KBC Asset Management NV v. Discover Financial Services

• Court: District Court, N.D. Illinois
• Decided: March 31, 2025
• Docket: 1:23-cv-06788
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION KBC ASSET MANAGEMENT NV, NEW YORK CITY EMPLOYEES’ RETIREMENT SYSTEM, NEW YORK CITY POLICE PENSION FUND, NEW YORK CITY FIRE DEPARTMENT PENSION FUND, and TEACHERS’ RETIREMENT SYSTEM OF THE CITY OF NEW YORK, individually and on behalf of all others similarly situated, Plaintiffs, Case No. 23-cv-06788 v. Judge Martha M. Pacold DISCOVER FINANCIAL SERVICES, ROGER C. HOCHSCHILD, JOHN T. GREENE, R. MARK GRAF, MARY K. BUSH, CANDACE H. DUNCAN, JOSEPH F. EAZOR, CYNTHIA GLASSMAN, THOMAS G. MAHERAS, MICHAEL MOSKOW, DANIELA O’LEARY GILL, JOHN B. OWEN, DAVID L. RAWLINSON II, and JENNIFER L. WONG, Defendants.

MEMORANDUM OPINION AND ORDER Plaintiffs KBC Asset Management NV, New York City Employees’ Retirement System, New York City Police Pension Fund, New York City Fire Department Pension Fund, and Teachers’ Retirement System of the City of New York filed this lawsuit against Discover Financial Services, three of its former and current officers, Roger C. Hochschild, John T. Greene, R. Mark Graf, and ten of its former and current directors, Mary K. Bush, Candace H. Duncan, Joseph F. Eazor, Cynthia Glassman, Thomas G. Maheras, Michael Moskow, Daniela O’Leary Gill, John B. Owen, David L. Rawlinson II, and Jennifer L. Wong. The amended complaint, [74],1 alleges violations of Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and SEC Rule 10b–5. Plaintiffs sue on behalf of themselves and a putative class of others who purchased or acquired Discover stock between February 21, 2019, and January 17, 2024. Id. ¶ 24. Defendants move to dismiss the amended complaint under Federal Rule of Civil Procedure 12(b)(6). [89]. For the reasons below, defendants’ motion is granted. The amended complaint, [74], is dismissed without prejudice. BACKGROUND At the motion to dismiss stage, the court accepts as true the well-pleaded factual allegations in the amended complaint, [74], and draws all reasonable inferences in plaintiffs’ favor. Tamayo v. Blagojevich, 526 F.3d 1074, 1081 (7th Cir. 2008). The court may consider documents critical to the complaint and referred to in it, as well as information subject to proper judicial notice. Geinosky v. City of Chicago, 675 F.3d 743, 745 n.1 (7th Cir. 2012). I. The Defendants Discover Financial Services (“Discover”) is a digital banking and payment services company. [74] ¶ 34. It offers customers loans of various types (such as credit card loans, private student loans, and mortgages) as well as deposit products (such as savings and checking accounts). Id. ¶ 35. Individual defendants held various high-level positions within Discover between February 21, 2019, and January 17, 2024. Roger C. Hochschild served as Discover’s CEO and President from October 2018 to August 14, 2023. Id. ¶ 36. John T. Greene served as Discover’s Chief Financial Officer and Executive Vice President, replacing R. Mark Graf, who served in those roles from April 2011 to September 18, 2019. Id. ¶¶ 37–38. Mary K. Bush, Candace H. Duncan, Joseph F. Eazor, Cynthia Glassman, Thomas G. Maheras, Michael Moskow, Daniela O’Leary Gill, John B. Owen, David L. Rawlinson II, and Jennifer L. Wong sat on the Audit Committee or Risk Oversight Committee of Discover’s board of directors. Id. ¶¶ 40–49. II. Discover’s Compliance Issues In earnings calls and board meetings of every major financial services company, attendees are bound to hear terms like “compliance” and “risk management.” Both refer to “risks relating to possible violations of applicable laws, regulations, contractual terms, standards, or internal policies where such violation could result in direct or indirect financial liability, civil or criminal penalties, regulatory sanctions, or other negative effects for the organization or its personnel.” Id. ¶ 60 (quoting Comm. of Sponsoring Orgs. of the Treadway Comm’n, Compliance

1 Bracketed numbers refer to docket entries and are followed by page or paragraph citations. Page numbers refer to the CM/ECF page number. Risk Management: Applying the COSO ERM Framework, at 1). Put simply, discussion of “compliance” or “risk management” is discussion about whether the company was, is, or will be complying with state and federal laws and regulations. According to its public disclosures, Discover organizes its risk management program through “three lines of defense.” Id. ¶ 71 (quoting [90-8] at 11 (2022 Form 10-K)). First, Discover’s business units “identify[] and manag[e] risks that arise from day-to-day operations as well as those driven by change.” Id. ¶ 72. Second, the corporate risk management (“CRM”) department establishes and implements “enterprise-level risk management standards and policies.” Id. ¶ 73. Last, the internal audit department “performs periodic, independent reviews and tests compliance with risk management policies, procedures and standards across [the] Company”—in other words, checks the work of the corporate risk management department. Id. ¶ 74 (alteration in original). These three lines of defense were not impenetrable. On October 18, 2021, the Federal Deposit Insurance Corporation (“FDIC”) published a Consumer Compliance Report of Examination discussing its investigation into Discover’s banking practices. Id. ¶ 160. The Report identified violations of the Federal Trade Commission Act, the Truth-in-Lending Act, the Servicemembers Civil Relief Act, and the Electronic Records and Signatures in Commerce Act, as well as implementing regulations. Id. ¶¶ 160–162. On September 25, 2023, Discover entered into a consent order with the FDIC, agreeing to undertake specific measures to “eliminate or correct, and prevent the unsafe or unsound banking practices and the violations of law or regulation identified in the” 2021 Report. Id. ¶¶ 165–168. Some of these violations occurred during the time period relevant to this suit. Id. ¶ 170. Discover also came under scrutiny from the Consumer Financial Protection Bureau (“CFPB”) for its student loan servicing practices. On July 22, 2015, Discover entered into a consent order with CFPB, agreeing to refund $16 million to consumers, pay $2.5 million in fines, and undertake specific measures to improve compliance with the Fair Debt Collection Practices Act and the Consumer Financial Protection Act. Id. ¶¶ 177–194; see [90-38]. With respect to the Consumer Financial Protection Act, the CFPB found that Discover failed to “furnish clear information regarding the student-loan interest consumers paid,” unlawfully “initiate[d] collection calls to consumers at inconvenient times,” and “overstat[ed] the minimum amount due in student-loan billing statements.” [90-38] at 2. The CFPB’s enforcement efforts did not stop there. On December 22, 2020, Discover entered into another consent order based on its failure to comply with the earlier CFPB consent order, the Consumer Financial Protection Act, and the Electronic Fund Transfer Act. [74] ¶¶ 195–211; see [90-39]. Discover agreed to pay $10 million in consumer redress and $25 million in fines, as well as to undertake specific measures to ensure “compli[ance] with the laws that the Bureau enforces, including Federal consumer financial laws and this Consent Order.” [90-39] ¶ 75; [74] ¶¶ 195–211. On July 20, 2022, Discover announced that it was “suspending until further notice its existing share repurchase program because of an internal investigation relating to its student loan servicing practices and related compliance matters.” [74] ¶ 343. When news broke, Discover’s stock price dropped 9%. Id. ¶¶ 16, 351. In November 2023, Discover announced its plan to exit the student loan servicing business. Id. ¶ 234. Discover also confronted compliance issues in its credit card business. On July 19, 2023, Discover admitted in a press release that, since 2007, it “incorrectly classified certain credit card accounts into [its] highest merchant and merchant acquirer pricing tier.” Id. ¶¶ 10, 219, 223 (alteration in original). To rectify these errors, Discover agreed “to provide refunds to merchants and merchant acquirers as a result of the card product misclassification,” leading to “(as of June 30, 2023) a liability of 365 million . . . .” Id. ¶ 219 (quoting July 19, 2023, press release). Discover’s stock price plunged 16% that day.2 Id. ¶ 10. Hochschild resigned as CEO and President a month later. Id. ¶ 12. III. This Lawsuit A few months after the July 2023 press release, plaintiffs filed this suit, alleging violations of Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and SEC Rule 10b–5. [1]. Plaintiffs later filed an amended complaint. [74]. The proposed class of plaintiffs in this putative class action consists of investors who purchased Discover stock between February 21, 2019, and January 17, 2024. Id. ¶¶ 24–33. During that period, defendants made a series of allegedly false or misleading statements about Discover’s compliance program and compliance position. Id. ¶¶ 238–301. The crux of plaintiffs’ allegations is that, through various public statements and filings, defendants assured investors that Discover’s compliance efforts were effective, when those efforts were, in fact, deficient. Id. ¶¶ 1–19. This fraud-on-the- market theory posits that defendants’ statements gave investors an inaccurate, overly optimistic picture of Discover’s compliance position, causing artificial inflation in Discover’s stock price. Id. ¶ 16. Plaintiffs allege that they purchased stock at these inflated prices and lost money when the stock price later fell—once Discover’s compliance issues came to light. See Roots P’ship v. Lands’ End, Inc., 965 F.2d 1411, 1416 (7th Cir. 1992) (explaining that “a fraud-on-the-market theory” posits “that the defendants’ fraudulent statements artificially inflated the market price of [the

