Item 1.

Business	1
Item 1A.	Risk Factors	27
Item 1B.	Unresolved Staff Comments	49
Item 1C.	Cybersecurity	49
Item 2.	Properties	50
Item 3.	Legal Proceedings	50
Item 4.	Mine Safety Disclosures	50


Item 5.	Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	51
Item 6.	Reserved	52
Item 7.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	53
Item 7A.	Quantitative and Qualitative Disclosures about Market Risk	79
Item 8.	Financial Statements and Supplementary Data	81
Item 9.	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	149
Item 9A.	Controls and Procedures	149
Item 9B.	Other Information	149
Item 9C.	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	149


Item 10.	Directors, Executive Officers and Corporate Governance	150
Item 11.	Executive Compensation	150
Item 12.	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	150
Item 13.	Certain Relationships and Related Transactions, and Director Independence	150
Item 14.	Principal Accounting Fees and Services	151


Item 15.	Exhibits, Financial Statement Schedules	152
Item 16.	Form 10-K Summary	158

Except as otherwise indicated or unless the context otherwise requires, “Discover Financial Services,” “Discover,” “DFS,” “we,” “us,” “our,” and “the Company” refer to Discover Financial Services and its subsidiaries. See “Item 8 — Financial Statements and Supplementary Data — Glossary of Acronyms” for terms and abbreviations used throughout the annual report.

We own or have rights to use the trademarks, trade names and service marks that we use in conjunction with the operation of our business, including, but not limited to: Discover®, PULSE®, Cashback Bonus®, Discover Cashback Checking®, Discover it®, Freeze it®, College Covered® and Diners Club International®. All other trademarks, trade names and service marks included in this annual report on Form 10-K are the property of their respective owners.

Part I.

Part I | Item 1. Business

Introduction

Discover Financial Services (the “Company”) is a digital banking and payment services company. We were incorporated in Delaware in 1960. We are a bank holding company under the Bank Holding Company Act of 1956 as well as a financial holding company under the Gramm-Leach-Bliley Act (“GLBA”) and therefore are subject to oversight, regulation and examination by the Board of Governors of the Federal Reserve System (the “FRB” or “Federal Reserve”). We provide digital banking products and services and payment services through our subsidiaries. We offer our customers credit card loans, personal loans, home loans and deposit products. We had $128.4 billion in loan receivables and $84.0 billion in deposits issued through direct-to-consumer channels and affinity relationships at December 31, 2023. We also operate the Discover Network, the PULSE network (“PULSE”) and Diners Club International (“Diners Club”), collectively known as the Discover Global Network. The Discover Network processes transactions for Discover-branded credit and debit cards and provides payment transaction processing and settlement services. PULSE operates an electronic funds transfer network, providing financial institutions issuing debit cards on the PULSE network with access to automated teller machines (“ATMs”) domestically and internationally, as well as merchant acceptance throughout the United States of America (“U.S.”) for debit card transactions. Diners Club is a global payments network of licensees, which are generally financial institutions, that issue Diners Club branded charge cards and/or provide card acceptance services.

On November 29, 2023, we announced our Board of Directors had authorized management to explore the sale of our private student loan portfolio. We stopped accepting new applications for private student loans February 1, 2024. See “— Operating Model — Digital Banking — Private Student Loans” for more information.

Pending Merger with Capital One Financial Corporation

On February 19, 2024, Discover and Capital One Financial Corporation (“Capital One”) jointly announced that they entered into an agreement and plan of merger (the “Merger Agreement”), under which the companies will combine in an all-stock merger, which values Discover at $35.3 billion. Under the terms of the Merger Agreement, holders of Discover common stock will receive 1.0192 shares of Capital One common stock for each share of Discover common stock they own. Capital One shareholders will own approximately 60% of the combined company and Discover shareholders will own approximately 40% of the combined company. The Merger Agreement contains customary representations and warranties, covenants and closing conditions. The Board of Directors of the combined company will have fifteen directors, consisting of the current twelve Capital One Board members and three Discover Board members to be named at a later date. For more information, see Discover’s Current Report on Form 8-K filed with the Securities and Exchange Commission (the “SEC”) on February 22, 2024.

Completion of the proposed merger remains subject to approval by the FRB and the Office of the Comptroller of the Currency (“OCC”) and other customary closing conditions, including the approval of both companies’ shareholders.

Available Information

We make available, free of charge through the investor relations page of our internet site www.discover.com, our annual reports on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, proxy statements, Forms 3, 4 and 5 filed by or on behalf of our directors and executive officers, and any amendments to those documents filed with or furnished to the SEC pursuant to the Securities Exchange Act of 1934. These filings are available as soon as reasonably practicable after they are filed with or furnished to the SEC.

In addition, the following information is available on the investor relations page of our internet site: (i) our Corporate Governance Guidelines; (ii) our Code of Conduct and Business Ethics; and (iii) the charters of the Audit, Compensation and Leadership Development, Nominating, Governance and Public Responsibility and Risk Oversight Committees of our Board of Directors. These documents are also available in print without charge to any person who requests them by writing or telephoning our principal executive offices: Discover Financial Services, Office of the Corporate Secretary, 2500 Lake Cook Road, Riverwoods, Illinois 60015, United States of America, telephone number (224) 405-0900.

Operating Model

We manage our business activities in two segments: Digital Banking and Payment Services. Our Digital Banking segment includes consumer banking and lending products, specifically Discover-branded credit cards issued to

-1-

individuals on the Discover Network and other consumer banking products and services, including private student loans, personal loans, home loans and deposit products. Our Payment Services segment includes PULSE, Diners Club and our Network Partners business, which provides payment transaction processing and settlement services on the Discover Global Network.

We are principally engaged in providing products and services to customers in the U.S. However, we also receive revenue from sources outside of the U.S., including royalty and licensee revenue from our Diners Club licensees and network assessment, discount and interchange fees from our network-to-network partners (“Network Alliances”). For quantitative information concerning our geographic distribution, see Note 4: Loan Receivables to our consolidated financial statements.

Below are descriptions of the principal products and services of each of our reportable segments. For additional financial information relating to our business and our operating segments, see Note 22: Segment Disclosures to our consolidated financial statements.

Digital Banking

Set forth below are descriptions of the credit cards, private student loans, personal loans, home loans and deposit products issued by our bank subsidiary, Discover Bank.

Credit Cards

We currently offer and issue credit cards to consumers. Our credit card customers are permitted to “revolve” their balances and repay their obligations over a period of time and at an interest rate set forth in their cardmember agreements, which may be either fixed or variable. The interest that we earned on revolving credit card balances comprised approximately 81% of our total interest income for the year ended December 31, 2023. We also charge customers other fees as specified in the cardmember agreements. These may include fees for late payments, returned checks, balance transfer transactions and cash advance transactions.

Our credit card customers’ transactions in the U.S. are processed over the Discover Network. We receive discount and fee revenue from merchants with whom we have a direct relationship. Where we do not have a direct relationship with a merchant, we receive interchange and assessment fees from acquirers.

All of our cards offer rewards programs, the costs of which are generally recorded as a reduction of discount and interchange revenue. See “— Marketing — Rewards / Cashback Bonus” for further discussion of our programs offered.

The following chart* shows the Discover card transaction cycle as processed on the Discover Network:

For information on how we market our credit card loans, see “— Credit Risk Management — Account Acquisition (New Customers)” and “— Marketing.”

-2-

Private Student Loans

On November 29, 2023, we announced our Board of Directors had authorized management to explore the sale of the private student loan portfolio and transfer servicing of these loans to a third-party servicer. We stopped accepting new applications for private student loans February 1, 2024. Applications received prior to this date will continue to be processed, and pending approval, disbursed under the terms and conditions laid out below. Generally, final disbursements of funds will be completed by December 31, 2024.

All of our private student loans are unsecured and have terms and conditions that vary by type of student loan, and feature fixed or variable interest rates with zero origination fees. Customers can elect to make extra payments to pay their loans off earlier than contractually scheduled without penalty. The loans can feature potential rewards, such as for earning good grades, and we also offer optional in-school payment features where students make payments while in school. The standard repayment period is 15 to 20 years, depending on the type of student loan. Private student loans may include a deferment period, during which interest continues to accrue and customers are not required to make payments while enrolled in school at least half time as determined by the school. This period begins on the date the loan is first disbursed and ends six to nine months (depending on loan type) after the student ceases to be enrolled in school at least half time. As part of the loan approval process, all of our private student loans, except for bar study, residency and private consolidation loans, are certified by and disbursed through the school to ensure students do not borrow more than the cost of attendance less other financial aid.

Personal Loans

Our personal loans are primarily intended to help customers consolidate existing debt, although they can be used for other purposes. These loans are unsecured with fixed interest rates, terms and payments, and have zero origination fees. The repayment period for personal loans is 3 to 7 years and there is no penalty for prepaying any portion of a personal loan balance. Customers may be subject to late fees if they have not made a minimum payment by the contractual due date.

We market personal loans primarily through direct mail, digital channels and email. Prospective applicants can obtain information regarding Discover Personal Loans and complete an application either online or by telephone.

Home Loans

Our home loans are intended for multiple purposes, including mortgage refinance, debt consolidation, home improvement and other major expenses. These loans are closed-end with fixed interest rates, terms and payments, and are secured by a first or second lien on a customer’s home. These loans require monthly payment over a 10 to 30-year term. Customers may elect to make larger than minimum payments without being subject to a prepayment penalty. Customers do not pay origination fees or third-party costs during the application process or at closing, but they may be required to reimburse certain third-party costs if the loan is repaid in full within three years. Customers may also be subject to additional charges, including late fees and returned payment charges.

We market home loans primarily through direct mail, digital channels and email. Prospective applicants can obtain information and apply online or by telephone.

Deposits

We obtain deposits from consumers directly or through affinity relationships (“direct-to-consumer deposits”). Additionally, we obtain deposits through third-party securities brokerage firms that offer our deposits to their customers (“brokered deposits”). Our direct-to-consumer deposit products include savings accounts, certificates of deposit, money market accounts, IRA savings accounts, IRA certificates of deposit and checking accounts, while our brokered deposit products include certificates of deposit and sweep accounts. All of our deposits are insured by the Federal Deposit Insurance Corporation (the “FDIC”) to the maximum permitted by law. We do not pay interest on checking account balances and instead offer cashback rewards for certain debit card purchases. Certificates of deposit are offered on a range of tenors from three months through ten years with interest rates that are fixed for the full period. There are minimum balance requirements to open certificates of deposit and penalties for early withdrawals. There are no minimum balance requirements to open money market accounts and savings accounts. Interest rates on money market accounts and savings accounts are subject to change at any time. Service charges apply to outgoing wire transfers only and availability of funds varies based on type and method of deposit and other factors.

