterly regulatory capital disclosures under the third pillar of Basel III.

Information contained on or accessible through, including any reports available on, our website or any other website referenced in this report is not part of this report. References to websites in

Showing the first 8K of 89K characters. Open the full section

Summary of Risk Factors

The following is a summary of some of the material risks and uncertainties that could have an adverse effect on our business.

• Credit Risk

**◦**We have concentrated credit exposure in commercial and industrial loans, commercial real estate loans, and commercial leases.

**◦**Should the fundamentals of the commercial real estate market deteriorate, our financial condition and results of operations could be adversely affected.

**◦**We are subject to the risk of defaults by our loan clients and counterparties.

**◦**Various factors may cause our allowance for loan and lease losses to increase or to be inadequate.

**◦**Declining asset prices could adversely affect us.

**◦**Geopolitical destabilization could adversely impact our loan portfolios.

• Compliance Risk

**◦**We are subject to extensive government regulation, supervision, and tax legislation.

**◦**We are subject to complex and evolving laws and regulations regarding privacy and cybersecurity, which could limit our ability to pursue business initiatives, increase the cost of doing business and subject us to compliance risks and potential liability.

**◦**Changes in accounting policies, standards, and interpretations could materially affect how we report our financial condition and results of operations.

• Operational Risk

**◦**We are subject to a variety of operational risks.

**◦**We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption.

**◦**We rely on third parties to perform significant operational services for us.

**◦**We are, and may in the future be, subject to claims, litigation, investigations, and governmental proceedings, which could result in significant financial liability and/or reputational harm.

**◦**Our controls and procedures may fail or be circumvented, and our methods of reducing risk exposure may not be effective.

**◦**Our operations and financial performance could be adversely affected by severe weather and natural disasters exacerbated by climate change.

◦Societal and governmental responses to climate change could adversely affect Key’s business and performance, including indirectly through impacts on Key’s customers.

**◦**The increased use of remote work infrastructure has expanded potential attack vectors and resulted in increased operational risks.

• Liquidity Risk

**◦**Capital and liquidity requirements imposed by banking regulations require banks and BHCs to maintain more and higher quality capital and more and higher quality liquid assets.

**◦**Federal agencies’ actions to ensure stability of the U.S. financial system may have disruptive effects on us.

**◦**We rely on dividends by our subsidiaries for most of our funds.

**◦**We are subject to liquidity risk, which could negatively affect our funding levels.

**◦**Our credit ratings affect our liquidity position.

• Market Risk

**◦**A worsening of the U.S. economy and volatile or recessionary conditions in the U.S. or abroad could negatively affect our business or our access to capital markets.

**◦**We are subject to interest rate risk, which could adversely affect net interest income.

**◦**Our profitability depends upon economic conditions in the geographic regions where we have significant operations and in certain market segments in which we conduct significant business.

**◦**The soundness of other financial institutions could adversely affect us.

◦Depressed market values for our common stock and adverse economic conditions sustained over a period of time may require us to write down all or some portion of our goodwill.

Table of contents

• Reputation Risk

**◦**Damage to our reputation could significantly impact our business and major stakeholders.

**◦**Key is subject to environmental, social, and governance (ESG) risks that could adversely affect our reputation, the trading price of our common stock and/or our business and results of operations.

• Strategic Risk

**◦**We may not realize the expected benefits of our strategic initiatives.

**◦**We operate in a highly competitive industry.

**◦**Maintaining or increasing our market share depends upon our ability to adapt our products and services to evolving industry standards and consumer preferences, while maintaining competitive products and services.

**◦**We may not be able to attract and retain skilled people.

**◦**Acquisitions or strategic partnerships may disrupt our business and dilute shareholder value.

• Model Risk

**◦**We rely on quantitative models to manage certain accounting, risk management, capital planning, and treasury functions.

As a financial services organization, we are subject to a number of risks inherent in our transactions and present in the business decisions we make. Described below are the material risks and uncertainties that if realized could have a material and adverse effect on our business, financial condition, results of operations or cash flows, and our access to liquidity. The risks and uncertainties described below are not the only risks we face. Disclosures of risks should not be interpreted to imply that the risks have not already materialized.

Our ERM program incorporates risk management throughout our organization to identify, understand, and manage the risks presented by our business activities. Our ERM program identifies Key’s major risk categories as: credit risk, compliance risk, operational risk, liquidity risk, market risk, reputation risk, strategic risk, and model risk. These risk factors, and other risks we may face, are discussed in more detail in other sections of this report.

