COF · CIK 927628
What Capital One Financial Corporation told the SEC could break it.
Capital One's disclosures cluster on concentration of its critical dependencies. It relies on single-source third-party providers for core functions — AWS for cloud infrastructure and TSYS for card processing — where an outage at a vendor it has no alternative for could significantly disrupt its business, and its operations and infrastructure are themselves concentrated in a few metro areas including Northern Virginia, New York, Chicago and the Philippines. Its lending shows the same pattern, with about 36% of its commercial real estate portfolio in the Northeast, and it carries integration and control-environment risk from the Discover acquisition, which made up 20% of total assets and 21% of net revenue in 2025 and was excluded from management's internal-control assessment.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Geographic concentration
- ~36% of commercial real estate loan portfolio concentrated in the Northeastmedium
Approximately 36% of Capital One's commercial real estate loan portfolio is concentrated in the Northeast region; a downturn, slow growth, catastrophe or natural disaster disproportionately affecting the Northeast could materially impair demand, repayment ability and collateral value.
“approximately 36% of our commercial real estate loan portfolio is concentrated in the Northeast region.”
SEC filing →As of 2026 - operations/infrastructure concentrated in Northern VA, NY, Chicago, Richmond, Plano TX, Philippineslow
Capital One's ability to conduct business may be adversely affected by infrastructure disruptions concentrated in the Northern Virginia, New York and Chicago metro areas, Richmond VA, Plano TX, and the Philippines (cyberattacks, physical-site loss, terrorism, etc.).
“the infrastructure that supports our business and the communities where we are located, which are concentrated in the Northern Virginia, New York and Chicago metropolitan areas, Richmond, Virginia, Plano, Texas and the Philippines.”
SEC filing →As of 2026
Sole-source dependency
- single-source third-party providers — AWS (cloud) and TSYS (card processing)high
Capital One relies on third-party service providers including AWS for cloud infrastructure and TSYS for consumer/commercial credit card processing; a service outage — particularly where the vendor is the single source — could significantly disrupt its business and customer relationships, and AWS has experienced outages and degradation.
“Any such service outage, particularly where the vendor is the single source from which we obtain such services, could significantly disrupt our business or negatively impact the relationship we have with customers that rely on such services.”
SEC filing →As of 2026
Other disclosures
- Discover integration — 20% of total assets / 21% of net revenue not yet under COF internal controlsmedium
Following the Discover acquisition, Discover Financial Services constituted 20% of Capital One's total assets and 21% of net revenue for 2025 and was excluded from management's internal-control-over-financial-reporting assessment — integration and control-environment risk for a newly acquired fifth of the company.
“did not include the internal controls of Discover Financial Services, which is included in the 2025 consolidated financial statements of the Company and constituted 20% of total assets as of December 31, 2025 and 21% of net revenue for the year then ended.”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings, including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its suppliers
Total System Services LLC (TSYS, a Global Payments company)
“These relationships include, but are not limited to: Amazon Web Services, Inc. (“AWS”) for our cloud infrastructure, Total System Services LLC (“TSYS”) for consumer and commercial credit card processing”
Cited →Amazon Web Services, Inc. (Amazon.com, Inc.)
“We continue to rely on third-party service providers to help us deliver systems and operational infrastructure. These relationships include, but are not limited to: Amazon Web Services, Inc. (“AWS”) for our cloud infrastructure, Total System Services LLC (“TSYS”) for consumer and commercial credit card processing”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch