Company: KEY-PI
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001628280-25-048757
Chunk: 60

Company: KEYCORP /NEW/
Filing Date: 2025-11-04
Form: 10-Q
Item: Item 2
Chunk 60
---
(13)(32)Payments(68)(74)(57)(111)(37)Transfers to OREO(1)(1)(2)(2)(1)Loans returned to accrual status(26)(21)(57)(22)(16)Balance at end of period$658 $696 $686 $758 $728 

Operational and compliance risk management

Like all businesses, we are subject to operational risk, which is the risk of loss resulting from human error or malfeasance, inadequate or failed internal processes and systems, and external events. These events include, among other things, threats to our cybersecurity, as we are reliant upon information systems and the internet to conduct our business activities. Operational risk intersects with compliance risk, which is the risk of loss from violations of, or noncompliance with, laws, rules and regulations, prescribed practices, and ethical standards. Under the Dodd-Frank Act, large financial companies like Key are subject to heightened prudential standards and regulation. This heightened level of regulation has increased our operational risk. While operational and compliance risk are separate risk disciplines in KeyCorp’s ERM framework, losses and/or additional regulatory compliance costs are included in operational loss reporting and could take the form of explicit charges, increased operational costs, or harm to our reputation.

44

We seek to mitigate operational risk through identification and measurement of risk, alignment of business strategies with risk appetite and tolerance, and a system of internal controls and reporting. We continuously strive to strengthen our system of internal controls to improve the oversight of our operational risk and to ensure compliance with laws, rules, and regulations. For example, an operational event database tracks the amounts and sources of operational risk and losses. This tracking mechanism helps to identify weaknesses and to highlight the need to take corrective action. We also rely upon software programs designed to assist in assessing operational risk and monitoring our control processes. This technology has enhanced the reporting of the effectiveness of our controls to senior management and the Board.

The Operational Risk Management Program provides the framework for the structure, governance, roles, and responsibilities, as well as the content, to manage operational risk for Key. The Compliance Risk Management Program serves the same function in managing compliance risk for Key. The Operational Risk Committee and the Compliance Risk Committee support the ERM Committee by identifying early warning events and trends, escalating emerging risks, and discussing forward-looking assessments. Both the Operational Risk Committee and the Compliance Risk Committee include attendees from each of the Three Lines of Defense