Risk Factors Dashboard

Once a year, publicly traded companies issue a comprehensive report of their business, called a 10-K. A component mandated in the 10-K is the ‘Risk Factors’ section, where companies disclose any major potential risks that they may face. This dashboard highlights all major changes and additions in new 10K reports, allowing investors to quickly identify new potential risks and opportunities.

View risk factors by ticker

Search filings by term

Risk Factors - SLM

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Item 1A. We could also be affected by, among other things: changes in our funding costs and availability; reductions to our credit ratings; cybersecurity incidents, cyberattacks, risks related to artificial intelligence (“AI”), and other failures or breaches of our operating systems or infrastructure, including those of third-party vendors; the societal, demographic, business, and legislative/regulatory impact of pandemics, other public health crises, severe weather events, and/or natural disasters; damage to our reputation; risks associated with restructuring initiatives, including failures to successfully implement cost-cutting programs and the adverse effects of such initiatives on our business; changes in the demand for higher education, educational financing, or in financing preferences of lenders, educational institutions, students, and their families, including changes to the amount or availability of funding that educational institutions, students, or their families receive from government sources; changes in laws and regulations with respect to the student lending business and financial institutions generally; changes in banking rules and regulations, including increased capital requirements; increased competition from banks and other consumer lenders; the creditworthiness of our customers, or any change related thereto; changes in the general interest rate environment, including the rate relationships among relevant money-market instruments and those of our earning assets versus our funding arrangements; rates of prepayments on the loans owned by us; changes in general economic or macroeconomic conditions, including changes due to inflation, stagflation, recession, shifts in the labor market, changes to government policies or initiatives, such as tariffs, trade wars, wars, immigration, and student visa policies, which could negatively impact consumer or business sentiment, demand for higher education, demand for student loans, our financial and business results and/or modeling, and our ability to successfully effectuate any acquisitions, strategic partnerships, or other initiatives. The preparation of our consolidated financial

2025 Form 10-K — SLM CORPORATION 1

statements also requires management to make certain estimates and assumptions, including estimates and assumptions about future events. These estimates or assumptions may prove to be incorrect.

All forward-looking statements contained in this Annual Report on Form 10-K are expressly qualified in their entirety by the factors, risks, and uncertainties set forth in the foregoing cautionary statements, and are made only as of the date of this report. In light of these risks, uncertainties, and assumptions, you should not put undue reliance on any forward-looking statements discussed herein.

2 SLM CORPORATION — 2025 Form 10-K

AVAILABLE INFORMATION

Our website address is www.salliemae.com. Copies of our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, and Current Reports on Form 8-K, as well as any amendments to those reports, and our Proxy Statements and any significant investor presentations, are available free of charge through our website as soon as reasonably practicable after they are electronically filed with, or furnished to, the SEC. The SEC maintains a website at www.sec.gov that contains all such filed or furnished reports and other information. In addition, copies of our Board Governance Guidelines, Code of Business Conduct (which includes the code of ethics applicable to our Principal Executive Officer, Principal Financial Officer, and Principal Accounting Officer) and the governing charters for each committee of our Board of Directors are available free of charge on our website, as well as in print to any stockholder upon request. We intend to disclose any amendments to or waivers of our Code of Business Conduct (to the extent applicable to our Principal Executive Officer, Principal Financial Officer, or Principal Accounting Officer) by posting such information on our website. Information contained or referenced on our website is not incorporated by reference into and does not form a part of this Annual Report on Form 10-K.

2025 Form 10-K — SLM CORPORATION 3

PART I.

Item 1. Business

Our Company Mission

SLM Corporation, more commonly known as Sallie Mae, is the premier financial brand in higher education. As an education solutions company, we provide students and their families with the products and services needed to confidently and successfully navigate their higher education journey. We support students and families navigating to, through, and immediately after higher education. We simplify the college planning process and advance higher education access and completion by providing free tools, resources, scholarships, and responsible financing options.

We believe education, in all forms, is the foundation for success, an equalizer of opportunities, and a proven pathway to economic mobility. Higher education increases lifetime wages and enables economic mobility. For example, data from the U.S. Bureau of Labor and Statistics confirms those with bachelor’s degrees earn 66 percent more than those with a high school diploma.1 Those with advanced degrees earn an even greater percentage than those with a high school diploma.1 This effect is multigenerational, as children of parents who are college educated are more likely to earn a bachelor’s degree than students whose parents did not go to college. Most would agree our society prospers and becomes more economically inclusive when each of its members is provided access to post-secondary education.2 Education represents a transformative investment in one’s future that yields our country’s next nurses, teachers, engineers, business leaders, and more.

Our History

While the Sallie Mae name has existed for more than 50 years, the company that operates as Sallie Mae today, SLM Corporation, was formed in late 2013 and includes its wholly owned subsidiary, Sallie Mae Bank, an industrial bank established in 2005 (the “Bank”). On April 30, 2014, we legally separated (the “Spin-Off”) from another public company that is now named Navient Corporation (“Navient”), which is in the education loan management, consolidation loan, and business processing businesses. Navient retained all assets and liabilities generated prior to the Spin-Off other than those explicitly retained by us pursuant to the Separation and Distribution Agreement executed in connection with the Spin-Off (the “Separation and Distribution Agreement”). We are a consumer banking business and did not retain any assets or liabilities generated prior to the Spin-Off other than those explicitly retained by us pursuant to the Separation and Distribution Agreement. We sometimes refer to the company that existed prior to the Spin-Off as “pre-Spin-Off SLM.”

Our principal executive offices are located at 300 Continental Drive, Newark, Delaware 19713. Additionally, we have offices in New Castle, Delaware; Salt Lake City, Utah; Indianapolis, Indiana; Newton, Massachusetts; and Sterling, Virginia. Our telephone number is (302) 451-4911.

______________________

1 “Education pays, 2024,” Career Outlook, U.S. Bureau of Labor Statistics, May 2025.

2 https://research.collegeboard.org/trends/education-pays. The information contained on, or accessible through, the foregoing website does not constitute a part of, and is not incorporated by reference in, this Annual Report on Form 10-K.

4 SLM CORPORATION — 2025 Form 10-K

Our Business

Our business is focused and aligned to strategic imperatives that set the foundation for our continued success. Our focus is driving innovation to maximize the sustainable growth and profitability of our core private student loan business. Additionally, we aim to accelerate the growth of new lines of business to attract more customers requiring our products and services. We are also focused on building the data infrastructure, technology, and talent required to compete in a digital world. We seek to create a customer-centric brand as an education solutions company that supports students and families through their higher education journey. We are focused on driving greater internal commitment to our mission, brand, and strategy, while we evolve our structure and risk capabilities to support our core private student loan business and emerging new businesses.

Private Education Loans

Our primary business is to originate and service high-quality Private Education Loans. “Private Education Loans” are education loans for students or their families that are not made, insured, or guaranteed by any state or federal government. We also offer a range of deposit products insured by the Federal Deposit Insurance Corporation (the “FDIC”). We serve more families than any other private student loan lender.

Our Private Education Loans serve primarily to bridge the gap between the cost of higher education and the amount funded through family income and savings, scholarships and grants, and federal financial aid. We also extend Private Education Loans as an alternative to similar federal education loan products where we believe our rates are competitive.

Private student lending is cyclical in nature. We typically experience peak volume of originations and commitments in the third quarter of our fiscal year, corresponding to the required timing of disbursements prior to the start of the fall semester at most higher education institutions. There is generally also a “mini-peak” in volume of originations and commitments in the first quarter of our fiscal year, corresponding to the required timing of disbursements prior to the start of the spring semester at most higher education institutions. Similarly, we also experience cyclicality with respect to when borrowers are scheduled to exit their applicable grace period and enter full principal and interest repayment status, with the largest volume generally happening in our fourth fiscal quarter, and a smaller wave occurring in our second fiscal quarter.

The grace period for a Smart Option Student Loan generally runs for six months after the borrower separates from school and can run for up to 36 months for a small subset of graduate loans. Making payments while in school helps customers become accustomed to making on-time regular loan payments. We offer both variable-rate and fixed-rate loans.

We also offer six loan products for specific graduate programs of study. These include the Sallie Mae Law School Loan, the Sallie Mae MBA Loan, the Sallie Mae Graduate School Loan for Health Professions, the Sallie Mae Medical School Loan, the Sallie Mae Dental School Loan, and the Sallie Mae Graduate School Loan. We also offer two non-cost of attendance loans to support bar study preparation, as well as residency and relocation expenses for medical and dental school students. In 2025, we launched the Airline Career Loan which is tailored to the unique needs of students pursuing professional pilot program certificates.

2025 Form 10-K — SLM CORPORATION 5

We regularly review and update the terms of our Private Education Loan products. As a holder of Private Education Loans, we bear the full credit risk of the customers. We manage this risk by underwriting and pricing based on customized credit scoring criteria and the addition of qualified cosigners. For Private Education Loans originated during the year ended December 31, 2025, our average FICO scores (representing the higher credit scores of the cosigners or borrowers) at the time of original approval were 755, and approximately 92.8 percent of those loans were cosigned. In addition, for all loans other than Bar Study loans and Residency and Relocation loans, we require school certification of both the need for, and the amount of, every Private Education Loan we originate (to prevent unnecessary borrowing beyond a school’s cost of attendance), and we disburse the loan proceeds directly to the higher education institutions to ensure loan proceeds are applied directly to the student’s education expenses.

Our loans are of high-credit quality, and the overwhelming majority of our customers manage their payments with great success. Private Education Loans in repayment include loans on which customers are making interest only or fixed payments, as well as loans that have entered full principal and interest repayment status after any applicable grace period. At December 31, 2025, 4.0 percent of Private Education Loans (held for investment) in repayment were 30 days or more delinquent, and Private Education Loans (held for investment) in forbearance were 2.7 percent of loans in repayment and forbearance. In 2025, Private Education Loan net charge-offs as a percentage of average loans in repayment were 2.15 percent.

Sallie Mae Bank

The Bank, which is regulated by the Utah Department of Financial Institutions (the “UDFI”), the FDIC, and the Consumer Financial Protection Bureau (the “CFPB”), offers traditional savings products, such as high-yield savings accounts, money market accounts, and certificates of deposit (“CDs”), and originates Private Education Loans.

Our ability to obtain deposit funding and offer competitive interest rates on deposits will be necessary to sustain our Private Education Loan originations and achieve other business goals. Our ability to obtain such funding is dependent, in part, on the capital levels of the Bank and its compliance with other applicable regulatory requirements. During 2025, we maintained our diversified funding base by raising $0.5 billion in term funding collateralized by pools of Private Education Loans in the long-term asset-backed securities (“ABS”) market. This brought our total ABS funding outstanding at December 31, 2025 to $4.9 billion, or 24 percent of our total Private Education Loans held for investment portfolio. We plan to continue to use ABS funding, market conditions permitting. This helps us better match-fund our assets and avoids excessive reliance on deposit funding.

Strategic Partnerships and Loan Program Management

In 2025, we announced our first private credit strategic partnership. This new funding model allows us to establish a capital-light, fee-based revenue strategy that complements our core private student loan business. Under our strategic partnership (and any future partnerships that we may enter into), we intend to sell Private Education Loans while maintaining the relationships with customers, retaining servicing for the sold loans, and earning ongoing fees for providing servicing and program management, including industry expertise. We expect strategic partnerships to expand our access to scalable and capital efficient funding through innovative structures, while strengthening our loan originations capacity and ability to serve students families.

6 SLM CORPORATION — 2025 Form 10-K

Our Lending Philosophy

Sallie Mae is committed to responsible lending and encourages responsible borrowing by advising students and families to follow this three-step approach to paying for higher education:

Start with money you won’t have to pay back. Supplement savings and income by maximizing scholarships, grants, and work-study.

Explore federal student loans. Explore federal student loan options by completing the Free Application for Federal Student Aid.

Consider a responsible private student loan. Fill the gap between available resources and any remaining costs of higher education.

The best interests of our customers are front-and-center and integral to our responsible lending philosophy. We reward financial responsibility, emphasize building good credit, and provide flexible repayment terms to help customers manage and eliminate debt. We also embed customer protections in our products. To ensure applicants borrow only what they need to cover their school’s cost of attendance, we actively engage with schools and require school certification before we disburse a Private Education Loan (except for Bar Study loans and Residency and Relocation loans). To help applicants understand their loan and its terms, we provide multiple, customized disclosures explaining the applicant’s interest rate, whether the interest rate is fixed or variable, and the loan’s total cost under the available repayment options. Our Private Education Loans generally feature (i) no origination fees and no prepayment penalties, (ii) an interest rate reduction for those who enroll in and make monthly payments through auto debit, (iii) free access to quarterly FICO credit scores to help customers monitor their credit health, (iv) a choice of repayment options, (v) a choice of either a variable or fixed interest rate, and (vi) loan forgiveness in the case of death or permanent disability of the student borrower.

