Bread Financial Holdings (BFH) Risk Factors

Compliance Risk is the risk arising from violations of laws or regulations, or from nonconformance with prescribed practices, internal policies and procedures, or ethical standards. This risk exposes organizations to fines, payment of damages, and the voiding of contracts. Our Compliance organization is responsible for establishing and maintaining our Compliance Risk Management Program. Pursuant to this Program, we seek to manage and mitigate compliance risk by assessing, controlling, monitoring, measuring and reporting the legal and regulatory risks to which we are exposed. The Compliance Risk Management Committee, chaired by the Chief Compliance Officer, oversees the implementation and execution of the Compliance Management System and monitors compliance exposures to manage compliance risks.

In November 2021, we completed the spinoff of our former LoyaltyOne segment, consisting of the Canadian AIR MILES Reward Program and the Netherlands-based BrandLoyalty businesses, into an independent, publicly traded company, LVI. As part of the spinoff, we retained 19% of the outstanding shares of common stock of LVI. We received a private letter ruling, or PLR, from the IRS and an opinion from our tax advisor to the effect that the spinoff of our former LoyaltyOne segment qualified as tax-free for U.S. federal income tax purposes for us and our stockholders (except for cash received in lieu of fractional shares). However, if the factual assumptions or representations made by us in connection with the delivery of the PLR and opinion are inaccurate or incomplete in any material respect, including those relating to the past and future conduct of our business, we may not be able to rely on the PLR or opinion. Furthermore, the PLR does not address all the issues that are relevant to determining whether the spinoff qualified for tax-free treatment, and the opinion from our tax advisor is not binding on the IRS or the courts. If, notwithstanding receipt of the PLR and the opinion from our tax advisor, the spinoff transaction and certain related transactions are determined to be taxable, we would be subject to a substantial tax liability. In addition, if the spinoff transaction is taxable, each holder of our common stock who received shares of LVI in connection with the spinoff would generally be treated as receiving a taxable distribution of property in an amount equal to the fair market value of the shares received. Even if the spinoff otherwise qualifies as a tax-free transaction, the distribution would be taxable to us (but not to our stockholders) in certain circumstances if post-spinoff significant acquisitions of our stock or the stock of LVI are deemed to be part of a plan or series of related transactions that included the spinoff. In this event, the resulting tax liability could be substantial, and could discourage, delay or prevent a change of control of us. In connection with the spinoff, we entered into a tax matters agreement with LVI, pursuant to which LVI agreed to not enter into any transaction that could cause any portion of the spinoff to be taxable to us without our consent and to indemnify us for any tax liability resulting from any such transaction. On March 1, 2023, LVI announced that it had entered into an agreement to sell its BrandLoyalty business. At LVI's request to accommodate the sale, we agreed to not take action under the tax matters agreement to attempt to prevent the BrandLoyalty sale and, upon the closing, agreed to certain mutual releases with the buyer in the sale. Subsequently, on March 10, 2023, LVI and certain of its subsidiaries filed voluntary petitions for relief under Chapter 11 of the United States Bankruptcy Code and in Canada under the Companies' Creditors Arrangement Act (Canada) (collectively, the LVI Bankruptcy Proceedings). In the Canadian proceedings, LVI conducted an auction process and subsequently sold its AIR MILES business to Bank of Montreal in June 2023. While we believe these transactions should not affect the qualification of the spinoff as a tax-free transaction, it is possible the IRS could disagree and successfully assert that the spinoff should be taxable to us and our stockholders that received LVI shares in the spinoff. In addition, it is possible the IRS could view this disposition as inconsistent with the PLR and, as a result, the IRS could take the position that we cannot rely on the PLR. More generally, we have been adversely affected by LVI's performance, and we may continue to be adversely affected by the ongoing LVI Bankruptcy Proceedings or disputes involving or relating to LVI. During 2022, LVI's stock price decreased significantly and, as a result, we wrote down the value of our 19% shareholding in LVI from $50 million as of December 31, 2021, to $6 million as of December 31, 2022. As of March 31, 2023, we had written down the value of these LVI shares to zero. We continued to hold our 19% ownership interest in LVI until it, along with all other common stock of LVI, was cancelled and extinguished pursuant to LVI's Chapter 11 Plan, which became effective in June 2023. Furthermore, though we believe that our process and decision-making with respect to the spinoff transaction were entirely appropriate, LoyaltyOne, Co. (the LVI subsidiary that operated its Canadian AIR MILES business) filed suit against us and Joseph Motes, our general counsel, in the Ontario Superior Court of Justice in Canada in October 2023. The lawsuit asserts that Mr. Motes, in his capacity as a pre-spinoff director of LoyaltyOne, Co., breached various fiduciary duties owed to LoyaltyOne, Co. in connection with the LVI spinoff and certain other transactions, and that Bread Financial assisted in and benefited from those breaches. The lawsuit seeks damages in the amount of $775 million. LVI has also established a litigation trust in the U.S. Chapter 11 proceedings to pursue claims against us and one or more members of our management team in respect of the spinoff transaction, although no such claims have been filed to date. While we believe that the suit filed against us in Canada and any other claims in connection with the spinoff are without merit and we will defend ourselves vigorously, litigation is complex and the outcomes are inherently uncertain. LoyaltyOne, Co. is also contesting our entitlement to certain potential tax refunds under the tax matters agreement, and we may also become involved in other disputes with respect to the spinoff agreements with LVI, or incur other liabilities or obligations under contractual arrangements with LVI. In addition, a putative federal securities class action complaint was filed in April 2023 against us and current and former members of our management team concerning disclosures made about LVI's business, which we believe is without merit and we will defend ourselves vigorously. Any litigation or dispute arising out of or relating to the spinoff could distract management, result in significant legal and other costs, and otherwise adversely impact our financial position, results of operations and financial condition. RISK MANAGEMENT Our Enterprise Risk Management (ERM) program is designed to ensure that all significant risks are identified, measured, monitored and addressed. Our ERM program reflects our risk appetite, governance, culture and reporting. We manage enterprise risk using our Board-approved Enterprise Risk Management Framework, which includes Board-level oversight, risk management committees, and a dedicated risk management team led by our Chief Risk Officer (CRO). Our Board and executive management determine the level of risk we are willing to accept in pursuit of our objectives, through the ERM program and the well-defined risk appetite statements developed thereunder. We utilize the "three lines of defense" risk management model to assign roles, responsibilities and accountabilities for taking and managing risk. Governance and Accountability