2 That settlement, a proposed FDIC consent order, and the suspension of Discover’s share buyback program became public at the same time, so the 16% drop reflects those other developments as well. [74] ¶ 16. company’s] common stock and that [plaintiffs] suffered injury by purchasing the stock at such an inflated price (which later dropped when the truth became known to the market)” (footnote omitted)). LEGAL STANDARD A motion to dismiss pursuant to Rule 12(b)(6) challenges the sufficiency of the complaint. Hallinan v. Fraternal Ord. of Police Chicago Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009). In deciding the motion to dismiss, the court must determine whether the complaint “contain[s] sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “[N]aked assertion[s] devoid of further factual enhancement” are insufficient. Id. (quoting Twombly, 550 U.S. at 557). Claims alleging fraud must satisfy the heightened pleading requirements of Rule 9(b). That rule requires a party to “state with particularity the circumstances constituting fraud.” Fed. R. Civ. P. 9(b). “That includes the ‘who, what, when, where, and how’ of the fraud.” W. Palm Beach Firefighters’ Pension Fund v. Conagra Brands, Inc., 495 F. Supp. 3d 622, 634 (N.D. Ill. 2020) (quoting Menzies v. Seyfarth Shaw LLP, 943 F.3d 328, 338 (7th Cir. 2019)), aff’d sub nom. Nat’l Elevator Indus. Pension Fund v. Conagra Brands, Inc., No. 21-1155, 2022 WL 1449184 (7th Cir. May 9, 2022). “Each instance of fraud must be alleged with ‘precision and some measure of substantiation.’” Id. (quoting Menzies, 943 F.3d at 338). Claims alleging securities fraud under the Securities Exchange Act must also meet the “exacting pleading requirements” of the Private Securities Litigation Reform Act (“PSLRA”). Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 313 (2007) (“Tellabs II”). Under those requirements, “[a]ny complaint alleging a material misstatement or omission must also ‘specify each statement alleged to have been misleading’ and the ‘reason or reasons why the statement is misleading.’” Cornielsen v. Infinium Cap. Mgmt., LLC, 916 F.3d 589, 599 (7th Cir. 2019) (quoting 15 U.S.C. § 78u-4(b)(1)). The PSLRA also dictates that “if an allegation regarding the statement or omission is made on information and belief, the complaint shall state with particularity all facts on which that belief is formed.” 15 U.S.C. § 78u-4(b)(1). And it further requires that “complaints alleging securities fraud ‘state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind.’” Cornielsen, 916 F.3d at 598–99 (quoting 15 U.S.C. § 78u- 4(b)(2)(A)). DISCUSSION I. Section 10(b) and Rule 10b–5(b) Section 10(b) of the Securities Exchange Act proscribes the “use or employ[ment], in connection with the purchase or sale of any security . . . [of] any manipulative or deceptive device or contrivance in contravention of such rules and regulations as the Commission may prescribe as necessary or appropriate in the public interest or for the protection of investors.” 15 U.S.C. § 78j(b). The Securities and Exchange Commission (“SEC”) “promulgated Rule 10b–5 pursuant to authority granted under § 10(b) of the Securities Exchange Act of 1934[.]” Janus Cap. Grp., Inc. v. First Derivative Traders, 564 U.S. 135, 141 (2011) (citation omitted). Rule 10b-5(b) makes it unlawful “to make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading . . . , in connection with the purchase or sale of any security.” 17 C.F.R. § 240.10b–5(b). “Rule 10b–5 encompasses only conduct already prohibited by § 10(b).” Stoneridge Inv. Partners, LLC v. Sci.-Atlanta, 552 U.S. 148, 157 (2008). To state a securities fraud claim under § 10(b) and Rule 10b–5, the complaint must adequately allege: “(1) a material misrepresentation or omission by the defendant; (2) scienter; (3) a connection between the misrepresentation or omission and the purchase or sale of a security; (4) reliance upon the misrepresentation or omission; (5) economic loss; and (6) loss causation.” Id. (citation omitted). This case turns on whether the amended complaint adequately alleges that defendants made material misrepresentations or omissions with respect to Discover’s compliance program. A statement is false when it asserts facts that are untrue when the statement was made. In re Lululemon Sec. Litig., 14 F. Supp. 3d 553, 571 (S.D.N.Y. 2014); cf. Thompson v. United States, 604 U.S. ----, ----, 2025 WL 876266, at *4 (2025) (explaining that a statement is “false” if it is “not true”). In contrast, a statement— though literally true—may be misleading if it implies something that is false. In re Philip Morris Int’l Inc. Sec. Litig., 437 F. Supp. 3d 329, 349 (S.D.N.Y. 2020). Whether a statement is misleading “depends on the perspective of a reasonable investor: The inquiry . . . is objective.” Omnicare, Inc. v. Laborers Dist. Council Constr. Indus. Pension Fund, 575 U.S. 175, 186–87 (2015) (citation omitted). Thus, the question is whether, “given the context and manner in which” the statement was made, a reasonable investor would understand the speaker to convey a “false” version of events. Heavy & Gen. Laborers’ Loc. 472 & 172 Pension and Annuity Funds v. Fifth Third Bancorp, No. 20 C 2176, 2022 WL 1642221, at *15–16 (N.D. Ill. May 24, 2022) (“This is an objective inquiry, considering whether a reasonable investor would have received a false impression from the statement given the context and manner in which Defendants presented the statement.”). In addition to a misleading statement, “a misleading omission,” “half truth,” or “[f]ailure to give the whole story” may be “actionable as fraud” “when a defendant actively conceals information” it is duty-bound to disclose. United States v. Chanu, 40 F.4th 528, 541 (7th Cir. 2022) (alterations and citation omitted). However, “§ 10(b) and Rule 10b–5(b) do not create an affirmative duty to disclose any and all material information.” Macquarie Infrastructure Corp. v. Moab Partners, L. P., 601 U.S. 257, 264 (2024) (quoting Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 44 (2011)). Instead, “[d]isclosure is required . . . only when necessary to make . . . statements made, in the light of the circumstances under which they were made, not misleading.” Id. (second ellipsis in original) (internal quotation marks omitted) (quoting Matrixx Initiatives, 563 U.S. at 44). “Pure omissions”—that is, “when a speaker says nothing, in circumstances that do not give any particular meaning to that silence”—are not actionable under § 10(b) and Rule 10b–5(b). Id. at 263, 266; see Higginbotham v. Baxter Int’l, Inc., 495 F.3d 753, 760 (7th Cir. 2007) (“Silence is not ‘fraud’ without a duty to disclose.” (citations omitted)). Further, a misrepresentation or omission is actionable only if it is deceptive as to a material fact. A misrepresented fact is material if “there is a substantial likelihood that a reasonable shareholder would consider it important in deciding how to vote” or trade. Smykla v. Molinaroli, 85 F.4th 1228, 1235–36 (7th Cir. 2023) (quoting TSC Indus., Inc. v. Northway, Inc., 426 U.S. 438, 449 (1976)); see also Basic Inc. v. Levinson, 485 U.S. 224, 238 (1988) (“It is not enough that a statement is false or incomplete, if the misrepresented fact is otherwise insignificant.”). Similarly, an omitted fact is material if “there is a substantial likelihood that the disclosure of the omitted fact would have been viewed by the reasonable investor as having significantly altered the total mix of information made available.” Matrixx Initiatives, 563 U.S. at 38 (internal quotation marks omitted) (quoting Basic, 485 U.S. at 231– 32); see also SEC v. Ustian, No. 16 C 3885, 2019 WL 7486835, at *28 (N.D. Ill. Dec. 13, 2019) (“An omission renders a statement materially misleading when it creates an impression of a state of affairs that differs in a material way from the one that actually exists.” (citation and internal quotation marks omitted)). Courts “can resolve materiality as a matter of law when the information at issue is so obviously unimportant that reasonable minds could not differ,” “look[ing] at all available information” related to the “challenged omission or misstatement.” Smykla, 85 F.4th at 1236 (quoting Kuebler v. Vectren Corp., 13 F.4th 631, 638–39 (7th Cir. 2021)); see also In re Midway Games, Inc. Sec. Litig., 332 F. Supp. 2d 1152, 1164 (N.D. Ill. 2004) (“Courts have held immaterial as a matter of law loosely optimistic statements that are so vague, so lacking in specificity, or so clearly constituting the opinions of the speaker, that no reasonable investor could find them important to the total mix of information available.” (citation and internal quotation marks omitted)); In re Newell Rubbermaid Inc. Sec. Litig., No 99 C 6853, 2000 WL 1705279, at *7 (N.D. Ill. Nov. 14, 2000) (noting that if a “reasonable investor could not have been swayed by an alleged misstatement, a court may determine as a matter of law that the misstatement was not material”). The amended complaint alleges that dozens of defendants’ statements and omissions were materially misleading. [74] ¶¶ 238–301. The court addresses these statements by category. A. Statements Describing Discover’s Compliance Goals and Capabilities Plaintiffs first challenge defendants’ statements lauding Discover’s compliance program and its ability to appropriately manage risk. The court addresses each statement separately, starting with the earliest in time. 2018 Form 10-K. Generally, publicly-traded companies file an annual “Form 10-K” with the SEC. [74] ¶ 241. The form “presents an overview of the company’s business and financial condition . . . .” Roth v. Aon Corp., 254 F.R.D. 538, 540 (N.D. Ill. 2009); see Gallagher v. Abbott Lab’ys, 269 F.3d 806, 809 (7th Cir. 2001) (explaining that the Form 10-K provides “snapshots” of a registrant’s overall financial position). During the years relevant to this litigation,3 Discover’s Form 10-Ks stated the following:  Our [risk management] framework is designed to be comprehensive with respect to our business units and their control and support functions, and across all risk types.  We structure accountability across three lines of defense along the principles of risk management execution, oversight and independent validation . . . . The principles apply across all businesses and risk types and guide the definition of specific roles and responsibilities.  The CRM department sets risk management standards and policies that are consistent with the size and complexity of our business, industry practices and applicable legal and regulatory requirements.  Our risk governance framework is implemented such that bank-level risk governance requirements are satisfied as well.  Our Risk Committee . . . establishes a comprehensive enterprise risk management program, which includes . . . establishing and overseeing an enterprise-wide approach to risk management through the development of our Enterprise Risk Management Policy and the associated oversight framework for the identification, measurement, monitoring, management and reporting of enterprise risk . . . and . . . reviewing, on a periodic basis, our aggregate enterprise-wide risk exposures and the effectiveness of risk identification, measurement, monitoring, management and reporting policies and procedures, and related controls within the lines of business.

3 The amended complaint notes that the language of the 2018 Form 10-K “appears in substantially similar form in subsequent Form 10-Ks.” [74] ¶ 241. Because the amended complaint and parties’ briefs focus on the language of the 2018 Form 10-K, [90-4], the court will do the same.  The CEO establishes a risk management culture throughout the Company and ensures that businesses operate in accordance with this risk culture.  The CRM department has enterprise risk management, corporate compliance, third-party risk management, model risk management, information security and risk and insurance management frameworks to manage potential risk that might arise within these respective areas.  The internal audit department . . . validates that risk management controls are functioning as intended by reviewing and evaluating the design and operating effectiveness of the CRM program and processes, including the independence and effectiveness of the CRM function.  Our enterprise risk management principles are executed through a risk management framework that is based upon industry standards for managing risk and controls.  We have policies and a defined governance structure in place to manage risks.  In addition, we have established various policies to help govern these risks.  Compliance risk exposures are actively and primarily managed by our business units in conjunction with our compliance department. Id. ¶ 242 (alterations and ellipses in original) (emphasis omitted); see [90-4]. Plaintiffs argue that these statements were materially misleading given the “glaring and significant gaps” in Discover’s compliance program. [74] ¶ 243. This argument is unpersuasive. First, no reasonable investor would interpret statements describing the purposes and goals of Discover’s compliance program— that it is “designed” to be “comprehensive,” ensure “accountability,” “manage risks,” and “help govern these risks”—to convey specific predictions and assurances about Discover’s level of compliance. Id. ¶ 242; see Chew v. MoneyGram Int’l, Inc., No. 18– cv–7537, 2024 WL 4346522, at *9 (N.D. Ill. Sept. 30, 2024) (“[T]hese statements were limited to descriptions of the purpose of [the company’s] efforts; they made no claims whatsoever about the results of those efforts.”); Fifth Third Bancorp, 2022 WL 1642221, at *16 (noting that a “statement about an oversight program designed to ‘mitigate’ compliance risk through consistent business practices is general and aspirational, and therefore not actionable”); In re Citigroup Sec. Litig., 20 Civ. 9132, 2023 WL 2632258, at *14 (S.D.N.Y. Mar. 24, 2023) (concluding that a company’s statements touting its “risk governance framework” and its “policies, procedures, and processes” as “designed to protect” against risk were inactionable because they were “exactly the types of routine representations of risk-management practices that almost every bank makes” (citation, internal quotation marks, and ellipsis omitted)). Vague and aspirational statements about the company’s “risk management culture” are not actionable either. [74] ¶ 242e; see Singh v. Cigna Corp., 918 F.3d 57, 60 (2d Cir. 2019) (“[B]anal and vague corporate statements affirming the importance of regulatory compliance . . . do not invite reasonable reliance.”). Next, plaintiffs challenge Discover’s statements about its current level of compliance performance. Plaintiffs challenge Discover’s statement that “[t]he CRM department sets risk management standards and policies that are consistent with the size and complexity of our business, industry practices and applicable legal and regulatory requirements.” [90-4] at 4; [74] ¶ 242c. This sentence falls under the section labeled “Independence”—one of Discover’s five “Enterprise Risk Management Principles.” [90-4] at 3–4. No reasonable investor would understand that sentence to mean that Discover has complied with all (or any) of its legal obligations. The sentence states that the corporate risk management department is responsible for setting policies “consistent with applicable legal and regulatory requirements”—not that Discover has complied with those policies or with “applicable legal and regulatory requirements.” Id. at 4. Immediately following the allegedly misleading sentence, Discover stated that its corporate risk management department “periodically reviews the design and operating effectiveness of [its] risk management program and processes”—in other words, updates policies to align with “the size and complexity of [its] business, industry practices and applicable legal and regulatory requirements.” Id. The allegedly misleading sentence—read in context—provides a basic description of the corporate risk management department’s role within Discover’s “approach to risk management.” Id. at 3. No reasonable investor would find from these vague descriptions any concrete assurance that there were no “significant gaps and deficiencies in the Company’s risk management and corporate governance framework.” [74] ¶ 244; see In re Merrill Lynch Auction Rate Sec. Litig., 704 F. Supp. 2d 378, 392 (S.D.N.Y. 2010) (“Corporations are not required to phrase disclosures in pejorative terms.” (citation omitted)). Plaintiffs also challenge as misleading Discover’s statement that its “internal audit department also validates that risk management controls are functioning as intended by reviewing and evaluating the design and operating effectiveness of the CRM program and processes . . . .” [90-4] at 6. No reasonable investor would interpret this generic description of Discover’s internal audit department’s role and internal auditing process as an assurance of specific results. Discover did not say that its compliance policies were “functioning as intended,” but that the auditors’ job was to “validate” whether that was the case. The verb “validates” appears in the present (not past) tense, in a paragraph describing the internal audit department’s general responsibilities. No reasonable investor would understand the sentence to convey that the department had reached a particular assessment about Discover’s compliance position. Even assuming that a reasonable investor might interpret Discover’s description of its internal audit department to mean that Discover’s compliance program was functional, courts have found similarly vague statements to be immaterial as a matter of law. See, e.g., City of Warren Police & Fire Ret. Sys. v. Zebra Techs. Corp., 19 C 5782, 2020 WL 6118571, at *6 (N.D. Ill. Oct. 16, 2020) (noting that a company’s statements that its enterprise resource planning system was “functioning really well” and “working well for us” were inactionable puffery), aff’d, 8 F.4th 592, 595 (7th Cir. 2021). Last, plaintiffs challenge Discover’s statement that “[o]ur risk governance framework is implemented such that bank-level risk governance requirements are satisfied as well.” [90-4] at 4; [74] ¶ 242d. Plaintiffs interpret the word “satisfied” as an assurance that Discover has “implemented and maintained a properly functioning, robust, and compliant risk management and corporate governance framework.” [74] ¶ 296. But no reasonable investor—reading the Form 10-K as a whole—would interpret the statement that way. In the context of the challenged statement, “bank-level risk governance requirements” do not refer to applicable banking statutes and regulations, but to the “risk governance, compliance, auditing and other requirements” promulgated by Discover itself. [90-4] at 4. Neither the complaint nor plaintiffs’ response brief identifies—with any particularity—what (if any) internal banking-specific rules Discover allegedly violated. And the challenged statement did not suggest that satisfaction of internal banking-specific rules would suffice to bring Discover’s banking practices into compliance with applicable statutes and regulations. Indeed, elsewhere in the Form 10-K, Discover clarified that compliance was a work in progress. Discover stated that it “seeks to . . . create a risk management structure that . . . reduces impact of potential risk events,” “manage[s] potential risk that might arise,” and “control[s] our risk exposure . . . .” [90-4] at 6, 8, 15. Compliance risk was something to be “reduced,” “managed,” and “controlled”—not something that was already eliminated or fixed. See Fifth Third Bancorp, 2022 WL 1642221, at *16 (“[A] statement [that] clearly acknowledges the potential for noncompliance (something that needs to [be] identified, mitigated, and monitored) . . . does not present the type of specific, factual statement of compliance that courts have found to be misleading.” (citation and footnote omitted)); Washtenaw Cnty. Emps.’ Ret. Sys. v. Walgreen Co., No. 15–cv–3187, 2016 WL 5720375, at *6 (N.D. Ill. Sept. 30, 2016) (“[D]efendants’ statement was that there were measures to ‘mitigate’ the risk, not to ‘eliminate’ it.”). Indeed, Discover expressly caveated that “[o]ur risk management framework and models for managing risks may not be effective in mitigating our risk of loss.” [90-4] at 15 (emphasis in original); see also id. at 16 (“If the models that we use to mitigate risks are inadequate, we may incur increased losses . . . . If our risk management framework and models do not effectively identify or mitigate our risks, we could suffer unexpected losses and our financial condition and results of operations could be materially adversely affected.”). Moreover, as discussed further below in the context of the PSLRA’s safe harbor, “Note 19: Litigation and Regulatory Matters” of the Form 10-K warned the reader: The Company is also involved, from time to time, in other reviews, investigations and proceedings (both formal and informal) by governmental agencies regarding the Company’s business . . . , some of which may result in significant adverse judgments, settlements, fines, penalties, injunctions, decreases in regulatory ratings, customer restitution or other relief, which could materially impact the Company’s consolidated financial statements, increase its cost of operations, or limit its ability to execute its business strategies and engage in certain business activities. Discover, 2018 Form 10-K (Feb. 20, 2019), at 130. Where, as here, “each of [the company’s] statements was framed by acknowledgements of the complexity and numerosity of applicable regulations,” “[s]uch framing suggests caution (rather than confidence) regarding the extent of [the company’s] compliance.” Singh, 918 F.3d at 64. The isolated phrase “bank-level risk governance requirements are satisfied” therefore does not negate abundant and unambiguous language throughout the Form 10-K acknowledging that Discover’s efforts on the compliance front were ongoing, and that its exposure to compliance-related setbacks persisted.4 See Omnicare, 575 U.S. at 190 (“[A]n investor reads each statement within such a document, whether of fact or of opinion, in light of all its surrounding text, including hedges, disclaimers, and apparently conflicting information.”); Eisenstadt v. Centel Corp., 113 F.3d 738, 746 (7th Cir. 1997) (explaining that statements putting a “rosy face on an inherently uncertain process” were inactionable, and indeed, “investors would have expected no less”); Howard v. Arconic Inc., 395 F. Supp. 3d 516, 552 (W.D. Pa. 2019) (“[A] reasonable investor reading the 10-K risk disclosures would not conclude that [defendant] faced no legal or compliance risks, or that the risk management and compliance programs [defendant] had adopted were completely adequate to prevent all such risks.”).

