Our unfunded lending commitments primarily consist of credit card lines, loan commitments to customers of both our Commercial Banking and Consumer Banking businesses, as well as standby and commercial letters of credit. These commitments, other than credit card lines, are legally binding conditional agreements that have fixed expirations or termination dates and specified interest rates and purposes. The contractual amount of these commitments represents the maximum possible credit risk to us should the counterparty draw upon the commitment. We generally manage the potential risk of unfunded lending commitments by limiting the total amount of arrangements, monitoring the size and maturity structure of these portfolios, and applying the same credit standards for all of our credit activities.

For unused credit card lines, we have not experienced and do not anticipate that all of our customers will access their entire available line at any given point in time. Commitments to extend credit other than credit card lines generally require customers to maintain certain credit standards. Collateral requirements and loan-to-value (“LTV”) ratios are the same as those for funded transactions and are established based on management’s credit assessment of the customer. These commitments may expire without being drawn upon; therefore, the total commitment amount does not necessarily represent future funding requirements.

We also issue letters of credit, such as financial standby, performance standby and commercial letters of credit, to meet the financing needs of our customers. Standby letters of credit are conditional commitments issued by us to guarantee the performance of a customer to a third party in a borrowing arrangement. Commercial letters of credit are short-term commitments issued primarily to facilitate trade finance activities for customers and are generally collateralized by the goods being shipped to the client. These collateral requirements are similar to those for funded transactions and are established based on management’s credit assessment of the customer. Management conducts regular reviews of all outstanding letters of credit and the results of these reviews are considered in assessing the adequacy of reserves for unfunded lending commitments.

Table 14.1: Unfunded Lending Commitments: Contractual Amount and Carrying Value



	Contractual Amount				Carrying Value
(Dollars in millions)	September 30, 2019		December 31, 2018		September 30, 2019		December 31, 2018
Credit card lines	$	349,896	$	346,186	N/A		N/A
Other loan commitments⁽¹⁾	35,351		34,449		$	122	$	95
Standby letters of credit and commercial letters of credit⁽²⁾	1,658		1,792		33		29
Total unfunded lending commitments	$	386,905	$	382,427	$	155	$	124

__________

Within our Commercial Banking business, we originate multifamily commercial real estate loans with the intent to sell them to the GSEs. We enter into loss sharing agreements with the GSEs upon the sale of the loans. At inception, we record a liability representing the fair value of our obligation which is subsequently amortized as we are released from risk of payment under the loss sharing agreement. If payment under the loss sharing agreement becomes probable and estimable, an additional liability may be recorded on the consolidated balance sheets and a non-interest expense may be recognized in the consolidated statements of income. The liability recognized on our consolidated balance sheets for these loss sharing agreements was $70 million and $59 million as of September 30, 2019 and December 31, 2018, respectively.

In the U.K., we previously sold payment protection insurance (“PPI”). In response to an elevated level of customer complaints across the industry, heightened media coverage and pressure from consumer advocacy groups, the U.K. Financial Conduct Authority (“FCA”), formerly the Financial Services Authority, investigated and raised concerns about the way the industry has handled complaints related to the sale of these insurance policies. For the past several years, the U.K.’s Financial Ombudsman Service (“FOS”) has been adjudicating customer complaints relating to PPI, escalated to it by consumers who disagree with the rejection of their complaint by firms, leading to customer remediation payments by us and others within the industry. In August 2017, the FCA issued final rules and guidance on the PPI complaints. This set the deadline for complaints as August 29, 2019. It also provided clarity on how to handle PPI complaints under s.140A of the Consumer Credit Act, including guidance on how redress for such complaints should be calculated.

In determining our best estimate of incurred losses for future remediation payments, management considers numerous factors, including (i) the number of customer complaints or information requests still to be processed; (ii) our expectation of upholding those complaints; (iii) the expected number of complaints customers escalate to the FOS; (iv) our expectation of the FOS upholding such escalated complaints; (v) the number of complaints that fall under s.140A of the Consumer Credit Act; and (vi) the estimated remediation payout to customers. We monitor these factors each quarter and adjust our reserves to reflect the latest data.

Our U.K. PPI reserve totaled $231 million and $133 million as of September 30, 2019 and December 31, 2018, respectively. For the three months ended September 30, 2019, we recorded an additional reserve build of $212 million due to significantly elevated claims volume ahead of the August 29, 2019 claims submission deadline. Our best estimate of reasonably possible future losses beyond our reserve as of September 30, 2019 is approximately $50 million.

On July 29, 2019, we announced that on July 19, 2019, we determined there was unauthorized access by an outside individual who obtained certain types of personal information relating to people who had applied for our credit card products and to our credit card customers (the “Cybersecurity Incident”). The Cybersecurity Incident occurred on March 22 and 23, 2019. We believe that a highly sophisticated individual was able to exploit a specific configuration vulnerability in our infrastructure. The configuration vulnerability was reported to us by an external security researcher on July 17, 2019. We then began our own internal investigation, leading to the July 19, 2019, determination that the Cybersecurity Incident occurred. We immediately fixed the configuration vulnerability that this individual exploited and verified there are no other instances in our environment. Among other things, we also augmented our routine automated scanning to look for this issue on a continuous basis. We promptly began working with federal law enforcement. The person responsible was arrested by the Federal Bureau of Investigation on July 29, 2019 and federal prosecution of the responsible person has commenced. The U.S. Attorney’s Office has stated they believe the data has been recovered and that there is no evidence the data was used for fraud or shared by this individual.

We provided required notification to affected individuals and made free credit monitoring and identity protection available. We retained a leading independent cybersecurity firm that confirmed we correctly identified and fixed the specific configuration vulnerability exploited in the Cybersecurity Incident. We also have retained an outside expert to conduct a review of the root causes of the incident to help further inform our cybersecurity program.

We are subject to numerous legal proceedings and other inquiries relating to the Cybersecurity Incident and could be the subject of additional proceedings and inquiries in the future. See “Litigation—Cybersecurity Incident” section of this Note for additional information.

We carry insurance to cover certain costs associated with a cyber risk event. This insurance has a total coverage limit of $400 million and is subject to a $10 million deductible, which was met in the third quarter of 2019, as well as standard exclusions. During the third quarter of 2019, we incurred approximately $22 million of net Cybersecurity Incident expenses, consisting of $49 million of expenses, primarily from customer notifications and credit monitoring, and $27 million of probable insurance recoveries.

In accordance with the current accounting standards for loss contingencies, we establish reserves for litigation-related matters that arise from the ordinary course of our business activities when it is probable that a loss associated with a claim or proceeding has been incurred and the amount of the loss can be reasonably estimated. None of the amounts we currently have recorded individually or in the aggregate are considered to be material to our financial condition. Litigation claims and proceedings of all types are subject to many uncertain factors that generally cannot be predicted with assurance. Below we provide a description of potentially material legal proceedings and claims.

For some of the matters disclosed below, we are able to estimate reasonably possible losses above existing reserves, and for other disclosed matters, such an estimate is not possible at this time. For those matters below where an estimate is possible, management currently estimates the reasonably possible future losses beyond our reserves as of September 30, 2019 are approximately $1.1 billion. Our reserve and reasonably possible loss estimates involve considerable judgment and reflect that there is still significant uncertainty regarding numerous factors that may impact the ultimate loss levels. Notwithstanding our attempt to estimate a reasonably possible range of loss beyond our current accrual levels for some litigation matters based on current information, it is possible that actual future losses will exceed both the current accrual level and the range of reasonably possible losses disclosed here. Given the inherent uncertainties involved in these matters, especially those involving governmental agencies, and the very large or indeterminate damages sought in some of these matters, there is significant uncertainty as to the ultimate liability we may incur from these litigation matters and an adverse outcome in one or more of these matters could be material to our results of operations or cash flows for any particular reporting period.

In 2005, a putative class of retail merchants filed antitrust lawsuits against MasterCard and Visa and several issuing banks, including Capital One, seeking both injunctive relief and monetary damages for an alleged conspiracy by defendants to fix the level of interchange fees. Other merchants have asserted similar claims in separate lawsuits, and while these separate cases did not name any issuing banks, Visa, MasterCard and issuers, including Capital One, have entered settlement and judgment sharing agreements allocating the liabilities of any judgment or settlement arising from all interchange-related cases.