Although we have extensive physical and cyber security controls and have implemented a cybersecurity risk management and governance program and associated procedures, our data has in the past been and in the future may be subject to unauthorized access. In such instances of unauthorized access, we may have data loss that could harm our customers and brand partners. This in turn could lead to reputational risk as concerns with security and privacy of data may result in consumers and future and existing brand partners not wanting to use our product offerings. We also have arrangements in place with our partners and other third parties through which we share and receive information about their customers who are or may become our customers, which magnifies certain information security issues. Information security risks for large financial institutions have increased with the adoption of new technologies, including those used on mobile devices, to conduct financial and other business transactions, and the increased sophistication and activity level of threat actors. The use of our products and services could decline if any compromise of physical or cyber security occurred. In addition, any unauthorized release of customer information or any public perception that we released customer information without authorization, could subject us to legal claims from our partners or their customers, consumers or regulatory enforcement actions, which may adversely affect our partner relationships and result in damage to our reputation and our brand. We cannot be certain that our cybersecurity insurance coverage will be adequate for cybersecurity liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that our insurer will not deny coverage as to any future claim.

We expect an important source of our growth to come from new and acquired credit card and other loan programs. We cannot be assured that the loss experience on new and acquired programs will be consistent with our more established programs, or that the cost to provide service to these new and acquired programs will not be higher than anticipated. The failure to successfully underwrite these new and acquired programs may result in defaults greater than our expectations and could have a material adverse impact on us and our profitability. See "Our risk management policies and procedures may not be effective, and the models we rely on may not be accurate or may be misinterpreted.". Moreover, under the CECL accounting rules, the acquisition of an existing credit card or BNPL portfolio typically has a negative impact on certain key financial metrics in the near-term, including Net income and Earnings per share, because we are required to include a reserve build in our Provision for credit losses for the estimated credit losses to be experienced over the life of the acquired portfolio. The amount of this reserve build (which is included in the reporting period in which the portfolio is obtained) is often large relative to the amount of revenue generated through such date by the newly-acquired portfolio. See also "–The amount of our Allowance for credit losses could adversely affect our business and may prove to be insufficient to cover actual losses on our loans." below.