Our Approach to Assisting Students and Families Borrowing and Repaying Private Education Loans

Approximately half of our Private Education Loan customers elect an in-school repayment option. By making in-school payments, customers learn to establish good repayment patterns, reduce their total loan cost, and graduate with less debt. We send monthly communications to customers while they are in school, even if they have no monthly payments scheduled, to keep them informed and encourage them to reduce the amount they will owe when they leave school.

Our experience has taught us the successful transition from school to full principal and interest repayment status involves making and carrying out a financial plan. As customers approach the principal and interest repayment period on their loans, Sallie Mae engages with them and communicates what to expect during the transition. In addition, SallieMae.com provides educational content for customers on how to organize loans, set up a monthly budget, and understand repayment obligations. Examples are provided to help explain how payments are applied and allocated, and how the accrued interest on alternative repayment programs could affect the cost of customers’ loans.

Some customers transitioning from school to the work force may require more time before they are financially capable of making full payments of principal and interest.

After graduation, a student borrower may apply for the cosigner to be released from the loan. This option is available after 12 principal and interest payments are made and the student borrower demonstrates an ability to assume sole responsibility for repayment of the loan. In the event of a cosigner’s death, the student borrower automatically continues as the sole individual on the loan with the same terms.

If a customer’s account becomes delinquent, our collection teams work with the customer and/or the cosigner to understand their ability to make ongoing payments. If the customer is in financial hardship, we work with the customer and/or cosigner and identify potential alternative arrangements designed to reduce monthly payment

2025 Form 10-K — SLM CORPORATION 7

obligations. We offer rate and term modifications to customers experiencing more severe hardship.

Customer Service

We perform the origination, servicing, and collections activities for all of our Private Education Loans with dedicated representatives assisting customers with various needs. We expect the Bank or affiliates of the Bank to retain servicing of all Private Education Loans the Bank originates, regardless of whether the loans are held, sold, or securitized.

Over the past few years, we have implemented several improvements in our ability to interact with our loan customers, including:

•an integrated platform with customer-centric capabilities that allows self-service and empowers our servicing and collections agents, thus streamlining our processes and providing efficiencies;

•an online chat function for application support, customer service, and collections related inquiries;

•a mobile application accessible through smart phones; and

•expansion of customer surveys to gain feedback on areas for improvement within our originations, servicing, and collections functions.

Customer Success

We continue to adapt our business to best serve the needs of families who see us as a trusted advisor and partner. We are strongly invested in our customers’ success.

In 2022, we acquired the assets of Epic Research Education Services, LLC, which did business as Nitro College (“Nitro”).

The acquisition of Nitro enhanced future strategic growth opportunities and expanded our digital marketing capabilities, reduced the cost to acquire customer accounts, and accelerated our progress to become a broader education solutions provider helping students to, through, and immediately after higher education.

In 2023, we completed the acquisition of several key assets of Scholly, Inc.

8 SLM CORPORATION — 2025 Form 10-K

Key Drivers of Private Education Loan Market Growth

The size of the Private Education Loan market is based primarily on three factors: college enrollment levels, the costs of attending college, and the availability of funds from the federal government to pay for a college education. The amounts students and their families can contribute toward college costs and the availability of scholarships and institutional grants are also important. If enrollment levels or college costs decline, or the availability of federal education loans, grants, or subsidies and scholarships significantly increases, Private Education Loan demand could decrease.

Traditionally, we have focused primarily on students attending public and private not-for-profit four-year degree granting institutions. We lend to some students attending two-year and for-profit schools. Approximately 16 percent or $1.25 billion of our 2025 Private Education Loan originations were for students attending for-profit schools. The for-profit schools where we continue to do business are primarily focused on career training and health care fields. We expect students who attend and complete programs at for-profit schools to support the same repayment performance as students who attend and graduate from public and private not-for-profit four-year degree granting institutions.

As discussed in more detail in Item 1. “Business — Supervision and Regulation — Overview”, certain reforms to the federal student loan program have been enacted into law and will become effective for new borrowers beginning July 1, 2026. We anticipate that these changes to the federal student loan program, which establish caps on certain federal student loan programs and eliminate certain federal graduate student loan programs, will increase demand for Private Education Loans, particularly for graduate students and parents. As part of our origination expansion initiative, we are working to expand our product offerings and originations capabilities to be ready for this anticipated increase in demand.

Our primary competitors1 in the Private Education Loan market include large banks and specialty finance companies such as Citizens Financial Group, Inc., PNC Bank, Sofi Technologies, Inc. and College Ave, and members of the Education Finance Council. We compete based on our products, originations capability, price, and customer service.

______________________

1Source: Enterval Analytics LLC Q3 2025 Private Student Loan Semi Annual Report, January 2026.

2025 Form 10-K — SLM CORPORATION 9

Enrollment

According to the College Board’s study, the full-time equivalent enrollment for undergraduate and graduate students has remained relatively flat since 2020/2021.2 We expect that trend to continue over the next several years.

Full-Time Equivalent Enrollment2

(in millions)

______________________

10 SLM CORPORATION — 2025 Form 10-K

Tuition Rates

Average published tuition and fees (exclusive of room and board) at four-year public and private not-for-profit institutions increased at compound annual growth rates of 2.1 percent and 3.4 percent, respectively, from AYs 2021-2022 through 2025-2026. Average published tuition and fees at public and private four-year not-for-profit institutions grew 2.7 percent and 3.6 percent, respectively, between AYs 2023-2024 and 2024-2025 and 2.9 percent and 4.0 percent, respectively, between AYs 2024-2025 and 2025-2026.3

Published Tuition and Fees3

(Dollars in actuals)

2025 Form 10-K — SLM CORPORATION 11

Sources of Funding

Private Education Loan originations were an estimated $11.5 billion in AY 2024-2025, consistent with an estimated $11.5 billion of Private Education Loan originations in AY 2023-2024.4

Federal & Private Student Loan Volume.jpg

4 Source: The College Board-Trends in Student Aid 2025© The College Board. Enterval LLC. Funding sources in current dollars and include federal and private student loan data. The College Board restates its data annually, which may cause previously reported results to vary. We rely on publicly available sources for market estimates, because we believe it provides a more appropriate basis for comparison of the performance of our business.

12 SLM CORPORATION — 2025 Form 10-K

We estimate total spending on higher education was $536 billion in AY 2024-2025, up from $466 billion in AY 2020-2021. Private Education Loan originations increased $1 billion from the year-ago period to an estimated $14 billion in AY 2024-2025 and represent just 2.6 percent of total spending on higher education.5

Over the AYs 2020-2025 period, increases in total spending have been absorbed primarily through increased family contributions. If household finances continue to improve, we would expect this trend to continue.

_________________________


5 Source: Total post-secondary education spending is estimated by Sallie Mae determining the full-time equivalents for both graduates and undergraduates and multiplying by the estimated total per person cost of attendance for each school type. In doing so, we utilize information from the U.S. Department of Education, National Center for Education Statistics, Digest of Education Statistics to 2031 (NCES 2025, January 2025), The Integrated Postsecondary Education Data System (IPEDS), College Board -Trends in College Pricing and Student Aid 2025. © 2025 The College Board and Company analysis. Other sources for these data points also exist publicly and may vary from our computed estimates. NCES, IPEDS, and College Board restate their data annually, which may cause previous reports to vary. We have also recalculated figures in our Company analysis to standardize all costs of attendance to dollars not adjusted for inflation. This has a minimal impact on historically-stated numbers.

2025 Form 10-K — SLM CORPORATION 13

Supervision and Regulation

Overview

We are subject to extensive regulation, examination, and supervision by various federal, state, and local authorities. The more significant aspects of the laws and regulations that apply to us and our subsidiaries are described below. These descriptions are qualified in their entirety by reference to the full text of the applicable statutes, legislation, regulations, and policies, as they may be amended, and as interpreted and applied, by federal, state, and local agencies.

Federal law establishes requirements and mandates oversight on almost every aspect of the U.S. financial services industry, including consumer protection laws and regulations, capital and liquidity requirements, limits on leverage, and enhanced supervisory authority.

Some states have enacted legislation creating specialized offices within state government to oversee the student loan origination and servicing industry operating within those states, as well as to set minimum standards governing the practices of student loan lenders and servicers. This represents a significant change from the past in which states generally did not issue laws and regulations tailored specifically to the student loan origination and servicing industry.

Passage of H.R.1

The passage of H.R.1 in July 2025 (“H.R.1.”) introduced significant changes to federal student loan programs, effective July 1, 2026, with limited grandfathering for existing borrowers. Key changes to federal student loan programs and repayment options under H.R.1 include:

•the elimination of Grad PLUS loans for graduate students;

•the capping of Parent PLUS loans at $20,000 annually and $65,000 lifetime per student;

•new Graduate loan limits of $20,500 annually ($100,000 lifetime) for non-professional degrees and $50,000 annually ($200,000 lifetime) for professional degrees;

•new universal lifetime borrowing cap across all federal programs;

•an overhaul of the federal student loan repayment structure including the introduction of the Repayment Assistance Plan (RAP), requiring payments of 1%–10% of adjusted gross income, with forgiveness after 30 years;

•a phase-out of existing income-driven repayment plans (e.g., SAVE, PAYE, ICR) by July 1, 2028; and

•stricter forbearance and deferment provisions.

Consumer Protection Laws and Regulations

A number of our products and services, including our origination, servicing, first-party collection, deposit taking, and education solutions activities, subject us to federal and state consumer protection, privacy, and related laws and regulations. Some of the more significant laws and regulations applicable to our business include:

•various state and federal laws governing unfair, deceptive, or abusive acts or practices;

•various state laws and regulations imposing specific, mandated standards and requirements on the conduct and practices of student loan lenders and servicers;

•the federal Truth-In-Lending Act and Regulation Z, which govern disclosures of credit terms to consumer borrowers;

•the Fair Credit Reporting Act and Regulation V, which govern the use and provision of information to consumer reporting agencies;

•the Equal Credit Opportunity Act and Regulation B, which prohibit creditor practices that discriminate on the basis of race, religion, and other prohibited factors in extending credit;

14 SLM CORPORATION — 2025 Form 10-K

•the Servicemembers Civil Relief Act, which applies to all debts incurred prior to commencement of active military service (including education loans) and limits the amount of interest, including fees, that may be charged;

•the Truth in Savings Act and Regulation DD, which mandate certain disclosures related to consumer deposit accounts;

•the Expedited Funds Availability Act, Check Clearing for the 21st Century Act and Regulation CC issued by the Board of Governors of the Federal Reserve System, which relate to the availability of deposit funds to consumers;

•the Right to Financial Privacy Act, which imposes a duty to maintain the confidentiality of consumer financial records and prescribes procedures for complying with federal government requests for and subpoenas of financial records;

•the Electronic Funds Transfer Act and Regulation E, which govern automated transfers of funds and consumers’ rights related thereto;

•the Telephone Consumer Protection Act, which governs communication methods that may be used to contact customers;

•the Gramm-Leach-Bliley Act, which governs the ability of financial institutions to disclose nonpublic information about consumers to non-affiliated third parties; and

•the California Consumer Privacy Act and California Privacy Rights Act, which govern transparency and disclosure obligations regarding personal information of residents of the State of California.

Consumer Financial Protection Bureau

The CFPB is the Bank’s primary consumer compliance supervisor with compliance examination authority and primary consumer protection enforcement authority. It is authorized to collect fines and order consumer restitution in the event of violations, engage in consumer financial education, track consumer complaints, request data, and promote the availability of financial services to underserved consumers and communities. It has authority to prevent unfair, deceptive, or abusive acts and practices by issuing regulations or by using its enforcement authority without first issuing regulations.

The Private Education Loan Ombudsman within the CFPB is authorized to receive and attempt to informally resolve inquiries about Private Education Loans. The Private Education Loan Ombudsman is required by law to report to Congress annually on the trends and issues identified through this process. The CFPB recently indicated its intent to deemphasize student loans in its supervision and examination priorities going forward. Further, the operational, enforcement and regulatory posture of the CFPB under the current federal administration is currently unclear.

Regulation of Sallie Mae Bank

The Bank was chartered in 2005 and is a Utah industrial bank regulated by the FDIC, the UDFI, and the CFPB. We are not a bank holding company under the Bank Holding Company Act, and, therefore are not subject to the federal regulations applicable to bank holding companies. However, we and our non-bank subsidiaries are subject to regulation and oversight as institution-affiliated parties. The following discussion sets forth some of the elements of the bank regulatory framework applicable to us, the Bank, and our other non-bank subsidiaries.

General

The Bank is currently subject to prudential regulation and examination by the FDIC and the UDFI, and consumer compliance regulation and examination by the CFPB. Numerous other federal and state laws and regulations govern almost all aspects of the operations of the Bank and, to some degree, our operations and those of our non-bank subsidiaries as institution-affiliated parties.

