Ally Financial (ALLY) Risk Analysis

A fractious or volatile political environment in the United States, including any related social unrest, could negatively impact business and market conditions, economic growth, financial stability, and business, consumer, investor, and regulatory sentiments, any one or more of which in turn could cause our business and financial results to suffer. Uncertainty regarding government shutdowns, government funding, debt ceilings or deficits could adversely affect economic and market conditions, as well as the credit rating of the United States. A default by the United States on its debt obligations or additional prolonged government shutdowns could result in unprecedented market volatility. A downgrade of the U.S. federal government's credit rating, whether due to a default, concerns about a default or otherwise, could adversely affect financial markets and the value and liquidity of U.S. government securities. In addition, disruptions in the foreign relations of the United States could adversely affect the automotive and other industries on which our business depends and our tax positions and other dealings in foreign countries. We also could be negatively impacted by political scrutiny of the financial-services industry in general or our business or operations in particular, whether or not warranted, and by an environment where criticizing financial-services providers or their activities is politically advantageous. Our business and financial results are also significantly affected by the fiscal and monetary policies of the U.S. government and its agencies. We are particularly affected by the monetary policies of the FRB, which regulates the supply of money and credit in the United States in pursuit of maximum employment, stable prices, and moderate long-term interest rates. The FRB and its policies influence the availability and demand for loans and deposits, the rates and other terms for loans and deposits, the conditions in equity, fixed-income, currency, and other markets, and the value of securities and other financial instruments. Refer to the risk factor below, titled The levels of or changes in interest rates could affect our results of operations and financial condition, for more information on how the FRB affects interest rates. These policies and related governmental actions could adversely affect every facet of our business and operations-for example, the new and used vehicle financing market, the creditworthiness of our customers, the cost of our deposits and other interest-bearing liabilities, and the yield on our earning assets. Our business and financial results may also be affected by changes in government policies. For example, the current U.S. administration has adopted and may consider additional tariffs, other controls on imports or exports, and other foreign policies that could affect our businesses and supply chain. Such developments have negatively impacted our business and the automobile industry and could continue to do so. The long term impacts on the automobile industry remain uncertain and could negatively impact our business to the extent they increase the cost of automobile repairs, reduce the purchasing power or credit quality of our customers or impact the ability of third parties to provide services upon which Ally depends. In addition, in recent years the U.S. federal government and the U.S. Treasury Department have been required to take specific measures to prevent the U.S. government from breaching the federal debt ceiling. Continued uncertainty as to the U.S. federal debt ceiling, or any federal government shutdown, downgrade in the U.S. sovereign credit rating or other adverse effects of a prolonged period of elevated budget deficits, including changes in fiscal and monetary policies, could have severe repercussions on us and our clients. Additionally, changes to tax policies, or changes to the interpretations of existing policies, could have a significant impact on our results of operations and financial condition. Tax and other fiscal policies, moreover, impact not only general economic and market conditions but also give rise to incentives or disincentives that affect how we and our customers prioritize objectives, deploy resources, and run households or operate businesses. For example, the September 30, 2025 expiration of federal electric-vehicle tax credits for both new and used vehicles, in addition to vehicle recalls and OEM marketing incentives, have negatively impacted both consumer demand for electric vehicles and the residual value of electric vehicles subject to an automotive operating lease. Both the timing and the nature of any changes in monetary or fiscal policies, as well as their consequences for the economy and the markets in which we operate, are beyond our control and difficult to predict but could adversely affect us. More broadly, the U.S. federal government, U.S. states and certain other countries and regions have adopted or are considering legislation, regulation or policies that reflect diverging and, in some cases, potentially conflicting policy goals. Compliance with such laws, regulations or policies, including any that may be adopted in the future, could, among other things, increase the costs of operating our businesses, reduce the demand for our products and services, impact our ability to meet or maintain current or future goals or targets or continue initiatives, and increase our legal, operational and other risks, any or all of which could materially adversely affect our results of operations. Failure, or perceived failure, to comply with any legislation, regulation or policy, including as a result of making good faith interpretations that may differ from those taken by enforcement authorities in relevant jurisdictions, could potentially result in substantial fines, criminal sanctions, reputational harm or operational changes. Changes in administration priorities can also lead to shifts in supervisory or enforcement focus-for example, public debates around "debanking" and related account-closure practices-which may alter regulatory expectations and increase compliance and reputational risks. Moreover, our customers, shareholders, employees and other stakeholders have a full range of expectations, demands and perspective on environmental, social and other topics, which are continuing to evolve. We may not be able to meet the full range of expectations and demands of all of our stakeholders, which could harm our reputation, reduce customer demand for our products and services, and subject us to legal and operational risks.