-3-

We market our direct-to-consumer deposit products through the use of digital channels, direct mail, print materials, email and arrangements with third parties. Customers can generally apply for deposit accounts online or by telephone. Cashback Debit checking account applications can only be initiated online. For more information regarding our deposit products, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources — Funding Sources — Deposits.”

Payment Services

Set forth below are descriptions of PULSE, Diners Club and our Network Partners business, which provides payment transaction processing and settlement services, among other services.

PULSE

Our PULSE network is a leader in debit payments, cash access and account transfers. PULSE links cardholders served by financial institutions to ATMs and point-of-sale (“POS”) terminals located throughout the U.S., including cardholders at financial institutions with which PULSE has direct relationships and through agreements PULSE has with other debit networks. PULSE also provides cash access at ATMs internationally.

PULSE’s primary source of revenue is transaction fees charged for switching and settling ATM and debit transactions initiated through the use of debit cards issued by participating financial institutions. In addition, PULSE offers a variety of optional products and services that produce income for the network, including signature debit transaction processing, debit card fraud detection and risk mitigation services and connections to other regional and national electronic funds transfer networks.

When a financial institution joins the PULSE network, debit cards issued by that institution are eligible to be used at all of the ATMs and POS debit terminals that participate in the PULSE network and the PULSE mark can be used on that institution’s debit cards and ATMs. In addition, financial institution participants may sponsor merchants, direct processors and independent sales organizations to participate in the PULSE POS and ATM debit service. A participating financial institution assumes liability for transactions initiated through the use of debit cards issued by that institution, as well as for ensuring compliance with PULSE’s operating rules and policies applicable to that institution’s debit cards, ATMs and, if applicable, sponsored merchants, direct processors and independent sales organizations.

When PULSE enters into a network-to-network agreement with another debit network, the other network’s participating financial institutions’ debit cards can be used at terminals in the PULSE network. PULSE does not have a direct relationship with these financial institutions and the other network bears the financial responsibility for transactions of those financial institutions’ cardholders and for ensuring compliance with PULSE’s operating rules.

Diners Club

Our Diners Club business maintains a global acceptance network through its relationships with licensees, which are generally financial institutions. We do not directly issue Diners Club cards to consumers, but grant our licensees the right to issue Diners Club-branded cards and/or provide card acceptance services. Our licensees pay us royalties for the right to use the Diners Club brand, which is our primary source of Diners Club revenues. We also earn revenue from providing various support services to our Diners Club licensees, including processing and settlement of cross-border transactions. We also provide a centralized service center and technological services to our licensees.

When Diners Club cardholders use their cards outside the host country or territory of the issuing licensee, transactions are routed and settled over the Diners Club network through its centralized service center. In order to increase merchant acceptance in certain targeted countries and territories, we work with merchant acquirers to offer Diners Club and Discover acceptance to their merchants. These acquirers are granted licenses to market the Diners Club and Discover brands to existing and new merchants. Diners Club cardholders with cards issued by licensees outside of North America continue to use their cards on the Discover Network in North America and on the PULSE and Diners Club networks in their card-issuing territory and abroad.

Network Partners Business

We have agreements with a number of financial institutions including financial technology firms, networks or Network Alliances and commercial service providers for issuance of products or processing of payments on the Discover Global Network. We refer to these financial institutions, networks and commercial service providers as “Network Partners.” We may earn merchant discount and acquirer assessments net of issuer fees paid, in addition to

-4-

other fees, for processing transactions for Network Partners. We also leverage our payments infrastructure in other ways, such as business-to-business payment processing.

Our Network Partners business is composed of Network Alliances, technology-enabled partners and our commercial payments network. Network Alliances allow Discover-enabled cards to be used at other networks’ participating merchants and allow other networks’ participating issuers’ cards to be used at Discover Network merchants. Our commercial payments network facilitates transactions and business-to-business payments between buyers and suppliers using the existing payment infrastructure of Discover Network.

The following chart* shows an example of a Network Partners transaction cycle:

* * *

The discussion below provides additional detail concerning the supporting functions of our two segments. The credit card, private student loan, personal loan, home loan and deposit products issued through our Digital Banking segment require significant investments in consumer portfolio risk management, marketing, customer service and related technology. The operation of our Payment Services segment requires that we invest in the technology to manage risk and service network partners, merchants and merchant acquirer relationships. We also make strategic investments in payment services entities to support our Payment Services segment.

Credit Risk Management

Credit risk refers to the risk of loss arising from borrower default when borrowers are unable or unwilling to meet their financial obligations to us. For all loan types, we have established a credit policy and limits that are designed to manage our exposure to credit risk. Our credit risk arising from consumer lending products is generally highly diversified across millions of accounts without significant individual exposures. We manage credit risk primarily based on customer segments and product types. See “— Risk Management” for more information regarding how we define and manage our credit and other risks.

Account Acquisition (New Customers)

We acquire new credit card customers through direct mail, internet, media advertising, merchant or partner relationships, or through unsolicited individual applications. We also acquire new personal loan and home loan customers through similar channels. In all cases we have a rigorous process for screening applicants.

Our credit risk management and marketing teams use proprietary analytical tools to match our product offerings with customer needs and identify creditworthy prospective customers. We consider the prospective customer’s financial condition and stability, as well as ability and willingness to pay.

-5-

We assess the creditworthiness of each consumer loan applicant by evaluating an applicant’s credit information provided by credit bureaus and information from other sources. The assessment is performed using our credit scoring systems, both externally developed and proprietary. For our unsecured lending products, we also use experienced credit underwriters to supplement our automated decision-making processes. For our home loan products, experienced credit underwriters must review and approve each application.

Upon approval of a customer’s application for one of our lending products, we assign a specific annual percentage rate using an analytically driven pricing framework that simultaneously provides competitive pricing for customers and seeks to maximize revenue on a risk-adjusted basis. For our credit card loans, we also assign a credit line based on risk level and expected return.

Portfolio Management (Existing Customers)

The revolving nature of our credit card loans requires that we regularly assess the credit risk exposure of such accounts. This assessment uses the individual’s Discover account performance information as well as information from credit bureaus. We utilize statistical evaluation models to support the measurement and management of credit risk. At the individual customer level, we use custom risk models together with more generally available industry models as an integral part of the credit decision-making process. Depending on the duration of the customer’s account, risk profile and other performance metrics, the account may be subject to a range of account management treatments, including transaction authorization limits and increases or decreases on credit limits.

Customer Assistance

We provide our customers with a variety of tools to proactively manage their accounts, including email, text message, push reminders and publicly accessible web pages dedicated to customer education, as further discussed under the heading “— Customer Service.” These tools are designed to limit a customer’s risk of becoming delinquent. When a customer’s account becomes delinquent or is at risk of becoming delinquent, we employ a variety of strategies to assist customers in preventing delinquency or returning delinquent accounts to current status.

All monthly billing statements of accounts with past due amounts include a request for payment of such amounts. Customer assistance personnel generally initiate contact with customers within 30 days after any portion of their balance becomes past due. The nature and the timing of the initial contact are determined by a review of the customer’s prior account activity and payment habits.

We reevaluate our collection efforts and consider the implementation of other techniques as a customer becomes increasingly delinquent. We limit our exposure to delinquencies through controls within our process for authorizing transactions and credit limits and criteria-based account suspension and revocation. In situations involving customers with financial difficulties, we may enter into arrangements to extend or otherwise change payment schedules, lower interest rates and/or waive fees to aid customers in returning to current status on their obligations to us. For more information see Note 4: Loan Receivables to our consolidated financial statements.

Marketing

Our marketing group works closely with credit risk management to provide key functions to acquire new customers and enhance our relationships with existing customers. These key functions include product development, Cashback Bonus and other rewards programs management, protection product management, and brand and advertising management.

Product Development

To attract and retain customers and merchants, we continue to develop new programs, features and benefits and market them through various channels, including television, radio, mail and digital. Marketing efforts may promote various features including, but not limited to, no annual fee, Cashback Bonus and promotional offers, as well as various free benefits such as Online Privacy Protection, FICO Credit Score, Freeze it, Spend Analyzer and Social Security Number Alerts. By developing an extensive prospect database, using credit bureau data and using a customer contact strategy and management system, we continuously develop our modeling and customer engagement capabilities that help optimize the product, pricing and channel selection.

-6-

Rewards / Cashback Bonus

Our cardmembers use several card products, all with no annual fee, that allow them to earn their rewards based on their purchases, which can be redeemed in any amount at any time, in general as set forth below.

• Discover it card offers a 5% Cashback Bonus in categories that change each quarter, which customers must activate each quarter, up to a quarterly maximum and a 1% Cashback Bonus on all other purchases.

• Discover it Chrome card offers a 2% Cashback Bonus at gas stations and restaurants on up to $1,000 in combined purchases each quarter and a 1% Cashback Bonus on all other purchases.

• Discover it Miles card offers 1.5 miles for every dollar spent on purchases.

• Discover it Business card, which we no longer offer for new accounts, offers a 1.5% Cashback Bonus on all purchases.

Protection Products

We currently sell Identity Theft Protection and we service and maintain existing enrollments of the Payment and Wallet Protection products detailed below for our credit card customers.

• Identity Theft Protection includes an initial credit report, credit bureau report monitoring at the three major credit bureaus, alerts to customers when key changes to their credit bureau files are made, provides their credit bureau snapshot, monitoring that notifies a customer if their personal identifying information is shared on the dark web, identity theft insurance of up to $1,000,000 to cover certain expenses due to identity theft and access to knowledgeable professionals who can help resolve issues.

• Payment Protection allows customers to suspend their minimum payments due for up to two years, depending on the qualifying event and product level, when certain qualifying life events occur. While on this benefit, customers have no minimum monthly payment and are not charged interest, late fees or other product fees. This product covers various events, such as unemployment, disability, Federal or State disasters and other life events, such as marriage or the birth of a child. Depending on the product level and availability under state laws, outstanding balances up to $10,000 or $25,000, are cancelled in the event of death.

• Wallet Protection offers convenience if a customer’s wallet is lost or stolen, including requesting cancellation and replacement of the customer’s credit and debit cards, monitoring the customer’s credit bureau reports at the three major credit bureaus for 180 days and alerting them to key changes to their credit files, and providing up to $100 to replace the customer’s wallet or purse.

Brand and Advertising Management

We maintain a full-service marketing department charged with delivering integrated mass and direct communications to foster customer engagement with our products and services. We also leverage strategic partnerships and sponsorship properties such as the NHL and the Big Ten Conference to help drive loan growth. Our brand team utilizes consumer insights and market intelligence to define our mass communication strategy, create multi-channel advertising messages and develop marketing partnerships with sponsorship properties. This work is performed in-house as well as with a variety of external agencies and vendors.