2025 Form 10-K — SLM CORPORATION 15

Actions by Federal and State Regulators

Under federal and state laws and regulations pertaining to the safety and soundness of insured depository institutions, the UDFI and the FDIC have the authority to compel or restrict certain actions of the Bank if it is determined to lack sufficient capital or other resources or is otherwise operating in a manner deemed to be inconsistent with safe and sound banking practices. Under this authority, the Bank’s regulators can require it to enter into informal or formal supervisory agreements, including board resolutions, memoranda of understanding, written agreements, and consent or cease and desist orders, pursuant to which the Bank would be required to take identified corrective actions to address cited concerns and refrain from taking certain actions.

Enforcement Powers of Regulators

As “institution-affiliated parties” of the Bank, we, our non-bank subsidiaries, and our management, employees, agents, independent contractors, and consultants are subject to potential civil and criminal penalties for violations of law, regulations, or written orders of a government agency. Violations can include failure to timely file required reports, filing false or misleading information, or submitting inaccurate reports. Civil penalties may be as high as $1,000,000 per day for such violations, and criminal penalties for some financial institution crimes may include imprisonment for 20 years. Regulators have flexibility to commence enforcement actions against institutions and institution-affiliated parties, and the FDIC has the authority to terminate deposit insurance. When issued by a banking agency, cease and desist and similar orders may, among other things, require affirmative action to correct any harm resulting from a violation or practice, including by compelling restitution, reimbursement, indemnification, or guarantees against loss. A financial institution may also be ordered to restrict its growth, dispose of certain assets, rescind agreements or contracts, or take other actions determined to be appropriate by the ordering agency. The federal banking regulators also may remove a director or officer from an insured depository institution (or bar them from the industry) if a violation is willful or reckless.

Standards for Safety and Soundness

The Federal Deposit Insurance Act requires the federal banking regulatory agencies such as the FDIC to prescribe, by regulation or guidance, operational and managerial standards for all insured depository institutions, such as the Bank, relating to internal controls, information systems and audit systems, loan documentation, credit underwriting, interest rate risk exposure, and asset quality. The agencies also must prescribe standards for earnings and stock valuation, as well as standards for compensation, fees, and benefits. The federal banking regulators have implemented these required standards through regulations and interagency guidance designed to identify and address problems at insured depository institutions before capital becomes impaired. Under the regulations, if a regulator determines a bank fails to meet any prescribed standards, the regulator may require the bank to submit an acceptable plan to achieve compliance, consistent with deadlines for the submission and review of such safety and soundness compliance plans.

Dividends and Share Repurchase Programs

The Bank is chartered under the laws of the State of Utah and its deposits are insured by the FDIC. The Bank’s ability to pay dividends is subject to the laws of Utah and the regulations of the FDIC. Generally, under Utah’s industrial bank laws and regulations as well as FDIC regulations, the Bank may pay dividends from its net profits without regulatory approval if, following the payment of the dividend, the Bank’s capital and surplus would not be impaired. The Company relies on dividends from the Bank, as necessary, to enable the Company to pay any declared dividends and other payments and consummate share repurchases, as described herein.

The Company pays quarterly cash dividends on its outstanding Floating-Rate Non-Cumulative Preferred Stock, Series B (the “Series B Preferred Stock”) when, as, and if declared by its Board of Directors, in the Board’s discretion. In January 2019, the Company initiated a new policy to pay a regular, quarterly cash dividend on its common stock as well, beginning in the first quarter of 2019, and its Board of Directors approved a common stock share repurchase program.

Common stock dividend declarations are subject to determination by, and the discretion of, the Company’s Board of Directors. The Company may change its common stock dividend policy at any time.

We expect that the Bank will pay dividends to the Company as may be necessary to enable the Company to pay any declared dividends on its Series B Preferred Stock and common stock and to consummate any common

16 SLM CORPORATION — 2025 Form 10-K

share repurchases by the Company under the Company’s share repurchase programs.

Our Board of Directors has authorized share repurchase programs during prior years, including a share repurchase program which was approved in January 2024 (for a program of up to $650 million of common stock). As of December 31, 2025, we had $33 million of capacity remaining under the 2024 Share Repurchase Program (as hereinafter defined). The 2024 Share Repurchase Program expired on February 6, 2026. On January 22, 2026, we announced a new share repurchase program (the “2026 Share Repurchase Program”), which became effective on January 22, 2026 and is expected to be completed over the next approximately 24 months ending on February 4, 2028. The 2026 Share Repurchase Program permits us to repurchase shares of our common stock from time to time in various transaction formats including, but not limited to, tender offers, open market purchases, accelerated share repurchases, negotiated or block purchases, and/ or pursuant to trading plans in accordance with Rules 10b5-1 and 10b-18 of the Securities and Exchange Act of 1934, as amended (the “Exchange Act”), up to an aggregate repurchase price not to exceed $500 million.

Under the share repurchase programs, purchases take place as and when we determine in open market or private transactions made based upon the market price of our common stock, the nature of other investment opportunities or growth projects, our cash flows from operations, and general economic conditions. The share repurchase programs do not require us to acquire any specific number of shares, and may be modified, suspended, extended, or terminated by us at any time. We repurchased 12.8 million and 11.6 million shares during the years ended December 31, 2025 and 2024, respectively. See Notes to the Consolidated Financial Statements, Note 13, “Stockholders’ Equity” in this Form 10-K for additional information.

Regulatory Capital Requirements

The Bank is subject to various regulatory capital requirements administered by the federal and state banking authorities. Failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a direct material adverse effect on our business, results of operations, and financial condition.

For more information on how the Bank manages its capital position, see Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Regulatory Capital – Capital Management.”

Stress Testing Requirements

The Bank is not currently subject to stress testing requirements under the Dodd-Frank Act. However, under regulatory guidance, the Bank still conducts annual capital stress tests, the results of which it presents to its prudential regulators - the FDIC and the UDFI - for their review. The Bank also conducts quarterly liquidity stress tests to evaluate the adequacy of its liquidity sources under various stress scenarios and provides the results to its Board of Directors. These results are submitted to the Bank’s prudential regulators at their request.

Deposit Insurance and Assessments

Deposits at the Bank are insured up to the applicable legal limits by the FDIC-administered Deposit Insurance Fund (the “DIF”), which is funded primarily by quarterly assessments on insured banks. A bank’s assessment base and assessment rate are determined each quarter.

The Bank’s insurance assessment base currently is its average consolidated total assets minus its average tangible equity during the assessment period. The Bank’s assessment rate is determined by the FDIC using a number of factors, including the results of supervisory evaluations, the Bank’s capital ratios and its financial condition, as well as the risk posed by the Bank to the DIF. Assessment rates for insured banks also are subject to adjustment depending on a number of factors, including significant holdings of brokered deposits in certain instances and the issuance or holding of certain types of debt.

2025 Form 10-K — SLM CORPORATION 17

Deposits

With respect to brokered deposits, an insured depository institution must be well capitalized under the prompt corrective action framework in order to accept, renew, or roll over such deposits without FDIC clearance. An adequately capitalized insured depository institution must obtain a waiver from the FDIC to accept, renew, or roll over brokered deposits. Undercapitalized insured depository institutions generally may not accept, renew, or roll over brokered deposits.”

Regulatory Examinations

The Bank currently undergoes regular on-site examinations by the Bank’s regulators, who examine for adherence to a range of legal and regulatory compliance responsibilities. A regulator conducting an examination has unfettered access to the books and records of the examined institution. The results of the examination are confidential. The cost of examinations may be assessed against the examined institution as the agency deems necessary or appropriate.

Source of Strength

Under the Dodd-Frank Act, we are required to serve as a source of financial strength to the Bank and to commit resources to support the Bank in circumstances when we might not do so absent the statutory requirement. Any loan by us to the Bank would be subordinate in right of payment to depositors and to certain other indebtedness of the Bank.

Community Reinvestment Act

The Community Reinvestment Act (the “CRA”) requires the FDIC to evaluate the record of the Bank in meeting the credit needs of its local community, including low- and moderate-income neighborhoods, consistent with the safe and sound operation of the institution. These evaluations are considered in evaluating mergers, acquisitions, and applications to open a branch or facility. Failure to adequately meet these criteria could result in additional requirements and limitations on the Bank. The Bank received a CRA rating of Outstanding on its most recent review.

Data Privacy and Data Security Laws and Regulations

The federal banking regulators, as required by the Gramm-Leach-Bliley Act (“GLBA”), have adopted regulations that limit the ability of banks and other financial institutions to disclose nonpublic information about consumers to unaffiliated third parties. Financial institutions are required to disclose to consumers their policies for collecting and protecting confidential customer information. Customers generally may prevent financial institutions from sharing nonpublic personal information with unaffiliated third parties, with some exceptions. The privacy regulations also restrict information sharing among affiliates for marketing purposes and govern the use and provision of information to consumer reporting agencies. For example, we are subject the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices (including with respect to data privacy and data security). The CCPA and CPRA contain several exemptions, including an exemption applicable to information that is collected, processed, sold, or disclosed pursuant to the GLBA. However, the definition of personal information is expanded under the California statutes to apply to certain data

18 SLM CORPORATION — 2025 Form 10-K

beyond the scope of the GLBA exemption. Further, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach. Misuse of or failure to secure certain personal information could result in violation of data privacy or data security laws and regulations, proceedings against the Company by governmental entities or others, damage to our reputation and credibility, and could negatively affect our business, financial condition, and results of operations. If other states in the U.S. adopt similar laws or if a comprehensive federal data privacy or data security law is enacted, or if regulators whose authority we are subject to adopt additional or amend existing data privacy or data security regulations, we may expend considerable additional resources to meet these requirements and the overall risk to the Company could incrementally increase depending upon the reach and application of any such laws or regulations.

State Regulation of Student Loan Lenders, Holders, and Servicers

In certain states, laws regulating the conduct of student loan lenders, holders, and servicers may apply to and impact the origination, holding, and servicing practices of the Bank and/or other Company subsidiaries. While these state laws vary in content, they generally include components relating to licensure and oversight by state authorities and the creation of specialized student loan ombudsman offices to oversee the student loan industry operating within these states. Notably, these laws often include provisions for enforcement of alleged violations by state regulators as well as private litigation by aggrieved consumers.

Other Sources of Regulation

Many other aspects of our businesses are subject to federal and state regulation and administrative oversight. Some of the most significant of these are described below.

Oversight of Derivatives

Title VII of the Dodd-Frank Act requires certain standardized derivatives, including most interest rate swaps, to be submitted for clearing to central intermediaries to reduce counterparty risk. Two of the central intermediaries we use are the Chicago Mercantile Exchange (the “CME”) and the London Clearing House (the “LCH”). All variation margin payments on derivatives cleared through the CME and LCH are required to be accounted for as legal settlement. As of December 31, 2025, $562 million notional of our derivative contracts were cleared on the CME and $11 million were cleared on the LCH. When there is a net negative exposure, we consider our exposure to the counterparty to be zero.

Credit Risk Retention

The Dodd-Frank risk retention rules generally require sponsors of ABS, such as Sallie Mae, to retain an economic interest in an ABS transaction that represents at least five percent of the credit risk of the assets being securitized. We early adopted the Dodd-Frank risk retention rules beginning with our 2016-A securitization transaction completed in May 2016. For our 2016-A transaction and subsequent securitizations that are treated as on-balance sheet, we comply with the Dodd-Frank risk retention rules by retaining (for a requisite period of time) an “eligible horizontal residual interest” comprised of residual certificates representing at least five percent of the fair value of all ABS interests issued in the securitization transaction, determined as of the date of transfer.

2025 Form 10-K — SLM CORPORATION 19

Anti-Money Laundering, the USA PATRIOT Act, and U.S. Economic Sanctions

The Bank is subject to the reporting and recordkeeping requirements of the Bank Secrecy Act (“BSA”) and its implementing regulations. The BSA was amended by the USA PATRIOT Act of 2001, which substantially broadened the scope of United States anti-money laundering laws and regulations by imposing significant new compliance and obligations, creating new crimes and penalties, and expanding the extra-territorial jurisdiction of the United States. The U.S. Treasury Department and federal banking regulators have issued a number of regulations that apply various requirements of the BSA to financial institutions such as the Bank. The BSA and its implementing regulations impose obligations on financial institutions to, among other things, maintain internal policies, procedures, and controls to detect, prevent and report money laundering and terrorist financing and to maintain programs to verify the identity of their customers, among other requirements. In addition, U.S. law generally prohibits or substantially restricts U.S. persons from doing business with countries and territories that are the subject of comprehensive territorial sanctions imposed by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) or with persons that are the subject of sanctions administered by OFAC or other agencies. OFAC sanctions programs also impose other restrictions on certain investments and dealings. We maintain policies and procedures designed to ensure compliance with relevant U.S. laws and regulations applicable to U.S. persons, including the BSA, as amended, and its implementing regulations and U.S. economic sanctions.