I. Credit Risk

We have concentrated credit exposure in commercial and industrial loans, commercial real estate loans, and commercial leases.

As of December 31, 2023, approximately 69% of our loan portfolio consisted of commercial and industrial loans, commercial real estate loans, including commercial mortgage and construction loans, and commercial leases. These types of loans are typically larger than single family residential real estate loans and other types of consumer loans and have a different risk profile. The deterioration of a larger loan or a group of loans in this category could cause an increase in criticized and nonperforming loans, which could result in lower earnings from these loans, additional provision for loan and lease losses, and ultimately an increase in loan losses.

Should the fundamentals of the commercial real estate market deteriorate, our financial condition and results of operations could be adversely affected.

Recent Federal Reserve monetary policy, including shrinkage of its balance sheet and incremental increases in target interest rates early in 2023 followed by a sustained period of relatively high target interest rates throughout

the latter part of 2023, continue to impact the commercial and residential real estate markets. Capitalization rates

are rising, and property value appreciation has slowed or is now declining. In many markets within Key’s footprint,

property values have begun to decrease. Industrial and retail properties continue to remain stable, but multifamily,

office, hospitality, and single family detached properties are beginning to show signs of deterioration. Development

and construction continue, but at muted levels, and deliveries of additional units into the market have been supported. Oversupply of multifamily housing is a concern in certain urban and gateway markets. However, our

exposures in those markets are limited (for example, approximately 5% of our multifamily portfolio is located in New York City, Chicago, Los Angeles, and San Francisco; we also have no exposure to rent controlled properties in New York City). The most severely impacted commercial re

Showing the first 8K of 88K characters. Open the full section

None.

Cybersecurity Risk Management

As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related

to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature

and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see “Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption” in Item 1A. Risk Factors of this report.

Key maintains an Information Security Program (the “IS Program”) to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key’s

clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of

Key’s information assets. Our Chief Information Security Officer (“CISO”), who is also the Enterprise Security

Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key’s Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.

The IS Program is designed to provide safeguards for Key’s assets through a series of administrative, technical,

and physical controls. Key employs a variety of security practices and controls to protect information and assets,

including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external

penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails

for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated

security personnel.

As described in more detail in “Risk Management — Overview” in Item 7 of this report and in “Cybersecurity

Governance” below, Key employs the “Three Lines of Defense” in its risk governance framework. Assessing,

identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key’s internal audit function (Third Line of Defense):

• First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key’s lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure.

• Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key’s customers, employees, and other individuals from who Key collects personally identifiable information.

• Third Line of Defense – Risk Review Group. The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key’s LOBs, operations, information systems, and technologies. These internal audits provide an independent

Table of contents

perspective on Key’s processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key’s Operational and Compliance Risk Management Groups, the Board’s Audit Committee, and banking regulators.

As part of its cybersecurity risk management strategy, Key regularly reviews its security and privacy controls in the context of industry standard practices, frameworks, evolving laws, and changing client expectations. Key engages external providers periodically to perform a maturity assessment of the IS Program against industry cybersecurity frameworks. Key also engages external advisors periodically to perform security posture assessments of our environment to proactively identify weakness within our security policy and/or configurations. Summary level results from these assessments are shared to internal stakeholders through Key’s Risk Governance committee structure. Key is also subject to cybersecurity and privacy regulatory exams, as required by law for financial institutions.

Key has implemented cybersecurity, privacy, and fraud education and awareness programs across the

enterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees and

contractors with access to assets or data owned or maintained by Key receive mandatory enterprise-wide

cybersecurity, privacy, and fraud training on an annual basis.

With respect to third party service providers, Key maintains a third party management program that is designed to

identify, review, monitor, escalate, and, if necessary, remediate third party information security risks. Key’s third

party onboarding process includes risk-based due diligence and security-relevant contract language. Risk-based

due diligence can also include an assessment of the strength of certain control areas, including, but not limited to,

information security management, physical security, network security, platform security, application security, cloud

security, encryption management, business resiliency, and privacy. Once a business relationship is established with a service provider, Key performs risk-based periodic reviews of the third party service provider's security programs. In addition to an established governance approval process for new engagements, Key has established a Third Party Management Committee to oversee compliance with Key’s Third Party Management Policy and Program.