4 Plaintiffs rely on City of Sterling Heights General Employees’ Retirement System v. Hospira, Inc., No. 11 C 8332, 2013 WL 566805 (N.D. Ill. Feb. 13, 2013). There, the court held that the defendant’s statement that it is “working across our operations to make sure that we meet the highest level of compliance and quality for both pharmaceutical and device products” “does not constitute puffery as a matter of law” in light of the statement’s surrounding context. Id. at *24. Specifically, the court noted that the defendant made this statement at a “Specialty Pharmaceuticals Conference,” “shortly after the release of Hospira’s second- quarter 2010 financial results on July 28, 2010 and that analysts ‘reacted positively’ to the results.” Id. Here, however, context undermines (rather than supports) plaintiffs’ contention that Discover’s Form 10-K statements were materially misleading. In sum, none of Discover’s statements in its Form 10-K, read in context, supports the inference that reasonable investors were misled to believe a false version of events or made investment decisions based on what was said. Hochschild’s Statements at Annual Shareholder Meeting on May 19, 2022. In his scripted remarks, Hochschild told shareholders that: We offer bank products that are easy to use, good value and help you when you need it. We lead the industry with practical, innovative features and the best customer experience. To achieve our goals, we must balance agility, innovation and growth with the discipline and control required in a high-risk regulated industry. We also need to relentlessly focus on our customers and better serving them, which will make the Discover brand the most trusted in financial services. [A]nd we must continuously improve our capabilities and how we work across each part of our business with a particular focus on technology, analytics, marketing and talent management. Let’s look at some of the things we’re doing this year. Top of the list is our focus on compliance first, which means we’ll continue to strengthen and fine-tune our processes and comply with all the regulations required of a large national bank. To accelerate growth, will [sic] drive awareness about the products and features we offer with both our card and non-card products to attract new customers. We’ll continue to improve upon our mobile-first experience, making it integrated across all product lines and will [sic] enhance our existing products to ensure they meet consumers’ changing needs. To manage charge-offs, we’ll continue to monitor and manage credit. Charge-off rates are historically low right now, but we do expect them to go up next year. [90-11] at 7. Plaintiffs challenge Hochschild’s single sentence about compliance: “[t]op of the list is our focus on compliance first, which means we’ll continue to strengthen and fine-tune our processes and comply with all the regulations required of a large national bank.” [74] ¶ 281. First, plaintiffs argue that Hochschild misled investors into believing that compliance was a “top” priority. However, “banal and vague corporate statements affirming the importance of regulatory compliance . . . do not invite reasonable reliance.” Singh, 918 F.3d at 60; see ECA, Loc. 134 IBEW Joint Pension Tr. of Chicago v. JP Morgan Chase Co., 553 F.3d 187, 206 (2d Cir. 2009) (explaining that “generalizations regarding [the company’s] business practices” “did not, and could not, amount to a guarantee that its choices would prevent failures in its risk management practices”). Second, plaintiffs argue that Hochschild’s statement that “we’ll continue to strengthen and fine-tune our processes and comply with all the regulations required of a large national bank” misled investors into believing that Discover had complied with applicable regulations. [90-11] at 7. Defendants argue that this statement is a forward-looking statement protected by the PSLRA’s safe harbor provision. The PSLRA defines a “forward-looking statement” to include:  “a statement of the plans and objectives of management for future operations, including plans or objectives relating to the products or services of the issuer,” 15 U.S.C. § 78u-5(i)(1)(B);  “a statement of future economic performance, including any such statement contained in a discussion and analysis of financial condition by the management or in the results of operations included pursuant to the rules and regulations of the Commission,” id. § 78u-5(i)(1)(C);  “any statement of the assumptions underlying or relating to any statement described in subparagraph (A), (B), or (C),” id. § 78u-5(i)(1)(D). A statement is forward-looking if it is “one whose truth or falsity cannot be determined until after the statement has been made.” Hedick v. Kraft Heinz Co., No. 19–cv–1339, 2021 WL 3566602, at *14 (N.D. Ill. Aug. 11, 2021) (citation and internal quotation marks omitted). Under the PSLRA’s safe harbor provision, a “forward- looking statement” is not actionable if it is “identified as a forward-looking statement, and is accompanied by meaningful cautionary statements identifying important factors that could cause actual results to differ materially from those in the forward- looking statement.” 15 U.S.C. § 78u-5(c)(1)(A)(i). Here, Hochschild’s statement is (1) a forward-looking statement, (2) identified as a forward-looking statement, and (3) contains meaningful cautionary language. Thus, it is inactionable under the PSLRA’s safe harbor provision. 1. Forward-Looking Statement For the reasons below, no reasonable investor would interpret Hochschild’s statement that “we’ll continue to strengthen and fine-tune our processes and comply with all the regulations required of a large national bank,” [90-11] at 7, in context, to convey a specific and concrete assurance that Discover had achieved perfect compliance. Rather, this statement “forecasts in a tentative way a future state of affairs in which a present commitment unfolds into action.” Carvelli v. Ocwen Financial Corporation, 934 F.3d 1307, 1329 (11th Cir. 2019). The challenged statement is therefore a forward-looking statement. Hochschild’s statement, in isolation, may be susceptible to multiple interpretations. One could interpret it as a forward-looking statement—that “we’ll . . . comply with all” applicable regulations. This statement about the company’s future compliance position cannot be verified as either true or false when uttered. On the other hand, plaintiffs interpret the challenged statement as an assertion of present fact—that “we’ll continue to . . . comply with all” applicable regulations, with an emphasis on the word “continue.” However, no reasonable investor—hearing the challenged statement in the context of Hochschild’s entire speech and Discover’s related SEC filings—would adopt plaintiffs’ interpretation. First, the fact that Hochschild introduced compliance as one “of the things we’re doing this year,” rather than one “of the things we accomplished last year,” suggests that compliance was a goal, not an accomplishment. [90-11] at 4, 7. That interpretation comports with Hochschild’s use of the phrase “we’ll continue” throughout the speech:  “We’ll continue rolling out more features over the coming months, and we’ll begin mass marketing later this summer.” Id. at 5.  “We’ll continue to improve upon our mobile-first experience, making it integrated across all product lines and will enhance our existing products to ensure they meet consumers’ changing needs.” Id. at 7.  “To manage charge-offs, we’ll continue to monitor and manage credit. Charge-off rates are historically low right now, but we do expect them to go up next year.” Id. at 7.  “[W]e’ll continue to work on reducing fraud.” Id.  “To drive efficiencies, we’ll continue our focus on giving customers more self-service options and we’ll find additional ways to reduce costs to free up more funds for investment.” Id.  “To strengthen our foundation, we’ll continue to work on capabilities we’ll keep discovered [sic] at the leading edge, including efforts to make our processes more efficient.” Id.  “Our business technology teams will continue to simplify our architecture, which will increase our speed and reduce technology investments.” Id.  “To grow our payments business, we’ll continue the momentum we have as more types of payments shift to digital[.]” Id. Situated alongside discussion of these other priorities, Hochschild’s sentence about compliance falls within his broad-brush summary about the company’s goals for the year. Moreover, no reasonable investor would understand Hochschild, in context, to convey concrete assurances about Discover’s present compliance position. Discover’s 2021 Form 10-K—a document that Hochschild expressly incorporated into his speech, as explained below—disclaimed any notion that Discover had achieved perfect compliance. Notably, under the subheading “Current Economic and Regulatory Environment,” the document stated that: Financial regulatory developments have and will continue to significantly impact the environment for the financial services industry, which could adversely impact our business, results of operations and financial condition. . . . Regulatory and legislative developments, findings and actions have had and could continue to have a negative impact on our business strategies or require us to: limit, exit or modify our business practices and product offerings; restructure our products in unanticipated ways; invest more management time and resources in compliance efforts; limit the fees we charge for services; impact the value of our assets; or limit our ability to pursue certain innovations and business opportunities and obtain related required regulatory approvals. . . . It is possible that any new regulatory measures or legislation may disproportionately affect us due to our size, structure or product offerings, among other things. Compliance expectations and expenditures have steadily and significantly increased for us and other financial services firms and are expected to continue to increase as regulators escalate their focus on controls and operational processes. We may face additional compliance and regulatory risks if we introduce new products and services or enter into new business arrangements with third-party service providers, alternative payment providers, or other industry participants. Ongoing or additional regulatory requirements may generate additional expenses or require significant time and resources to ensure compliance. [90-7] at 10–11 (emphasis in original); see Discover, 2021 Form 10-K (Feb. 24, 2022), at 32 (explaining that “[legal] risks are inherent in all of our businesses”). Further, Discover calculated that its “[l]itigation and regulatory settlement-related expense” had trended upwards, from $31 million in 2020 to $59 million” in 2021. Discover, 2021 Form 10-K (Feb. 24, 2022), at 129. Discover also estimated that its possible loss exposure from “legal and regulatory proceedings” “is up to $230 million as of December 31, 2021.” Id. These disclosures “made clear that compliance was a work in progress.” Chew, 2024 WL 4346522, at *9. Thus, any reasonable investor evaluating the challenged statement in context would understand Hochschild to be making an aspirational commitment to “comply with all” applicable regulations going forward, not a concrete assurance that the company had resolved all outstanding compliance issues. See Omnicare, 575 U.S. at 190 (explaining that investors interpret “each statement . . . in light of all its surrounding text, including hedges, disclaimers, and apparently conflicting information”). Even if the court was to conclude (which it does not) that a reasonable investor would interpret Hochschild’s statement as phrased in the present tense, “[t]he fact that some of the statements contain language phrased in the present-tense does not convert the entire statement into a historical statement.” Selbst v. McDonald’s Corp., No. 04 C 2422, 2005 WL 2319936, at *8 (N.D. Ill. Sept. 21, 2005) (citing Harris v. Ivax Corp., 182 F.3d 799, 807 (11th Cir. 1999)). A statement phrased in the present tense can still be forward-looking if it conveys a prediction. See Makor Issues & Rights, Ltd. v. Tellabs Inc., 513 F.3d 702, 705 (7th Cir. 2008) (“Tellabs III”) (“The fact that all the statements challenged in this case . . . are in the present tense is not decisive on the question whether the statements include predictions: ‘Our earnings are certain to double’ is in the present tense, but is a prediction.”); Washtenaw Cnty. Emps.’ Ret. Sys. v. Walgreen Co., No. 15–cv–3187, 2021 WL 5083756, at *6 (N.D. Ill. Nov. 2, 2021) (explaining that the defendant’s statement that “we ‘continue to recognize that there are risks to achieving this goal, however, we remain focused on delivering it’”— although phrased “in the present tense”—“is a forward-looking statement because the truth or falsity of this statement could not be discerned until a later time” (citation omitted)). Carvelli, 934 F.3d at 1307, is instructive. There, the Eleventh Circuit considered a company’s “promise that [it] would ‘continue to provide strong servicing results’—implying both that servicing results are currently strong and that [it] commits to provide strong results in the future.” Id. at 1329. The court explained that “[t]hese types of statements, when accompanied by meaningful cautionary language, are properly sheltered under the safe-harbor because they convey management plans for yet-to-be-proven future operations and goals.” Id. (citing Harris, 182 F.3d at 805). Indeed, “[i]t would be illogical to bar forward-looking statements from protection simply because they implicitly communicate information about the present . . . .” Id. Here, as in Carvelli, Hochschild’s statement that “we’ll continue to strengthen and fine-tune our processes and comply with all the regulations required of a large national bank” is “intended, first and foremost, to communicate a future plan.” Id.; see Institutional Invs. Grp. v. Avaya, Inc., 564 F.3d 242, 256 (3d Cir. 2009) (holding that a company’s statement that it is “on track” to achieve projections was a forward- looking statement entitled to safe harbor protection). Thus, Hochschild’s statement is forward-looking. In sum, no reasonable investor evaluating the challenged statement in the context of Hochschild’s entire speech and Discover’s accompanying Form 10-K disclaimers would come away with the conclusion that Discover had achieved perfect compliance in all material respects. Rather, the statement is forward-looking, either because it is a future-tense statement about Discover’s goals for the year, or because it is a present-tense statement that “forecasts in a tentative way a future state of affairs in which a present commitment unfolds into action.” Carvelli, 934 F.3d at 1329. 2. Identified as a Forward-Looking Statement Under the PSLRA’s safe harbor, “a forward-looking statement” is not actionable if it is “identified as a forward-looking statement, and is accompanied by meaningful cautionary statements identifying important factors that could cause actual results to differ materially from those in the forward-looking statement.” 15 U.S.C. § 78u-5(c)(1)(A)(i). Consistent with 15 U.S.C. § 78u-5(c)(1)(A)(i), Hochschild identified his statement as forward-looking. At the start of his presentation, immediately after he greeted shareholders, Hochschild made the following disclaimer: I want to remind you that today’s presentation contains certain forward- looking statements about the company’s future financial performance and business prospects, which are subject to risks and uncertainties and speak only as of today. Factors that could cause actual results to differ materially from these forward-looking statements are set forth in the company’s annual report on Form 10-K for the year ended December 31[,] 2021, which is available on the company’s website and the SEC’s website and subsequent reports on Forms 8-K and 10-Q. [90-11] at 4. It is clear that Hochschild’s single sentence about compliance was the sort of “forward-looking statement[] about the company’s future financial performance and business prospects” described in his disclaimer. The Form 10-K— which Hochschild expressly incorporated into the introduction of his speech—states the following: This annual report on Form 10-K and materials we have filed or will file with the SEC (as well as information included in our other written or oral statements) contain or will contain certain statements that are forward-looking within the meaning of the Private Securities Litigation Reform Act of 1995. These statements are not guarantees of future performance and involve certain risks, uncertainties and assumptions that are difficult to predict. Actual outcomes and results may differ materially from those expressed in, or implied by, our forward-looking statements. Words such as “expects,” “anticipates,” “believes,” “estimates,” “forecasts,” and other similar expressions or future or conditional verbs such as “will,” “should,” “would,” and “could,” are intended to identify such forward-looking statements. You should not rely solely on the forward-looking statements and should consider all uncertainties and risks throughout this annual report on Form 10-K, including those described under “Risk Factors.” The statements are only as of the date they are made and we undertake no obligation to update any forward-looking statement. Discover, 2021 Form 10-K (Feb. 24, 2022), at 45–46 (emphasis added); see also Patten v. N. Tr. Co., 703 F. Supp. 2d 799, 803 n.2 (N.D. Ill. 2010) (“The court takes judicial notice of matters of public record, such as stock prices and SEC filings.” (citing Gen. Elec. Cap. Corp. v. Lease Resol. Corp., 128 F.3d 1074, 1080–81 (7th Cir. 1997))).5