Volcker Rule

The “Volcker Rule” provisions of the Dodd-Frank Act are implemented by rules issued by the U.S. banking agencies, the SEC, and the U.S. Commodity Futures Trading Commission that prohibit insured depository institutions and their affiliates from engaging in proprietary trading and from investing in, sponsoring, or having certain financial relationships with, certain private funds. These prohibitions are subject to a number of important exclusions and exemptions that, for example, permit insured depository institutions and their affiliates to trade for risk-mitigating hedging and liquidity management, subject to certain conditions and restrictions. The Volcker Rule does not have a meaningful effect on our current operations or those of our subsidiaries, as we do not materially engage in the businesses prohibited by the Volcker Rule.

Human Capital Resources and Talent Development

We believe in a mission-led culture that inspires commitment and drives performance. Our human capital strategy is focused on the attraction, development, empowerment, recognition, and rewarding of team members as they bring our mission to life.

As of December 31, 2025, we had approximately 1,788 team members, all located in the United States. We believe an engaged workforce leads to a more innovative, productive, and profitable company. For this reason, we measure employee engagement through culture surveys. These culture surveys provide insights we use to create an environment in which team members thrive and bring their full selves to work.

We strive to create a culture of belonging — an environment that encourages and reinforces mutual trust, makes it safe to express thoughts, ideas and concerns, and connects and embraces all backgrounds and perspectives to power and fuel our mission. We believe in paying competitive market wages, and our benefits package includes Company contributions to the 401(k), educational assistance to our team members and their dependents, flexible work arrangements, and other comprehensive health and welfare programs.

We have made significant investments in learning and talent development, and provide team members with the tools and resources necessary to support their success and drive performance of the Company.

Our team members are involved in the communities in which they live and work through the Sallie Mae Employee Volunteer Program and the Sallie Mae Employee Matching Gift Program. We also provide matching gifts for team members to support their interests and needs and those of their communities.

20 SLM CORPORATION — 2025 Form 10-K

Item 1A. Risk Factors

SUMMARY OF RISK FACTORS

Below is a summary of the principal factors that make an investment in our securities risky. This summary does not address all of the risks that we face. Additional discussion of the risks summarized in this risk factor summary, and other risks that we face, can be found below and should be carefully considered, together with other information in this Form 10-K and our other filings with the SEC, before making an investment decision regarding our securities.

•Our core product offerings are concentrated in Private Education Loan products and services.

•Consumer access to alternative means of financing the costs of education and other factors may reduce demand for, or adversely affect our ability to retain, Private Education Loans, which could have a material adverse effect on us.

•Consolidation or refinancing of existing Private Education Loans could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

•Our deposit funding base is primarily concentrated in online deposit products, including high-yield savings accounts, money market accounts, and certificates of deposit.

•A deterioration in economic or macroeconomic conditions, or instability in the macroeconomic environment, could have a material adverse effect on our business, financial condition, and/or results of operations.

•Defaults on our loans could adversely affect our business, financial condition, results of operations, and/or cash flows.

•Our allowance for credit losses may not be adequate to cover actual losses in all possible scenarios, and we may be required to materially increase our allowance, which may adversely affect our capital, financial condition, and/or results of operations.

•We are subject to the creditworthiness of third parties other than borrowers and exposure to those third parties could adversely affect our business, financial condition, results of operations, and/or cash flows.

•The levels of or changes in interest rates could adversely affect our results of operations, financial condition, regulatory capital, and/or liquidity.

•The interest rate and maturity characteristics of our earning assets do not fully match the interest rate and maturity characteristics of our funding arrangements, which may negatively impact the level of our net interest income.

•We are subject to repayment and prepayment risks, which can increase uncertainty and adversely affect our business, financial condition, results of operations, and/or cash flows.

•Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings.

•Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and sell loans at attractive prices to help fund share repurchase programs and other activities. An inability to effectively manage our liquidity could have a material adverse effect on us.

•In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties. If those liabilities are significant, they could adversely affect our business and financial condition.

•Adverse developments, and/or a continuation of recent turmoil, in the financial services industry could adversely affect our financial condition and results of operations.

•The Bank is subject to various regulatory capital requirements, and failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on us.

2025 Form 10-K — SLM CORPORATION 21

•Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect us.

•Changes in accounting standards, or incorrect estimates and assumptions by management in connection with the preparation of our consolidated financial statements, could adversely affect us.

•We operate in a highly regulated environment and the laws and regulations that govern our operations, or changes in these laws and regulations, or our failure to comply with them, may adversely affect us.

•Failure to comply with consumer protection, privacy, data protection, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business.

•Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss in all possible scenarios and, if the framework is ineffective, could have a material adverse effect on us.

•Proposals of federal and state governments, or of various political officials or candidates, affecting the student loan industry in particular, subject us to political risk and could have a material adverse impact on us.

•We are subject to reputational and other risks, which could damage our brand and have a material adverse impact on us.

•Failure or significant interruption of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action or litigation, or damage our reputation.

•We could lose market share if we are not able to keep pace with rapid changes in technology (including AI).

•We depend on secure information technology and a breach of those systems or those of third-party vendors could materially adversely affect us and lead to significant financial, legal, and reputational exposure.

•We depend significantly on third parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third parties, could disrupt our business.

•We may face risks from our operations related to litigation or regulatory or supervisory actions that could result in significant legal expenses and settlement or damage awards.

•Our internal controls over financial reporting and disclosure controls, as well as other internal controls, may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations.

•Our business operations and those of our third-party vendors may be adversely impacted by unpredictable catastrophic events.

•New lines of business, strategic partnerships, and/or initiatives and our ability to successfully begin or make new acquisitions, strategic partnerships, and/or initiatives are subject to significant risks.

•Our origination expansion initiative and strategic partnership funding model are new and untested and may expose us to a broad range of potential risks.

•We may have exposure to risks related to the Spin-Off, indemnification claims, and/or Navient’s creditworthiness.

•

•We may be limited in our ability to receive dividends from the Bank, pay dividends on and repurchase our common stock, and make payments on our corporate debt.

•Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees.

22 SLM CORPORATION — 2025 Form 10-K

RISK FACTORS

We face many risks and uncertainties, any one or more of which could have a material adverse effect on our business, financial condition (including capital and liquidity), results of operations, cash flows, and/or stock price.

CONCENTRATION & COMPETITIVE RISK

Our core product offerings are primarily concentrated in Private Education Loan products and services.

Our core product offerings are primarily concentrated in loan products for higher education, specifically Private Education Loans. This concentration poses the risk that any disruption, dislocation, significant adverse legislative or regulatory change, or other negative event or trend in the Private Education Loan market, the overall education loan market, the higher education market, or the overall economic environment—including an inflationary and rising or high interest rate environment or a recession in the U.S.—could disproportionately and adversely affect our business, financial condition, and results of operations.

We compete with financial technology (“FinTech”) companies, banks, digital asset service providers, and other consumer lending institutions. Certain of these competitors have lower return hurdles than more traditional consumer lending institutions, and some may have greater financial resources or more diversified asset portfolios, which could enable them to be more competitive in their products and offerings. The emergence, adoption, and evolution of new technologies and advances in robotic process automation and AI could significantly affect the competition for Private Education Loans. Growth in these alternative distribution channels could diminish the effectiveness of our more traditional lending channels and increase our cost to originate Private Education Loans.

The federal government, through the Federal Direct Student Loan Program and other higher education lending programs, also poses significant competition to our Private Education Loan products. The availability and terms of loans the government originates or guarantees affect the demand for Private Education Loans because students and their families often rely on Private Education Loans to bridge the gap between available funds, including family savings, scholarships, grants, and federal and state loans, and the costs of post-secondary education. The federal government currently places both annual and aggregate limits on the amount of federal loans any student can receive and determines the criteria for student eligibility. These federal education lending programs are generally adjusted in connection with funding authorizations from the U.S. Congress for programs under the Higher Education Act of 1965 (the “HEA”). However, the passage of H.R. 1 in July 2025 introduced significant changes to federal student loan programs that are expected to reduce the federal government’s borrowing capacity for graduate and professional students, creating substantial funding gaps for borrowers and shifting demand to Private Education Loans or other alternatives, particularly for students in high-cost educational programs. The impacts of H.R.1’s changes may result in increased risk of competition and market disruptions, borrower affordability challenges, and potential reputational considerations for private student loan lenders. Future legislative changes, amendments, or rulemakings related to or impacting the HEA, the Federal Direct Student Loan Program, H.R.1, and/or other government efforts to provide relief for borrowers of student loans in general, could provide a legislative vehicle for additional changes to student loan programs. Possible components that could impact the Private Education Loan market and our business include changes to federal education loan limits and/or payment requirements, or private loan refinancing programs.

Moreover, given H.R. 1’s changes to government-supported higher education funding and repayment plans, and the current federal administration’s deregulatory posture, we expect that our competition will increase as various lending institutions, FinTechs, and other competitors enter or re-enter the Private Education Loan market with the intent of disrupting and/or capturing newly created or existing market share (including through new student loan offerings or refinancing of existing loans). We compete based on our brand, products, origination capability,

2025 Form 10-K — SLM CORPORATION 23

institutional relationships, student loan industry and underwriting expertise, and customer service.R. 1, or offer new, novel, or more successful products or services, we could lose market share to them and/or our existing loans could be subject to consolidation or refinancing risk.

Consumer access to alternative means of financing the costs of education and other factors may reduce demand for, or adversely affect our ability to retain, Private Education Loans, which could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

The demand for Private Education Loans could weaken if families and student borrowers use other vehicles to bridge the gap between available funds and costs of post-secondary education. These vehicles include, among others:

•Home equity loans or other borrowings available to families to finance their education costs;

•Pre-paid tuition plans, which allow students to pay tuition at today’s rates to cover tuition costs in the future;

•Section 529 plans, which include both pre-paid tuition plans and college savings plans that allow a family to save funds on a tax-advantaged basis;

•Education IRAs, now known as Coverdell Education Savings Accounts, under which a holder can make annual contributions for education savings;

•Government education loan programs;

•Direct loans from colleges and universities, as well as income sharing agreements offered by schools and facilitated by private companies;

•Employer-sponsored tuition reimbursement or education benefit programs;

•Alternative credentialing, online education, and non-degree programs; and

•“Buy now, pay later” or other FinTech-driven tuition payment models.

In addition, our ability to grow Private Education Loan originations and retain assets at our planned levels could be negatively affected if:

•Demographic trends in the United States result in a decrease in college-age individuals;

•Demand for higher education decreases (which can occur, among other times, during periods of strong employment in the United States, due to decreased interest or access to U.S. higher education by international students, and/or when fewer employers require college degrees for their employees (including as a result of changes to macroeconomic conditions, workforce needs, and/or changes in technology and AI));

•The cost of attendance of higher education decreases;

•Consumers increase their targeted savings for higher education;

•Prepayment rates on our Private Education Loans increase or accelerate due to greater market liquidity, availability of alternative means of financing, improved household incomes, increasing consumer confidence, and/or various other factors;

•State or federal initiatives for tuition-free or debt-free college;

•Negative media or political attention on private student lending;

•There is broader public resistance to increasing higher education costs; or

•Proposals for new federal and state education spending described below in “—POLITICAL/REPUTATIONAL RISK” gain broader appeal or momentum.

In addition, other macroeconomic factors such as high unemployment, recession, inflation, stagflation, wars, trade wars, or tariffs may also negatively impact loan applicants’ or borrowers’ ability to meet our credit standards or repay credit obligations. See “—MACROECONOMIC RISK—A deterioration in economic or macroeconomic

24 SLM CORPORATION — 2025 Form 10-K

conditions, or instability in the macroeconomic environment, could have a material adverse effect on our business, financial condition, and/or results of operations.”

Consolidation or refinancing of existing Private Education Loans could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

We believe the design of our Private Education Loan products, with emphasis on rigorous underwriting, credit-worthy cosigners and variable or fixed interest rates, creates sustainable, competitive loan products. However, increasing amounts of private education consolidation loans at interest rates below those of our existing portfolio - whether from private sources (including FinTech companies) or otherwise - can contribute to an increase in the prepayment rates of our existing Private Education Loans and, if prolonged and continuous, could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows. Increases in consolidation loans may result from competition, as there has been, and there may continue to be, an increase in the number of lenders offering consolidation or refinancing products.

Our deposit funding base is primarily concentrated in online deposit products, including high-yield savings accounts, money market accounts, and certificates of deposit.

We expect to compete based primarily on a combination of reputation, rate, and availability of information about our deposit products. Our competitors, many of whom have greater financial resources or lower costs than we do, may be more effective in attracting new deposits and retaining existing deposits such as by offering more competitive rates, dedicating more resources for advertising, or engaging in more effective forms of marketing. For instance, our new depositor acquisition marketing is partly dependent on search engines, as well as bank deposit information aggregators, to direct a significant amount of traffic to our website via organic ranking and paid search advertising. In addition, changes to search engines and deposit information aggregators’ methodologies and business practices could result in a decline in our new deposit growth or existing customer retention.

Additionally, competition has increased from institutions not subject to the same regulatory restrictions as domestic banks and bank holding companies, including FinTech companies that may offer bank-like products or services that compete directly with our deposit products and services or that offer other types of cash management products, such as stablecoins, non-fungible tokens, digital currencies, and cryptocurrencies. Increased competition for deposits could cause our cost of funds to increase, which could negatively impact our loan pricing and net interest margin. For example, the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (GENIUS Act) provides a legal framework for stablecoins to be issued in the United States, which may allow new and existing competitors to compete for funds that may have otherwise been deposited with banks, such as the Bank. See also “—LIQUIDITY RISK” in this Item 1A.

MACROECONOMIC RISK

A deterioration in economic or macroeconomic conditions, or instability in the macroeconomic environment, could have a material adverse effect on our business, financial condition, and/or results of operations.

A prolonged period of economic weakness, volatility, slow growth, or a deterioration in macroeconomic conditions in the United States and/or globally could result in higher loan defaults, increased net charge-offs, changes to our provision for credit losses, lower deposit levels or deposit demand, liquidity issues, and/ or reduced demand for new labor, higher education, higher education products, and/or private student loans, which could have a material adverse effect on our financial condition and results of operations.

A number of factors could disrupt capital markets, reduce consumer and market sentiment, business activity, demand for or funding of higher education, and weaken the labor market, including, but not limited to:

2025 Form 10-K — SLM CORPORATION 25

•Monetary policy actions, such as changes to interest rates by the Federal Reserve or other central banks, and increases in the U.S. fiscal deficit or debt-to-GDP ratio;

•Fiscal policy actions, including changes to applicable tax codes, at both the federal and state level;

•Geopolitical conflicts or instabilities, such as wars, or increased tensions between major economies, or changes to immigration and visa policies;

•Trade wars, tariffs, labor shortages, and disruptions of global supply chains;

•U.S. government stalemates, which may lead to government shutdowns, developments related to the federal debt ceiling, or credit-rating downgrades;

•Inflation or deflation, and the effects of related governmental responses;

•Concerns over a potential recession or a recession, which may lead to changes in consumer and business spending patterns, credit risks, and liquidity concerns;

•Technology-driven disruption of certain industries, including those resulting from advances in AI, robotics, and digital assets;

•Lower demand for higher education caused by shifts in demographics, the labor market, technology-driven disruption and AI, reduced education funding, reduced access to higher education providers, and decreased immigration or access to student visas; and

•Shifts in consumer behavior, including changes in deposit practices and payment patterns.

Decreases in overall business activity, sudden and/or unexpected changes in economic or macroeconomic conditions, and changes in customer behavior may lead to increases in our charge-off rates, reduce our ability to recover previously charged-off debt, and decrease the reliability of our internal processes and models, including those used to estimate our allowance for credit losses and higher education demand projections. Unexpected variations in key inputs and assumptions may cause actual losses to diverge from model projections, increasing reliance on management’s judgment and potentially resulting in adverse impacts to our financial results. See also “—CREDIT RISK”, “—INTEREST RATE RISK”, and “—LIQUIDITY RISK” in this Item 1A.

CREDIT RISK

Defaults on our Private Education Loans could adversely affect our business, financial condition, results of operations, and/or cash flows.

If those loans were to default at rates much higher than anticipated or at speeds faster than anticipated, our business, financial condition, results of operations, and/or cash flows could be adversely affected. Delinquencies are an important indicator of the potential future credit performance of our loan portfolio.

Rising unemployment rates and the failure of our in-school borrowers to graduate are two of the most significant macroeconomic factors that could increase loan delinquencies, defaults, and loan modifications, or otherwise negatively affect performance of our existing education loan portfolio, as such factors may cause borrowers and cosigners to experience trouble repaying credit obligations or meeting our credit standards. The impact of these factors may be heightened in rising or high-interest rate environments when interest rates rise causing payments on variable-rate loans to increase. See Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Financial Condition — Allowance for Credit Losses — Use of Forbearance and Modifications as a Private Education Loan Collection Tool” for a discussion of how items such as changes in credit administration practices can impact the timing and level of delinquencies and defaults on our

26 SLM CORPORATION — 2025 Form 10-K

loans. As part of our underwriting process, we rely heavily upon information supplied by applicants and third parties. If any of this information is intentionally or negligently misrepresented, or is inaccurate, and is not detected by us before completing the transaction, or changes after we collect the information, we may experience increased credit risk. Higher credit-related losses and weaker credit quality negatively affect our business, financial condition, and results of operations and limit funding options, which could also adversely impact our liquidity position. Our Private Education Loan (held for investment) delinquencies (loans greater than 30 days past due), as a percentage of Private Education Loans (held for investment) in repayment, were 4.00 percent at December 31, 2025.

Our allowance for credit losses may not be adequate to cover actual losses in all possible scenarios, and we may be required to materially increase our allowance, which may adversely affect our capital, financial condition, and/or results of operations.

We are required to measure our allowance for credit losses based on our estimate of all current expected credit losses over the remaining contractual term of our assets. The evaluation of our allowance for credit losses is inherently subjective, as it requires material estimates that may be subject to significant changes. The measurement of expected credit losses is based on historical information, current conditions, and reasonable and supportable forecasts to estimate the expected loss over the life of the loan. Our models take into account historical loss experience in various economic conditions to estimate expected future losses based upon future economic forecasts over a period of time (“reasonable and supportable period”), at which point we immediately revert our forecasted economic factors to long-term historical loss conditions. Defaults can be higher than anticipated due to a variety of factors, and our models may not accurately estimate future loan loss performance. The models used in calculating our CECL estimates include forecasts of future economic conditions, the weighting of economic forecasts, prepayment speeds, and recovery rates. If these forecasts prove to be inaccurate, or our models were not designed properly, our allowance for credit losses may not be sufficient to cover future losses, which could negatively impact our financial condition, results of operations, and capital levels. In addition, the amount of losses recorded under CECL is very sensitive to the inputs described above. As such, changes to these inputs could significantly change the amount of allowance necessary, which could have a negative impact on our financial results and capital levels. If these differences in judgment are significant, our allowance could increase significantly and result in sizable decreases in our net income and capital. See Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Estimates — Allowance for Credit Losses” for further details regarding our allowance for credit losses.

We are subject to the creditworthiness of third parties other than borrowers and exposure to those third parties could adversely affect our business, financial condition, results of operations, and/or cash flows.

We are also subject to the creditworthiness of third parties, including various lending, securitization, strategic partnership, investment, and derivative counterparties. Our overall counterparty exposure is more fully discussed in Part II, Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources — Counterparty Exposure.” If our counterparties are unable to perform their obligations, or the ability of our counterparties to perform their obligations becomes impaired or less certain, the obligations of our counterparties to us or our investments in any counterparties or their securities could become impaired, which could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows.

INTEREST RATE RISK

The levels of or changes in interest rates could adversely affect our results of operations, financial condition, regulatory capital, and/or liquidity.

We are highly dependent on net interest income, which is the difference between interest income on earning assets (such as loans and investments) and interest expense on deposits and borrowings. Net interest income is significantly affected by market rates of interest, which in turn are influenced by monetary and fiscal policies of governmental agencies, general economic conditions, conditions in the capital markets, the political and regulatory environments, business and consumer sentiment, competitive pressures, and expectations about the future. We

2025 Form 10-K — SLM CORPORATION 27

may be adversely affected by policies or events that have the effect of flattening or inverting the yield curve (that is, the difference between long-term and short-term interest rates), compressing interest rates on our earnings assets closer to interest rates on our deposits and borrowings, increasing the volatility of market rates of interest, or changing the spreads among different interest rate indices. Changes in interest rate levels also can lead to other adverse impacts, such as reducing the demand for or increasing the prepayment speeds of our Private Education Loans, increasing the delinquencies or defaults of our borrowers or other counterparties, reducing the value of our assets, or increasing our liabilities. Many of these adverse impacts can occur in an inflationary and/or rising interest rate environment. These adverse impacts may materially adversely affect our operations, our regulatory capital and liquidity position, the credit performance of our Private Education Loans and other assets, the number of borrowers seeking payment relief, our results of operations and financial condition, and/or our cash flows. The level of and changes in market rates of interest and, as a result, these risks and uncertainties, are beyond our control.

The interest rate and maturity characteristics of our earning assets do not fully match the interest rate and maturity characteristics of our funding arrangements, which may negatively impact the level of our net interest income.

Net interest income is the primary source of cash flow generated by our loan portfolio. ABS funding closely mirrors the expected maturities of our education loans and provides a combination of fixed and variable-rate funding. Deposits are issued with both fixed and variable rates, and the average term is typically shorter than the expected term of our loan portfolio.

The different interest rate and maturity characteristics of our loan portfolio and the liabilities funding the portfolio result in fluctuations in our net interest income. In certain interest rate environments, this mismatch may reduce our net interest margin (the interest yield earned on our portfolio less the rate paid on our interest-bearing liabilities) and net interest income. While we actively monitor and manage mismatches in the interest rate and maturity characteristics of our assets and liabilities, using derivative transactions where necessary to avoid excessive levels of repricing and refunding risk, it is not possible to hedge all of our exposure to such risks. In these circumstances, our earnings could be materially adversely affected.

Consolidations and refinancings contribute to increased prepayment rates. In addition, increases in employment levels, wages, family income, alternative sources of financing, and government support for student loan borrowers or the forgiveness for certain borrowers of federal student loan indebtedness, may also contribute to higher-than-expected prepayment rates, which can adversely affect our interest rate and repricing risk and our financial condition and results of operations.

Our use of derivatives to manage interest rate sensitivity exposes us to credit and market risk that could have a material adverse effect on our earnings.

We maintain an overall interest rate strategy that uses derivatives to reduce the economic effect of interest rate changes. Developing an effective hedging strategy for dealing with movements in interest rates is complex, and no strategy can completely avoid the risks associated with these fluctuations. In addition, some of our interest rate risk management activities expose us to mark-to-market losses if interest rates move in a materially different way than was expected when we entered into the related derivative contracts.

Our use of derivatives also exposes us to market risk and credit risk. Market risk is the chance of financial loss resulting from changes in interest rates and market liquidity. Some of the interest rate swaps we use to economically hedge interest rate risk between our assets and liabilities do not qualify for hedge accounting treatment. Therefore, the change in fair value, called the “mark-to-market,” of the swaps that do not qualify as accounting hedges is included in our statement of income. A decline in the fair value of those derivatives could have a material adverse effect on our reported earnings. See also “— CREDIT RISK — We are subject to the

28 SLM CORPORATION — 2025 Form 10-K

creditworthiness of third parties other than borrowers and exposure to those third parties could adversely affect our business, financial condition, results of operations, and/or cash flows” in this Item 1A.

LIQUIDITY RISK

Our ability to achieve our business goals will be heavily reliant on our ability to obtain deposits, obtain funding through asset-backed securitizations, and sell loans at attractive prices. An inability to effectively manage our liquidity could negatively impact our ability to fund our business obligations and opportunities, which could lead to regulatory scrutiny and could have a material adverse effect on our business, financial condition, results of operations, and/or cash flows.

We must effectively manage the liquidity risk inherent in our business. We require liquidity to meet cash requirements for such things as day-to-day operating expenses, funding of our Private Education Loan originations, deposit withdrawals and maturities, payment of any declared dividends on our preferred stock and common stock, payment of our debt service, and payment for any shares of common stock or preferred stock acquired under any stock repurchase program or otherwise. We may maintain too much liquidity, which can be costly, or we may be too illiquid, which could result in financial distress during times of economic stress or capital market disruptions.

We fund Private Education Loan originations through asset-backed securitizations and deposits raised by the Bank, including term and liquid brokered and retail deposits, as well as Educational 529 and Health Savings Account deposits, and with proceeds received from loan sales. Assets funded through deposits result in refinancing risk because the average term of the deposits is shorter than the expected term of the Private Education Loan assets we originate. The significant competition for deposits from other banking organizations, new FinTech companies, or other types of cash management products, such as digital wallets, non-fungible tokens and digital currencies and cryptocurrencies (including stablecoins), which are also seeking stable deposits to support their funding needs, may affect deposit renewal rates, costs, or availability. Brokered deposits may be more price sensitive than other types of deposits and may become less available if alternative investments offer higher returns. In addition, our ability to maintain existing balances of all deposit types or obtain additional deposits of any type may be affected by factors, including those beyond our control, such as a rising stock market, more attractive returns on alternative investments, perceptions about our existing and future financial strength, quality of deposit servicing or online banking generally, changes in monetary or fiscal policies that influence deposit or other rates, general economic conditions, including high unemployment and decreased savings rates, and adverse developments in the financial services industry generally. Also, our ability to maintain our current level of deposits or grow our deposit base could be affected by regulatory restrictions, including the possible imposition by our regulators of prior approval requirements or restrictions on our offered rates, brokered deposit growth, or other areas.