Cybersecurity Governance

As described in more detail in “Risk Management — Overview” in Item 7 of this report, the Board serves in an

oversight capacity to ensure that Key’s risks, including risk from cybersecurity threats, are managed in a manner that is effective and balanced and adds value for our shareholders. The Board’s Risk Committee exercises primary oversight over enterprise-wide risk at Key, including operational risk, which includes cybersecurity risk, and provides oversight of management’s activities related to cybersecurity risk. The Board’s Audit Committee monitors and exercises oversight over cybersecurity risk as part of its joint oversight of operational risk with the Risk Committee. The Board’s Technology Committee provides additional oversight of management’s activities related to Key’s technology strategic investment plan, cybersecurity investments, and major technology vendor relationships and is expected to escalate to the Risk Committee on certain risk management issues.

Key’s CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 29 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.

The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2023). The CISO’s update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key’s compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key’s Deputy CISO, also report annually to the Technology Committee to obtain approval on Key’s Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.

Key’s Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity

& Access Management Operations, Information Security Governance, and Security Architecture and Engineering.

The Deputy CISO has over 16 years of cybersecurity and technology risk management experience across financial

Table of contents

services and retail, previously served as the Head of Information Security Governance within KeyCorp’s Corporate

Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp’s

Risk Management group. He holds a bachelor’s degree in Finance and Management Information Systems and an

MBA.

The CISO reports to Key’s Chief Information Officer who oversees all of Key’s shared services for technology,

operations, data, servicing, cyber and physical security, and corporate real estate solutions. Our Chief Information Officer, who has served in the role since 2012, has extensive experience overseeing technology and operations delivery for critical enterprise functions and has held various leadership roles during her over 30-year career in the financial services industry.

At the management level, our Enterprise Risk Management (ERM) Committee, chaired by the Chief Executive

Officer and comprising other senior level executives, including the Chief Information Officer, reports to the Board’s

Risk Committee and is responsible for managing risk, including cybersecurity risk. The ERM Committee serves as a

senior level forum for review and discussion of material operational risk issues, including cybersecurity risk, and

receives regular updates from the CISO regarding cybersecurity risk. The ERM Committee directly oversees the

Operational Risk Committee, which provides governance, direction, oversight, and high-level management of

operational risk, including cybersecurity risk, and includes senior management representation from the LOB and

support areas. The CISO is a voting member of the Operational Risk Committee.

The Operational Risk Committee also includes subcommittees which, among other things, address security issues

and concerns, pursue security-related program enhancements, address fraud trends, provide input on fraud

strategy, weigh the impacts of fraud risk on customers, business clients, and the LOB, and cascades awareness of

fraud risks across Key.

Key also has a Privacy Team led by a Chief Privacy Officer (CPO) who has over ten years of experience in legal,

compliance, and risk roles at financial institutions, focusing primarily on data protection and privacy. Our CPO holds

an undergraduate degree in finance, a master’s degree in business administration, and a juris doctorate. He is

licensed to practice law in the state of Ohio and has obtained the CIPP/US certification through the International

Association of Privacy Professionals. The CPO and Privacy team have the authority to escalate privacy risks to the

Board. The Privacy and Information Security teams work together to implement controls around how personally

identifiable information is managed and protected and to comply with applicable laws and regulations.

Cybersecurity Incidents

When a cybersecurity incident is identified, we follow established processes in our enterprise privacy and cyber

incident response plans, which are a supplement to our corporate incident response plan. These plans provide a

framework to enable the appropriate personnel to recover operations in the event of a cyberattack and manage

incidents impacting banking information, including our clients’ and employees’ information.

Our Core Incident Response Rapid Emergency Assessment and Coordination Team (Core IR REACT) is

responsible for responding to incidents, including cyberattacks, performing a preliminary assessment, and engaging

additional support team members as necessary. The Core IR REACT team is a multidisciplinary team that is

empowered to escalate issues, as appropriate, to our Crisis Management Team (CMT), which includes the CEO

and senior executives from Key’s LOB and major support areas. The CMT provides overall strategic

direction for incident responses and recovery. Incidents are also reported internally to key stakeholders through Key’s risk governance committee structure.

As discussed above in “Cybersecurity Risk Management,” the RRG shares the results of its independent internal

audits of security activities at Key and the effectiveness of the IS Program with the line of business management,

Key’s Operational and Compliance Risk Management Groups, the Board’s Audit Committee, and banking

regulators. Any identified gaps are risk rated, issued a due date for remediation, and tracked through completion of

remediation. Remediation is then verified by the RRG.

Table of contents

The headquarters of KeyCorp and KeyBank are located at 127 Public Square, Cleveland, Ohio 44114-1306 in the Key Center. At December 31, 2023, Key leased approximately 375,414 square feet of the complex, encompassing the first floor branch, the 2nd, 3rd and 5th through 9th office floors, the 12th floor, and the 54th through 56th floors of the 57-story Key Center. In addition, Key owned two buildings in Brooklyn, Ohio, with office space that it operated from and totaling 584,930 square feet at December 31, 2023. Our office space is used by all of our segments. As of the same date, KeyBank owned 415 branches and leased 544 branches. The lease terms for applicable branches are not individually material, with terms ranging from month-to-month to 99 years from inception.

The information presented in the Legal Proceedings section of Note 22 (“Commitments, Contingent Liabilities, and Guarantees”) of the Notes to Consolidated Financial Statements is incorporated herein by reference.

On at least a quarterly basis, we assess our liabilities and contingencies in connection with outstanding legal proceedings utilizing the latest information available. Where it is probable that we will incur a loss and the amount of the loss can be reasonably estimated, we record a liability in our consolidated financial statements. These legal reserves may be increased or decreased to reflect any relevant developments on a quarterly basis. Where a loss is not probable or the amount of the loss is not estimable, we have not accrued legal reserves, consistent with applicable accounting guidance. Based on information currently available to us, advice of counsel, and available insurance coverage, we believe that our established reserves are adequate and any liabilities that may arise from outstanding legal proceedings will not have a material adverse effect on our consolidated financial condition. We note, however, that in light of the inherent uncertainty in legal proceedings there can be no assurance that the ultimate resolution will not exceed established reserves. As a result, the outcome of a particular matter or a combination of matters may be material to our results of operations for a particular period, depending upon the size of the loss or our income for that particular period.

Not applicable.

Table of contents

PART II

The following disclosures included in Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations are incorporated herein by reference:

The following graph compares the price performance of our Common Shares (based on an initial investment of $100 on December 31, 2018, and assuming reinvestment of dividends) with that of the S&P 500 Index and a group of other banks that constitute our peer group. The peer group consists of the banks that make up the S&P 500 Regional Bank Index and the banks that make up the Standard & Poor’s 500 Diversified Bank Index. We are included in the S&P 500 Index and the peer group. Share price performance is not necessarily indicative of future price performance.

From time to time, KeyCorp or its principal subsidiary, KeyBank, may seek to retire, repurchase, or exchange outstanding debt of KeyCorp or KeyBank, and capital securities or preferred stock of KeyCorp, through cash purchase, privately negotiated transactions, or otherwise. Such transactions, if any, depend on prevailing market conditions, our liquidity and capital requirements, contractual restrictions, and other factors. The amounts involved may be material.

In July 2021, the Board of Directors authorized the repurchase of up to $1.5 billion of our Common Shares, effective the third quarter of 2021 through the third quarter of 2022. In September 2022, the Board of Directors approved the extension of the previous authorization through the third quarter of 2023. This authorization expired as of September 30, 2023. During the fourth quarter of 2023, Key repurchased less than $1 million of shares related to equity compensation programs.

The following table summarizes our repurchases of our Common Shares for the three months ended December 31, 2023.

(a)Includes Common Shares deemed surrendered by employees in connection with our stock compensation and benefit plans to satisfy tax obligations. We did not complete any open market share repurchases in the fourth quarter of 2023.

(b)Our previous share purchase authorization expired as of September 30, 2023

Table of contents

Table of contents

Introduction

This section reviews the financial condition and results of operations of KeyCorp and its subsidiaries for 2023 and 2022. Some tables may include additional periods to comply with disclosure requirements or to illustrate trends in greater depth. When you read this discussion, you should also refer to the consolidated financial statements and related notes in this report. The page locations of specific sections and notes that we refer to are presented in the Table of Contents. To review our financial condition and results of operations for 2021 and a comparison between the 2021 and 2022 results, see Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations of our 2022 Form 10-K filed with the SEC on February 22, 2023, which discussion is incorporated herein by reference.