We use quantitative models and certain other qualified tools to price products and services, measure risk, calculate the quantitative portion of our allowance for loan losses, estimate asset and liability values, assess capital and liquidity, manage our balance sheet, create financial forecasts, and otherwise conduct our business and operations. If the design, implementation, or use of any of these models is flawed, a model's assumptions or limitations are misunderstood or set incorrectly, or the input data used is inaccurate or unrepresentative, we could make strategic or tactical decisions based on incorrect, misleading, or incomplete information. In addition, to the extent that any flawed or misused models or inappropriate inputs cause inaccurate model outputs are used in reports to banking agencies or the public, we could be subjected to supervisory actions, private litigation, and other proceedings that may adversely affect our business and financial results. Refer to the section titled Risk Management in the MD&A that follows.

We are subject to extensive regulatory frameworks and to direct supervision and periodic examinations by various governmental agencies and industry SROs that are charged with overseeing the kinds of business activities in which we engage. This regulatory and supervisory oversight is designed to protect public and private interests-such as macroeconomic policy objectives, financial-market stability and liquidity, and the confidence and security of depositors generally-that may not always be aligned with those of our shareholders or non-deposit creditors. At any given time, we are involved in a number of legal and regulatory proceedings and governmental and regulatory examinations, investigations, and other inquiries. Refer to the risk factor below titled We are or may be subject to potential liability in connection with pending or threatened legal proceedings and other matters, which could adversely affect our business or financial results. While the scope, intensity, and focus of governmental oversight can vary from time to time, we expect a highly demanding environment for the foreseeable future. Regulatory and other governmental agencies have in the past taken, and in the future may continue to take actions that create more challenging and volatile financial and operating conditions for financial-services companies, including through formal rulemakings that change the law or interpretations of the law, supervisory expectations and public statements that are designed to informally compel changes in industry practices, and more aggressive approaches to enforcement that are accompanied by increasingly severe penalties. Further, the level of regulatory scrutiny may fluctuate over time based on numerous factors, including as a result of changes in governmental policies in response to adverse events impacting the financial services industry or from changes to public sentiment regarding financial institutions. We are unable to predict the form or nature of any future changes to the laws, rules, regulations, or supervisory guidance and policies, including the interpretation, implementation, or enforcement thereof. Changes in laws or the regulatory and supervisory environment could adversely affect us in substantial and unpredictable ways. The introduction of new or more stringent regulatory requirements, as well as heightened supervisory expectations, could require Ally to maintain additional capital or liquidity or incur significant expenses. In addition, changes in the regulatory environment or increased governmental oversight may increase our operating costs or reduce our revenues, limit the types of financial services and products we may offer, alter the investments we may make, affect the manner in which we conduct our business and operations, increase our litigation and regulatory costs, and enhance the ability of others to offer more competitive financial services and products. We continue to devote substantial time and resources to risk management, compliance, regulatory-change management, and cybersecurity and other technology initiatives, each of which-whether successful or not-also may adversely affect our ability to operate profitably or to pursue advantageous business opportunities. Ally has elected to be treated as an FHC, which permits us to engage in a number of financial and related activities-including securities, advisory, insurance, and merchant-banking activities-beyond the business of banking. As a result, Ally and Ally Bank are subject to ongoing requirements for Ally to qualify as an FHC, including that Ally and all of its depository institution subsidiaries must be "well capitalized" and "well managed," as defined under applicable law. If a BHC or any of its IDIs is found not to be well capitalized or well managed, the BHC can be restricted from engaging in the broader range of financial and related activities permitted for FHCs, including the ability to acquire companies engaged in those activities, and can be required to discontinue these activities or even divest any of its IDIs. In addition, if an IDI subsidiary of a BHC fails to achieve a "satisfactory" or better rating in its most recent CRA performance evaluation, the ability of the BHC to expand its financial and related activities or make acquisitions could be restricted. In connection with their continuous supervision and examinations of us, the FRB, the UDFI, the CFPB, the SEC, FINRA, the NYDFS, or other regulatory agencies have in the past and in the future may continue to explicitly or implicitly require changes in our business or operations. Such a requirement may be judicially enforceable or impractical for us to contest, and if we are unable to comply with the requirement in a timely and effective manner, we have in the past and in the future may become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives. In addition, compliance failures or other violations raised in connection with supervisory evaluations have in the past and in the future may continue to result in additional requirements for us to take certain remedial actions, including changes to our controls, operations or other processes. Compliance with such remedial actions may be costly and time consuming, and failure to comply in a timely manner that is sufficient from the perspective of the applicable regulatory agency could subject us to further remedial steps or enforcement actions. The financial-services industry continues to face increased scrutiny from supervisory authorities in the examination process, including through an increasing use of horizontal reviews from a broader industry perspective as well as strict enforcement of laws at federal, state, and local levels-particularly in connection with business and other practices that may harm or appear to harm consumers and compliance with anti-money-laundering, sanctions, and related laws. In addition, violations by other financial institutions relating to a particular business activity or practice may result in increased scrutiny, or increased penalties in connection with a related enforcement action, for similar activities. The amounts paid by financial institutions in settling proceedings or investigations and the severity of other terms of regulatory settlements are likely to remain elevated. In some cases, governmental authorities have required criminal pleas or other extraordinary terms, including admissions of wrongdoing and the imposition of monitors, as part of settlements. Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business or make acquisitions, our flexibility in conducting operations, and our ability to pay dividends or utilize capital. Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence, and a prior enforcement action may also increase the risk that regulators and governmental authorities pursue formal enforcement actions in connection with the resolution of an inquiry or investigation, even if unrelated to the prior enforcement action. We could be required as well to dispose of specified assets and liabilities within a prescribed period of time. As a result, any enforcement or other supervisory action could have an adverse effect on our business, financial condition, results of operations, and prospects. Our regulatory and supervisory environments-whether at international, federal, state, or local levels-are not static. No assurance can be given that applicable statutes, regulations, and other laws will not be amended or construed differently, that new laws will not be adopted, that any of these laws will not be enforced more aggressively, or that applicable laws, or the interpretation or enforcement thereof, may overlap, diverge or conflict across jurisdictions. Litigation challenging actions or regulations by federal or state authorities could, depending on the outcome, significantly affect the regulatory and supervisory framework affecting our operations. Changes in the regulatory and supervisory environments, including as a result of changes from elections in the United States and the corresponding change in administrative regimes, could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, and restricting our ability to make acquisitions or pursue other profitable opportunities. Uncertainty about the timing and scope of future changes in laws, regulations and policies, or the interpretations thereof, may impact our decision making with respect to business activities or initiatives, and reacting to such changes could increase our operating and compliance costs. Further, our noncompliance with applicable laws-whether as a result of changes in interpretation or enforcement, system or human errors, or otherwise and, in some cases, regardless of whether noncompliance was inadvertent-could result in the suspension or revocation of licenses or registrations that we need to operate and in the initiation of enforcement and other supervisory actions or private litigation.