Customer Service

Our credit card customers have the option to manage their accounts online via Discover.com, through Discover Mobile applications and by calling our U.S.-based customer service personnel. Our digital solutions offer a range of benefits, which includes, but is not limited to, the following:

• Access to overall credit health tools such as Credit Scorecard, Freeze it, Social Security Number Alerts and New Account Alerts;

• Customer service via multiple communication channels, including messaging and 24/7 telephone customer service; and

• Proactive notifications via email, text messaging and in-app messaging for monitoring transaction activity and account security.

-7-

Our private student loan, personal loan, home loan and deposit product customers can utilize our online account services to manage their accounts and to use interactive tools and calculators. Additionally, our card, personal loan and deposit product customers have access to Discover’s Mobile application. Card and deposit product customers that use the mobile application have access to benefits, including Online Privacy Protection. This benefit helps customers to have more control over their personal information online by regularly helping to remove it from select people-search sites that could sell their data.

Processing Services

Our processing services cover four functional areas: card personalization, print/mail, remittance processing and item processing. Card personalization is responsible for the mailing of credit and debit cards for new accounts, replacements and reissues. Print/mail specializes in statement and letter printing and mailing. Remittance processing handles account payments and physical check processing. Item processing handles hard-copy forms and electronic documents, including bank deposits, credit disputes and general correspondence, among other items.

Fraud Prevention

We monitor our customers’ accounts to help prevent, detect, investigate and resolve fraud. Our fraud prevention processes are designed to protect the security of cards, applications and accounts in a manner consistent with our customers’ needs to easily acquire and use our products. Prevention systems monitor the authorization of application information, verification of customer identity, sales, processing of convenience and balance transfer checks and electronic transactions.

Each credit and debit card transaction is subject to screening, authorization and approval through externally developed and proprietary POS decision systems. We use a variety of techniques that help identify and halt fraudulent transactions, including machine-learning models, rules-based decision-making logic, report analysis, data integrity checks and manual account reviews. We manage accounts identified by the fraud detection system through technology that integrates fraud prevention and customer service. Strategies are subject to regular review and enhancement to enable us to respond quickly to changing conditions as well as to protect our customers and our business from emerging fraud activity.

Discover Global Network Operations

We support our merchants through a merchant acquiring model that includes direct relationships with large merchants in the U.S. and arrangements with merchant acquirers generally for small- and mid-size merchants. Additionally, Discover Network cards are widely accepted, and acceptance continues to grow in a number of countries around the world on the Diners Club network or through reciprocal acceptance arrangements made with international payment networks (i.e., Network Alliances).

We maintain direct relationships with most of our large merchant accounts, which enables us to benefit from joint marketing programs and opportunities and to retain the entire discount revenue from the merchants. The terms of our direct merchant relationships are governed by merchant services agreements. These agreements are also accompanied by additional program documents that further define our network functionality and requirements, including operating regulations, technical specifications and dispute rules. To enable ongoing improvements in our network’s functionality and in accordance with industry convention, we publish updates to our program documents on a semi-annual basis.

Discover Global Network services the majority of its small- and mid-size merchant portfolios through third-party merchant acquirers to allow such acquirers to offer a comprehensive payments processing package to such merchants. Merchants also can apply to our merchant acquirer partners directly to accept Discover Global Network cards through the acquirers’ integrated payments solutions. Merchant acquirers provide merchants with consolidated servicing for Discover, Visa and MasterCard transactions, resulting in streamlined statements and customer service for merchants and reduced costs for us. These acquirer partners also perform credit evaluations and screen applications against unacceptable business types and the Office of Foreign Asset Control Specifically Designated Nationals list.

The Discover Global Network operates systems and processes that seek to ensure data integrity, prevent fraud and ensure compliance with our operating regulations. Our systems evaluate incoming transaction activity to identify abnormalities that require investigation and fraud mitigation. Designated Discover Global Network personnel are responsible for validating compliance with our operating regulations and law, including enforcing our data security standards and prohibitions against illegal or otherwise unacceptable activities. Discover Global Network is a founding and current member of the Payment Card Industry Security Standards Council, LLC (the “Council”) and is working to

-8-

expand the adoption of the Council’s security standards globally for merchants and service providers that store, transmit or process cardholder data.

Technology

We provide technology systems processing through a combination of owned and hosted data centers and the use of third-party vendors. These data centers support our payment networks, provide customers with access to their accounts and manage transaction authorization and settlement, among other functions. The Discover Global Network works with a number of vendors to maintain our connectivity in support of POS authorizations. This connectivity also enables merchants to receive timely payment for their Discover Global Network card transactions.

Our approach to technology development and management involves both third-party and in-house resources. We use third-party vendors for technology services (e.g., cloud, telecommunications, hardware and operating systems) as well as for processing and other services for our digital banking and payment services businesses. We subject each vendor to a formal approval process, which includes, among other things, a security assessment, to ensure that the vendor can assist us in maintaining a cost-effective, reliable and secure technology platform. We use our in-house resources to build, maintain and oversee some of our technology systems. We believe this approach enhances our operations and improves cost efficiencies.

Seasonality

In our credit card business, we experience fluctuations in transaction volumes and the level of loan receivables as a result of higher seasonal consumer spending and payment patterns around the winter holidays, summer vacations and back-to-school periods. Historically, in our private student loan business, our loan disbursements peaked at the beginning of a school’s academic semester or quarter; we stopped accepting new applications for private student loans February 1, 2024. Seasonal trends have not caused significant fluctuations in our results of operations or credit quality metrics between quarterly and annual periods.

Revenues in our Diners Club business are generally higher in the first half of the year as a result of Diners Club’s tiered pricing system where licensees qualify for lower royalty rate tiers as cumulative volume grows during the course of the year.

Competition

The consumer financial services business is highly competitive. We compete with other consumer financial services providers, including non-traditional providers such as financial technology firms and payment networks, based on several factors, including brand, reputation, customer service, product and service offerings, incentives, pricing, e-commerce and digital wallet participation, and other terms. Our credit card business also competes on the basis of reward programs and merchant acceptance. We compete for accounts and utilization with cards issued by other financial institutions (including American Express, Bank of America, JPMorgan Chase, Capital One and Citibank) and, to a lesser extent, businesses that issue their own private label cards or otherwise extend credit to their customers. In comparison to our largest credit card competitors, our strengths include no annual fees, cash rewards, conservative portfolio management and strong, 100% U.S.-based customer service. Competition based on rewards and other card features and benefits continues to be strong. Our personal loan product competes for customers primarily with financial institutions (including Citibank and American Express) and non-traditional lenders (including SoFi and Lending Club). Our home loan product faces competition primarily from national and regional mortgage lenders.

Our credit card receivables continue to represent a majority of our receivables. The credit card business is highly competitive. Some of our competitors offer a wider variety of financial products than we do, which may position them better among customers who prefer to use a single financial institution to meet all of their financial needs. Some of our competitors enjoy greater financial resources, diversification and scale than we do and are therefore able to invest more in initiatives and technology to attract and retain customers, such as advertising, targeted marketing, account acquisitions and pricing offerings in interest rates, annual fees, reward programs and low-priced balance transfer programs. In addition, some of our competitors have assets such as branch locations and co-brand relationships that may help them compete more effectively. Another competitive factor in the credit card business is the increasing use of debit cards as an alternative to credit cards for purchases.

-9-

Merchant acceptance of the Discover card has increased in the past several years to reach near parity in the U.S. for both the number of merchants enabled for acceptance and the number of merchants actively accepting Discover. However, the legacy perception of lower acceptance still presents limitations in attracting new cardholders and debit card issuers. Most domestically-issued credit cards, other than those issued on the American Express network, are issued on the Visa and MasterCard networks, thus most other card issuers benefit from the dominant market share of Visa and MasterCard. We continue to make investments in expanding Discover and Diners Club acceptance in key international markets where an acceptance gap exists.

In our payment services business, we compete with other networks for volume and to attract network partners to issue credit, debit and prepaid cards on the Discover, PULSE and Diners Club networks. We generally compete on the basis of customization of services and various pricing strategies, including incentives and rebates. We also compete on the basis of issuer fees, fees paid to networks (including switch fees), merchant acceptance, network functionality, customer perception of service quality, brand image, reputation and market share. The Discover and Diners Club networks’ primary competitors are Visa, MasterCard and American Express. PULSE’s network competitors include Visa’s Interlink, MasterCard’s Maestro and First Data’s STAR. American Express is a particularly strong competitor to Diners Club as both cards target international business travelers. As the payments industry continues to evolve, we are also facing ongoing competition from financial technology firms and alternative payment solutions, which leverage new technologies and a customer’s existing deposit and credit card accounts and bank relationships to create payment or other fee-based solutions.

In our direct-to-consumer deposits business, we have acquisition and servicing capabilities similar to other large banks, including Ally, American Express, Barclays, Capital One, Goldman Sachs, Synchrony and USAA. We compete with banks and credit unions that source deposits through branch locations and direct channels. We seek to differentiate our deposit product offerings on the basis of brand reputation, digital experience, customer service and value.

For more information regarding the nature of the risks we face in connection with the competitive environment for our products and services, see “Risk Factors — Strategic Business Risk.”

Intellectual Property

We use a variety of methods, such as trademarks, patents, copyrights and trade secrets, to protect our intellectual property. We also place appropriate restrictions on our proprietary information to control access and prevent unauthorized disclosures. Our Discover, PULSE and Diners Club brands are important assets and we take steps to protect the value of these assets and our reputation.

Human Capital

The success of our business is highly dependent on attracting, retaining and developing employees with the necessary skills and experience to support our customers, our business and our strategy. We employed approximately 21,100 individuals at December 31, 2023, which consisted primarily of full-time employees in the U.S. Additionally, we employ 100% of our customer service agents within the U.S., which we believe offers a distinct competitive advantage.

Our purpose-driven, people-first culture and human capital management strategy is built on a foundational set of core values and Discover Behaviors and powered by significant investments in employee learning and development, market-competitive compensation and benefits and diversity, equity and inclusion (“DE&I”). One place we see the results from our human capital strategy is in our consistently high levels of employee engagement, which we measure through employee surveys.

Employee Learning and Development

Career and skill development are important components of our talent management system. In addition to on-the-job coaching and training, we provide a range of internal professional and leadership development programs that help our employees build better teams and develop the skills to advance their careers. For example, employees can access continuing education courses that cover a variety of subjects through our training and development platform. Additionally, we support our employees’ educational goals through programs that can reimburse up to 100% of tuition at certain schools.

-10-

Market-Competitive Compensation and Benefits

We offer a market-competitive compensation and benefits package to attract, retain and motivate highly qualified and diverse talent. We designed our compensation and benefits package using a pay-for-performance philosophy to reward the achievement of our financial and strategic performance goals as well as individual performance. Our total compensation and benefits package for U.S. employees includes competitive holiday and flexible paid-time-off; a 401(k) retirement savings plan with matching and company contributions that can total up to 8% of an employee’s wages per year; subsidized medical, dental, vision, disability and supplemental life insurance; paid parental and caregiver leave; adoption and surrogacy assistance; and an employee assistance program, among other benefits.