Table of contents

Long-term financial targets

(a)See the section entitled “GAAP to non-GAAP Reconciliations,” which presents the computations of certain financial measures related to “cash efficiency.” The section includes tables that reconcile the GAAP performance measures to the corresponding non-GAAP measures, which provides a basis for period-to-period comparisons.

(a)See the section entitled “GAAP to non-GAAP Reconciliations,” which presents the computations of certain financial measures related to “tangible common equity.” The section includes tables that reconcile the GAAP performance measures to the corresponding non-GAAP measures, which provides a basis for period-to-period comparisons.

Positive Operating Leverage

Generate positive operating leverage and a cash e**fficiency ratio in the range of 54.0% to 56.0%.

For the 2023 fiscal year, our cash efficiency ratio and operating leverage were affected by an increase in noninterest expense and a decrease in revenues. Noninterest expense increased 7% from prior year including the impact of the FDIC special assessment as well as efficiency-related charges as we focused on expense management, including simplifying and streamlining our businesses. Net interest income decreased 13% from prior year reflecting higher interest-bearing deposit costs and a shift in funding mix to higher cost deposits and borrowings. Positive operating leverage remains one of our long-term financial targets.

Moderate Risk Profile

Maintain a moderate risk profile by targeting a net loan charge-offs to average loans ratio in the range *of .40% to .60% th

Showing the first 8K of 231K characters. Open the full section

The information included under the caption “Risk Management — Market risk management” in the MD&A beginning on page 76 is incorporated herein by reference.

Table of contents

Table of contents

Management’s Annual Report on Internal Control over Financial Reporting

We are responsible for the preparation, content and integrity of the financial statements and other statistical data and analyses compiled for this annual report. The financial statements and related notes have been prepared in conformity with U.S. generally accepted accounting principles and include amounts which of necessity are based on management’s best estimates and judgments and give due consideration to materiality. We believe the financial statements and notes present fairly our financial position, results of operations and cash flows in all material respects.

We are responsible for establishing and maintaining a system of internal control that is designed to protect our assets and the integrity of our financial reporting as defined in the Securities Exchange Act of 1934, as amended. This corporate-wide system of controls includes policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Corporation; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of the consolidated financial statements in conformity with U.S. generally accepted accounting principles, and that receipts and expenditures of the Corporation are made only in accordance with authorizations of management and directors of the Corporation; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Corporation’s assets that could have a material effect on the consolidated financial statements. All employees are required to comply with our code of ethics. We conduct an annual certification process to ensure that our employees meet this obligation. Although any system of internal control can be compromised by human error or intentional circumvention of required procedures, we believe our system provides reasonable assurance that financial transactions are recorded and reported properly, providing an adequate basis for reliable financial statements.

During 2023, the Audit Committee of the Board of Directors met regularly with Management, internal audit, and the independent registered public accounting firm, Ernst & Young LLP, to review the scope of their audits and to discuss the evaluation of internal accounting controls and financial reporting

Showing the first 8K of 458K characters. Open the full section

None.

Evaluation of Disclosure Controls and Procedures

As of the end of the period covered by this report, KeyCorp carried out an evaluation, under the supervision and with the participation of KeyCorp’s management, including our Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of KeyCorp’s disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934 (the “Exchange Act”)), to ensure that information required to be disclosed by KeyCorp in reports that it files or submits under the Exchange Act, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to KeyCorp’s management, including its Chief Executive Officer and Chief Financial Officer, as appropriate, to allow for timely decisions regarding required disclosure. Based upon that evaluation, KeyCorp’s Chief Executive Officer and Chief Financial Officer concluded that the design and operation of these disclosure controls and procedures were effective, in all material respects, as of the end of the period covered by this report. No changes were made to KeyCorp’s internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act) during the last year that materially affected, or are reasonably likely to materially affect, KeyCorp’s internal control over financial reporting.

Reports Regarding Internal Controls

Management’s Annual Report on Internal Control over Financial Reporting, the Report of Independent Registered Public Accounting Firm on Internal Control over Financial Reporting, and the Report of Independent Registered Public Accounting Firm are included in Item 8 on pages 97, 98, and 99, respectively.