5 Many of Discover’s press releases also contain the same disclaimer. See, e.g., Discover, Discover Financial Services Reports First Quarter 2022 Net Income of $1.2 Billion or $4.22 Per Diluted Share (Apr. 27, 2022); Discover, Discover Financial Services Reports Third Hochschild’s statement that “we’ll continue to strengthen and fine-tune our processes and comply with all the regulations required of a large national bank” falls squarely within these disclaimers’ definition of “forward-looking statements.” [90-11] at 4. Thus, Hochschild’s forward-looking statement was properly identified as such. 3. Meaningful Cautionary Language Additionally, to be protected under the PSLRA’s safe harbor, a forward-looking statement must be “accompanied by meaningful cautionary statements identifying important factors that could cause actual results to differ materially from those in the forward-looking statement.” 15 U.S.C. § 78u-5(c)(1)(A)(i). Cautionary language “must be tailored to the risks that accompany the particular projections.” Asher v. Baxter Int’l Inc., 377 F.3d 727, 733 (7th Cir. 2004) (“‘[B]oilerplate’ warnings won’t do.”). “[U]nder the literal language of the safe harbor statute the author of any forward-looking statement . . . is insulated from liability so long as that statement is accompanied by some meaningful cautionary statement.” Desai v. Gen. Growth Props., Inc., 654 F. Supp. 2d 836, 844 (N.D. Ill. 2009). By referring the audience to the factors discussed in Discover’s 2021 Form 10- K, [90-11] at 4, Hochschild provided a sufficiently meaningful cautionary statement. See In re Danimer Sci., Inc. Sec. Litig., No. 21-CV-02708, 2023 WL 6385642, at *7 (E.D.N.Y. Sept. 30, 2023) (explaining that “Defendants were permitted to incorporate cautionary language by reference” to the company’s SEC filings); cf. Asher, 377 F.3d at 732 (“tak[ing] the claim as the pleadings framed it: the market for [the company’s] stock is efficient, which means that [the company’s] cautionary language must be treated as if attached to every one of its oral and written statements”). In addition to the discussion under the subheading “Current Economic and Regulatory Environment”—block quoted above, see [90-7] at 11—the 2021 Form 10-K specifically addressed many of the regulatory actions and lawsuits that gave rise to this case: In July 2015, the Company announced that its subsidiaries . . . agreed to a consent order with the CFPB with respect to certain private student loan servicing practices (the “2015 Order”). The 2015 Order expired in July 2020. On December 22, 2020, the Discover Subsidiaries agreed to a consent order (the “2020 Order”) with the CFPB resolving the agency’s investigation into Discover Bank’s compliance with the 2015 Order. In connection with the 2020 Order, Discover is required to implement a redress and compliance plan and must pay at least $10 million in consumer redress to consumers who may have been harmed and paid a $25 million civil money penalty to the CFPB.