Our success also depends on our ability to structure Private Education Loan securitizations or execute other secured funding transactions. Several factors may have a material adverse effect on both our ability to obtain such funding and the time it takes us to structure and execute these transactions, including the following:

•Persistent and prolonged disruption or volatility in the capital markets (which could occur as a result of, among other things, general economic conditions, a government debt default, or a government shutdown) or in the education loan ABS sector specifically;

•Degradation of the credit quality or performance of the Private Education Loans we sell or finance through securitization trusts, or adverse rating agency assumptions, rating actions, or conclusions with respect to those trusts or the education loan-backed securitization trusts sponsored by other issuers;

•A material breach of our obligations to purchasers of our Private Education Loans, including securitization trusts;

•The timing, pricing, and size of education loan asset-backed securitizations other parties issue, or the adverse performance of, or other problems with, such securitizations;

2025 Form 10-K — SLM CORPORATION 29

•Challenges to the enforceability of Private Education Loans based on violations of, or changes to, federal or state consumer protection or licensing laws and related regulations, or imposition of penalties or liabilities on assignees of Private Education Loans for violation of such laws and regulations; and

•Our inability to structure and gain market acceptance for new product features or services to meet new demands of ABS investors, rating agencies, or credit facility providers.

Future downgrades to our credit ratings, or to the credit ratings of our subsidiaries or to the securities issued in our securitization transactions, also could result in higher funding costs and reduce our net interest margin.

Our ability to sell loans at attractive prices, as well as the timing and volume of any sales, will be subject to market conditions and competitive purchasers, and there can be no guarantee that we will be able to effectuate planned or unplanned loan sales at the prices, times, or volumes we desire, or at all. If we are unable to effectuate loan sales at the prices, times, and volumes we desire, we may not be able to fund share repurchase programs that are authorized from time to time, originate Private Education Loans in the volumes we desire, meet other obligations, or achieve other business goals.

Several factors, some of which may be beyond our control, may have a material adverse effect on our ability to raise funding at any given time through any of the channels described above in this Risk Factor in the amounts, at the rates, or within the timeframes we desire or need. If this occurs, our business, results of operations, financial position, and/or cash flows could be materially and adversely affected.

We conduct quarterly liquidity stress tests to evaluate the adequacy of our liquidity sources under several stress scenarios, including a severely adverse macroeconomic scenario.

In structuring and facilitating securitizations or sales of Private Education Loans, administering securitization trusts, or servicing loans we have securitized or sold, we may incur liabilities to transaction parties. If those liabilities are significant, they could adversely affect our business, financial condition, results of operations, and/or cash flows.

Under applicable state and federal securities laws, if investors incur losses as a result of purchasing ABS issued in connection with our securitization transactions, we could be deemed responsible and could be liable to investors for damages. We could also be liable to investors or other parties for certain updated performance information that we may provide subsequent to the original issuances. If any of those liabilities are significant, they could adversely affect our business, financial condition, results of operations, and/or cash flows.

Adverse developments, and/or a continuation of recent turmoil, in the financial services industry could adversely affect our financial condition and results of operations.

In the past few years, several financial services institutions failed or required outside liquidity support. The impact of these failures led to risk of additional stress to the financial services industry generally as a result of increased lack of confidence in the financial sector. Significant, unanticipated deposit withdrawals due to market distress or otherwise or our inability to access other sources of liquidity, whether due to capital markets dislocations or otherwise, could result in constraints on our liquidity and adversely affect our business, financial condition, and results of operations.

30 SLM CORPORATION — 2025 Form 10-K

The financial system is highly interrelated, and we have exposure to, and routinely execute transactions with, a variety of financial institutions.

CAPITAL RISK

The Bank is subject to various regulatory capital requirements administered by the FDIC and the UDFI. Failure to meet minimum capital requirements can initiate certain mandatory and possibly additional discretionary actions by regulators that, if undertaken, could have a material adverse effect on our business, results of operations, and/or financial condition.

Under the FDIC’s regulations implementing the Basel III capital framework (“U.S. Basel III”) and the regulatory framework for prompt corrective action, the Bank must meet specific capital standards that involve quantitative measures of its assets, liabilities, and certain off-balance sheet items as calculated under regulatory accounting practices. The Bank’s capital adequacy and its classification under the prompt corrective action framework are also subject to qualitative judgments by the regulators about components of capital, risk weightings, and other factors.

If the Bank fails to satisfy regulatory risk-based or leverage capital requirements, it would be subject to serious regulatory consequences, including restrictions on the ability to make dividend payments or share repurchases, that could prevent us from successfully executing our business plan and may have a material adverse effect on our business, results of operations, financial position, and/or cash flows. See Item 7. “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Regulatory Capital.”

Unfavorable results from the periodic stress scenarios we model under regulatory guidance may adversely affect our business and result in regulatory action that could adversely affect our cost of capital and liquidity position.

Pursuant to regulatory guidance, the Bank conducts annual capital stress tests, modeling a systemic stress scenario. In addition, the Bank may model company-specific stress scenarios from time to time. In 2025, the Bank conducted its annual capital stress tests and the results of these tests were presented to and reviewed by the Bank’s senior management, the Bank’s Board of Directors, and the Board’s Financial Risk Committee. In addition, the Bank made the results of the stress tests (its current business forecast) available to its prudential regulators - the FDIC and the UDFI. Generally, the stress test results include certain measures that evaluate the Bank’s ability to absorb losses in severely adverse economic and financial conditions. On the basis of a stress analysis, senior management may elect to adjust its business plans or capital targets to reduce risks identified by the analysis. Our regulators may also require the Bank to raise additional capital or take other actions, or may impose restrictions on our business, based on the results of the stress tests. We may not be able to raise additional capital if required to do so or may not be able to do so on terms that are advantageous to us. Any such capital raises, if required, may also be dilutive to our existing stockholders. Our regulators may also update their supervisory expectations applicable to the Bank’s stress tests, which could change how the Bank conducts stress tests or how senior management uses the results of the stress tests to inform business plans and capital targets.

Changes in accounting standards, or incorrect estimates and assumptions by management in connection with the preparation of our consolidated financial statements, could adversely affect our capital levels, results of operations, and/or financial condition.

We are subject to the requirements of entities that set and interpret the accounting standards governing the preparation of our financial statements and other financial reports. These entities, which include the Financial Accounting Standards Board (the “FASB”), the SEC, and banking regulators, may add new requirements or change their interpretations of how those standards should be applied. Changes in our accounting policies or in accounting standards could materially affect how we report our financial condition and/or results of operations. As a result of changes to financial accounting or reporting standards, whether promulgated or required by the FASB or other regulators, we could be required to change certain of the assumptions or estimates we have previously used in preparing our financial statements, which could negatively impact how we record and report our financial condition, results of operations, and capital levels.

The preparation of our consolidated financial statements requires us to make critical accounting estimates and assumptions that affect the reported amounts of assets, liabilities, income, and expenses during the reporting

2025 Form 10-K — SLM CORPORATION 31

periods. Incorrect estimates and assumptions by us in connection with the preparation of our consolidated financial statements could adversely affect the reported amounts of assets, liabilities, income, and expenses.”

REGULATORY RISK

We operate in a highly regulated environment and the laws and regulations that govern our operations, or changes in these laws and regulations, or our failure to comply with them, may adversely affect us.

We are subject to extensive regulation and supervision that govern almost all aspects of our operations. Intended to protect clients, depositors, the DIF, and the overall financial system, these laws, regulations, and supervisory actions may, among other matters:

•increase minimum capital requirements;

•reclassify the types of assets we hold for regulatory capital purposes, including for risk-weightings;

•limit the rates of growth of our business;

•impose limitations on the business activities in which we can engage;

•limit the dividends or distributions the Bank can pay to us;

•limit share repurchases;

•restrict the payment of discretionary bonuses to executive officers;

•restrict the ability of institutions to guarantee our debt;

•limit proprietary trading and investments in certain private funds;

•impose certain specific accounting requirements on us that may be more restrictive;

•result in changes from time to time in our practices, policies, procedures, and personnel in various areas of our business (including, without limitation, practices and policies regarding the dischargeability of certain Private Education Loans in the event of a borrower’s bankruptcy);

•enhance restrictions regarding money laundering and the financing of terrorism;

•enhance requirements related to risk management and corporate governance; and

•result in greater or earlier charges to earnings or reductions in our capital.

Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations, as well as increased intensity in supervision, often impose additional costs and could result in additional charge-offs. In recent years, there has been an increase in the scope of the laws and regulations and the intensity of the supervision to which we are subject, as well as an increase in regulatory enforcement and fines across the banking and financial services sector.

In connection with their continuous supervision and examinations of us, the FDIC, the UDFI, the CFPB, or other regulatory agencies may require changes in our business or operations. Such a requirement may be judicially enforceable or impractical for us to contest, and we could become subject to formal or informal enforcement and other supervisory actions, including memoranda of understanding, written agreements, cease-and-desist orders, and prompt-corrective-action or safety-and-soundness directives. Supervisory actions could entail significant restrictions on our existing business, our ability to develop new business, our flexibility in conducting operations, and our ability to pay dividends or utilize capital. Enforcement and other supervisory actions also can result in the imposition of civil monetary penalties or injunctions, related litigation by private plaintiffs, damage to our reputation, and a loss of customer or investor confidence. We could be required as well to dispose of specified assets and liabilities or to increase our level of charge-offs within a prescribed period of time. As a result, any enforcement or other supervisory action could have an adverse effect on our business, financial condition, results of operations, and

32 SLM CORPORATION — 2025 Form 10-K

prospects. Restrictions or limitations on our operations, or other directives, imposed by our regulators may be confidential and thus, in some instances, we may not be permitted to publicly disclose the actions.

In addition, changes in the regulatory and supervisory environments could adversely affect us in substantial and unpredictable ways, including by limiting the types of financial services and products we may offer, enhancing the ability of others to offer more competitive financial services and products, restricting our ability to make acquisitions or pursue other profitable opportunities, and negatively impacting our financial condition and results of operations.

The current federal administration has implemented significant changes in federal priorities and has taken steps to change the operations, structure, and policy focus of various federal agencies, as well as regulatory priorities, policy approaches and interpretations of existing laws by those federal agencies. The full and complete impact of the current federal administration’s deregulatory policies is unclear and new developments could have significant implications for bank supervision compliance, litigation strategy, and consumer protection laws. It is also possible the expected changes in regulation do not occur or are reversed by a subsequent federal administration, or the regulatory measures that are ultimately enacted deliver significant competitive advantages to financial services that are structured differently or serve different markets than the Company and the Bank.

Our failure to comply with the laws, regulations, and supervisory actions to which we are subject, even if the failure is inadvertent or reflects a difference in interpretation, could subject us to fines, other penalties, and restrictions on our business activities, any of which could adversely affect our business, financial condition, cash flows, results of operations, capital base, and/or the price of our securities.

Failure to comply with consumer protection, privacy, data protection, or cybersecurity laws and requirements could subject us to civil and criminal penalties or litigation, including class actions, and have a material adverse effect on our business.

We are subject to a broad range of federal and state consumer protection laws applicable to our lending and retail banking activities, including laws governing fair lending, unfair, deceptive and abusive acts and practices, service member protections, interest rates and loan fees, disclosures of loan terms, marketing, servicing, and collections.

The CFPB is the Bank’s primary consumer compliance supervisor, with exclusive authority to conduct examinations for the purpose of assessing compliance with the requirements of federal consumer financial laws and with primary consumer compliance enforcement authority. CFPB jurisdiction, regulation, and supervision could increase our costs and limit our ability to pursue business opportunities. Complaints received by the CFPB regarding us could lead to additional scrutiny of us and increase our costs. Consent orders, decrees, or settlements entered into with governmental agencies may also increase our compliance costs or restrict certain of our activities. Currently, the operational, enforcement, and regulatory posture of the CFPB under the current federal administration is unclear. H.R.1 amended the Dodd-Frank Act to dramatically reduce CFPB funding. As of November 20, 2025, the current federal administration began transferring the CFPB’s enforcement authority and active enforcement actions to the DOJ. Multiple lawsuits related to the current federal administration’s actions remain ongoing and federal courts have issued preliminary injunctions designed to prevent the current federal administration from defunding or shutting down the CFPB while litigation is ongoing. Without final judicial or congressional intervention or a change in the current federal administration’s policies, the CFPB may cease operations in the future. These developments could have significant implications for our regulatory environment, compliance requirements, litigation strategy, and consumer protection laws.

