Ally Financial (ALLY) Risk Factors

Much of our business and operations is conducted by Ally Bank, which is a direct bank with no branch network, and a primary component of our business strategy is its continued growth. This growth includes expanding our consumer and commercial lending and increasing our deposit customers and balances while optimizing our cost of funds. If regulatory agencies raise concerns about any aspect of our business strategy for Ally Bank or the way in which we implement it, we may be obliged to limit or even reverse the growth of Ally Bank or otherwise alter our strategy, which could have an adverse effect on our business, financial condition, results of operations, or prospects. In addition, if we are compelled to retain or shift any of our business activities in or to nonbank affiliates, our funding costs for those activities-such as unsecured funding in the capital markets-could be more expensive than our cost of funds at Ally Bank.

We are subject to extensive regulatory frameworks and to direct supervision and periodic examinations by various governmental agencies and industry SROs that are charged with overseeing the kinds of business activities in which we engage. This regulatory and supervisory oversight is designed to protect public and private interests-such as macroeconomic policy objectives, financial-market stability and liquidity, and the confidence and security of depositors generally-that may not always be aligned with those of our stockholders or non-deposit creditors. At any given time, we are involved in a number of legal and regulatory proceedings and governmental and regulatory examinations, investigations, and other inquiries. Refer to the risk factor below titled We are or may be subject to potential liability in connection with pending or threatened legal proceedings and other matters, which could adversely affect our business or financial results. While the scope, intensity, and focus of governmental oversight can vary from time to time, we expect a highly demanding environment for the foreseeable future. In recent years, regulatory and other governmental agencies have taken a host of actions that create more challenging and volatile financial and operating conditions for financial-services companies, including through formal rulemakings that change the law or interpretations of the law, supervisory expectations and public statements that are designed to informally compel changes in industry practices, and more aggressive approaches to enforcement that are accompanied by increasingly severe penalties. These actions are comprehensive in their coverage, such as rulemakings on climate-related disclosures, cybersecurity risk governance (including incident disclosure), CRA reform, credit-card fees (such as the CFPB's proposed rule to cap late fees), and personal-financial-data rights as well as guidance and statements on mergers and acquisitions, regulatory capital, resolution planning, automotive financing and insurance, fees for financial services, and UDAAP. Further, following the failures of three large banks in 2023, banking regulators have proposed changes, or indicated the potential for changes, regarding the regulation and supervision of banking organizations, in particular those, such as Ally, with $100 billion or more in assets. The introduction of new or more stringent regulatory requirements, as well as heightened supervisory expectations, could require Ally to maintain additional capital or liquidity or incur significant expenses. Governmental oversight of this kind may increase our operating costs or reduce our revenues, limit the types of financial services and products we may offer, alter the investments we may make, affect the manner in which we conduct our business and operations, increase our litigation and regulatory costs, and enhance the ability of others to offer more competitive financial services and products. We continue to devote substantial time and resources to risk management, compliance, regulatory-change management, and cybersecurity and other technology initiatives, each of which-whether successful or not-also may adversely affect our ability to operate profitably or to pursue advantageous business opportunities. Ally has elected to be treated as an FHC, which permits us to engage in a number of financial and related activities-including securities, advisory, insurance, and merchant-banking activities-beyond the business of banking. Ally and Ally Bank are subject to ongoing requirements for Ally to qualify as an FHC. If a BHC or any of its insured depository institutions is found not to be well capitalized or well managed, as defined under applicable law, the BHC can be restricted from engaging in the broader range of financial and related activities permitted for FHCs, including the ability to acquire companies engaged in those activities, and can be required to discontinue these activities or even divest any of its insured depository institutions. In addition, if an insured-depository-institution subsidiary of a BHC fails to achieve a satisfactory or better rating under the CRA, the ability of the BHC to expand its financial and related activities or make acquisitions could be restricted. In connection with their continuous supervision and examinations of us, the FRB, the UDFI, the CFPB, the SEC, FINRA, the NYDFS, or other regulatory agencies may explicitly or implicitly require changes in our business or operations. Such a requirement may be judicially enforceable or impractical for us to contest, and if we are unable to comply with the requirement in a timely and effective manner, we could become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives. The financial-services industry continues to face scrutiny from supervisory authorities in the examination process, including through an increasing use of horizontal reviews from a broader industry perspective as well as strict enforcement of laws at federal, state, and local levels-particularly in connection with business and other practices that may harm or appear to harm consumers and compliance with anti-money-laundering, sanctions, and related laws. Because of the regulatory and supervisory framework, financial institutions often are less inclined to litigate with governmental authorities. In general, the amounts paid by financial institutions in settling proceedings or investigations and the severity of other terms of regulatory settlements are likely to remain elevated. In some cases, governmental authorities have required criminal pleas or other extraordinary terms, including admissions of wrongdoing and the imposition of monitors, as part of settlements. Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business or make acquisitions, our flexibility in conducting operations, and our ability to pay dividends or utilize capital. Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence, and a prior enforcement action may also increase the risk that regulators and governmental authorities pursue formal enforcement actions in connection with the resolution of an inquiry or investigation, even if unrelated to the prior enforcement action. We could be required as well to dispose of specified assets and liabilities within a prescribed period of time. As a result, any enforcement or other supervisory action could have an adverse effect on our business, financial condition, results of operations, and prospects. Our regulatory and supervisory environments-whether at federal, state, or local levels-are not static. No assurance can be given that applicable statutes, regulations, and other laws will not be amended or construed differently, that new laws will not be adopted, that any of these laws will not be enforced more aggressively, or that applicable laws, or the interpretation or enforcement thereof, may overlap, diverge or conflict across jurisdictions. Changes in the regulatory and supervisory environments could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, and restricting our ability to make acquisitions or pursue other profitable opportunities. Further, our noncompliance with applicable laws-whether as a result of changes in interpretation or enforcement, system or human errors, or otherwise and, in some cases, regardless of whether noncompliance was inadvertent-could result in the suspension or revocation of licenses or registrations that we need to operate and in the initiation of enforcement and other supervisory actions or private litigation.

Geopolitical conditions, government shutdowns, military conflicts (including Russia's invasion of Ukraine and the conflicts in the Middle East), acts or threats of terrorism, natural disasters, pandemics (including the COVID-19 pandemic), and other conditions or events beyond our control may adversely affect our business, results of operations, financial condition, or prospects. For example, military conflicts, acts or threats of terrorism, and political, financial, or military actions taken in response could adversely affect general economic, business, or market conditions and, in turn, us, especially as an intermediary within the financial system. In addition, nation states engaged in warfare or other hostile actions may directly or indirectly use cyberattacks against financial systems and financial-services companies like us to exert pressure on one another or other countries with influence or interests at stake. We also could be negatively impacted if our key personnel, a significant number of our employees, or our systems or infrastructure were to become unavailable or damaged due to a pandemic, natural disaster, war, act of terrorism, accident, or similar cause. Furthermore, a shutdown of the United States government could adversely affect the economy and increase the risk of economic instability and market volatility, which could have an adverse impact on our business, financial condition, liquidity, and results of operations. These same risks and uncertainties arise too for the service providers and counterparties on whom we depend as well as their own third-party service providers and counterparties. For example, the most notable impact of COVID-19 on our results of operations was a significant increase in our provision expense for credit losses during the year ended December 31, 2020. This was primarily driven by incremental reserves associated with a deterioration in macroeconomic conditions, such as unemployment, following the onset of the pandemic. In the case of Russia's invasion of Ukraine and the current conflicts in the Middle East, security risks as well as increases in fuel and other commodity costs, supply-chain disruptions, and associated inflationary pressures have impacted our business the most. These conditions and events and others like them are highly complex and inherently uncertain, and their effect on our business, results of operations, financial condition, and prospects in the future cannot be reliably predicted.

Our businesses are driven by robust economic and market activity, monetary and fiscal stability, and positive investor, business, and consumer sentiment. A downturn in economic conditions, disruptions in the equity or debt markets, high unemployment or underemployment, depressed vehicle or housing prices, unsustainable debt levels, high inflation, high interest rates, unfavorable changes in interest rates, declines in household incomes or savings, deteriorating consumer or business sentiment, consumer or commercial bankruptcy filings, or declines in the strength of national or local economies could decrease demand for our products and services, increase the amount and rate of delinquencies and losses, raise our operating and other expenses, and negatively impact the returns on and the value of our loans, investment portfolio, and other assets. Further, if a significant and sustained increase in fuel prices or other adverse conditions were to lead to diminished new and used vehicle purchases or prices, our automotive finance and insurance businesses could suffer considerably. In addition, concerns about the pace of economic growth and uncertainty about fiscal and monetary policies can result in significant volatility in the financial markets and could impact our ability to obtain cost-effective funding. If any of these events were to occur or worsen, our business, results of operation, and financial condition could be adversely affected.

Our business is centered around lending and banking with an emphasis on our digital platform, and a significant percentage of our assets are composed of loans, operating leases, and securities. As a result, in the ordinary course of business, credit risk is one of our most significant risks. Our business and financial results depend significantly on household, business, economic, and market conditions. When those conditions are weak or deteriorating, we could simultaneously experience reduced demand for credit and increased delinquencies or defaults, including in the loans that we have securitized and in which we retain a residual interest. These kinds of conditions also could dampen the demand for products and services in our insurance, banking, brokerage, advisory, and other businesses. Increased delinquencies or defaults could also result from our failing to appropriately underwrite loans and operating leases that we originate or purchase or from our adopting-for strategic, competitive, or other reasons-more liberal underwriting standards. If delinquencies or defaults on our loans and operating leases increase, their value and the income derived from them could be adversely affected, and we could incur increased administrative and other costs in seeking a recovery on claims and any collateral. If unfavorable conditions are negatively affecting used vehicle or other collateral values at the same time, the amount and timing of recoveries could suffer as well. Weak or deteriorating economic conditions also may negatively impact the market value and liquidity of our investment securities, and we may be required to record additional impairment charges that adversely affect earnings if debt securities suffer a decline in value that is considered other-than-temporary. There can be no assurance that our forecasts of economic conditions, our assessments and monitoring of credit risk, and our efforts to mitigate credit risk through risk-based pricing, appropriate underwriting and investment policies, loss-mitigation strategies, and diversification are, or will be, sufficient to prevent an adverse impact to our business and financial results. For example, early loss performance in our consumer automotive lending portfolio is trending higher compared to expectations at the time of origination for loans originated in 2022, and more specifically the second half of 2022. In addition, because of CECL, our financial results may be negatively affected as soon as weak or deteriorating economic conditions are forecasted and alter our expectations for credit losses. A financial or systemic shock and a failure of a significant counterparty or a significant group of counterparties could negatively impact us as well, possibly to a severe degree, due to our role as a financial intermediary and the interconnectedness of the financial system. We continue to have exposure to nonprime consumer automotive financing and used vehicle financing. We define nonprime consumer automotive loans primarily as those loans with a FICO Score (or an equivalent score) at origination of less than 620. Customers that finance used vehicles tend to have lower FICO Scores as compared to new vehicle customers, and defaults resulting from vehicle breakdowns are more likely to occur with used vehicles as compared to new vehicles that are financed. The carrying value of our nonprime consumer automotive loans before allowance for loan losses was $8.7 billion, or approximately 10.3% of our total consumer automotive loans at December 31, 2023, as compared to $8.8 billion, or approximately 10.6% of our total consumer automotive loans at December 31, 2022. At December 31, 2023, and 2022, $258 million and $302 million, respectively, of nonprime consumer automotive loans were considered nonperforming as they had been placed on nonaccrual status in accordance with our accounting policies. Refer to the Nonaccrual Loans section of Note 1 to the Consolidated Financial Statements for additional information. Additionally, the carrying value of our consumer automotive used vehicle loans before allowance for loan losses was $57.6 billion, or approximately 68.3% of our total consumer automotive loans at December 31, 2023, as compared to $55.7 billion, or approximately 67.0% of our total consumer automotive loans at December 31, 2022. If our exposure to nonprime consumer automotive loans or used vehicle financing continue to increase over time, our credit risk will increase to a possibly significant degree. As part of the underwriting process, we rely heavily upon information supplied by applicants and other third parties, such as credit reporting agencies, automotive dealers and retailers (in the case of automotive consumer and commercial loans), and service providers (in the case of unsecured personal loans). If any of this information is intentionally or negligently misrepresented and the misrepresentation is not detected before completing the transaction, we may experience increased credit risk.

We rely heavily upon communications, data management, and other operating systems and infrastructure-including cloud-based services-to conduct our business and operations, which creates meaningful operational risk for us. For example, during 2021, there were a number of widely publicized cases of outages in connection with access to cloud service providers. Any failure of or interruption in these systems or infrastructure or those of our service providers or others on whom we rely-including as a result of inadequate or failed technology or processes, unplanned or unsuccessful updates to technology, sudden increases in transaction volume, human errors, fraud or other misconduct, deficiencies in the integration of acquisitions or the commencement of new businesses, energy or similar infrastructure outages, disruptions in communications networks or systems, natural disasters, catastrophic events, pandemics, acts of terrorism, political or social unrest, external or internal security breaches, acts of vandalism, cyberattacks such as computer viruses and malware, misplaced or lost data, or breakdowns in business continuity plans-could cause failures or delays in receiving applications for loans and operating leases, underwriting or processing loan or operating-lease applications, servicing loans and operating leases, accessing online accounts, processing transactions, executing brokerage orders, communicating with our customers, managing our investment portfolio, or otherwise conducting our business and operations. These adverse effects could be exacerbated if systems or infrastructure need to be taken offline or meaningfully repaired, if backup systems or infrastructure are not adequately redundant and effective for the conduct of our business and operations, or if technological or other solutions do not exist or are slow to be developed. Further, to the extent that the systems or infrastructure of service providers or others are involved, we may have little or no knowledge, control, or influence over how and when failures or delays are addressed. As a digital financial-services company with a meaningful dependence on service providers, we are susceptible to business, reputational, financial, regulatory, and other harm as a result of these risks. In the ordinary course of our business, we collect, store, process, and transmit sensitive, confidential, or proprietary data and other information, including business information, intellectual property, and the personally identifiable information of customers and employees. The secure collection, storage, processing, and transmission of this information are critical to our business and reputation, and if any of this information were mishandled, misused, improperly accessed, altered, lost, or stolen or if related operations were disabled or otherwise disrupted, we could suffer significant business, reputational, financial, regulatory, and other damage. Even when a failure of or interruption in operating systems or infrastructure is timely resolved, we may need to expend substantial resources in doing so, may be required to take actions that could adversely affect customer satisfaction or behavior, and may be exposed to reputational damage. We also could be exposed to contractual claims, supervisory actions, or litigation by private plaintiffs.