Quarter 2021 Net Income of $1.1 Billion or $3.54 Per Diluted Share (Oct. 20, 2021); Discover, Discover Financial Services Reports Second Quarter 2022 Net Income of $1.1 Billion or $3.96 Per Diluted Share (Jul. 20, 2022) (referenced in [74] ¶ 343). On March 8, 2016, a class-action lawsuit was filed against the Company, other credit card networks, other issuing banks and EMVCo in the U.S. District Court for the Northern District of California . . . alleging a conspiracy by the defendants to shift fraud liability to merchants with the migration to the EMV security standard and chip technology. The plaintiffs assert joint and several liability among the defendants and seek unspecified damages, including treble damages, attorneys’ fees, costs and injunctive relief. . . . The Company is not in a position at this time to assess the likely outcome or its exposure, if any, with respect to this matter. However, the Company will seek to defend itself vigorously against all claims asserted by the plaintiffs. Discover, 2021 Form 10-K (Feb. 24, 2022), at 130. These cautionary statements are both specific and meaningful: Discover disclosed “[company]-specific information and highlighted some parts of the business that might cause problems.” Asher, 377 F.3d at 733. That suffices for Hochschild’s forward-looking statement to fall within the PSLRA’s safe harbor. See Plumbers and Pipefitters Loc. Union No. 630 v. Allscripts- Misys Healthcare Sols., Inc., 778 F. Supp. 2d 858, 874 (N.D. Ill. 2011) (“[I]t is enough for the cautionary statements to point to the principal contingencies that could cause actual results to depart from projections. Such statements are meaningful if they put an investor on notice of the danger of the investment in order for her to make an intelligent decision about the investment according to her own preferences for risk and reward.” (citing Asher, 377 F.3d at 734; Stavros v. Exelon Corp., 266 F. Supp. 2d 833, 843 (N.D. Ill. 2003))). In sum, Hochschild’s statement that “we’ll continue to strengthen and fine- tune our processes and comply with all the regulations required of a large national bank” is inactionable under the PSLRA’s safe harbor provision. Greene’s Statements at the Barclays Global Financial Services Conference on September 13, 2022. In response to a question about “the suspension of the share repurchase program and the internal investigation” into Discover’s student loan practices, Greene stated: Yes. I’ll give an update on that. So what we said on the Second Quarter call, and it was spread throughout our script and through the Q&A, but in essence, it was that the Board authorization on the share repurchase remains intact. That second [sic] was that we only intended to resume buybacks as soon as we could. We then also said, we believe the financial exposure related to any matters related to the investigation was able to be absorbed within our existing expense guidance. So that was a bit of a quantification of it. We also talked about our SEB and our results from our stress test that actually improved, and that’s based on a qualitative and quantitative assessment. We said that we were still targeting that 10.5%. . . . And we took a conservative approach as discovered us [sic]. So Discover has traditionally been conservative on accounting matters and legal matters. We said, Okay with a Board investigation going on related to the student loan servicing intent to order items, it’d be better to hold on share repurchase. My hope is that by the end of the year, this will be behind us, and we’ll be able to resume share repurchases. Now that will be subject to the Board’s review and conclusion of the work they’re doing on this. But overall, I look at this as a matter of timing, not anything greater than that. [90-12] at 11. Plaintiffs challenge as misleading Greene’s statements that Discover “took a conservative approach” toward compliance issues, that “we believe the financial exposure related to any matters related to the investigation was able to be absorbed within our existing expense guidance,” and that “[o]verall, I look at this as a matter of timing, not anything greater than that.” [74] ¶ 263. Greene’s statements are not actionably misleading. No reasonable investor would rely on Greene’s “generalized, generic opinions” in deciding whether to buy or sell Discover stock. Fifth Third Bancorp, 2022 WL 1642221, at *17; see also JP Morgan Chase Co., 553 F.3d at 206 (“The statements are too general to cause a reasonable investor to rely upon them.”); Plumbers and Pipefitters, 778 F. Supp. 2d at 872 (“[R]easonable investors rely on facts in determining the value of a security, not mere expressions of optimism from company officials.” (citation omitted)); Zebra Techs., 8 F.4th at 595 (suggesting that a CEO’s description of a project as “progressing as planned” was not actionable because the statement “did not make any concrete assertion” and “expressed only vague optimism”); City of Warwick Mun. Emps. Pension Fund v. Rackspace Hosting, Inc., No. 17 Civ. 3501 (JFK), 2019 WL 452051, at *5 (S.D.N.Y. Feb. 5, 2019) (concluding that a statement touting the company’s “good progress” was inactionable puffery); Rosenzweig v. Azurix Corp., 332 F.3d 854, 870 (5th Cir. 2003) (‘“[M]aking steady progress’ is precisely the sort of generalized positive characterization that is not actionable under the securities laws.”). Specifically, Greene’s recitation of the company’s earlier assertion that “we believe the financial exposure related to any matters related to the investigation was able to be absorbed within our existing expense guidance” would not have led a reasonable investor to believe that Discover’s compliance issues posed no financial risk. [74] ¶ 263. Indeed, Greene expressly acknowledged the existence of compliance-related financial risks, opining that the company had “absorbed” the costs associated with that risk as part of its expenses. [90-12] at 11. The complaint does not allege with any particularity that, as of September 13, 2022, Discover had defaulted on (or been unable to pay) its compliance-related liabilities. Id. Because Greene’s statements and omissions were not misleading, Greene lacked an affirmative duty to disclose the full extent of Discover’s compliance difficulties. See Shemian v. Rsch. In Motion Ltd., No. 11 CIV. 4068 (RJS), 2013 WL 1285779, at *20 (S.D.N.Y. Mar. 29, 2013) (holding that a company’s “general” praise for a new product was “too vague and inconsequential to give rise to any duty to disclose” potential shortcomings), aff’d, 570 F. App’x 32 (2d Cir. 2014); In re UBS AG Sec. Litig., No. 07 CIV. 11225 (RJS), 2012 WL 4471265, at *14 (S.D.N.Y. Sept. 28, 2012) (holding that the company’s “aspirational statements that constitute non- actionable puffery” did not provide the company with any further duty to disclose), aff’d sub nom. City of Pontiac Policemen’s & Firemen’s Ret. Sys. v. UBS AG, 752 F.3d 173 (2d Cir. 2014). Here, as in Chew, Greene’s “expressions of optimism and descriptions of progress” do not amount to securities fraud. See 2024 WL 4346522, at *11, 13 (explaining that the defendant’s “vague expressions of positivity,” including its statement that “[w]e will continue to invest until we get it right, but we feel good about the outlook we have right now,” were inactionable). Hochschild’s Statements at the Goldman Sachs US Financial Services Conference on December 6, 2022. When asked about Discover’s personal loans business and “what are you thinking about for the student loan business as we think about the next 12 months ahead,” Hochschild answered: So personal loans is a very challenging business. And it is really all about underwriting. That’s where we’ve deployed our most leading-edge analytics and are seeing great performance. So, we’re confident in the loans we’re booking on. But again, that also is . . . where we will make the fastest and most dramatic changes to credit policy. It’s a great environment for first loans. The vast majority of our loans are used for debt consolidation, average ticket of about $19,000. And with rates going up, a lot of consumers are now looking to consolidate their credit card debt and bring it to a lower rate. So really excited about returning to growth there. The business you did mention, home equity is also seeing very strong demand because given where mortgage rates are, people are really unable or unwilling to do cash out [refinance]. And so strong demand for second mortgage home equity products, which is where we play. In student loans, I think it’s been public. We’ve had some compliance challenges there, but the team is doing a lot of great work. I’m really excited about that product. We see good returns. We’re the second largest originator of private student loans. It’s a great way to get your product and your brand in front of the next generation of consumers. So that’s a business that I’m very excited about. [90-13] at 13. Plaintiffs focus on Hochschild’s statement that Discover’s student loans business unit is “doing a lot of great work,” and that it was “see[ing] good returns,” [74] ¶ 265. Plaintiffs argue that he misled investors by “conceal[ing] the Company’s chronic and persistent compliance failures.” Id. ¶ 266. But “[n]o investor would take such statements seriously in assessing a potential investment, for the simple fact that almost every . . . bank makes” generalized statements about corporate success. JP Morgan Chase, 553 F.3d at 206; see In re Midway Games, Inc. Sec. Litig., 332 F. Supp. 2d 1152, 1165 (N.D. Ill. 2004) (noting that “overly-optimistic statements” and “self-directed corporate puffery” do not give rise to securities fraud because “[t]he market is not so easily duped” (citation omitted)). “Excessively vague, generalized, and optimistic comments” of this sort are not what “a reasonable investor, exercising due care, would view as moving the investment-decision needle—that is, they’re not material.” Kuebler, 13 F.4th at 638 (citation and internal quotation marks omitted); see Plumbers and Pipefitters, 778 F. Supp. 2d at 872 (“These statements are so general and devoid of any substantive content that they fail to communicate anything that would alter the total mix of information available to investors and the market.”). Moreover, Hochschild’s comments largely related to the performance and profitability of Discover’s student loans business. See Chew, 2024 WL 4346522, at *7 (“No reasonable investor would have understood these statements regarding the company’s overall performance to have any bearing on MoneyGram’s compliance outlook.”). To the extent Hochschild specifically discussed compliance-related matters, he observed that Discover has “had some compliance challenges there . . . .” [90-13] at 13. Because Hochschild’s statements were not materially misleading, § 10(b) and Rule 10b-5(b) did not impose any affirmative duty to disclose the full extent of Discover’s compliance issues. And “[m]ere silence about even material information is not fraudulent absent a duty to speak.” Stransky v. Cummins Engine Co., 51 F.3d 1329, 1331 (7th Cir. 1995); see Zebra Techs., 8 F.4th at 595 (“[T]he Securities Exchange Act does not impose a duty of total corporate transparency. A corporation need not couple each piece of good news with disclosure of some tangential difficulty.” (citation and internal quotation marks omitted)). Greene’s Statements at the Credit Suisse 24th Annual Financial Services Forum on February 14, 2023. When asked “[h]ow do you see those targeted capital levels evolving over time,” especially in light of Discover’s suspension of its share repurchase program, Greene answered: So what we’ve historically said is we would — we had a target of 10.5% and we’ve been persistently higher than that. In 2022, we put forward a really, really robust plan in terms of return of capital. We are executing on that very, very well, and then we had to pause at the end of the second quarter into the third quarter. Fortunately, we got that behind us. At the end of the year, I believe we had $2.8 billion remaining on our authorization, and the plan is to execute on that authorization in the first quarter of ’23 and into the second quarter of ’23. Then, we’ll share a proposal with our Board. The expectation is that we’ll continue to maintain our capital allocation priorities. So first, investment in organic growth. Second, return excess capital to shareholders. Then third, if there’s some sort of bolt-on M&A, we’ll look at it. But, no major changes in the priorities. [90-14] at 7–8. Plaintiffs argue that the sentence “we got that behind us” is misleading because Discover’s stock buyback suspension “was specifically tied to ‘student loan servicing practices and related compliance matters,’ an issue that was not in fact ‘behind the Company’ in February 2023 or even today.” [74] ¶ 268 (alterations omitted). This argument is unpersuasive—for two reasons. First, Greene did not say that Discover’s student-loans-related compliance issues are “behind us”; he said that Discover’s share buyback suspension was “behind us.” Plaintiffs do not allege that the suspension was still on pause as of February 14, 2023, such that Greene’s statement was false. Second, no reasonable investor hearing Greene’s answer to a question about Discover’s “targeted capital levels” would make the sweeping inference that Discover had resolved its compliance issues. Because Greene’s statement was not misleading, he had no duty to disclose information about Discover’s compliance position. 2022 Annual Report. On page 10 of this 180-page report, Discover stated that: Everything we do starts with a focus on our customers, including the products and services we offer, the exceptional customer service we provide and managing risk to prevent issues that could impact them. Managing risk is an essential part of the way we work and requires a strong compliance management system (CMS). We have focused on three key areas to strengthen our CMS over the past few years:  Increased management oversight through a dedicated team in compliance that monitors regulatory changes and helps assess our processes and make required changes to avoid customer harm.  Strong compliance programs to ensure we understand and follow regulatory requirements, identify potential risks, and put in place robust, effective processes that we regularly monitor and test to be certain they are working as designed.  Identifying and solving problems before customer harm happens, or when mistakes do occur, find the root causes, fix them quickly and prevent them from happening again. When we know, monitor and improve our processes through strong compliance management, we enhance the customer experience and eliminate or mitigate issues before they cause customer harm. [90-16] at 3. Plaintiffs argue that these statements are misleading “because they concealed Discover’s systemic and pervasive risk management, compliance, corporate governance, and internal control failures.” [74] ¶ 273; see [98] at 9. That argument is unpersuasive. Discover did not expressly assure that its compliance program was “robust,” “effective,” “dedicated,” “[s]trong,” and “working as designed”; it merely affirmed its “focus[]” on “put[ting] in place” processes “to strengthen” the program and “test” its efficacy. [90-16] at 3. These aspirational statements do not reasonably suggest that Discover’s compliance program was bound to deliver specific results, or that its compliance issues had been fixed. See Singh, 918 F.3d at 64 (explaining that “simple and generic assertions about having ‘policies and procedures’ and allocating ‘significant resources’” are not actionably misleading); Carvelli, 934 F.3d at 1321 (explaining that the company’s “proclamations that it was devoting ‘substantial resources’ to its problems, with ‘improved results,’ as well as its boasts that it was taking a ‘leading role’ and making ‘progress’ toward compliance” amounted to puffery); Chew, 2024 WL 4346522, at *9 (“[T]hese statements were limited to descriptions of the purpose of [the company’s] efforts; they made no claims whatsoever about the results of those efforts.”); Fifth Third Bancorp, 2022 WL 1642221, at *16 (explaining that a company’s description of its compliance program as “provid[ing] independent oversight to ensure consistency and sufficiency in the execution . . . is general and aspirational, and therefore not actionable”); Barilli v. Sky Solar Holdings, Ltd., 389 F. Supp. 3d 232, 253 (S.D.N.Y. 2019) (“[S]tatements regarding the introduction of internal controls do not, standing alone, constitute assertions that the controls are adequate, nor does a subsequent circumvention of such controls support an inference that descriptive statements about the implementation of such controls were false.”). Indeed, Discover expressly acknowledged that, notwithstanding its compliance program, “mistakes” leading to “customer harm . . . do occur.” [90-16] at 3. Even if a reasonable investor would interpret Discover’s Annual Report to describe its compliance program as “robust,” “effective,” “dedicated,” and “[s]trong,” [90-16] at 3—which it is not clear that a reasonable investor would—the Annual Report’s “adjective-laden statements are too vague and unverifiable” to be actionably misleading. Phoenix Ins. Co., Ltd. v. ATI Physical Therapy, Inc., 690 F. Supp. 3d 862, 877–878 (N.D. Ill. 2023) (noting that “intrinsically vague terms” describing the company’s compensation model as “competitive,” “superior,” and “favorable” “would alert any reasonable investor that puffery is at play”); see also W. Palm Beach Firefighters’ Pension Fund, 495 F. Supp. 3d at 653 (explaining that a statement touting the company’s “robust innovation” was vague, thus inactionable); Shemian, 2013 WL 1285779 at *20 (holding that a company’s “general” praise of new product was “too vague and inconsequential to give rise to any duty to disclose” potential shortcomings); Emps.’ Ret. Sys. v. Whole Foods Mkt., Inc., 905 F.3d 892, 902 (5th Cir. 2018) (“[A] reasonable investor will not judge [the company’s] value based on its own generalized and self-serving statements” about its “transparency, quality, and responsibility.”). Because no reasonable investor reading the 2022 Annual Report would be misled to conclude that Discover’s compliance program was adequate, Discover lacked a duty to disclose the full extent of its compliance issues. Under plaintiffs’ approach, “any company that has a compliance program and discloses that program in even the most austere terms would be required, ipso facto, to disclose any possible deviation that came to its attention.” In re FBR Inc. Sec. Litig., 544 F. Supp. 2d 346, 360 (S.D.N.Y. 2008). But neither § 10(b) nor Rule 10b–5(b) prescribes such an approach. “[R]evealing one fact about a subject does not trigger a duty to reveal all facts on the subject, so long as what was revealed would not be so incomplete as to mislead.” Richman v. Goldman Sachs Grp., Inc., 868 F. Supp. 2d 261, 274 (S.D.N.Y. 2012) (citation and internal quotation marks omitted); see City of Pontiac Policemen’s & Firemen’s Ret. Sys., 752 F.3d at 184 (“[D]isclosure is not a rite of confession, and companies do not have a duty to disclose uncharged, unadjudicated wrongdoing.” (citation and internal quotation marks omitted)); Gallagher, 269 F.3d at 808 (“[F]irms are entitled to keep silent (about good news as well as bad news) unless positive law creates a duty to disclose.”). Hochschild’s Statements During Quarterly Earnings Call on April 20, 2023. In his scripted remarks, Hochschild stated, in relevant part: As we look to the remainder of 2023, we may adjust our outlook as conditions evolve. We believe there is a potential for more stringent regulation. We believe we’re well positioned for more rigorous regulatory capital and liquidity requirements, given our strong internal standards, and we also continue to focus on enhancing our compliance management systems. [90-17] at 4. Plaintiffs challenge as misleading Hochschild’s statement that Discover will “continue to focus on enhancing our compliance management systems.” [74] ¶ 274. However, no reasonable investor hearing this statement would conclude that Discover’s compliance program was adequate. Statements identifying an area of “focus” do not convey assurances that the company has made satisfactory progress in that area.6 See Fifth Third Bancorp, 2022 WL 1642221, at *18 (explaining that a company’s “vague, optimistic statements” that “we are focused on growing our credit