The issuance of regulatory guidance and the enforcement of the enhanced vendor management standards via examination and investigation of us or any third party with whom we do business may increase our costs, require increased management attention, and adversely impact our operations.

2025 Form 10-K — SLM CORPORATION 33

We are also subject to a dynamically changing landscape of privacy, data protection, and cybersecurity laws, regulations, and requirements. Various federal and state regulators, including governmental agencies, have adopted, or are considering adopting, laws and regulations regarding the use and disclosure of personal information and data privacy and security. This patchwork of legislation and regulation may lead to conflicts or differing views of privacy rights. As an example, certain state laws regarding personal information may be broader in scope or more stringent than federal laws or the laws of other states regarding personal information.

Further, we make public statements about our use, collection, disclosure, and other processing of personal information through our privacy policies, information provided on our website, and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide assurances about privacy, data protection, and data security can subject us to potential regulatory or legal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices.

Violations of federal or state consumer protection, privacy, data protection, or cybersecurity laws or related regulations may expose us to litigation, administrative fines, penalties, and restitution.

The impacts of, and regulatory framework for, such technology are continually evolving and remain uncertain and could affect our operations and the way in which we and our third-party service providers use such technology. Additionally, we could incur significant costs to comply with such evolving framework, which could adversely affect our business, financial condition, and results of operations.

POLITICAL/REPUTATIONAL RISK

Proposals of federal and state governments, or of various political officials or candidates, affecting the student loan industry in particular, subject us to political risk and could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

We operate in an environment of heightened political and regulatory scrutiny of education loan lending, holding, servicing, and originations. The enactment of any proposed legislation or policies such as those described in this Item 1A. Risk Factors, even if they do not apply specifically to Private Education Loans, could have a material adverse impact on our business, results of operations, financial condition, and/or cash flows. In addition, the continued ongoing publicity regarding these various proposals, even if they are not enacted, could negatively impact the market price of our common stock.

We are subject to reputational and other risks, which could damage our brand and have a material adverse impact on our business, results of operations, financial condition, and/or cash flows.

Our brand is very important to us and our business. In addition, the business practices, financial health, and integrity of the overall student loan market, other loan markets, or the market for online deposits, as applicable, could impact our reputation. Negative publicity, including as a result of our culture, actual or alleged conduct by us,

34 SLM CORPORATION — 2025 Form 10-K

our employees, or our vendors, or public opinion of the broader student loan industry or other relevant industries generally, could damage our reputation and business and adversely impact the price of our common stock or other securities.

Other matters that can impact our reputation, including, but not limited to, community impact and workforce issues, and our overall governance environment, may expose us to negative publicity based on the identity and activities of those with whom we do business and the public’s view of our approach and performance, and that of our business partners, regarding these matters. Such negative publicity could damage our relationships and reputation with our existing and prospective customers and third parties with whom we do business, have an adverse effect on our ability to attract and retain customers and employees, and have a negative impact on the demand for and market price of our securities.

Any negative publicity, including individual posts via social media, could “go viral”, causing potentially significant harm to our brand and reputation, and our business, whether or not factually accurate.

TECHNOLOGICAL RISK

Failure or significant interruption of our operating systems or infrastructure or the inability to adapt to changes could disrupt our business, cause significant losses, result in regulatory action or litigation, or damage our reputation.

Our business is dependent on our ability to process and monitor large numbers of transactions in compliance with legal and regulatory standards and our product specifications. As processing demands change and our loan portfolio grows in both volume and differing terms and conditions, developing and maintaining our operating systems and infrastructure become increasingly challenging. There is no assurance we can adequately or efficiently develop, maintain, or acquire access to such systems and infrastructure.

Our loan originations and deposits and the servicing, financial, accounting, data processing, communications, or other operating systems, processes, and facilities that support them may fail to operate properly, become disabled as a result of events beyond our control, or be unable to be rapidly configured to timely address business requirements or regulatory changes, in each case potentially adversely affecting our ability to process these transactions adequately. Despite the plans we have in place from time to time, our ability to operate may be adversely affected by a disruption in the infrastructure that supports our businesses. Notwithstanding our efforts to maintain business continuity, a disruptive event impacting our processing locations, a failure to adequately anticipate the level of staffing or effort needed to efficiently and effectively communicate with and service our customers or to service and collect on our loans, or another similar operational event could adversely affect our business, financial condition, results of operations, and/or cash flows.

Our business processes are becoming increasingly dependent upon technological advancement, and we could lose market share if we are not able to keep pace with rapid changes in technology.

Our future success depends, in part, on our ability to underwrite and approve loans, process loan applications and payments, and provide other customer services, in a safe, automated manner with high-quality service standards. The volume of loan originations we are able to process is reliant on the systems and processes we have

2025 Form 10-K — SLM CORPORATION 35

implemented and developed. These systems and processes are becoming increasingly dependent upon technological advancement, such as the ability to process loans and payments over the internet or mobile applications, accept electronic signatures, and provide initial decisions instantly. Our future success also depends, in part, on our ability to develop and implement technology solutions that keep pace with continuing changes in technology, industry standards, and client preferences, including FinTech developments. We may not be successful in anticipating or responding to these developments in a timely manner. We have made, and need to continue to make, investments in our technology platform to provide competitive products and services and to reduce the number of manual processes we employ. We may be required to expend significant funds to develop or acquire new technologies. If competitors introduce products, services, and systems that are better than ours or that are more cost-effective or that gain greater market acceptance, we could lose market share. Any one of these circumstances could have a material adverse effect on our business reputation and ability to obtain and retain clients and, therefore, could materially adversely affect our business, financial condition, and/or results of operations.

The development and use of AI presents risks and challenges that may adversely impact our business.

We are in the initial phases of integrating AI into our business operations with the objective of enhancing employee productivity, client outreach, and customer experience in general. In addition, certain vendors and third parties may incorporate AI technologies into business processes, services, or products that we utilize. The adoption and use of AI introduces a range of risks and challenges to our business.

The legal and regulatory landscape governing AI is highly dynamic and continues to evolve rapidly in the United States and internationally, including through the development of regulatory frameworks specifically targeting AI. Recent federal executive actions have signaled a shift in the regulatory landscape for AI in the United States. These actions direct federal agencies to promote a unified national approach to AI oversight, including the potential preemption of conflicting state laws and the establishment of federal standards. While these executive actions do not currently impose direct obligations on private financial institutions, future regulatory developments or agency actions could impact our adoption and governance of AI technologies, as well as our oversight of third-party vendors. Additionally, individual states continue to explore their own laws and regulations related to the use and application of AI. As the legal and regulatory framework for AI continues to evolve, we may face increased, shifting or conflicting compliance requirements, which may require operational adjustments or strategic considerations related to our or our vendors’ use and implementation of AI, which could in turn increase our compliance costs and the risk of non-compliance.

Further, the use of AI models could result in the inadvertent disclosure of confidential company information, infringement of intellectual property rights, or other adverse outcomes. The complexity and opacity of many AI models may also make it difficult to fully assess and mitigate these risks. As a result, our use of AI, or the use of AI by our vendors or third parties, could expose us to liability, regulatory or legal consequences, and reputational harm and, therefore, could materially adversely affect our business, financial condition, and/or results of operations.

We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure.

Our operations rely on the secure collection, processing, storage, and transmission of personal, confidential, and other information in a significant number of customer transactions on a continuous basis through our computer systems and networks and those of our third-party service providers. Information security risks for financial institutions and third-party service providers have increased in recent years and continue to evolve in part because of the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, activists, and other external parties, including foreign state-sponsored actors. These parties also may fraudulently induce employees, customers, and others who use our or our service providers’ systems or have access to our or our customers’ data, to gain access to our and our customers’ data or our assets.

We and our service providers face constant threats to our systems and data and continuously experience cyberattacks and other security incidents. Additionally, while we and our third-party service providers

36 SLM CORPORATION — 2025 Form 10-K

commit resources to the design, implementation, maintenance, security, and monitoring of our networks and systems, there is no guarantee that our security controls, or those of our third-party service providers, will protect against all threats.

Despite the measures we and our third-party service providers implement to protect our systems and our or our customers’ data, we may not be able to anticipate, prevent, or detect cyberattacks, particularly because the techniques used by attackers change frequently or are not recognized until launched, and because cyberattacks can originate from a wide variety of sources, including third parties who are or may be involved in organized crime or linked to terrorist organizations or hostile foreign governments. Such third parties may seek to gain unauthorized access to our systems either directly or using equipment or security passwords belonging to employees, customers, third-party service providers, or other users of our systems or those of our third-party service providers. Or, they may seek to disrupt or disable our (or our service providers’) services through attacks such as denial-of-service and ransomware attacks. As a result, our computer systems, software, and networks, as well as those of third-party vendors we utilize, may be vulnerable to unauthorized access, computer viruses, malware attacks, and other events that could have a security impact beyond our control. We also routinely transmit and receive personal, confidential, and proprietary information, some through third parties, which may be vulnerable to interception, misuse, or mishandling. This risk may be heightened by our hybrid work environment, which may lead to unanticipated issues arising from handling personal, confidential, and other information from a work-from-home environment.

If one or more of such events occur, personal, confidential, and other information processed by, stored in, or transmitted through, our computer systems and networks, or those of third-party vendors, could be compromised or could cause interruptions or malfunctions in our or our customers’ or service providers’ operations that could result in significant losses, loss of business by us and loss of confidence in us, customer dissatisfaction, significant litigation, regulatory exposures, and harm to our reputation and brand. In addition, we may be required to expend significant resources to modify our protective measures, to investigate the circumstances surrounding the event, and implement mitigation and remediation measures. We also may be subject to fines, penalties, litigation (including securities fraud class action lawsuits) and regulatory investigation costs and settlements and other financial losses. If one or more of such events occur, our business, financial condition, and/or results of operations could be significantly and adversely affected.

While we seek to mitigate cyber and related risks associated with outsourcing to third-party service providers, including through our vendor management processes, both operational and technological cyber risks remain, and certain risks are beyond our security and control systems.

While we maintain insurance coverage that may apply to various cybersecurity risks and liabilities, there is no guarantee that any or all costs or losses incurred would be partially or fully covered.

We depend significantly on third parties for a wide array of our operations and customer services and key components of our information technology infrastructure, and a breach of security or service levels, or violation of law by one of these third parties, could disrupt our business or provide our competitors with an opportunity to enhance their position at our expense.

We depend significantly on third parties for a wide array of our operations and customer services and key components of our information technology and security infrastructures. If a service provider fails to provide the services we require or expect, or fails to meet applicable regulatory or contractual requirements, such as service levels, protection of our customers’ personal and confidential information, or compliance with applicable laws, that failure could negatively impact our business by adversely affecting our ability to process customers’ transactions in a timely and accurate manner, otherwise hampering our ability to serve our customers and investors, or subjecting us to litigation and regulatory risk for matters as diverse as poor vendor oversight, improper release or

2025 Form 10-K — SLM CORPORATION 37

protection of personal information, or release of incorrect information. Such a failure could adversely affect the perception of the reliability of our networks and services, and the quality of our brand, and could materially adversely affect our business, financial condition, and/or results of operations.

OPERATIONAL RISK

We may face risks from our operations related to litigation or regulatory or supervisory actions that could result in significant legal expenses and settlement or damage awards.

From time to time, in the ordinary course of our business, we face litigation alleging violations of consumer protection, securities, employment, and other laws.

Our internal controls over financial reporting and disclosure controls, as well as other internal controls, may be ineffective, which could have a material adverse effect on our financial condition and/or results of operations.

Our management is responsible for maintaining, regularly assessing, and, as necessary, making changes to our internal controls over financial reporting and our disclosure controls. Nevertheless, our internal controls over financial reporting and our disclosure controls can provide only reasonable assurances regarding the reliability of our financial reporting and the preparation of our financial statements for external purposes in accordance with generally accepted accounting principles in the United States (“GAAP”) and may not prevent or detect misstatements. Any failure or circumvention of our internal controls over financial reporting or our disclosure controls, failure to comply with rules and regulations related to such controls, or failure to make sound and appropriate application of the criteria established in the framework set forth in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission could have a material adverse effect on our financial condition and/or results of operations.

Other internal controls, including fraud detection and controls, and corporate governance procedures also are based on the assumption that they can provide only reasonable, not absolute, assurances the objectives of the controls and procedures are met. Any failure or circumvention of controls and procedures, including as a result of human error, malfeasance of employees or third parties, or other misconduct by employees or third parties, can result in legal risk and reputational harm and have a material adverse effect on our business, financial condition, and/or results of operations.