The lawsuits were consolidated before the U.S. District Court for the Eastern District of New York for certain purposes and were settled in 2012. The class settlement, however, was invalidated by the United States Court of Appeals for the Second Circuit in June 2016, and the suit was bifurcated into separate class actions seeking injunctive and monetary relief, respectively. In addition, numerous merchant groups opted out of the 2012 settlement and have pursued their own claims. The claims by the injunctive relief class have not been resolved, but the parties reached a new settlement agreement with the monetary damages class in August 2018, whereby the class would receive up to approximately $6.2 billion collectively from the defendants in exchange for a release of their claims, depending on the percentage of class plaintiffs who opt out. The trial court preliminarily approved the settlement in January 2019. Visa and MasterCard have also settled several of the opt-out cases, which required non-material payments from issuing banks, including Capital One. Visa created a litigation escrow account following its initial public offering of stock in 2008 that funds settlements for its member banks, and any settlements related to MasterCard-allocated losses have either already been paid or are reflected in our reserves.

We face residual exposure related to subsidiaries that originated residential mortgage loans and sold these loans to various purchasers, including purchasers who created securitization trusts. In connection with their sales of mortgage loans, these subsidiaries entered into agreements containing varying representations and warranties about, among other things, the ownership of the loan, the validity of the lien securing the loan, the loan’s compliance with any applicable criteria established by the purchaser, including underwriting guidelines and the existence of mortgage insurance, and the loan’s compliance with applicable federal, state and local laws. Each of these subsidiaries may be required to repurchase mortgage loans or indemnify certain purchasers and others against losses they incur in the event of certain breaches of these representations and warranties.

The substantial majority of our representation and warranty exposure has been resolved through litigation, and our remaining representation and warranty exposure is almost entirely litigation-related. Accordingly, we establish litigation reserves for representation and warranty losses that we consider to be both probable and reasonably estimable. The reserve process relies heavily on estimates, which are inherently uncertain, and requires the application of judgment. Our reserves and estimates of

We are subject to an open consent order with the Office of the Comptroller of the Currency (“OCC”) dated July 10, 2015 relating to our anti-money laundering (“AML”) program. In October 2018, we paid a civil monetary penalty of $100 million to resolve the monetary component of the AML consent order.

The Department of Justice and the New York District Attorney’s Office have closed their investigations into certain former check casher clients of the Commercial Banking business and our AML program. We are in discussions with the Financial Crimes Enforcement Network (“FinCEN”) of the U.S. Department of Treasury to explore a potential regulatory resolution of its investigation into our AML program, which could include a monetary penalty.

Consumer class actions. To date, we have been named as a defendant in approximately 70 putative consumer class action cases (60 in U.S. federal courts and 10 in Canadian courts) alleging harm from the Cybersecurity Incident and seeking various remedies, including monetary and injunctive relief. The lawsuits allege breach of contract, negligence, violations of various privacy laws and a variety of other legal causes of action. On October 2, 2019, the U.S. consumer class actions were consolidated for pretrial proceedings before a multi-district litigation panel in the U.S. District Court for the Eastern District of Virginia, Alexandria Division.

Securities class action. The Company and certain officers have also been named as defendants in a putative class action in the U.S. District Court for the Eastern District of New York, which was filed on October 2, 2019, alleging violations of certain federal securities laws in connection with statements and alleged omissions in securities filings relating to our information security standards and practices. The complaint seeks certification of a class of all persons who purchased or otherwise acquired Capital One securities from February 2, 2018 to June 29, 2019, as well as unspecified monetary damages, costs and other relief.

We received a subpoena from the New York Attorney General’s office in August 2019 and a subpoena from the U.S. Attorney’s Office for the Southern District of New York, Civil Division, in October 2019 relating to investigations of the taxi medallion finance industry we exited beginning in 2015. The subpoenas seek, among other things, information regarding our lending counterparties and practices. We are cooperating with these investigations.

Some of the claimants in the U.K. PPI regulatory claims process described above have initiated legal proceedings. The significant increase in PPI regulatory claim volumes shortly before the August 29, 2019 claims submission deadline increases the potential exposure for PPI-related litigation, which is not subject to the August 29, 2019 deadline.

In addition, we are commonly subject to various pending and threatened legal actions relating to the conduct of our normal business activities. In the opinion of management, the ultimate aggregate liability, if any, arising out of all such other pending or threatened legal actions, is not expected to be material to our consolidated financial position or our results of operations.