In recent years, financial services companies have experienced increased reputational risk as consumers protest and regulators scrutinize business and compliance practices of such companies. Maintaining a positive reputation is critical to attracting and retaining partners, customers, investors and employees. Damage to our reputation can therefore cause significant harm to our business and prospects. Harm to our reputation can arise from numerous sources, including, among others, employee misconduct; a breach of our or our service providers' cybersecurity defenses; service outages, such as those many of our customers experienced in 2022 in connection with the transition of our credit card processing services to strategic outsourcing providers; litigation or regulatory outcomes; stockholder activism; failing to deliver minimum standards of service and quality; compliance failures; the use of our, or our partners' products to facilitate legal, but controversial, products and services, including adult content, cryptocurrencies, firearms and gambling activity; and the activities of customers, business partners and counterparties. Social media also can cause harm to our reputation. By its very nature, social media can reach a wide audience in a very short amount of time, which presents unique challenges for corporate communications. Negative or otherwise undesirable publicity generated through unexpected social media coverage can damage our reputation and brand. Negative publicity regarding us, whether or not true, may result in customer attrition and other harm to our business prospects. There has also been increased focus on topics related to environmental, social and governance policies, and criticism of our policies in these areas could also harm our reputation and/or potentially limit our access to some forms of capital or liquidity.

Our ability to originate new credit card accounts, generate new loans, and earn interest and fees and other income is dependent, in part, upon sales of merchandise and services by our partners. The retail and other industries in which our partners operate are intensely competitive. Our partners' sales may decrease or may not increase as we anticipate for various reasons, some of which are in the partners' control and some of which are not. For example, partner sales have been, and in the future may be adversely affected by pandemic or endemic diseases like COVID-19 or other macroeconomic conditions having a national, regional or more local effect on consumer spending, business conditions affecting the general retail environment, such as supply chain distributions or the ability to maintain sufficient staffing levels or a particular partner or industry, or natural disasters or other catastrophes affecting broad or more discrete geographic areas. If our partners' sales decline for any reason, it generally results in lower credit sales, and therefore lower loan volumes and associated interest and fees and other income for us from our customers. In addition, if a partner closes some or all of its stores or becomes subject to a voluntary or involuntary bankruptcy proceeding (or if there is a perception that such an event may occur), its customers who have used our financing products may have less incentive to pay their outstanding balances to us, which could result in higher charge-off rates than anticipated and our costs for servicing its customers' accounts may increase. This risk is particularly acute with respect to our largest partners that account for a significant amount of our Total net interest and non-interest income. See "A significant percentage of our Total net interest and non-interest income, or revenue, is generated through our relationships with a limited number of partners, and a decrease in business from, or the loss of, any of these partners could cause a significant drop in our revenue.". Moreover, if the financial condition of a partner deteriorates significantly or a partner becomes subject to a bankruptcy proceeding, we may not be able to recover customer returns, customer payments made in partner stores or other amounts due to us from the partner. A decrease in sales by our partners for any reason, or a bankruptcy proceeding involving any of them could have a material adverse impact on our business and results of operations.

We are generally unable to control the amount of premiums that are required to be paid for FDIC insurance. If there are bank or financial institution failures, we may be required to pay significantly higher premiums than the levels currently imposed or additional special assessments or taxes that could adversely affect our earnings. Any future increases or required prepayments in FDIC insurance premiums may materially adversely affect our results of operations.

Liquidity Risk is the risk arising from an inability to meet obligations when they come due. Liquidity Risk includes the inability to access funding sources or manage fluctuations in funding levels. Liquidity Risk also results from an organization's failure to recognize or address changes in market conditions. The primary liquidity objective is to maintain a liquidity profile that will enable us, even in times of stress or market disruption, to fund our existing assets and meet liabilities in a timely manner and at an acceptable cost. Policy and risk appetite limits require us and the Banks to ensure that sufficient liquid assets are available to survive liquidity stresses over a specified time period. The Asset & Liability Management Committee assists the Banks Board of Directors and Bank Management in overseeing, reviewing, and monitoring liquidity risk.