6 To the extent Hochschild’s comments gave investors the impression that Discover’s compliance program was adequate, Greene followed up by describing compliance as “an area of investment.” [90-17] at 11. Further, Greene stated that “we are still seeing good opportunities to generate positive account growth with an appropriate risk tolerance,” informing investors that Discover’s business model involved some level of risk exposure. Id. at 8 card business” and “we are prioritizing organic growth opportunities” “do not support a securities fraud claim”). Because the challenged statement was not misleading, it did not create a duty to disclose the full extent of Discover’s compliance issues. 2022 Environmental, Social and Governance Report. The May 3, 2023, report begins with “A message from Roger”: Our core value of “Doing the Right Thing” guides our approach in all we do, from serving our customers and communities to ensuring strong governance to reducing our environmental impact. . . . Discover holds $71 billion in direct-to-consumer deposits, has the third largest payments network in the world, and serves tens of millions of customers each day. As such, having strong governance and risk management is critical. We adhere to a rigorous Code of Conduct, have protocols in place to meet regulatory requirements, prioritize cybersecurity and data privacy to protect consumers from online attacks, and are committed to transparency, accountability, and ethical behavior in all we do . . . . Our enterprise-wide risk management framework, which is reviewed and approved by our Board of Directors and overseen by its Risk Oversight Committee, enables the consistent execution of risk management principles through a comprehensive set of programs. These programs are defined in formal policies and procedures and support our businesses in identifying, measuring, managing, monitoring, and reporting their risks. Independent oversight, including adherence to policy requirements, is provided by the second and third lines of defense. Collectively, our risk management framework and supporting programs ensure our businesses are making risk-informed decisions and appropriately balancing risk and return in their activities. ESG risks, including climate-related risks, are managed in accordance with our risk management framework, and we continue to enhance processes to embed evolving ESG and climate risk considerations. [90-37] at 3–4. Plaintiffs challenge Hochschild’s statements that “having strong governance and risk management is critical,” and that “[o]ur enterprise-wide risk management framework . . . enables the consistent execution of risk management principles through a comprehensive set of programs.” [74] ¶ 296. For the reasons discussed as to other statements describing Discover’s compliance goals and capabilities, Hochschild’s vague and aspirational assertions are inactionable. See Citigroup, 2023 WL 2632258, at *14 (concluding that a company’s touting of its “risk governance framework” and its “policies, procedures, and processes” was not actionable because those statements were “exactly the types of routine representations of risk-management practices that almost every . . . bank makes . . .” (citation and internal quotation marks omitted)). Specifically, Hochschild’s statement describing risk management as “critical” is not actionable because a description of a company’s priorities does not reasonably suggest that those priorities have been achieved. See Chew, 2024 WL 4346522, at *9 (“No reasonable investor would have understood defendants’ statements as promising—or even predicting—that defendants’ compliance efforts would be found to satisfy [the company’s] obligations.”). Similarly, Hochschild’s statement describing Discover’s “consistent execution of risk management principles” was too generic to reasonably suggest specific results. [90-37] at 4; see In re Telefonaktiebolaget LM Ericsson Sec. Litig., 675 F. Supp. 3d 273, 283, 290–92 (E.D.N.Y. 2023) (concluding that a company’s statements touting its “zero tolerance approach to corruption” that was “implemented . . . throughout its global organization with a set of policies and processes” were inactionable because they were “‘simple and generic assertions’ regarding [the company’s] commitment to regulatory compliance and anti-corruption measures” (quoting Singh, 918 F.3d at 64)). Thus, Hochschild’s description of compliance as “critical” to Discover’s values and his failure to disclose additional information about Discover’s compliance issues are inactionable under § 10(b) and Rule 10b–5(b). Hochschild’s Statements During Annual Shareholder Meeting on May 11, 2023. In another set of scripted remarks, Hochschild stated, in relevant part: In 2023, we’re focused on maturing our compliance and risk management, including strengthening our monitoring and testing, and strengthening all three lines of defense to better identify, assess, and mitigate risk. We’re accelerating growth by driving awareness of the products and features we offer. We’ll also continue to improve our mobile-first experience and enhance existing products to ensure they meet consumers’ changing needs. [90-18] at 6. Plaintiffs challenge the first sentence of that paragraph as misleading, arguing that “in fact Discover needed to do much more than merely ensure it was ‘maturing’ or ‘strengthening’ its compliance and risk management.” [74] ¶ 277. This argument is unpersuasive. Similar to his statements during the April 20, 2023, quarterly earnings call, Hochschild’s vague assertion that Discover was “focused” on “maturing” and “strengthening” its compliance capabilities is inactionable. Because those assertions would not mislead any reasonable investor into believing that Discover’s compliance program was adequate, Hochschild had no duty to disclose the full extent of Discover’s compliance issues. See Jaroslawicz v. M&T Bank Corp., 912 F.3d 96, 110 (3d Cir. 2018) (“[A] duty to disclose corporate misconduct is only triggered where non-disclosure makes other voluntary statements misleading.”). B. Statements Describing Discover’s Compliance-Related Investments Plaintiffs challenge as misleading individual defendants’ statements describing Discover’s commitment to—and investments in—compliance. Hochschild’s Statements During Quarterly Earnings Call on October 22, 2020. In response to an analyst’s comment that Discover had “guided to negative operating leverage”—that is, a net loss position—“due to years of chronic underinvestment,” Hochschild stated that: So first having been here for over 20 years, I have to maybe disagree with the phrase chronic underinvestment. I think our investments have been appropriate. But at the beginning of the year, we saw an opportunity to invest more. And so I would characterize it that way. [74] ¶ 248; see [90-9] at 9. Plaintiffs argue that Hochschild’s statement misled investors into believing that there were no “significant gaps and deficiencies” in Discover’s “risk management and corporate governance framework.” [74] ¶ 250. This argument is unpersuasive—for two reasons. First, Hochschild’s statements—in context—did not specifically address Discover’s investments in compliance. Hochschild was asked whether Discover had “lost its expense discipline,” whether “years of chronic underinvestment” had caused “negative operating leverage,” and whether Discover could “continue to generate consistent positive operating leverage as we look to the other side of this.” [90-9] at 9. Neither the analyst’s question nor Hochschild’s answer specifically related to compliance. When Hochschild said “our investments have been appropriate” and “we saw an opportunity to invest more,” he was talking about Discover’s overall financial and business outlook—not its compliance position. That much is clear from other parts of his response, where he discusses “our overall lower cost operating model,” “the effectiveness of that business model even through extremely challenging cycles,” and the “day-to-day corporate type expenses that we’re always trying to bring down.” [90- 9] at 9. No reasonable investor would interpret Hochschild’s generalized statements about Discover’s high-level business approach to convey specific assurances about its compliance program.7 See FTC v. Trudeau, 579 F.3d 754, 766 (7th Cir. 2009) (“In determining whether a statement is puffery, the context matters.”).

7 Plaintiffs argue that defendants’ references to other statements in Hochschild’s speech improperly refute the complaint’s allegations. [98] at 16. Not so. “To the extent that an exhibit attached to or referenced by the complaint contradicts the complaint’s allegations, the exhibit takes precedence.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1020 (7th Cir. 2013); see Omnicare, 575 U.S. at 190 (explaining that, at the pleading stage, the court must consider the “surrounding text” of each allegedly fraudulent statement, “including hedges, disclaimers, and apparently conflicting information”). Second, even assuming that a reasonable investor could perceive Hochschild to be describing Discover’s compliance-related investments as “appropriate,” these “simple and generic assertions” about Discover’s levels of investment are insufficient to induce reasonable reliance. Singh, 918 F.3d at 64; see Searls v. Glasser, 64 F.3d 1061, 1066 (7th Cir. 1995) (explaining that a company’s description of its business as “recession-resistant” “lacks the requisite specificity to be considered anything but optimistic rhetoric,” thus is “better described as puffery rather than as material statements of fact”). Greene’s Statements at the Credit Suisse Virtual Financial Services Forum on February 25, 2021. During a presentation about Discover’s financial and business position, Greene was asked “about [his] views on operating efficiency[,] [h]ow they evolved over the last year[,] [a]nd how we should kind of think about that going forward[.]” [90-10] at 8. Greene answered that “[w]e’re not going to manage specifically to efficiency ratio, but what we are going to do is manage the business efficiently.” Id. He elaborated: So by that, [what] I mean is a real focus on corporate cost. Those dollars that aren’t directly attributable to our ability to grow or our ability to grow in a compliant way. So we’re [a] regulated financial services institution. We’re going to put money into risk and compliance as we want. But the other G&A functions, we’re going to try to through operation. We’ve got a program, call it, operational effectiveness, that we are going to focus on, both process and headcount, in order to ensure that as we move forward and hit a period of growth that we’re not having to scale up the G&A functions as we’re growing the top line. Now that will, in turn, create positive operating leverage as well as an improvement in the efficiency ratio over time. With—the pandemic was the start of it, and we’re going to continue through ’21 into ’22, and thereby freeing up money to put on to top line growth initiatives. Id.; see [74] ¶ 253. Plaintiffs challenge only two sentences of Greene’s answer: first, that Discover will cut costs on “[t]hose dollars that aren’t directly attributable to our ability to grow or our ability to grow in a compliant way”; second, that “[w]e’re going to put money into risk and compliance as we want.” Plaintiffs argue that these statements are misleading in light of Greene’s later admission—33 months later— that Discover “historically underinvested” in compliance. [74] ¶ 254. This argument is unpersuasive. No reasonable investor would interpret Greene’s statements to mean that Discover invested appropriate sums into its compliance program. Greene’s answer was directed at the interviewer’s comment that “most of the kind of controllable or nondiscretionary types of expenses should be flattish, maybe some of them down even, and then kind of putting the money into the growth-oriented marketing type expenses”—in other words, that Discover should reduce overhead and divert investment toward business units that generate significant revenue. [90-10] at 8. When Greene responded that Discover might cut “[t]hose dollars that aren’t directly attributable to our ability to grow or our ability to grow in a compliant way,” he did not suggest that Discover’s compliance-related investments were adequate, but that they would not be cut as part of Discover’s top- to-bottom strategy to “manage the business efficiency.” Id. Greene affirmed that takeaway by assuring investors that “[w]e’re going to put money into risk and compliance as we want.” Id. To say that compliance-related investments will not be cut is not to imply that their current levels are sufficient.8 Tellingly, plaintiffs do not allege that Discover cut its compliance-related investments while telling the public the opposite. See Chew, 2024 WL 4346522, at *8 (“A corporation and its officers are entitled to make truthful reports of specific expenditures or performance metrics without incurring an obligation to air every ounce of the corporation’s dirty laundry.”). Hochschild’s Letter to Shareholders Dated March 21, 2023. In a two-page letter, and under the subheading “Succeeding with Shareholders,” Hochschild wrote that “[w]e invested significantly in key areas of our business to advance our data and analytics capabilities, improve our products and features, strengthen compliance and expand our global acceptance footprint.” [90-15] at 2. Similar to statements made in the 2022 Annual Report, no reasonable investor would interpret this vague and optimistic statement about Discover’s “significant[]” investments “in key areas of our business” to mean that its compliance program was adequate to deal with the compliance issues facing the company. See Singh, 918 F.3d at 64 (concluding that the company’s statement about “allocating ‘significant resources’” toward compliance was inactionable). Hochschild’s Statements During Bernstein’s 39th Annual Strategic Decisions Conference on June 2, 2023. When asked to “talk through where you see the incremental dollars going, the need to invest[,] [and] any thoughts on the guidance on expenses from here,” Hochschild answered: So for us, the biggest driver of expenses is headcount, right? We’ve been investing in people, both for the technology side. But as I talked about in the first question on the compliance side as well. And so our spending on compliance and risk management is up roughly $250 million a year from 2019. It reflects that compliance is our top priority. And so an area we need to make sure we continue to invest. In terms of the puts and

8 According to the amended complaint, Greene said that “‘as a regulated financial institution,’ Discover was ‘ab[le] to grow in a compliant way . . . .’” [74] ¶ 254 (brackets in original). Here is a more complete quotation of Greene’s sentence: “So by that, I mean is a real focus on corporate cost. Those dollars that aren’t directly attributable to our ability to grow or our ability to grow in a compliant way.” [90-10] at 8. Greene’s statement that Discover would not cut costs “directly attributable to . . . our ability to grow in a compliant way” does not suggest that Discover actually manifested that sort of growth. takes and how that translates into overall expense levels, it’s a bit hard to say. And so John talked at the last call about there being some upward pressure on that range. Part of it will also depend on the economy because if conditions deteriorate, you tend to cut back on marketing, and so there’s an offsetting savings on the expense side. So we’ll probably provide an update on the next call as we get more clarity towards the back half of the year. But obviously continuing to make those investments on the compliance side, but also on building capabilities that will continue to let us succeed. [90-19] at 12. Plaintiffs challenge as misleading Hochschild’s statements that “compliance is our top priority” and “we need to make sure we continue to invest” in compliance, on grounds that he “concealed Discover’s systemic and pervasive risk management, compliance, and internal control failures.” [74] ¶ 281. This argument is unpersuasive for the reasons already discussed with respect to Hochschild’s other statements. His vague assertions that “compliance is our top priority” and Discover “obviously continu[es] to make those investments on the compliance side” are inactionable. [90-19] at 12; see Plumber & Steamfitters Loc. 773 Pension Fund v. Danske Bank A/S, 11 F.4th 90, 103 (2d Cir. 2021) (“General declarations about the importance of acting lawfully and with integrity are inactionable puffery, especially when expressed in aspirational terms.” (citation and internal quotation marks omitted)); In re Citigroup Sec. Litig., 2023 WL 2632258, at *8, *18 (company’s statement that “prudent risk management was top of mind for both management and the board” constituted “immaterial ‘milquetoast corporate- speak.’” (citation omitted)). Hochschild’s statement that “we need to make sure we continue to invest” in compliance is not misleading either. No reasonable investor who hears a statement about what a company “needs” to do will infer that the company has done it. Because no reasonable investor could be misled to believe that Discover’s compliance program was adequate, Hochschild had no duty to disclose the full extent of Discover’s compliance issues. C. Statements Relating to Discover’s Code of Ethics Specific Statements in Discover’s Code of Ethics. During the period relevant to this litigation, Discover published a Code of Ethics and Business Conduct (“Code of Ethics”). The version dated October 23, 2019, stated that: “[t]he Company complies with both the letter and the spirit of fair and responsible banking laws,” and “the Company complies with federal and state laws that prohibit unfair, deceptive, or abusive acts or practices.” [74] ¶ 294; see [90-35]. Plaintiffs argue that these statements are misleading because Discover did not comply with applicable banking and consumer protection laws when the Code of Ethics was published and later amended. This argument is unpersuasive. As the first sentence of the Code explained, the document “sets forth principles that you must follow in your activities as a director, officer, or employee” of the company. [90-35] at 2. The document continues: The Code of Ethics does not cover every legal or ethical issue that you may face at the Company. However, by following the Code of Ethics and other Company policies and procedures, by adhering to the letter and the spirit of all applicable laws and regulations, and above all by applying sound judgment to your activities, you can demonstrate your commitment to the Company’s values. The Company is subject to numerous laws and regulations in a variety of domestic and international jurisdictions. It is your responsibility to understand the laws applicable to your job responsibilities and to comply with both the letter and the spirit of these laws. Certain significant policies, laws and regulations are highlighted below, and additional information may be found in other applicable Company policies and procedures, including the Code of Conduct. This does not constitute a complete listing of the laws, rules, regulations and policies that must be adhered to by every person subject to the Code of Ethics. Id. Immediately following the statement that “[t]he Company is committed to full compliance with” anti-money laundering, anti-terrorism, anti-bribery, and anti- corruption laws, the section on “Consumer Protection” states: The Company complies with both the letter and the spirit of fair and responsible banking laws. The Company is committed to adhering to the regulatory prohibition against unfair, deceptive, and abusive acts and practices and to making financial services available to customers and prospective customers on a fair and consistent manner. The Company offers and extends all of its products and services to any qualified applicant without regard to race, color, religion, national origin, sex, marital status, familial status, handicap, age (provided the applicant has the legal capacity to enter into a binding contract), the fact that all or part of a customer’s or prospective customer’s income is derived from any public assistance program, or the fact that a customer or prospective customer has—in good faith—exercised any of his or her rights under the Consumer Credit Protection Act. The Company maintains a program to monitor and enforce its policies on fair and responsible banking. Id. at 3. Toward the end, the Code proclaims that “[t]he Company’s reputation for integrity depends upon you. You are the Company’s first line of defense against civil or criminal liability and unethical business practices.” Id. at 7–8. The Code concludes with the lofty declaration that “[a] truly great, visionary company continuously lives and defends its values. Only by doing so can the Company realize the potential of its constituent parts and the talents of its people.” Id. at 9. No reasonable investor reading the Code as a whole would come away with the impression that Discover’s various statements about its approach toward consumer protection laws amount to “concrete assertion[s]” to the investing public about its compliance condition. Zebra Techs., 8 F.4th at 595. The target audience—the “you” that the Code addresses—is the officers and employees of the company, whose “responsibility [is] to understand the laws applicable to [their] job responsibilities and to comply with both the letter and the spirit of these laws.” [90-35] at 2. Read fairly and in context, the Code purports only to impose duties on the company’s agents, not to make any definite guarantees that either the company or its agents are fully complying with those duties. Indeed, a “company’s adoption and publication of a code of ethics does not imply that all of its directors and officers are in compliance with that code.” Desai, 654 F. Supp. 2d at 859 (rejecting the argument “that publication of an ethics code on a website is equivalent to a representation that the code is not being violated”); see also In re Braskem S.A. Sec. Litig., 246 F. Supp. 3d 731, 756 (S.D.N.Y. 2017) (“There is an important difference between a company’s announcing rules forbidding bribery and its factually representing that no officer has engaged in such forbidden conduct.”). To the extent the target audience of the Code of Ethics is the investing public, the allegedly misleading statements in it amount to inactionable puffery. While the statement “[t]he Company complies with both the letter and the spirit of fair and responsible banking laws” could arguably be interpreted as a factual assertion, it is sandwiched between generalized, aspirational statements about Discover’s commitment to compliance with “Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Programs,” “Anti-Bribery and Corruption” laws, and “regulatory prohibition[s] against unfair, deceptive, and abusive acts and practices.” [90-35] at 2–3. Later in the document, the Code indicates that violations may arise, instructing supervisors “to take appropriate steps . . . to stop any misconduct that you are aware of and to prevent its recurrence.” Id. at 8. No reasonable investor—reading the Code as a whole—would identify any concrete assertion about the effectiveness of Discover’s compliance program. See Fifth Third Bancorp, 2022 WL 1642221, at *16 (describing the company’s “stated core principles” to “conduct business in compliance with all applicable laws, rules and regulations” and “act with integrity in all activities” as “non-specific puffery on which no reasonable investor would rely” (internal quotation marks omitted)); In re Braskem, 246 F. Supp. 3d at 755–56 (“Because a code of ethics is inherently aspirational, it simply cannot be that every time a violation of that code occurs, a company is liable under federal law for having chosen to adopt the code at all.” (citation and internal quotation marks omitted)). “General statements in [a company’s] Code of Business Conduct about the company’s policy to comply with” with applicable law “are goal-driven and cannot be reasonably read as promises or guarantees to investors of complete compliance with all such laws and regulations.” Del. Cnty. Emps. Ret. Sys. v. Cabot Oil & Gas Corp., 579 F. Supp. 3d 933, 948 (S.D. Tex. 2022); see Singh, 918 F.3d at 63 (“[G]eneral declarations” in Code of Ethics “about the importance of acting lawfully and with integrity” are “textbook example[s] of ‘puffery’”). Here, the statements in Discover’s internal Code of Ethics amounted to nothing more than inactionable puffery. Thus, § 10(b) and Rule 10b–5(b) did not impose an affirmative duty for Discover to disclose the full extent of its compliance problems. D. Sarbanes-Oxley Certifications and Statements Relating to Discover’s Internal Control over Financial Reporting Section 302(a) of the Sarbanes-Oxley Act (“SOX”), 15 U.S.C. § 7241(a), requires “that the principal executive officer or officers and the principal financial officer or officers . . . certify in each annual or quarterly report filed or submitted under” 15 U.S.C. §§ 78m(a) and 78o(d) that the officer has conducted certain statutorily enumerated activities. During the period relevant to this litigation, Hochschild, Greene, and Graf attached signed certifications to Discover’s Form 10-Ks. They certified each item listed in § 302(a)(4) of the Sarbanes-Oxley Act—specifically, that they:  “Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared,” [90-4] at 23;  “Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles,” id.;  “Evaluated the effectiveness of the registrant’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation[,]” id.;  “Disclosed in this report any change in the registrant’s internal control over financial reporting that occurred during the registrant’s most recent fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting . . . ,” id. [74] ¶ 290; see 15 U.S.C. § 7241(a)(4). Plaintiffs challenge these certifications on the grounds that Hochschild, Greene, and Graf failed to disclose Discover’s “systemic and pervasive failures to implement and maintain appropriate risk management, compliance, corporate governance, and internal control systems and practices.”9 [74] ¶ 292. SOX certifications regarding the design and effectiveness of Discover’s “internal control over financial reporting” do not support plaintiffs’ theory of securities fraud. The amended complaint adopts the SEC’s definition of “internal control over financial reporting”: “a process . . . to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles . . . .” 17 C.F.R. § 240.13a-15(f); see [74] ¶ 93. The Form 10-K also adopts the SEC’s definition. See [90-4] at 22. Statements about a company’s internal control over financial reporting do not necessarily convey facts about that company’s compliance program generally. See Boston Ret. Sys. v. Alexion Pharms., Inc., 556 F. Supp. 3d 100, 129 (D. Conn. 2021) (dismissing securities fraud claim predicated upon allegedly false or misleading SOX certifications where “[n]one of [plaintiffs’] factual allegations relate to deficiencies or material weaknesses in the design or operation of internal controls over financial reporting”). As alleged, Discover faced various compliance-related setbacks during the relevant time period: FDIC and CFPB consent orders, [74] ¶¶ 160–211, litigation and regulatory action challenging Discover’s credit card and student loans business practices, id. ¶¶ 218–237, 352–355, suspension of its share repurchase program, id. ¶¶ 343, 346–48, and the resignation of its CEO, id. ¶¶ 356–361. But none of these allegations specifically relates to Discover’s financial reporting or accounting practices. The amended complaint does not challenge the opinion of Discover’s independent auditor (Deloitte & Touche LLP) that “the financial statements present fairly, in all material respects, the financial position of the Company as of December 31, 2018 and 2017, and the results of its operations and its cash flows for each of the three years in the period ended December 31, 2018, in conformity with accounting principles generally accepted in the United States of America.” Discover, 2018 Form 10-K (Feb. 20, 2019), at 77. The amended complaint does not allege, with any particularity, that Discover’s internal control over financial reporting was inadequate, that Discover submitted erroneous financial reports or accounting documents, or that such errors exposed the company to litigation or regulatory action affecting its stock price. Absent particularized allegations on this score, defendants’ SOX certifications regarding Discover’s internal control over financial reporting do not amount to securities fraud. See In re Banco Bradesco S.A. Sec. Litig., 277 F. Supp. 3d 600, 648 (S.D.N.Y. 2017) (“Even if it were sufficient for Plaintiff to allege that a

9 Plaintiffs fail to address defendants’ argument that plaintiffs improperly conflate statements about Discover’s internal control over financial reporting with issues regarding Discover’s compliance program. See generally [98]; see [90] at 28–29. Thus, any counterargument is waived. See Bonte v. U.S. Bank, N.A., 624 F.3d 461, 466 (7th Cir. 2010) (”[F]ailure to respond to an argument . . . results in waiver”). However, putting waiver aside, plaintiffs’ theory also fails on the merits. failure in internal controls occurred, the amended complaint fails to allege any such failure with respect to the Company’s financial reporting.”); Green v. Deutsche Bank Aktiengesellschaft, 18–CV–5104 (AJN), 2019 WL 4805804, at *2 (S.D.N.Y. Sept. 30, 2019) (“[T]he Amended Complaint never explains why these alleged deficiencies support the idea that the bank’s management failed to find the internal controls over financial reporting effective under the COSO framework. In fact, it never explains what these alleged deficiencies have to do with financial reporting at all.”); In re Gentiva Secs. Litig., 932 F. Supp. 2d 352, 371 (E.D.N.Y. 2013) (dismissing securities fraud claim challenging SOX certifications regarding internal controls over financial reporting where plaintiffs neither “challenge the Defendants’ accounting in any of the SEC filings” nor “allege[] any facts pertaining to the Company’s internal structure for financial reporting . . .” (citation omitted)); In re Sunedison, Inc., 300 F. Supp. 3d 444, 471 (S.D.N.Y. 2018) (“These statements about deficient internal controls related to internal management of cash and management’s disclosures to the board, and not to public financial reporting.”); In re PetroChina Co., 120 F. Supp. 3d 340, 359 (S.D.N.Y. 2015) (“Even if PetroChina officials were engaging in bribery, the [Second Amended Complaint] does not make any allegations that would imply that the Company had flawed internal controls over financial reporting.”). Furthermore, even assuming that statements regarding Discover’s internal control over financial reporting might bear on compliance generally, no reasonable investor would interpret the challenged certifications to convey concrete assurances about the adequacy of Discover’s compliance program. Statements about who was involved in the development of Discover’s “disclosure controls and procedures” would not lead a reasonable investor to infer facts about what results those controls and procedures yielded. [90-4] at 23. Plaintiffs do not allege, with any particularity, that Hochschild, Greene, and Graf skirted their responsibilities to supervise the design and testing of Discover’s compliance program.10 Plaintiffs allege that the program was inadequate. But Hochschild, Greene, and Graf did not certify to the contrary.11