Diversity, Equity and Inclusion

DE&I is a competitive differentiator for companies and something that we continue to advance at Discover. At December 31, 2023, our U.S.-based employee population was composed of 64% Women and 46% People of Color, including 15% who self-identify as Asian, 12% as Hispanic and 15% as Black. Our workforce diversity either meets or exceeds the diversity of the available workforce in each of the metropolitan areas where we have locations.

Our Executive Management Committee and Board of Directors regularly review our DE&I strategy and progress. Our VP, Chief Diversity & Social Impact Officer leads our DE&I office, which manages the development, implementation and monitoring of our enterprise-wide DE&I strategies, programs, initiatives and policies. We strive to incorporate our DE&I principles throughout our human capital management processes, including talent acquisition, learning and development, employee relations, performance management and total rewards (including pay equity).

Pay Equity

We seek to pay our employees fairly for their work and we regularly monitor our performance, addressing pay-equity discrepancies or issues as appropriate. We regularly benchmark roles and compensation data to help ensure internal pay equity. We partner with an independent, third-party consultant to conduct a company-wide pay equity analysis that considers race, ethnicity and gender. We use this analysis to identify groups with pay discrepancies, understand the underlying drivers and implement best practices to address inequity. Based on our most recent review using this approach, women and minorities at Discover earn, on average, between $0.99 and $1.03 for every $1 earned by men and non-minorities after accounting for factors such as role, tenure and geography.

Employee Engagement

Discover is an award-winning workplace, recognized for our inclusive and collaborative culture; examples for 2023 include Fortune’s 100 Best Companies to Work For® and the Disability Equality Index’s Best Places to Work for Disability Inclusion. Employee engagement and satisfaction is core to our talent attraction and retention strategy, which supports our business success. We consistently leverage employee listening to drive continuous improvement throughout our company. In our most recent employee survey conducted in the fourth quarter of 2023, 82% of employees recommended Discover as a great place to work, which places Discover among the top 25% of all companies surveyed by Glint.

Risk Management

We manage risks that affect our customers, financial performance and ability to meet stakeholder and regulatory expectations. We use an enterprise-wide risk management framework to identify, measure, monitor, manage and report these risks. We have made changes throughout 2023 to better ensure compliance with our risk management framework and supporting governance structure. These enhancements will continue throughout 2024 to further demonstrate strong risk management.

Enterprise Risk Management Framework

Our enterprise risk management principles are executed through a risk management framework that is based on industry standards for managing risk and controls. While the detailed activities vary by risk type, there are common process elements that apply across risk types. We seek to apply these elements consistently in the interest of effective and efficient risk management. This framework seeks to link risk processes and infrastructure with the appropriate risk oversight to create a risk management structure that raises risk awareness, reduces impact of potential risk events, improves business decision-making and increases operational efficiency.

-11-

Our enterprise risk management philosophy is expressed through five key principles that guide our approach to risk management: Comprehensiveness, Accountability, Independence, Defined Risk Appetite and Transparency.

Comprehensiveness

We seek to maintain a comprehensive risk management framework for managing risk enterprise-wide, including policies, standards, risk management processes, monitoring and testing and reporting. Our framework is designed to be comprehensive with respect to our business units and their control and support functions, and across all risk types.

Accountability

We structure accountability across the three lines of defense model along the principles of risk management execution, oversight and independent validation. As the first line of defense, our business units seek to achieve business objectives while identifying and managing risks that arise from day-to-day operations as well as those driven by change. The principles apply across all businesses and risk types and guide the definition of specific roles and responsibilities.

Independence

Our second and third lines of defense operate independently of the business units. The second line of defense includes our corporate risk management (“CRM”) department, which is led by our Chief Risk Officer (“CRO”), who is appointed by our Board of Directors. The CRM department (i) oversees the establishment of enterprise-level risk management standards and policies; (ii) oversees the processes that are designed to be consistent with the size and complexity of our business, applicable legal and regulatory requirements and industry practices; and (iii) independently tests business units’ compliance with applicable regulatory requirements. Our internal audit department, as the third line of defense, performs periodic, independent reviews and tests compliance with risk management policies, procedures and standards across our Company. It also periodically reviews the design and operating effectiveness of our risk management program and processes, including the independence and effectiveness of our CRM function, and reports the results to our Audit Committee of the Board of Directors (“Audit Committee”) and, where appropriate, the Risk Oversight Committee of the Board of Directors (“Risk Oversight Committee”). The Chief Audit Executive reports directly to the Audit Committee and administratively to the Chief Executive Officer (“CEO”).

Defined Risk Appetite

We operate within a risk appetite framework approved by our Board of Directors, which guides an acceptable level of risk-taking relative to desired financial returns, strategic goals and other stakeholder objectives. To that end, limits and escalation thresholds are set consistent with the risk appetite approved by our Board of Directors.

Transparency

We seek to provide transparency of exposures and outcomes, which is core to our risk culture. We provide this risk transparency through our risk committee structure and standardized processes for escalating issues and reporting. This is accomplished at several levels within the organization, including at least quarterly meetings held by our Management Risk Committee and regular reporting to the Risk Oversight and Audit Committees, as well as regular reporting to our Risk sub-committees commensurate with the needs of our businesses. Further, our CRO is a member of our Executive Management Committee.

The following is a more detailed description of our three lines of defense for managing risk, as described in our Enterprise Risk Management Policy.

First Line of Defense

• Business Units: The CEO is ultimately responsible for risk management within our Company. In that capacity, the CEO establishes a risk management culture throughout our Company and ensures that businesses operate in accordance with this risk culture. Our business unit heads are responsible for managing risk associated with their strategic, financial and other business objectives. Business unit heads are responsible for (i) complying with all risk limits and risk policies; (ii) identifying and documenting risks and implementing appropriate controls; (iii) understanding and managing the overall level of risk in their organization, including the impact of the risks being accepted; (iv) explicitly considering risk when developing strategic plans, budgets and new products; (v) implementing appropriate controls when pursuing business strategies

-12-

and objectives; (vi) ensuring business units test and implement business unit processes, controls and monitoring to support corporate model risk management standards such as documentation standards and reporting standards; (vii) coordinating with CRM to produce relevant, sufficient, accurate and timely risk reporting that is consistent with the processes and methodology established by CRM; (viii) ensuring sufficient resources and qualified personnel are deployed to control the risks inherent in the business activities; and (ix) designating, in consultation with the CRO, a Business Risk Officer to assist with the above.

• Credit Risk Management is responsible for (i) developing, validating and implementing credit policy criteria and predictive loan origination and servicing models in order to optimize the profitability of our lending activities; (ii) ensuring adherence to our credit risk policies and approval limits and that departmental policies, procedures and internal controls are consistent with our defined standards; (iii) ensuring that we manage credit risk within approved limits; and (iv) monitoring performance for both new and existing consumer loan products and portfolios.

Second Line of Defense

• Corporate Risk Management is led by the CRO and supports business units by providing objective oversight of our risk profile. As a member of our senior management team, the CRO chairs our Management Risk Committee. In addition, the CRO has oversight responsibility to establish the CRM function with capabilities to exercise its mandate across all risk categories. Our CRO reports directly to our Risk Oversight Committee and administratively to the CEO. Our CRO provides our Board of Directors and executive management with an independent perspective on (i) the risks to which we are exposed; (ii) how well management is identifying, assessing and managing risk; and (iii) the capabilities we have in place to manage risk across the enterprise. The CRM department participates in our Management Risk Committee and sub-committee meetings to provide an enterprise-wide perspective on risk, governance matters, policies and risk thresholds. The CRM department includes, but is not limited to, teams that are responsible for oversight of enterprise, operational, consumer credit, counterparty credit, market, liquidity, compliance, Bank Secrecy Act/anti-money laundering, third-party and business technology and information security risks, as well as model validation and risk testing functions.

Third Line of Defense

• Internal Audit Department performs periodic, independent reviews and testing of compliance with risk management policies and standards across our Company, as well as assessments of the design and operating effectiveness of these policies and standards. The internal audit department also validates that risk management controls are functioning as intended by reviewing and evaluating the design and operating effectiveness of the CRM program and processes, including the effectiveness of the CRM function. The results of such reviews are reported to our Audit Committee and Risk Oversight Committee. In addition, our Chief Audit Executive is a non-voting member of our Executive Management Committee.

Legal

In addition to the three lines of defense, our legal department plays a significant role in managing our legal risk by, among other things, identifying, interpreting and advising on legal and regulatory risks. The legal department collaborates and coordinates closely with the CRM department and business units. Our legal department also participates in meetings of the Management Risk Committee and the sub-committees of the Management Risk Committee in order to advise on legal and compliance risks and to inform the committees of any relevant legislative and regulatory developments. Further, our Chief Legal Officer is a member of our Executive Management Committee.

Risk Types

We are exposed to a broad set of risks in the course of our business activities due to both internal and external factors, which we segment into seven major risk categories. The first six are defined to be broadly consistent with guidance published by the Federal Reserve and the Basel Committee on Banking Supervision (“BCBS”): credit (consumer and counterparty), market, liquidity, operational, compliance and legal risk. We recognize the seventh, strategic risk, as a separate risk type. We evaluate the potential impact of a risk event on our Company by assessing the financial impact, the impact to our reputation, the legal and regulatory impact and the client/customer impact. In addition, we have established various policies to help govern these risks.

-13-

Credit Risk

Our credit risk arises from the potential that a borrower or counterparty will fail to perform on an obligation. Our credit risk includes consumer credit risk and counterparty credit risk. Consumer credit risk is primarily incurred by Discover Bank through the issuance of (i) unsecured credit including credit cards, private student loans and personal loans and (ii) secured credit including deposit secured credit cards and home equity loans. Counterparty credit risk is incurred through a number of business-facing activities including payment network settlement, certain marketing and incentive programs, asset/liability management, guarantor and insurance relationships and strategic investments.

Market Risk

Market risk is the risk to our financial condition resulting from adverse movements in market rates or prices, such as interest rates, foreign exchange rates, credit spreads or equity prices. Given the nature of our business activities, we are exposed to various types of market risk; in particular interest rate risk, foreign exchange risk and other risks that arise through the management of our investment portfolio. Interest rate risk is more significant relative to other market risk exposures and results from potential mismatches in the repricing term of assets and liabilities (yield curve risk) and volatility in reference rates used to reprice floating-rate instruments (basis risk). Foreign exchange risk is primarily incurred through exposure to currency movements across a variety of business activities and is derived, specifically, from the timing differences between transaction authorizations and settlement.

Liquidity Risk

Liquidity risk is the risk that we will be unable to meet our obligations as they become due because of an inability to liquidate assets or obtain adequate funding, or an inability to easily unwind or offset specific exposures without significantly lowering market prices because of inadequate market depth or market disruptions.