No director or officer (as defined in Rule 16a-1(f) of the Exchange Act) of KeyCorp adopted, modified,

or terminated any Rule 10b5-1 trading arrangement or any non-Rule 10b5-1 trading arrangement (as such terms

are defined in Item 408 of Regulation S-K of the Exchange Act) during the quarter ended December 31, 2023,

except as may be noted below. We do not permit the use of Rule 10b5-1 trading arrangements by our directors or

executive officers.

Certain of our directors or officers have made elections to participate in, and are participating in, our KeyCorp

Second Amended and Restated Discounted Stock Purchase Plan, our Long-Term Incentive Deferral Plan, our

Directors’ Deferred Share Sub-Plan, and the Dividend Reinvestment Plan and dividend reinvestment features under

various compensation plans and arrangements, and previously made elections to participate in KeyCorp common

stock funds that are now frozen but were previously available as an investment option under our Deferred Savings

Plan and KeyCorp 401(k) plan. By participating in these plans or stock funds, the directors or officers have made,

and/or may from time to time make, elections involving transactions in KeyCorp common shares which may be

designed to satisfy the affirmative defense conditions of Rule 10b5-1 under the Exchange Act or may constitute

non-Rule 10b5-1 trading arrangements (as such term is defined in Item 408(c) of Regulation S-K of the Exchange

Act).

Not applicable.

PART III

The names of our executive officers, and biographical information for each, is set forth in Item 1. Business of this report.

Table of contents

The other information required by this item will be set forth in the following sections of KeyCorp’s Definitive Proxy Statement for the 2024 Annual Meeting of Shareholders to be held May 9, 2024 (the “2024 Proxy Statement”), and these sections are incorporated herein by reference:

• “Proposal One: Election of Directors”

• “Corporate Governance Documents — Code of Business Conduct and Ethics”

• “The Board of Directors and Its Committees — Board and Committee Responsibilities — Audit Committee”

• “Additional Information — Other Proposals and Director Nominations for the 2025 Annual Meeting of Shareholders”

KeyCorp expects to file the 2024 Proxy Statement with the SEC on or about March 22, 2024.

Any amendment to, or waiver from a provision of, the Code of Business Conduct and Ethics that applies to KeyCorp’s Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, or any other executive officer or director, will be promptly disclosed on KeyCorp’s website (www.key.com/ir) as required by laws, rules and regulations of the SEC.

The information required by this item will be set forth in the following sections of the 2024 Proxy Statement and these sections are incorporated herein by reference:

• “Compensation Discussion and Analysis”

• “Compensation of Executive Officers and Directors”

• “Compensation and Organization Committee Report”

• “The Board of Directors and Its Committees — Oversight of Compensation Related Risks”

The information required by this item will be set forth in the section captioned “Ownership of KeyCorp Equity Securities” contained in the 2024 Proxy Statement, and is incorporated herein by reference.

The information required by this item will be set forth in the following sections of the 2024 Proxy Statement and these sections are incorporated herein by reference:

• “The Board of Directors and Its Committees — Director Independence”

• “The Board of Directors and Its Committees — Related Party Transactions”

The information required by this item will be set forth in the sections captioned “Audit Matters — Ernst & Young’s Fees” and “Audit Matters — Pre-Approval Policies and Procedures” contained in the 2024 Proxy Statement, and is incorporated herein by reference.

PART IV

(a) (1) Financial Statements

The following financial statements of KeyCorp and its subsidiaries, and the auditor’s report thereon are filed as part of this report under Item 8. Financial Statements and Supplementary Data:

Table of contents

(a) (2) Financial Statement Schedules

All financial statement schedules for KeyCorp and its subsidiaries have been included in this Form 10-K in the consolidated financial statements or the related footnotes, or they are either inapplicable or not required.

Table of contents

(a) (3) Exhibits*

Table of contents

Table of contents

*Incorporated by reference. Copies of these Exhibits have been filed with

Table of contents

the SEC. Exhibits that are not incorporated by reference are filed with this report. Shareholders may obtain a copy of any exhibit, upon payment of reproduction costs, by writing KeyCorp Investor Relations, 127 Public Square, Mail Code OH-01-27-0737, Cleveland, OH 44114-1306.

KeyCorp hereby agrees to furnish the SEC upon request, copies of instruments, including indentures, which define the rights of long-term debt security holders. All documents listed as Exhibits 10.1 through 10.46 constitute management contracts or compensatory plans or arrangements.

Not applicable.

SIGNATURES

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized, on the date indicated.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the Registrant and in the capacities and on the date indicated.