Cybersecurity and data-privacy risks have received heightened legislative and regulatory attention and have been a specific focus area in supervisory reviews. In recent years, governments and regulators in multiple jurisdictions have adopted or proposed to adopt additional legal requirements focused on cybersecurity risk management, governance and disclosure, as well as data privacy and personal financial data rights. For example, U.S. banking agencies have adopted rules requiring us to notify the FRB within 36 hours of any significant computer security incident and have proposed enhanced cyber risk management standards applicable to us and our service providers that would address cyber risk governance and management, management of internal and external dependencies, and incident response, cyber resilience, and situational awareness. Several states and their governmental agencies, such as the NYDFS, also have adopted or proposed cybersecurity and data-privacy laws. Failure to comply with privacy laws or supervisory expectations could result in enforcement actions, civil litigation or reputational damages. Legislation and regulations on cybersecurity and data privacy, including as a result of remedial requirements in connection with supervisory actions, have in the past and in the future may continue to require that we enhance or modify our systems and infrastructure, invest in new systems and infrastructure, change our service providers, augment our scenario and vulnerability testing, or alter our business practices or our policies on security, data governance, and privacy. Compliance with these requirements increases the complexity and costs of our operations. In addition, in recent years there has been increasing supervisory expectations for financial institutions to introduce enhanced third-party risk management practices to mitigate cybersecurity and data privacy risks. If governmental or supervisory authorities were to conclude that we or our service providers had not adequately implemented appropriate operational infrastructure, policies, or practices with respect to cybersecurity and data privacy or had not otherwise met related supervisory expectations, we could be subject to enforcement and other supervisory actions, related litigation by private plaintiffs, reputational damage, or a loss of customer or investor confidence.

Our automotive finance and insurance businesses are impacted by the sales volume for new and used vehicles. Vehicle sales are impacted, in turn, by several economic and market conditions, including employment levels, household income and savings, vehicle affordability, interest rates, credit availability, inventory levels, customer preferences, and fuel costs. Any future declines in new or used vehicle sales, including as a result of market conditions and other external factors over which we do not control, could have an adverse effect on our business and financial results.

Skilled employees are our most important resource, and competition for talented people is intense. Even though compensation and benefits expense are among our highest costs, we may not be able to locate and hire the best people, keep them with us, or properly motivate them to perform at a high level. This risk may be exacerbated due to some of our competitors having significantly greater scale, financial and operational resources, and brand recognition. While we strive to mitigate human-capital risks, our senior executives and other key leaders possess deep, broad industry experience that would be difficult to replace without some disruption, making effective leadership continuity through succession planning critical. Delays in identifying, developing, or integrating successors for key roles could result in operational disruption and execution risk. We may also experience competition in retaining employees based on remote or other flexible work arrangements, and our ability to attract or retain qualified employees may be adversely affected if our work arrangements are perceived as less favorable than those of our competitors. Continued scrutiny of compensation practices, especially in the financial services industry, has made this competition for talent only more difficult. In addition, many parts of our business are particularly dependent on key personnel, and retaining talented people in certain areas, has been challenging. Further, growth in our businesses, through acquisitions or otherwise, will further increase our need for skilled employees. If we were to lose and find ourselves unable to replace these personnel or other skilled employees or if the competition for talent were to drive our compensation costs to unsustainable levels, our management of operational and other risks could suffer, and our business and financial results could be negatively impacted.