Operational Risk

Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. Operational risk is inherent in all our businesses. Operational risk categories incorporate all of the operational loss event-type categories set forth by the BCBS, which include the following: (i) internal fraud; (ii) external fraud; (iii) employment practices and workplace safety; (iv) clients, products and business practices; (v) damage to physical assets; (vi) business disruption and system failures; and (vii) execution, delivery and process management.

One of our key operational risks is information security, which includes cybersecurity. Our information security program is led by our Chief Information Security Officer (“CISO”) and overseen by our Technology and Information Risk Committee (“TIRC”). The program is designed to safeguard the confidentiality, integrity and availability of information assets. We continuously monitor the cyber threat landscape, internal threats and technological changes to ensure controls are in place to mitigate risks to the organization and our customers. In concert with our lines of business and corporate functions, our enterprise-wide incident management framework enables us to manage risk mitigation activities that stem from incidents; these include governance structure and organization, an incident management program, incident management and escalation principles, requirements for testing and exercising the program, risk management principles and external reporting guidance.

Compliance Risk

Compliance risk is the risk of material financial loss, damage to reputation or negative impact on business strategies that Discover Financial Services and its subsidiaries may suffer as a result of its failure to comply with laws, regulations, rules and key internal policies applicable to the activities of our Company. Compliance risk exposures are actively and primarily managed by our business units in conjunction with our compliance department. Our compliance program governs the management of compliance risk and includes oversight by our Management Risk Committee and Compliance Committee. Our Compliance Management System is in place to ensure we are responding in a timely manner to existing and changing laws, regulations and rules.

Legal Risk

Legal risk arises from the potential that unenforceable contracts, lawsuits or adverse judgments can disrupt or otherwise negatively affect our operations or condition. These risks are inherent in all of our businesses. Legal risk exposures are primarily managed by our business units in conjunction with our legal department Management Risk

-14-

Committee and Compliance Committee oversee our legal risk management. Specifically, the legal department is responsible for providing advice, interpreting and identifying developments regarding laws, regulations, regulatory guidance and litigation and setting standards for communicating relevant changes to corporate compliance, business units and internal audit. The legal department also identifies and communicates legal risk associated with new products and business practices.

Strategic Risk

Strategic risk is the risk that our strategies and the execution of those strategies do not produce the desired outcome, resulting in a negative impact on our enterprise value. This risk can be driven by internal and external factors, including (i) our business model, market position, selection of strategies and execution of those strategies and (ii) competitor strategies, emergence of new competitors, emergence of new technologies, changing consumer preferences or other market factors.

Our Management Risk Committee actively manages strategic risk by monitoring our risk appetite and key risk indicators (“KRIs”), identifying and providing oversight of key risks associated with our business strategies, and working with our Risk Oversight Committee and Board of Directors to identify and manage top strategic risks. Our business units take on and are accountable for managing strategic risk in pursuit of their objectives.

Enterprise Risk Management Activities

Risk Identification

We seek to identify potential exposures that could adversely affect our ability to successfully implement strategies and achieve objectives. To ensure that the full scale and scope of risk exposures from enterprise-wide activities are identified, we seek to identify risk exposures based on (i) significant enterprise-level risks that are strategic, systemic, or emerging in nature, including Company-specific risks that span across multiple lines of business; (ii) granular risk exposures from on-balance sheet and off-balance sheet positions, including concentrations; and (iii) risk exposures from initiatives focused on new, expanded, customized, or modified products, services and processes.

Risk exposures identified through these three approaches are consolidated to create a comprehensive risk inventory. This inventory is leveraged by a number of processes within our Company including stress scenario design and stress testing, capital planning, risk appetite setting and risk modeling. The risk inventory is reviewed and approved at least annually by the Management Risk Committee while sub-committees review the risks mapped to the relevant risk categories for transparency and comprehensive coverage of risk exposures.

Risk Measurement

Our risk measurement process seeks to ensure that the identified risk exposures are appropriately assessed. Risk measurement techniques appropriate to the risk category, including econometric modeling, statistical analysis, peer benchmarking and qualitative assessments, are employed to measure our material risk exposures.

Risk Monitoring

Our risks are monitored through an integrated monitoring framework consisting of risk appetite metrics and KRIs. These metrics are established to monitor changes in our risk exposures and external environment. Risk appetite metrics are used to monitor the overall risk profile of our Company by setting risk boundaries and expectations through quantitative limits and qualitative expressions. We use KRIs to monitor our risk profile through direct or indirect alignment with the risk appetite limits.

These metrics enable monitoring of risk by business management and by measuring risk and performance data against risk appetite and KRI escalation thresholds that are updated periodically. Escalation procedures are in place to notify the appropriate governance committees in the event of any actual risk limit breaches or potential upcoming breaches. In addition to metrics, independent CRM testing also informs how well risks are managed.

-15-

Risk Management

We have policies and a defined governance structure in place to manage risks. In the event of a risk exposure exceeding established thresholds, management determines appropriate response actions. Responses, which may be taken by the Board of Directors, the Risk Oversight Committee, the Audit Committee, the Management Risk Committee, sub-committees or the CRO, or business units, may include (i) actions to directly mitigate or resolve risk; (ii) actions to terminate any activities resulting in an undesired or unintended risk position; or (iii) actions to prevent, avoid, modify, share or accept a risk position (or activity prior to its occurrence).

Risk Reporting

As the constituents primarily responsible for proactively managing the risks to which they are exposed, our business units and risk and control functions periodically report to the governance committees. The CRM function is responsible for independent reporting on risk matters to various constituencies across our Company on a regular basis. The CRM department periodically provides risk management reporting to the Management Risk Committee, the Audit Committee, the Risk Oversight Committee and the Board of Directors.

Stress Testing

We use stress testing to better understand the range of potential risks, their impacts and the extent to which our Company is exposed. A stress testing framework is employed to provide a comprehensive, integrated and forward-looking assessment of material risks and vulnerabilities. Stress test results provide information for business strategy, risk appetite setting and decisions related to capital actions, contingency capital plans, liquidity buffer, contingency funding plans and balance sheet positioning. Our stress testing framework utilizes a risk inventory, which covers our risk exposures across our defined risk categories. The risk inventory provides a comprehensive view of our vulnerabilities capturing significant risks from the Board of Directors’ and management’s view, granular risks relevant to business units and emerging risks associated with new initiatives.

Risk Appetite and Strategic Limit Structure

Risk appetite is defined as the aggregate level and the type of risks we are willing to accept or avoid in order to achieve our strategic objectives. Risk appetite expressions are consistent with our aspirations, mission statement and core values and also serve as tools to preclude business activities that could have a negative impact on our reputation.

Risk appetite is expressed through both quantitative limits and qualitative expressions to recognize a range of possible outcomes and to help set boundaries for proactive management of risks. Risk appetite measures take into account the risk profile of the businesses, the external macroeconomic environment and stakeholder views, including those of shareholders, regulators, ratings agencies and customers. These limits and expressions are revised at least annually or as warranted by changes in business strategy, risk profile and external environment.

Management and our CRM department monitor approved limits and escalation triggers to ensure that the business is operating within the approved risk appetite. Risk limits are monitored and reported to various risk sub-committees, the Management Risk Committee and our Board of Directors, as appropriate. Through ongoing monitoring of risk exposures, management seeks to be able to identify appropriate risk response and mitigation strategies in order to react dynamically to changing conditions.

Capital Planning

Risk exposures identified through the risk identification process across risk categories and risk types are consolidated to create a comprehensive risk inventory. This inventory is leveraged by a number of processes within our Company including stress scenario design, capital planning, risk appetite setting and risk modeling. The risk inventory is reviewed and approved at least annually by the Capital Planning Committee, the Management Risk Committee and sub-committees to ensure transparency and comprehensive coverage of risk exposures. Our capital planning and management framework encompasses forecasting capital levels, establishing capital targets, monitoring capital adequacy against targets, maintaining appropriate contingency capital plans and identifying strategic options to deploy excess capital.

-16-

Risk Management Review of Compensation

Our compensation program is grounded in a pay-for-performance philosophy, which considers performance across our Company, business segments and individual performance, as appropriate, as well as the long-term interests of our shareholders and the safety and soundness of our Company. We strive to deliver compensation that is competitive relative to our peers, and have designed our program to attract, retain and motivate our employees. In addition to being competitive in the markets that we compete for talent and encouraging employees to achieve objectives set out by our management, our compensation programs are designed to balance an appropriate mix of compensation components to align the interests of employees with the long-term interests of shareholders and the safety and soundness of our business.

The design and administration of our compensation program provides incentives that seek to appropriately balance risk and financial results in a manner that does not incentivize employees to take imprudent risks, is compatible with effective controls and enterprise-wide risk management and is supported by strong corporate governance, including oversight by our Board of Directors and the Compensation and Leadership Development Committee (“CLDC”) of our Board of Directors. At least annually, the CLDC meets with the CRO to review and discuss the results of the assessment of whether our compensation plans encourage imprudent risk-taking that could threaten the value of, or have a material adverse effect on, our Company or result in a failure to comply with regulatory requirements.

Enterprise Risk Management Governance Structure

Our governance structure is based on the principle that each line of business is responsible for managing risks inherent in its business with appropriate oversight from our senior management and Board of Directors. Various committees are in place to oversee the management of risks across our business. We seek to apply operating principles consistently to each committee. These operating principles are detailed in each committee’s charter, which is approved by its parent committee. Our bank subsidiary has its own risk governance, compliance, auditing and other requirements. Our risk governance framework is designed such that bank-level risk governance requirements are satisfied as well. We are in the process of enhancing and strengthening our management committee structure and risk governance discipline, including the addition, elimination and re-alignment of management committees, to ensure comprehensive coverage.

Board Committee Structure

Board of Directors

Our Board of Directors (i) reviews and approves certain risk management policies; (ii) reviews and approves our capital targets and goals; (iii) reviews and approves our risk appetite framework; (iv) monitors and approves our strategic plan, as appropriate; (v) appoints our CRO and other risk governance function leaders, as appropriate; (vi) receives and reviews reports on any exceptions to the Enterprise Risk Management Policy; and (vii) receives and reviews regulatory examination reports. The Board of Directors receives reports from the Governance and Controls Committee on risks associated with significant regulatory remediation activities, including consent orders, the Audit Committee and Risk Oversight Committee on risk management matters and the CLDC on risks associated with compensation and leadership development.

-17-

Governance and Controls Committee of our Board of Directors

Our Governance and Controls Committee was formed in 2023 to assist the Board in fulfilling its respective oversight responsibilities with regard to significant regulatory remediation activities, including consent orders. The committee is responsible for overseeing and monitoring the establishment and timely implementation by management of remediation actions to address specific corrective actions required by the Company’s regulators. It is responsible for overseeing the Company’s Office of Remediation, approving the head of the Office of Remediation and reviewing that individual’s performance. The committee is also responsible for reviewing and approving, or recommending for Board approval, any material amendments to action plans made in response to supervisory feedback, and reviewing and approving any submissions to the Company’s regulators related to compliance with consent orders.