Our framework for managing risks, including model risk and data governance risk, may not be effective in mitigating our risk of loss in all possible scenarios and, if the framework is ineffective, could have a material adverse effect on us and our business.

Our risk management framework seeks to mitigate risk and appropriately balance risk and return. We continue to evolve our risk management framework to consider changes in business and regulatory expectations and to refine established processes and procedures intended to identify, measure, monitor, test, control, report, escalate, and mitigate the types of risk to which we are subject. We seek to monitor and control our risk exposure through a framework of policies, procedures, limits, and reporting requirements.

We also rely on quantitative models to measure and manage risks and estimate certain financial values. Models may be used in such processes as product pricing, extending credit, measuring interest rate and other market risk, estimating losses, calculating and assessing capital levels, estimating the value of financial instruments and balance sheet items, and various other processes. If the models that we use to measure and/or mitigate these risks and values are poorly designed, based upon incorrect or incomplete information, poorly implemented, or are otherwise inadequate, or our governance surrounding the management of data we use in our models and other aspects of our business is poorly designed or implemented, or otherwise is inadequate, our business decisions may be adversely affected, we may provide inaccurate information to the public or regulators, and/or we may incur increased losses.

38 SLM CORPORATION — 2025 Form 10-K

In addition, there may be existing or developing risks that we have not appropriately anticipated, identified, or mitigated. If our risk management framework does not effectively identify or mitigate our risks, we could suffer unexpected losses and our business, financial condition, and/or results of operations could be materially adversely affected. An ineffective risk-management framework or function also could give rise to enforcement and other supervisory actions, damage our reputation, and result in litigation.

Our business operations and those of our third-party vendors may be adversely impacted by political events, terrorism, cyberattacks, public health issues (including pandemics), natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, business interruptions, and other unpredictable catastrophic events.

Our business operations and those of our third-party vendors are subject to interruption by, among other things, geopolitical events, terrorism, cyberattacks, public health issues (including pandemics), natural disasters, severe weather, climate change, infrastructure failure or outages, labor disputes, and other unpredictable catastrophic events, which could make it difficult or impossible for us to deliver a satisfactory experience to our customers or could decrease demand for our products and services.

The occurrence of any such event could have a material adverse impact on our business, financial condition, results of operations, and/or cash flows.

New lines of business, new products and services, and/or new strategic partnerships or initiatives may subject us to additional risks.

We may face compliance and regulatory risks in each of those cases. We also may from time to time seek to acquire other financial services companies or businesses that complement our business strategy. These acquisitions may be subject to regulatory approval in some instances, and no assurance can be provided that we will be able to obtain that approval in a timely manner or at all or that approval may not be subject to burdensome conditions. Even if we are able to obtain any required regulatory approval, the failure of other closing conditions to be satisfied or waived could delay the completion of an acquisition for a significant period of time or prevent it from occurring altogether. Any failure or delay in closing an acquisition could adversely affect our reputation, business, and performance.

Acquisitions and/or implementation of new lines of business, products, services, strategic partnerships, initiatives, or business arrangements involve numerous risks and uncertainties, including inaccurate financial and operational assumptions, incomplete or failed due diligence, lower-than-expected performance, higher-than-expected costs, difficulties related to integration, diversion of management’s attention from other business activities, adverse market or other reactions, changes in relationships with customers or counterparties, the potential loss of key personnel, and the possibility of litigation and other disputes. An acquisition also could be dilutive to our existing stockholders if we were to issue common stock to fully or partially pay or fund the purchase price.

2025 Form 10-K — SLM CORPORATION 39

Our origination expansion initiative and strategic partnership funding model are new and untested and may expose us to a broad range of potential risks.

Our origination expansion initiative and strategic partnership funding model are new and untested. Engaging in new and untested strategies and initiatives like our origination expansion initiative and strategic partnership funding model could expose the Company to potential risks including, but not limited to, risks associated with the creation, expansion, growth, and scaling of these initiatives, as well as our reliance on third parties. Our new strategies and initiatives may increase our exposure to execution, operational, concentration, and counterparty risks. We may depend on a limited number of strategic partners, private credit sources, and external demand for higher education products and services, which could increase margin pressures, expenditures, and pose potential liquidity and concentration risks.

If we are unable to secure additional strategic partners, capture new opportunities related to the origination expansion initiative, or access additional sources of private credit, our ability to achieve our strategic objectives, including the anticipated growth or earnings potential of these strategies, could be limited. Our reliance on third parties, including strategic partners, higher education institutions, and other counterparties—may expose us to risks if such parties fail to fulfill their contractual obligations or our agreements with them are terminated unexpectedly. The simultaneous creation and management of multiple new strategic partnerships and initiatives may further increase operational complexity and risk.

RISKS RELATED TO SPIN-OFF

We may have exposure to risks related to the Spin-Off, indemnification claims, and/or Navient’s creditworthiness.

In connection with the Spin-Off, we entered into a Separation and Distribution Agreement with Navient (the “Separation and Distribution Agreement”). We also entered into various other ancillary agreements with Navient, including a tax sharing agreement, to effect the Spin-Off and provide a framework for our relationship with Navient thereafter.

The Bank and Navient entered into the above-referenced tax sharing agreement to govern the respective rights, responsibilities, and obligations of the parties after the Spin-Off relating to taxes, including with respect to the payment of taxes, the preparation and filing of tax returns, and the conduct of tax contests. Under this agreement, each party is generally liable for taxes attributable to its business. The agreement also addresses the allocation of tax liabilities that are incurred as a result of the Spin-Off and related transactions. While the statutes of limitation on the tax periods covered by the tax sharing agreement have largely run, any trailing tax liabilities associated with past periods could impact our business, financial condition, and/or results of operations.

Any financial liability or litigation costs resulting from an indemnification claim made against or by Navient could have a material adverse impact on our business, financial condition, and/or results of operations.

GENERAL RISK

Our business could be negatively affected if we are unable to attract, retain, and motivate skilled employees.

Our success depends, in large part, on our ability to retain key senior leaders and to attract and retain skilled employees and subject matter experts. We depend on our senior leaders and skilled employees and subject matter experts to oversee initiatives across the enterprise and execute on our business plans in an efficient and effective manner. Competition for such senior leaders and employees, and the cost associated with attracting and retaining them, is high. Recent scrutiny of compensation in the financial services industry has introduced additional

40 SLM CORPORATION — 2025 Form 10-K

challenges in this area. Our ability to attract and retain qualified employees also is affected by perceptions of our culture and management, our profile in the regions where we have offices, and the professional opportunities we offer. We rely upon our senior leaders not only for business success, but also to lead with integrity. To the extent our senior leaders behave in a manner that does not comport with our values, the consequences to our brand and reputation could be severe and could adversely affect our financial condition and results of operations. If we are unable to attract, develop, and retain talented senior leadership and employees, or to implement appropriate succession plans for our senior leadership and subject matter experts, our business could be negatively affected.

In addition, the loss of key senior leaders, skilled employees, or subject matter experts could result not only in operational disruption but also in the transfer of valuable institutional knowledge, strategic insights, and expertise to competitors. Departing employees may leverage the experience, training, and familiarity with our systems, processes, and strategic priorities gained during their employment to compete more effectively against us on behalf of a new employer. Even when subject to confidentiality and other restrictive covenants, the risk that such individuals could use or disclose proprietary know‑how, intentionally or unintentionally, may increase competitive pressures and adversely affect our business, financial condition, and results of operations.

At December 31, 2025, we had issued and outstanding 2.5 million shares of our Series B Preferred Stock. Our Series B Preferred Stock is senior to our shares of common stock in right of payment of dividends and other distributions. Generally, we must be current on dividends payable to holders of our Series B Preferred Stock before any dividends can be paid on our common stock. We also must comply with certain provisions that are protective of the Series B Preferred Stock in order to effectuate any repurchases under our common stock share repurchase program. In the event of our bankruptcy, dissolution, or liquidation, the holders of our Series B Preferred Stock must be satisfied before any distributions can be made to our common stockholders.

We may be limited in our ability to receive dividends from the Bank, pay dividends on and repurchase our common stock, and make payments on our corporate debt.

The declaration and payment of future common stock dividends, as well as the amount thereof, are subject to determination by, and the discretion of, our Board of Directors. In addition, we may change our policy regarding the payment of dividends and reduce or eliminate our common stock dividend in the future, which could adversely affect the market price of our common stock.

We may not be able to sell loans at prices, in volumes, or on a schedule, that will provide us with sufficient funds to effect share repurchases under our share repurchase programs. Additionally, we may pause or discontinue our share repurchase programs for other reasons, such as legal or regulatory considerations, or because we decide to allocate available funds for other corporate priorities. The timing and volume of any repurchases will be subject to market conditions, and there can be no guarantee that we will repurchase up to the limit of any program or at all, which could adversely affect the market price of our common stock.

We are dependent on funds obtained from the Bank to fund corporate debt payments, dividend payments, and any share repurchases. Regulatory and other legal restrictions may limit our ability to transfer funds freely, either to or from our subsidiaries. In particular, the Bank is subject to laws and regulations that authorize regulatory bodies to block or reduce the flow of funds to us, or that prohibit such transfers altogether in certain circumstances. These laws, regulations, and rules may hinder our ability to access funds that we may need to make payments in respect of our stock or to satisfy our other responsibilities. The FDIC has the authority to prohibit or limit the payment of dividends by the Bank and SLM Corporation.

Item 1B. Unresolved Staff Comments

None.

2025 Form 10-K — SLM CORPORATION 41

Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response standard.

We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements.

Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

Our cybersecurity risk management program includes the following key elements:

•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (“IT”) environment;

•a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents;

•the use of external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes;

•cybersecurity awareness training of employees with access to our IT systems;

•a cybersecurity incident response standard and Crisis Management Policy that guide our response to cybersecurity incidents; and

•a third-party risk identification and management process for service providers.

“Risk Factors – TECHNOLOGICAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure” in this Form 10-K.

Cybersecurity Governance

Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Operational and Compliance Risk Committee of the Board. The Operational and Compliance Risk Committee of our Board of Directors oversees management’s design, implementation, and enforcement of our cybersecurity risk management program.

Our Chief Security Officer (“CSO”) reports to our Executive Vice President, Chief Technology and Enablement Officer and leads the Company’s overall cybersecurity function. Our CSO provides periodic updates on our cybersecurity risk management program to the management-level Operational and Compliance Risk Committee (“OCRC”) and Executive Committee (“EC”). The Operational and Compliance Risk Committee of our Board of Directors also receives periodic reports from our CSO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.

Our CSO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include: briefings from internal security personnel; threat intelligence and other

42 SLM CORPORATION — 2025 Form 10-K

information obtained from governmental, public, or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.

Our CSO is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for leading our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CSO has significant executive experience in managing and leading IT and cybersecurity teams in both government and the private sector and has received industry recognition in the cybersecurity area. Our CSO holds cybersecurity certifications from leading cybersecurity training and research institutes, is a Fellow at the National Security Institute, and is a member of the Board of Directors of the Financial Services Information Sharing and Analysis Center.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
IRTC	an hour ago
GCMG	an hour ago
ED	an hour ago
IAUX	an hour ago
LNC	an hour ago
TSCO	an hour ago
MSTR	an hour ago
GH	an hour ago
MIR	an hour ago
CSGS	an hour ago
LKQ	an hour ago
DTM	an hour ago
BG	an hour ago
THRM	an hour ago
SEM	an hour ago
TVTX	an hour ago
KALU	an hour ago
LYV	an hour ago
FTI	an hour ago
MS	an hour ago
ICUI	an hour ago
ET	an hour ago
BNL	an hour ago
OWL	an hour ago
BTU	an hour ago
EFX	an hour ago
PTCT	2 hours ago
RPD	2 hours ago
MET	2 hours ago
IEX	2 hours ago
CNDT	2 hours ago
SPSC	2 hours ago
CYH	2 hours ago
SLM	2 hours ago
STT	2 hours ago
WSC	2 hours ago
NPO	2 hours ago
FFBC	2 hours ago
SUNC	2 hours ago
FDP	2 hours ago
SUN	2 hours ago
UDMY	2 hours ago
OPEN	2 hours ago
MSEX	2 hours ago
ULS	2 hours ago
GATX	2 hours ago
RMAX	2 hours ago
CTO	2 hours ago
GLPI	2 hours ago
AIZ	2 hours ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - SLM

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

Strategies

Alerts

Browse Data

Risk Factors Dashboard

View risk factors by ticker

Search filings by term

Risk Factors - SLM

-New additions in green-Changes in blue-Hover to see similar sentence in last filing

Recently Filed

OTHER DATASETS

House Trading

Corporate Flights

App Ratings

TRADE SMARTER

TRADE SMARTER

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing