Company: KEY-PI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000091576-25-000038
Chunk: 272

Company: KEYCORP /NEW/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 7
Chunk 272
---
 ended December 31, 2024, and December 31, 2023.

Figure 34. Summary of Changes in Nonperforming Loans from Continuing Operations

  2024 Quarters Dollars in millions2024FourthThirdSecondFirst2023Balance at beginning of period$574 $728 $710 $658 $574 $387 Loans placed on nonaccrual status1,140 309 271 317 243 768 Charge-offs(526)(131)(167)(131)(97)(318)Loans sold(72)(13)(32)(22)(5)(38)Payments(259)(111)(37)(76)(35)(132)Transfers to OREO(6)(2)(1)(1)(2)(9)Loans returned to accrual status(93)(22)(16)(35)(20)(84)Balance at end of period$758 $758 $728 $710 $658 $574 

Operational and compliance risk management

Like all businesses, we are subject to operational risk, which is the risk of loss resulting from human error or malfeasance, inadequate or failed internal processes and systems, and external events. These events include, among other things, threats to our cybersecurity, as we are reliant upon information systems and the internet to conduct our business activities. Operational risk intersects with compliance risk, which is the risk of loss from violations of, or noncompliance with, laws, rules and regulations, prescribed practices, and ethical standards. Under the Dodd-Frank Act, large financial companies like Key are subject to heightened prudential standards and regulation. This heightened level of regulation has increased our operational risk. While operational and compliance risk are separate risk disciplines in KeyCorp’s ERM framework, losses and/or additional regulatory compliance costs are included in operational loss reporting and could take the form of explicit charges, increased operational costs, or harm to our reputation.

We seek to mitigate operational risk through identification and measurement of risk, alignment of business strategies with risk appetite and tolerance, and a system of internal controls and reporting. We continuously strive to strengthen our system of internal controls to improve the oversight of our operational risk and to ensure compliance with laws, rules, and regulations. For example, an operational event database tracks the amounts and sources of 

90

operational risk and losses. This tracking mechanism helps to identify weaknesses and to highlight the need to take corrective action. We also