Risk Oversight Committee of our Board of Directors

Our Risk Oversight Committee is responsible for overseeing our risk management policies and the operations of our enterprise-wide risk management framework and our capital planning and liquidity risk management activities. The Committee is responsible for, among other things, (i) approving and periodically reviewing our global risk management policies; (ii) overseeing the operation of our policies and procedures for establishing our risk management governance, risk management procedures, risk appetite metrics and key risk indicators and risk-control infrastructure; (iii) overseeing the operation of processes and systems for implementing and monitoring compliance with such policies and procedures; (iv) receiving and reviewing regular reports from management on items related to operational risk; (v) reviewing and making recommendations to the Board of Directors, as appropriate, regarding our risk management framework, key risk management policies and our risk appetite and tolerance; (vi) receiving and reviewing regular reports from management and our CRO on risk management deficiencies and emerging risks, the status of and changes to risk exposures, policies, procedures and practices and the steps management has taken to monitor and control risk exposures; (vii) receiving reports on compliance with our risk appetite and limit structure and risk management policies, procedures and controls; and (viii) sharing information, liaising and meeting in joint session with the Audit Committee (which it may do through the chairs of the committees) as necessary or desirable to help ensure that the committees have received the information necessary to permit them to fulfill their duties and responsibilities with respect to oversight of risk management matters.

Audit Committee of our Board of Directors

With respect to the enterprise risk management framework, our Audit Committee’s responsibilities include the following: (i) discussing policies with respect to risk assessment and management; (ii) receiving and reviewing reports from our CRO and other members of management as the Committee deems appropriate on the guidelines and policies for assessing and managing our exposure to risks, the corporation’s major financial risk exposures and the steps management has taken to monitor and control such exposures; (iii) receiving and reviewing reports from management with respect to the Company’s compliance with applicable legal and regulatory requirements; and (iv) sharing information and liaising with the Risk Oversight Committee as necessary or desirable to help ensure that the committees have received the information necessary to permit them to fulfill their duties and responsibilities with respect to oversight of risk management matters.

Compensation and Leadership Development Committee of our Board of Directors

Our CLDC is responsible for overseeing risk management associated with our compensation and leadership development practices. The Committee receives reporting regarding our compensation practices and evaluates whether these practices encourage excessive risk-taking. As a part of its reviews, the Committee considers input from our CRO and takes into account risk outcomes and the safety and soundness of the Company and Discover Bank. The CLDC receives reporting regarding talent management practices and evaluates risks associated with leadership development and succession planning. With respect to individual performance and compensation oversight, the CLDC’s focus is on executive officers.

Nominating, Governance and Public Responsibility Committee of our Board of Directors

Our Nominating, Governance and Public Responsibility Committee is responsible for overseeing risk management with respect to many of the Company’s governing documents and Board composition. The Committee is responsible for, among other things, (i) evaluating whether the skills necessary for overseeing management and the Company are present on the Board and consistent with the Company’s Corporate Governance Guidelines; (ii) facilitating the Board’s self-evaluation process to ensure the right individuals are on the Board; (iii) overseeing the Company’s engagement efforts with institutional shareholders, which can highlight current and future risks; (iv)

-18-

overseeing the Company’s commitment to environmental, social and governance (“ESG”) matters and its ESG strategies; and (v) receiving reports from management with respect to ESG risks and reporting.

Management Risk Committee and Sub-committees Structure

Management Risk Committee

Our Management Risk Committee is an executive management-level committee that establishes and oversees a comprehensive enterprise risk management program, which includes (i) providing a regular forum for representatives of our different functional groups to identify and discuss key risk issues and to recommend to senior management actions that should be taken to manage the level of risk taken by the business lines; (ii) establishing and overseeing an enterprise-wide approach to risk management through the development of our Enterprise Risk Management Policy and the associated oversight framework for the identification, measurement, monitoring, management and reporting of enterprise risk; (iii) communicating our risk appetite and philosophy, including establishing limits and thresholds for managing enterprise-wide risks; and (iv) reviewing, on a periodic basis, our aggregate enterprise-wide risk exposures and the effectiveness of risk identification, measurement, monitoring, management and reporting policies and procedures and related controls within the lines of business.

Our Management Risk Committee has formed and designated a number of sub-committees to assist it in carrying out its responsibilities. These sub-committees, made up of representatives from senior levels of management, escalate issues to our Management Risk Committee. As of December 31, 2023, the sub-committees consisted of the following (except where otherwise indicated, all sub-committees cover both the Company and all of its subsidiaries):

• Credit Committee oversees lending activities for Discover Bank, providing a regular forum for business units to bring forth and discuss key issues.

• Asset and Liability Committee assists in the oversight of the liquidity, funding and market risk management, as well as the execution of strategies to maintain capital adequacy.

• Capital Planning Committee provides oversight of capital management and the development of capital plans for the Company and Discover Bank.

• Challenge Committee assists in ensuring that supervisory findings and enforcement actions are resolved in a timely and appropriate manner.

• Compliance Committee oversees compliance risk management with respect to the business and activities of the Company and its subsidiaries through the Company’s Compliance Management System.

-19-

• Counterparty Credit Committee oversees enterprise-wide counterparty credit risk at the Company and its subsidiaries, establishing an enterprise-wide approach to counterparty risk management through development of the Counterparty Credit Risk Management Policy.

• Human Resources Risk Committee assists in the oversight of the Human Resources programs, providing a forum for leaders across the Company’s business areas to evaluate key risks associated with Human Resources programs and employment practices.

• New Initiatives Committee assists in the oversight of new initiatives including new products, services, systems or business processes.

• Operational Risk Committee assists in the oversight of Operational Risk Management, approving and/or overseeing policies, standard, risk appetite and frameworks for operational risk measurement.

• Technology and Information Risk Committee provides oversight, leadership and direction setting concerning data risk, technology risk and information security risk management on an enterprise-wide basis.

• Resolution Planning Committee oversees all aspects of Discover Bank’s resolution planning efforts as defined by the FDIC under the Federal Deposit Insurance Act (“FDIA”).

• Affiliate Transactions Committee provides oversight of transactions between Discover Bank and its affiliates.

Supervision and Regulation

General

Our operations are subject to extensive regulation, supervision and examination under U.S. federal and state laws and regulations, and under the legal or regulatory frameworks of certain foreign jurisdictions. As a bank holding company under the Bank Holding Company Act of 1956 and a financial holding company under the GLBA, we are subject to supervision, examination and regulation by the Federal Reserve. As a large provider of consumer financial services, we are subject to supervision, examination and regulation of the Consumer Financial Protection Bureau (“CFPB”).

Our bank subsidiary, Discover Bank, is located in the U.S. and is chartered and regulated by the Office of the Delaware State Bank Commissioner (“Delaware Commissioner”) and is also regulated by the FDIC, which insures its deposits up to applicable limits and serves as the bank’s primary federal banking regulator. Discover Bank is also a member of the Federal Home Loan Bank (“FHLB”) of Chicago. Discover Bank offers credit card loans, personal loans and home loans as well as certificates of deposit, savings and checking accounts and other types of deposit accounts.

Bank Holding Company Regulation

Permissible activities for a bank holding company include owning a bank as well as those activities that are so closely related to banking as to be a proper incident thereto, such as consumer lending and other activities that have been approved by the Federal Reserve by regulation or order. Certain servicing activities are also permissible for a bank holding company if conducted for or on behalf of the bank holding company or any of its affiliates. Impermissible activities for bank holding companies include non-financial activities that are related to commerce such as manufacturing or retail sales of non-financial products.

A financial holding company and the non-bank companies under its control are permitted to engage in activities considered financial in nature, incidental to financial activities, or complementary to financial activities, if the Federal Reserve determines that such activities pose no risk to the safety or soundness of depository institutions or the financial system in general. Being a financial holding company under the GLBA requires that the depository institution we control meets certain criteria, including capital, management and Community Reinvestment Act requirements. In addition, under the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) we are required to meet certain capital and management criteria to maintain our status as a financial holding company. Failure to meet the criteria for financial holding company status results in restrictions on new financial activities or acquisitions and could require discontinuance of existing activities that are not otherwise generally permissible for bank holding companies.

Federal Reserve regulations and the FDIA require a bank holding company to serve as a source of strength to its subsidiary bank(s) and commit resources to support each subsidiary bank. This support may be required at times when a bank holding company may not be able to provide such support without adversely affecting its ability to meet other obligations.

-20-

The Dodd-Frank Act addresses risks to the economy and the payments system, especially those posed by large systemically important financial institutions. When the Dodd-Frank Act was first signed into law, all bank holding companies with $250 billion or more in total consolidated assets became subject to enhanced prudential standards. The Dodd-Frank Act was subsequently amended by the Economic Growth, Regulatory Relief, and Consumer Protection Act to provide the Federal Reserve with the authority to impose certain enhanced prudential standards on bank holding companies with total consolidated assets between $100 billion and $250 billion, including DFS, only after issuing a new regulation or order based on a risk-based determination. In October 2019, the federal banking agencies issued final rules that tailored the regulatory requirements in effect at that time related to capital, liquidity and enhanced prudential standards to align with the risk and complexity profiles of banking institutions with total consolidated assets of $100 billion or more. Under the final rules, which became effective in December 2019, DFS is considered a Category IV institution and therefore subject to the least stringent category of enhanced prudential standards for bank holding companies with at least $100 billion in total assets. Among other things, DFS is required to submit to supervisory stress tests every other year rather than annually, is no longer subject to regulations requiring DFS to submit the results of company-run capital stress tests and is no longer subject to the liquidity coverage ratio. However, DFS is still required to submit annual capital plans to the Federal Reserve and remains subject to other core components of enhanced prudential standards, such as risk-management and risk committee requirements and liquidity risk management regulations.

In January 2021, the Federal Reserve finalized regulatory amendments that made targeted changes to the capital planning, regulatory reporting and stress capital buffer (“SCB”) requirements for firms subject to Category IV standards, including DFS, to be consistent with the Federal Reserve’s regulatory tailoring framework that became effective in December 2019. Among other things, the amended rules provide Category IV institutions with the option to submit to supervisory stress tests during off years if they wish for the Federal Reserve to reset the stress test portion of their SCB requirement.

On June 23, 2022, the Federal Reserve released results of the 2022 Comprehensive Capital Analysis and Review (“CCAR”) exercise. Discover’s results showed strong capital levels under stress, well above regulatory minimums. These results were used to set the new SCB effective October 1, 2022. On August 4, 2022, the Federal Reserve disclosed the new SCB for DFS to be 2.5%, the lowest possible requirement. In accordance with the capital plan rule amendments, we elected not to participate in the 2023 supervisory stress tests. Nevertheless, we submitted to the Federal Reserve on April 5, 2023, a capital plan based on a forward-looking assessment of income and capital under baseline and stressful conditions. On July 27, 2023, the Federal Reserve disclosed that Discover’s SCB is unchanged at 2.5%, beginning October 1, 2023 through September 30, 2024.

DFS is subject to the Federal Reserve’s supervisory rating system for large financial institutions (“LFI Rating System”). The LFI Rating System is intended to align more closely with the Federal Reserve’s current supervisory programs for large financial institutions, enhance the clarity and consistency of supervisory assessments and provide greater transparency regarding the consequences of a given rating. Under the LFI Rating System, the Federal Reserve does not provide an institution with an overall composite rating but instead evaluates and assigns ratings for each of the following three components: capital planning and positions; liquidity risk management and positions; and governance and controls. An institution subject to the LFI Rating System, such as DFS, will not be considered “well managed” under applicable regulations if it is assigned a deficient rating in any one component, which could be a barrier for seeking the Federal Reserve’s approval to engage in new or expansionary activities.

Regulatory and supervisory developments, findings and ratings could negatively impact our business strategies or require us to limit or change our business practices, restructure our products in ways that we may not currently anticipate, limit our product offerings, invest more management time and resources in compliance efforts, limit the fees we can charge for services or limit our ability to pursue certain business opportunities and obtain related required regulatory approvals. For additional information regarding bank regulatory limitations on acquisitions and investments, see “— Acquisitions and Investments.” See Note 19: Litigation and Regulatory Matters to our consolidated financial statements for more information on recent matters affecting us. Regulatory developments could also influence our strategies, impact the value of our assets, or otherwise adversely affect our businesses. For more information regarding the regulatory environment and developments under the Dodd-Frank Act, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Regulatory Environment and Developments” and “Risk Factors.”

-21-

Capital, Dividends and Share Repurchases

DFS and Discover Bank are subject to capital adequacy guidelines adopted by federal banking regulators, which include maintaining minimum capital and leverage ratios for capital adequacy and higher ratios to be deemed “well-capitalized” for other regulatory purposes. DFS and Discover Bank are required to maintain Tier 1 and total capital equal to at least 6% and 8%of our total risk-weighted assets, respectively. DFS and Discover Bank are also required to maintain a minimum “leverage ratio” (Tier 1 capital to adjusted total assets) of 4% and a common equity Tier 1 capital ratio (common equity Tier 1 capital to total risk-weighted assets) of 4.5%. Further, under the Federal Reserve’s current capital plan requirements, DFS is required to demonstrate that under stress scenarios we will maintain each of the minimum capital ratios on a pro-forma basis throughout the nine-quarter planning horizon.

In addition to the supervisory minimum levels of capital described above, Federal Reserve rules applicable to DFS require maintenance of the following minimum capital ratios to be considered “well-capitalized” for certain purposes under Regulation Y (12 CFR 225): (i) a Tier 1 risk-based capital ratio of 6% and (ii) a total risk-based capital ratio of 10%. Our bank subsidiary is required by the FDIC’s Prompt Corrective Action rules to maintain the following minimum capital ratios to be considered “well-capitalized”: (i) a common equity Tier 1 capital ratio of 6.5%; (ii) a Tier 1 risk-based capital ratio of 8%; (iii) a total risk-based capital ratio of 10%; and (iv) a Tier 1 leverage ratio of 5%. At December 31, 2023, DFS met all requirements to be deemed “well-capitalized” pursuant to the applicable regulations. For related information regarding our bank subsidiary see “— FDIA” below.

There are various federal and state law limitations on the extent to which our bank subsidiary can provide funds to us through dividends, loans or otherwise. These limitations include minimum regulatory capital requirements, federal and state banking law requirements concerning the payment of dividends out of net profits or surplus, affiliate transaction limits and general federal and state regulatory oversight to prevent unsafe or unsound practices. In general, federal and applicable state banking laws prohibit, without first obtaining regulatory approval, insured depository institutions, such as Discover Bank, from making dividend distributions if such distributions are not paid out of available earnings or would cause the institution to fail to meet applicable capital adequacy standards. For more information, see “— FDIA” below.

Additionally, we are subject to regulatory requirements relative to capital distributions, including common stock dividends and repurchases, imposed by the Federal Reserve as part of its stress testing framework and CCAR program.

For more information on capital planning, including additional conditions and limits on our ability to pay dividends and repurchase our stock, see “— Bank Holding Company Regulation,” “Risk Factors — Operational and Other Risk — We may be limited in our ability to pay dividends on and repurchase our stock,” “Risk Factors — Operational and Other Risk — We are a holding company and depend on payments from our subsidiaries,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Regulatory Environment and Developments,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources — Capital” and Note 17: Capital Adequacy to our consolidated financial statements.

FDIA

The FDIA imposes various requirements on insured depository institutions. For example, the FDIA requires, among other things, the federal banking agencies to take “prompt corrective action” in respect of depository institutions that do not meet minimum capital requirements. The FDIA sets forth the following five capital tiers: “well-capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized” and “critically undercapitalized.” A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors that are established by regulation. At December 31, 2023, Discover Bank met all applicable requirements to be deemed “well-capitalized.”

The FDIA also prohibits any depository institution from making any capital distributions (including payment of a dividend) or paying any management fee to its parent holding company if the depository institution would thereafter be “undercapitalized.” “Undercapitalized” institutions are subject to growth limitations and are required to submit a capital restoration plan. For a capital restoration plan to be acceptable, among other things, the depository institution’s parent holding company must guarantee that the institution will comply with the capital restoration plan.

If a depository institution fails to submit an acceptable capital restoration plan, it is treated as if it is “significantly undercapitalized.” “Significantly undercapitalized” depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become “adequately capitalized,” requirements to

-22-

reduce total assets and cessation of receipt of deposits from correspondent banks. “Critically undercapitalized” institutions are subject to the appointment of a receiver or conservator.

The FDIA prohibits insured banks from accepting brokered deposits or offering interest rates on any deposits significantly higher than the prevailing rate in the bank’s normal market area or nationally (depending upon where the deposits are solicited), unless it is “well-capitalized,” or it is “adequately capitalized” and receives a waiver from the FDIC. Under current FDIC regulations, a bank that is less than “well-capitalized” is generally prohibited from soliciting deposits by offering an interest rate that exceeds 75 basis points over the national market average or 120 percent of the current yield on a similar maturity U.S. Treasury obligation plus 75 basis points, whichever is higher. There are no such restrictions under the FDIA on a bank that is “well-capitalized.” As of December 31, 2023, Discover Bank met the FDIC’s definition of a “well-capitalized” institution for purposes of accepting brokered deposits. An inability to accept brokered deposits in the future could materially adversely impact our funding costs and liquidity. For more information, see “Risk Factors — Credit, Market and Liquidity Risk — An inability to accept or maintain deposits in the future could materially adversely affect our liquidity position and our ability to fund our business.”

The FDIA also affords FDIC insured depository institutions, such as Discover Bank, the ability to “export” interest rates permitted under the laws of the state where the bank is located. Discover Bank is located in Delaware and, therefore, can charge interest on loans to out-of-state borrowers at rates permitted under Delaware law, regardless of the usury limitations imposed by the state laws of the borrower’s residence. Delaware law does not limit the amount of interest that may be charged on loans of the type offered by Discover Bank. This flexibility facilitates the current nationwide lending activities of Discover Bank.

The FDIA subjects Discover Bank to deposit insurance assessments. In an effort to bolster the reserves of the Deposit Insurance Fund, the Dodd-Frank Act raised the statutory minimum reserve ratio for the Fund to 1.35% and removed the statutory cap for the designated reserve ratio (“DRR”). The FDIA requires the FDIC to designate and publish a DRR annually. For 2023, the DRR was 2.00%. The FDIC also recently amended its deposit insurance regulations to increase initial base deposit insurance assessment rate schedules, beginning with the first quarterly assessment period of 2023, which will raise Discover Bank’s cost of deposit insurance. Further increases may occur in the future. In November 2023, the FDIC’s Board of Directors approved a final rule to implement a special assessment to recover the loss to the Deposit Insurance Fund associated with protecting uninsured depositors following the failure of two domestic banks in March 2023. The assessment base for the special assessment is equal to an insured depository institution’s estimated uninsured deposits reported as of December 31, 2022, adjusted to exclude the first $5 billion. The special assessment will be collected at an annual rate of approximately 13.4 basis points for an anticipated total of eight quarterly assessment periods, beginning with the first quarterly assessment period of 2024 (i.e., January 1 through March 31, 2024).

Discover Bank is subject to the FDIC’s final rule requiring periodic submission of a resolution plan to the FDIC. In June 2021, the FDIC announced a modified approach to its implementation of certain aspects of its resolution plan rule as it relates to insured depository institutions with $100 billion or more in total assets. Discover Bank is required to submit a resolution plan to the FDIC on a three-year cycle, with its first filing due on December 1, 2022, under the FDIC’s modified approach. Discover Bank submitted its most recent resolution plan to the FDIC in November 2022. In August 2023, the FDIC issued proposed revisions to strengthen the resolution plan rule, including with respect to the content and timing of resolution submissions as well as interim supplements provided to the FDIC. The proposed rule would require full plan submissions from Discover Bank every two years, with more limited supplements filed in off years. The proposed revisions also include updated and new information requirements. Because the rule revisions are not yet final, the impact to Discover Bank remains uncertain until the rulemaking process is complete.

Acquisitions and Investments

Since we are a bank holding company, and Discover Bank is an insured depository institution, we are subject to banking laws and regulations that limit the types of acquisitions and investments that we can make. In addition, certain permitted acquisitions and investments that we seek to make are subject to the prior review and approval of our banking regulators, including the Federal Reserve and FDIC. Our banking regulators have broad discretion on whether to approve proposed acquisitions and investments. In deciding whether to approve a proposed acquisition, federal bank regulators will consider, among other factors, the effect of the acquisition on competition; our financial condition and our future prospects, including current and projected capital ratios and levels; the competence, experience and integrity of our management and our record of compliance with laws and regulations; the convenience and needs of the communities to be served, including our record of compliance under the Community Reinvestment Act; and our effectiveness in combating money laundering. Therefore, results of supervisory activities of the banking regulators,

-23-

including examination results and ratings, can impact whether regulators approve proposed acquisitions and investments. For more information on recent matters affecting us, see Note 19: Litigation and Regulatory Matters to our consolidated financial statements. For information on the regulatory environment, see “Risk Factors.”

In addition, certain acquisitions of our voting stock may be subject to regulatory approval or notice under federal or Delaware state law. Investors are responsible for ensuring that they do not, directly or indirectly, acquire shares of our stock in excess of the amount that can be acquired without regulatory approval under the Change in Bank Control Act, the Bank Holding Company Act and the Delaware Change in Bank Control provisions, which prohibit any person or company from acquiring control of us without, in most cases, the prior written approval of each of the FDIC, the Federal Reserve and the Delaware Commissioner.

Consumer Financial Services

The relationship between us and our U.S. customers is regulated extensively under federal and state consumer protection laws. Federal laws include the Truth in Lending Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the GLBA, the Credit Card Accountability Responsibility and Disclosure Act, the Servicemembers Civil Relief Act, the Military Lending Act, the Truth in Savings Act, the Electronic Fund Transfer Act and the Dodd-Frank Act. These and other federal laws, among other things, prohibit unfair, deceptive and abusive practices, require disclosures of the cost of credit and other terms of credit and deposit accounts, provide substantive consumer rights, prohibit discrimination in credit transactions, regulate the use of credit report information, provide privacy protections, require safe and sound banking operations, restrict our ability to raise interest rates on credit cards, protect customers serving in the military and their dependents and subject us to substantial regulatory oversight. The CFPB has rulemaking and interpretive authority under the Dodd-Frank Act and other federal consumer financial services laws, as well as broad supervisory, examination and enforcement authority over large providers of consumer financial products and services, such as DFS. For more information, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Regulatory Environment and Developments — Consumer Financial Services.” State and, in some cases, local laws also may regulate in these areas, as well as in the areas of collection practices, and may provide other additional consumer protections.

Violations of applicable consumer protection laws can result in significant potential liability in litigation by customers, including civil monetary penalties, actual damages, restitution and attorneys’ fees. Federal banking regulators, as well as state attorneys general and other state and local consumer protection agencies, also may seek to enforce consumer protection requirements and obtain these and other remedies. Further violations may cause federal banking regulators to deny, or delay approval of, potential acquisitions and investments. See “— Acquisitions and Investments.”

We are subject to additional laws and regulations affecting mortgage lenders. Federal, state and, in some instances, local laws apply to mortgage lending activities. These laws generally regulate the manner that mortgage lending and lending-related activities are conducted, including advertising and other consumer disclosures, payments for services and recordkeeping requirements. These laws include the Real Estate Settlement Procedures Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Equal Credit Opportunity Act, the Fair Housing Act, the Home Mortgage Disclosure Act and various state laws. For more information, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Regulatory Environment and Developments — Consumer Financial Services.”

Payment Networks

Our payment networks deliver switching and settlement services to financial institutions and other program participants for a variety of ATM, payment and other electronic banking transactions. These operations are regulated by certain federal and state laws, including banking, privacy and data security laws. Moreover, the Discover and PULSE networks are subject to examination under the oversight of the Federal Financial Institutions Examination Council, an interagency body composed of the federal bank regulators and the National Credit Union Administration. In addition, as our payments business has expanded globally, we are subject to government regulation, both directly and indirectly through regulation affecting network licenses, in countries in which our networks operate or our cards are used. Changes in existing federal, state or international regulation could increase the cost or risk of providing network services, change the competitive environment, or otherwise materially adversely affect our operations. The legal environment regarding privacy and data security is particularly dynamic and any unpermitted handling or disclosure of confidential customer information could have a material adverse impact on our business, including loss of consumer confidence.

-24-

The Dodd-Frank Act contains several provisions that are relevant to the business practices, network transaction volume, revenue and prospects for future growth of our debit card network business. The Dodd-Frank Act requires that merchants control the routing of debit transactions and that interchange fees received by certain payment card issuers on debit card transactions be “reasonable and proportional” to the issuer’s cost in connection with such transactions, as determined by the Federal Reserve. The Dodd-Frank Act also requires the Federal Reserve to restrict debit card networks and issuers from requiring debit card transactions to be processed solely on a single payment network or two or more affiliated networks, or from requiring that transactions be routed over certain networks.

Money Laundering & Terrorist Financing Prevention Program

We maintain an enterprise-wide program designed to comply with all applicable anti-money laundering and anti-terrorism laws and regulations, including the Bank Secrecy Act and the USA PATRIOT Act of 2001. This program includes policies, procedures, training and other internal controls designed to mitigate the risk of money laundering or terrorist financing posed by our products, services, customers and geographic locale. These controls include procedures and processes to detect and report suspicious transactions, perform customer due diligence and meet all recordkeeping and reporting requirements related to particular transactions involving currency or monetary instruments. The program is coordinated by our anti-money laundering compliance and sanctions officer and undergoes regular independent audits to assess its effectiveness. Our program is typically reviewed on an annual basis by federal banking regulators. For additional information regarding bank regulatory limitations on acquisitions and investments, see “— Acquisitions and Investments.”

Sanctions Programs

We have a program designed to comply with applicable economic and trade sanctions programs, including those administered and enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control. These sanctions are usually targeted against foreign countries, terrorists, international narcotics traffickers and those believed to be involved in the proliferation of weapons of mass destruction. These regulations generally require either the blocking of accounts or other property of specified entities or individuals, but they may also require the rejection of certain transactions involving specified entities or individuals. We maintain policies, procedures and other internal controls designed to comply with these sanctions programs.

Information About Our Executive Officers

Set forth below is information concerning our executive officers, each of whom is a member of our Executive Management Committee.

Name	Age	Position

Michael G. Rhodes	58	Chief Executive Officer and President

John T. Greene	58	Executive Vice President, Chief Financial Officer

Daniel P. Capozzi	52	Executive Vice President, President - Consumer Banking

Jason P. Hanson	45	Executive Vice President, President - Payment Services

Hope D. Mehlman	59	Executive Vice President, Chief Legal Officer, General Counsel and Corporate Secretary

Michael E. Roemer	61	Executive Vice President, Chief Risk Officer

Jason J. Strle	47	Executive Vice President, Chief Information Officer

Keith E. Toney	52	Executive Vice President, President - Credit and Decision Management

Michael G. Rhodes is our CEO and President, having joined Discover in February 2024. Prior to joining Discover, Mr. Rhodes was the Group Head, Canadian Personal Banking at TD Bank Group (“TD”). He joined TD in 2011 to lead the North American Credit Card and Merchant Services business, and from 2017 to 2021, he also served as the Group Head, Innovation, Technology and Shared Services. His experience also includes leadership roles at both Bank of America and MBNA America Bank. Mr. Rhodes earned his MBA from the Wharton School at the University of Pennsylvania and holds a bachelor’s degree in engineering from Duke University.

-25-

John T. Greene is our Executive Vice President, Chief Financial Officer (“CFO”). He has held this role since September 2019. Prior to joining Discover, Mr. Greene served as executive vice president, chief financial officer and treasurer at Bioverativ, a global biopharmaceutical company. From 2014 to 2016, he was chief financial officer for Willis Group Holdings, which was preceded by more than eight years at HSBC Holdings where he held CFO positions for several divisions, including retail bank and wealth management, insurance and consumer and mortgage lending. He also held various CFO roles in his 12-year tenure with General Electric from 1993 to 2005. Mr. Greene holds a bachelor’s degree in accounting from the State University of New York and an MBA from the Kellogg School of Management at Northwestern University.

Daniel P. Capozzi is our Executive Vice President, President - Consumer Banking. He has held this role since July 2023. In his current role, Mr. Capozzi oversees enterprise marketing, consumer products (US Cards, Lending and Deposits) and customer care operations. Prior to this role, he served as president – US Cards from December 2020 to 2023. In October 2018, he was appointed to the role of executive vice president, president - Credit Operations and Decision Management and also previously served as senior vice president, Credit and Decision Management beginning in June 2017. Since joining Discover in 2007, Mr. Capozzi has held leadership positions in the Deposits business and Corporate Finance. Prior to joining Discover, he held various leadership positions in Finance at Citibank and Bank of America. Mr. Capozzi holds a bachelor’s degree in business administration from Northeastern University.

Jason P. Hanson is our Executive Vice President, President – Payment Services. He has held this role since July 2023, with responsibility for Discover Network, PULSE and Diners Club International. Since joining Discover in 2019, Mr. Hanson has held various leadership positions across Payment Services. Prior to joining Discover, Mr. Hanson held roles as a senior vice president at FIS/WorldPay, as a partner at McKinsey & Company and as an officer in the U.S. Army. Mr. Hanson holds a bachelor’s degree in economics from the United States Military Academy, West Point and an MBA from the University of Chicago Booth School of Business.

Hope D. Mehlman is our Executive Vice President, Chief Legal Officer, General Counsel and Corporate Secretary. She joined Discover in January 2023 as executive vice president, chief legal officer and general counsel, and became corporate secretary in February 2023. Prior to joining Discover, Ms. Mehlman was executive vice president, general counsel and corporate secretary of Bank of the West and corporate secretary of BNP Paribas USA, Inc., positions she held from 2020 to January 2023. From 2006 to 2020, she held multiple leadership roles at Regions Financial Corp., where she last served as executive vice president, deputy general counsel, chief governance officer and corporate secretary. Ms. Mehlman holds a bachelor’s degree in near eastern studies from Cornell University, a juris doctor from Seton Hall University Law School and a master of laws in taxation from New York University School of Law.

Michael E. Roemer is our Executive Vice President, CRO. He has held this role since July 2021 and previously served as chief compliance officer beginning in February 2021 through December 2021. Prior to joining Discover, Mr. Roemer served as chief compliance officer at Wells Fargo from 2018 to 2020, where he oversaw the transformation of its enterprise compliance function, focusing on regulatory remediation and improvement of compliance risk management. Before that, he was head of compliance at Barclays from 2014 to 2017, where he led the compliance transformation program and served as chief internal auditor from 2012 to 2014. Mr. Roemer holds a bachelor’s degree from St. John’s University and completed the Tuck Executive Program at Dartmouth College.

Jason J. Strle is our Executive Vice President, Chief Information Officer (“CIO”). He has held this role since July 2023. Prior to joining Discover, Mr. Strle served as executive vice president and group CIO for Corporate Functions at Wells Fargo from 2022 to 2023, Consumer Banking, Payments and Digital from 2017 to 2022. Prior to Wells Fargo, he spent almost 13 years with JPMorgan Chase in roles of increasing scope, culminating as CIO of Consumer and Small Business Banking. Mr. Strle holds a bachelor’s degree in computer science from Ohio University in Athens, Ohio.

Keith E. Toney is our Executive Vice President, President – Credit and Decision Management. He has held this role since July 2023 and previously served as executive vice president, president – data and analytics from October 2020 to July 2023. Prior to that, Mr. Toney served as senior vice president, chief data officer beginning in December 2019. From 2017 to 2019, Mr. Toney held leadership positions with The Hartford Financial Services Group, where he last served as senior vice president – product, data science and analytics. Mr. Toney, who also served as chief data scientist at Connexion Point from 2015 to 2017, has more than 20 years of information technology and risk management experience in financial services and analytics. He holds a bachelor’s degree and a master’s degree in mathematics from Ohio State University.

-26-

DFS - Discover Financial Services

Company Overview

Sector Information

Other Information