KEYKeyCorp

Group Overview and Responsibilities Activities Board of Directors –Oversight •Oversight capacity –Understands •Understands Key's risk philosophy –Oversees •Oversees that Key’s risks are managed in a manner that is effective and balanced –Approves •Approves the risk appetite –Fiduciary •Fiduciary duty to Key’s shareholders –Inquires •Inquires about risk practices –Reviews •Reviews the portfolio of risks –Compares •Compares the actual risks to the risk appetite –Is •Is apprised of significant risks, both actual and emerging, and determines whether management is responding appropriately –Challenges •Challenges management and promotes accountability Board of Directors Audit Committee (a) –Assists the Board in oversight of financial statement integrity, regulatory and legal requirements, independent auditors’ qualifications and independence, and the performance of the internal audit function and independent auditors –Meets with management and approves significant policies relating to the risk areas overseen by the Audit Committee –Assists the Board in oversight of financial reporting, legal matters, and fraud risk –Receives reports on enterprise risk –Meets bi-monthly –Convenes to discuss the content of our financial disclosures and quarterly earnings releases Board of Directors Risk Committee (a) –Assists Committee(a) •Assists the Board in oversight of strategies, policies, procedures, and practices relating to the assessment and management of enterprise-wide risk, including credit, market, liquidity, model, operational, compliance, reputation, strategic, and strategic technology risks –Reviews •Reviews and provides oversight of management’s activities related to the enterprise-wide risk management framework, which includes an annual review of the ERM Policy, including the Risk Appetite Statement, and management and ERM reports –Assists •Assists the Board in overseeing risks related to capital adequacy, capital planning, and capital actions –Approves •Approves any material changes to the charter of the ERM Executive Level (Level II) Risk Governance Committee charters and significant policies relating to risk management, including corporate risk tolerances metrics for major risk categories ERM Board of Directors Compensation & Organization Committee(a) •Assists the Board in oversight of compensation policies and practices to support Key’s efforts to attract, retain, develop, motivate, and reward a high performing and collaborative workforce to achieve its business objectives •Oversees compensation for Key’s Board-Reported Executives, talent management and organizational development, including succession planning, leadership development and strategic hiring objectives Board of Directors Nominating & Corporate Governance Committee(a) •Assists the Board with oversight of corporate governance matters and Key’s policies and practices on significant issues of corporate responsibility •Oversees the evaluation of the Board, the directors, and the Lead Director •Provides guidance on Board-related matters, including director candidates, director compensation, director independence, the Board committee structure, and succession planning matters •Reviews the Corporate Governance Guidelines •Provides oversight with respect to community investment strategy Board of Directors Technology Committee –Chaired (a) •Assists the Board with oversight of major technology investments and technology risks •Supports Key’s strategic objectives in areas such as cybersecurity, fraud, and data, project management, technology strategy, technology innovation, and emerging technology trends •In consultation with the Risk Committee, oversees technology-related risks including (but not limited to) cybersecurity, business resiliency, and other technology-related risks as necessary and appropriate Board of Directors Audit Committee(a) •Assists the Board in oversight of financial statement integrity, regulatory and legal requirements, independent auditors’ qualifications and independence, and the performance of the internal audit function and independent auditors •Meets with management and approves significant policies relating to the risk areas overseen by the Chief Executive Officer Audit Committee •Assists the Board in oversight of financial reporting, legal matters, and comprising the Chief Risk Officer and other senior level executives –Approves and manages the risk-adjusted capital framework we use to manage risks –Manage fraud risk and ensure that the corporate •Receives reports on enterprise risk profile is managed in a manner consistent with our risk appetite –Oversees the ERM Program, which encompasses our risk philosophy, policy, framework, and governance structure for the management of risks across the entire company Disclosure Committee –Includes representatives from each of the Three Lines of Defense –Convenes quarterly •Convenes to discuss the content of our 10-Q financial disclosures and 10-K –Meets quarterly to review recent internal and external events to determine whether all appropriate disclosures have been made in reports filed with the SEC Tier 2 earnings releases Executive Level (Level II) Risk Governance Committees –Includes •Includes ERM Committee, Asset Liability Committee, Capital Committee, Credit Risk Committee, Compliance Risk Committee, and Operational Risk Committee, as well as the Compensation & Benefits Oversight Committee and the Disclosure Committee. Level II Risk Governance Committees report to the Risk Committee of the Board (except for the Compensation & Benefits Oversight Committee, which reports to the Compensation & Organization Committee of the Board, and the Disclosure Committee, which reports to the Audit Committee of the Board) and are generally responsible for the activities listed herein •Escalation of risk issues, particularly issues that have the potential to increase aggregated risk beyond Key’s risk appetite, to the appropriate Level I Governance Committee, typically the Risk or Audit Committees of the Board •Identifying early warning events or trends, top and emerging risks and discussing forward looking assessments •Approving certain risk metrics •Monitoring certain metric limits, as well as associated risk levels to the Board approved risk appetite •Providing governance, direction, oversight and high-level management of their associated risk and the risk assessment process which is used in capital adequacy stress testing; •Monitoring stress testing results related to their associated risks (if required per committee charter) and escalating emerging risks as appropriate •Providing assurance, advice and support to the Risk Committee on their associated risk Management Level (Level III) Risk Governance Committees •Includes attendees from each of the Three Lines of Defense –Supports Defense: First Line (line of business and support areas), Second Line (risk management), and Third Line (internal audit function) •Supports the ERM Committee, Asset Liability Committee, Capital Committee, Credit Risk Committee, Compliance Risk Committee, and Operational Risk Committee, as well as the Compensation & Benefits Oversight Committee and the Disclosure Committee, by identifying early warning events and trends, escalating emerging risks, and discussing forward-looking assessments –The First Line of Defense is the line of business primarily responsible to accept, own, proactively identify, monitor, and manage risk –The Second Line of Defense comprises Risk Management representatives who provide independent, centralized oversight over all risk categories by aggregating, analyzing, and reporting risk information –Risk Review, our internal audit function, provides the Third Line of Defense. Its role is to provide independent assessment and testing of the effectiveness of, appropriateness of, and adherence to KeyCorp’s risk management policies, practices, and controls Internal Audit –Provide •Provides the KeyCorp Board and management with independent, risk-based, and objective assurance, advice, insight, and foresight. –Conducts foresight •Conducts objective examinations of evidence for the purpose of providing independent assessments to the Audit Committee, management, and outside parties on the adequacy and effectiveness of business processes, risk management activities, internal controls, and governance processes for KeyCorp. KeyCorp

Views about corporate responsibility and sustainability-related issues are diverse, differing, dynamic, and rapidly changing. Financial services companies, including Key, face increasing criticism with accompanying reputational risk from social activists, politicians, investors, and environmental activists stakeholders who target companies, including Key, believe companies should be focusing more or less on environmental, social, political, and governance matters. Companies in our industry are also targeted for engaging or not engaging in business with clients engaged specific customers or with customers in industries which such activists perceive to be harmful to communities or the environment. Such criticism directed at Key could generate dissatisfaction among our stakeholders. particular industries. Additionally, however we respond to such criticism, we face the risk that current or potential clients customers may decline to do business with us (or encourage others to do so) or current or potential employees refuse to work with us. for us and could subject us to litigation or regulatory action. This can be true regardless of whether we are perceived by some as not having done enough to address activist these concerns or by others as having inappropriately yielded to activist stakeholder pressures. Conversely, there exists anti-environmental, social and governance (ESG) and anti-diversity, equity, and inclusion (DEI) sentiment among certain stakeholders and government institutions, which has gained momentum across the U.S. For example, President Trump recently issued an executive order opposing DEI initiatives in the private sector, and certain states have

The amount of capital being allocated to our reporting units as a proxy for the carrying value is based on a combination of regulatory and economic equity. Fair values are estimated using a combination of market and income approaches. The market approach incorporates comparable public company multiples along with data related to recent merger and acquisition activity. The income approach consists of discounted cash flow modeling that utilizes internal forecasts and various other inputs and assumptions. A multi-year internal forecast is prepared

We determine the payment/performance risk associated with each type of guarantee described below based on the probability that we could be required to make the maximum potential undiscounted future payments shown in the preceding table. We use a scale of low (0% to 30% probability of payment), moderate (greater than 30% to 70% probability of payment), or high (greater than 70% probability of payment) to assess the payment/performance risk, and have determined that the payment/performance risk associated with each type of guarantee outstanding at December 31, 2024, is low.