10 The amended complaint alleges that “the Company’s executives ‘leaned on’ compliance personnel—specifically, ‘a little mini risk office inside the business to help the business with risk, controls and compliance,’ known at Discover as the ‘one and half lines of defense’—to ‘do their controls and their compliance for them.’” [74] ¶ 107. But this allegation is entirely consistent with Hochschild, Greene, and Graf’s certification that they “caused” employees to design and test Discover’s compliance program “under [their] supervision.” [90-4] at 23, 24. As alleged, the “first-line scoping team” and “first-line testing team” report up to their managers. [74] ¶¶ 110–116. And Hochschild sat atop the chain of command. Plaintiffs do not contend that the Sarbanes-Oxley Act proscribes this “delegation of responsibilities.” Id. ¶ 108. 11 Plaintiffs also argue that these certifications would mislead a reasonable investor into believing that Hochschild, Greene, and Graf “were actively monitoring those controls and procedures to ensure their integrity.” [74] ¶ 100. But their certifications did not say that they were “actively monitoring” Discover’s compliance program, only that they “caused such disclosure controls and procedures to be designed under [their] supervision[.]” [90-4] at 23. Pursuant to § 302(a)(5) of the Sarbanes-Oxley Act, 15 U.S.C. § 7241(a)(5), Hochschild, Greene, and Graf also certified that they “have disclosed . . . to the registrant’s auditors and the audit committee of the registrant’s board of directors”:  “All significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the registrant’s ability to record, process, summarize and report financial information,” [90-4] at 23;  “Any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal control over financial reporting,” id. See [74] ¶ 291; see also, e.g., [90-8] at 23, 24 (2022 Form 10-K). Plaintiffs argue that these certifications “conveyed to investors that” Hochschild, Greene, and Graf “determined there were no significant deficiencies or material weaknesses in the design or operation of the Company’s” internal control over financial reporting. [74] ¶ 100. But that is not what they certified, and no reasonable investor could interpret the certifications otherwise. They certified that Discover’s Form 10-K disclosed “to auditors and the audit committee of [Discover’s] board of directors” “significant deficiencies,” “material weaknesses,” and “[a]ny fraud”—not that the Form 10-K disclosed to the public the full extent of Discover’s compliance problems or that such problems did not exist. Furthermore, as discussed with respect to Hochschild, Greene, and Graf’s certifications corresponding to § 302(a)(4) of the Sarbanes-Oxley Act, plaintiffs do not allege—with any particularly—that Discover’s financial reporting or accounting practices were deficient. Reasonable investors evaluating specific statements about a company’s internal control over financial reporting would not infer that the company’s compliance program is generally adequate. Under plaintiffs’ theory, an executive who certifies a filing must also disclose to the investing public all information pertaining to deficiencies in the company’s compliance program, and failure to do so constitutes securities fraud. But § 302(a) of the Sarbanes-Oxley Act imposes no such mandate. See Jaroslawicz, 912 F.3d at 110 (“[W]e have never recognized a duty to disclose all corporate wrongdoing in securities filings.”); In re Banco Bradesco, 277 F. Supp. 3d at 661 (“[T]he securities laws do not impose on corporations a general, free-standing duty to disclose uncharged illegal conduct.”). Indeed, § 302(a)’s certification requirements track the elements of a securities fraud claim under § 10(b) and Rule 10b–5(b). See 15 U.S.C. § 7241(a)(2) (requiring the signing officer to certify that “based on the officer’s knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which such statements were made, not misleading”). Section 10(b) and Rule 10b–5

The amended complaint does not allege that Hochschild, Greene, and Graf failed to supervise subordinates who designed Discover’s disclosure controls and procedures. “do not create an affirmative duty to disclose any and all material information.” Matrixx Initiatives, 563 U.S. at 44. And § 302(a) does not backdoor such a duty. The amended complaint further challenges as misleading the following statement in Discover’s 2018 Form 10-K: Management assessed the effectiveness of our internal control over financial reporting as of December 31, 2018. In making this assessment, management used the criteria set forth in Internal Control Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on management’s assessments and those criteria, management has concluded that our internal control over financial reporting was effective as of December 31, 2018. [90-4] at 22; [74] ¶ 283. However, no reasonable investor would interpret this statement to convey concrete assurances about Discover’s compliance position. As discussed in the context of Hochschild, Greene, and Graf’s SOX certifications, Discover’s statement that “our internal control over financial reporting was effective” does not appear to discuss Discover’s compliance program generally. That language appears in the section of the Form 10-K titled “Management’s Report on Internal Control over Financial Reporting,” which explained that “[o]ur internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with generally accepted accounting principles.” [90-4] at 22. Discover’s statements about its approach to financial reporting and accounting do not convey concrete assurances about the effectiveness of Discover’s compliance program generally. Thus, based on the facts alleged, Discover’s Form 10-K statements regarding its internal control over financial reporting do not support a plausible securities fraud claim. In sum, certifications and statements related to Discover’s internal control over financial reporting do not support a plausible § 10(b) or Rule 10b–5 claim. E. Item 303 Last, plaintiffs attempt to ground their § 10(b) and Rule 10b–5(b) claims on defendants’ alleged failure to disclose certain information required under Item 303 of SEC Regulation S-K. [74] ¶¶ 299–301; [98] at 18–19; see 17 C.F.R. § 229.303. But Item 303 “is an SEC rule governing the contents of documents that companies must file with the SEC”—“not a catch-all disclosure requirement applicable to all public statements.” Chew, 2024 WL 4346522, at *26. Thus, among the various statements by various defendants that plaintiffs challenge as false or misleading, Item 303 applies only to statements on Discover’s SEC filings, such as its Form 10-Ks. Item 303 requires the filing to “focus specifically on material events and uncertainties known to management that are reasonably likely to cause reported financial information not to be necessarily indicative of future operating results or of future financial condition.” 17 C.F.R. § 229.303(a). “[T]he failure to disclose information required by Item 303 can support a Rule 10b–5(b) claim,” but “only if the omission renders affirmative statements made misleading.” Macquarie, 601 U.S. at 265. In other words, Item 303 does not enlarge § 10(b) and Rule 10b–5 to reach “pure omissions.” See Chew, 2024 WL 4346522, at *25. As discussed, none of the statements on Discover’s Form 10-Ks would mislead a reasonable investor to believe that Discover’s compliance program was adequate. Indeed, Discover disclaimed any impression readers might have about the results of its compliance program, informing them that “[t]he litigation process is not predictable and can lead to unexpected results,” and that “regulatory agencies . . . may assess civil money penalties, require changes to certain business practices or require customer restitution at any time.” See Discover, 2018 Form 10-K (Feb. 20, 2019), at 130. Because none of the affirmative statements on Discover’s Form 10-K was misleading, Discover was not obliged to disclose more. Thus, plaintiffs’ § 10(b) and Rule 10b–5 claims predicated on Item 303 are dismissed. II. SEC Rules 10b–5(a) and (c) Pivoting away from SEC Rule 10b–5(b), plaintiffs invoke SEC Rules 10b-5(a) and (c). Rules 10b–5(a) and (c) make it unlawful “[t]o employ any device, scheme, or artifice to defraud,” 17 C.F.R. § 240.10b-5(a), and “[t]o engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person,” id. § 240.10b-5(c), “in connection with the purchase or sale of any security,” id. § 240.10b-5. The “dissemination of false or misleading statements with intent to defraud can fall within the scope of subsections (a) and (c) of Rule 10b–5 . . . .” Lorenzo v. SEC, 587 U.S. 71, 78 (2019). To adequately plead a “device, scheme, or artifice to defraud,” plaintiffs must adequately plead some “manner of fraud in the securities industry.” Id. at 85. The use of “false representations to induce the purchase of securities” is “a paradigmatic example of securities fraud.” Id. at 81. In this case, the alleged fraudulent scheme is Hochschild, Greene, and Graf’s “concealment of material information from investors regarding the Company’s underinvestment in risk management and compliance for the purpose of artificially inflating [earnings per share] and reaping undue compensation based on that manipulated metric.” [98] at 45; see [74] ¶¶ 18, 387; [98] at 45. As discussed in Part I of this opinion, the amended complaint does not allege any false or misleading statements that convey facts that a reasonable investor would deem “important in deciding how to” trade. Smykla, 85 F.4th at 1236; see SEC v. Rio Tinto PLC, 41 F.4th 47, 55 (2d Cir. 2022) (explaining that plaintiffs may not “repackage their misstatement claims as scheme liability claims to evade the pleading requirements imposed in misrepresentation cases” (citation and internal quotation marks omitted)). Plaintiffs assert, in the alternative, that defendants perpetrated a scheme to defraud “based on their improper manipulation of shares outstanding and EPS [earnings per share] through stock buybacks.” [98] at 44; see [74] ¶ 18 (alleging that defendants “caused Discover to underinvest in risk management and compliance so they could instead pursue an aggressive stock repurchase program that directly inflated Hochschild’s and other Company executives’ personal compensation”). On this point, plaintiffs argue that “[i]t is the use of the share repurchases to artificially lower EPS for the Officer Defendants’ personal benefit, in addition to their improper concealment of material facts, that was deceptive and manipulative.” [98] at 45 (emphasis removed). This argument is unpersuasive. To the extent plaintiffs’ theory targets defendants’ decisions to “underinvest in risk management and compliance” and “pursue an aggressive stock repurchase program,” plaintiffs fail to adequately allege that this conduct was deceptive.12 Decisions that “might reflect bad business judgment or even mismanagement” do not necessarily rise to securities fraud. Fryman v. Atlas Fin. Holdings, Inc., 462 F. Supp. 3d 888, 898 (N.D. Ill. 2020); see DiLeo v. Ernst & Young, 901 F.2d 624, 627 (7th Cir. 1990) (“Securities laws do not guarantee sound business practices and do not protect investors against reverses.”); Gosselin v. First Trust Advisors L.P., No. 08 C 5213, 2009 WL 5064295, at *2 (N.D. Ill. Dec. 17, 2009) (“Generally, absent some sort of deception, misrepresentation, or purposeful omission, the federal securities laws do not protect investors from mismanagement of investments or poor business judgment.”). As discussed in Part I of this opinion, plaintiffs do not sufficiently allege that defendants made any misrepresentations or omissions that would have led a reasonable investor to believe that Discover’s compliance-related investments were adequate. Absent some material misrepresentation or omission to that effect, Discover’s business decision to prioritize investment in certain areas over others does not amount to securities fraud. And specifically with respect to defendants’ decision to “pursue an aggressive stock repurchase program,” plaintiffs do not allege that defendants concealed material facts about that program. Indeed, Discover’s SEC filings disclose the extent of its stock repurchases. See, e.g., [90-4] at 15 (2018 Form 10-K) (“In the year ended December 31, 2018, we . . . repurchased approximately 8% of our outstanding common stock under our share repurchase program.”). Plaintiffs do not allege that these disclosures were inaccurate.

12 To the extent plaintiffs’ scheme liability theory is predicted on defendants’ misstatements or omissions, that theory is implausible for reasons already discussed. Because the amended complaint fails to allege any statements, omissions, or conduct to support a plausible scheme liability theory under Rules 10b–5(a) and (c), plaintiffs’ scheme liability claims are dismissed. III. Section 20(a) Section 20(a), 15 U.S.C. § 78t(a), “set[s] out ‘control person’ liability—providing a vehicle to hold one defendant vicariously liable for the securities violations committed by another.” Donohoe v. Consol. Operating & Prod. Corp., 30 F.3d 907, 911 (7th Cir. 1994). To state a § 20(a) claim, “a plaintiff must allege: (1) a primary securities violation; (2) the individual defendant exercised general control over the issuer’s operations; and (3) the individual defendant ‘possessed the power or ability to control the specific transaction or activity upon which the primary violation was predicated, whether or not that power was exercised.’” Ross v. Career Educ. Corp., No. 12 C 276, 2012 WL 5363431, at *13 (N.D. Ill. Oct. 30, 2012) (quoting Harrison v. Dean Witter Reynolds, Inc., 974 F.2d 873, 881 (7th Cir. 1992)). Here, the amended complaint does not “adequately plead a primary violation of securities laws”—whether under § 10(b) or Rule 10-b5. Pugh v. Trib. Co., 521 F.3d 686, 693 (7th Cir. 2008); see also Pension Tr. for Operating Eng’rs v. Kohl’s Corp., 895 F.3d 933, 936 (7th Cir. 2018) (“[A] violation of [section 10(b) and Rule 10b–5] is necessary to support a violation of section 20(a).”); City of Omaha Civilian Emps.’ Ret. Sys. v. CBS Corp., 679 F.3d 64, 67–68 (2d Cir. 2012) (noting that § 10(b) and § 20(a) claims both “share a material misstatement or omission element”). Thus, plaintiffs’ § 20(a) claims are dismissed. CONCLUSION For the foregoing reasons, defendants’ motion to dismiss, [89], is granted and the amended complaint, [74], is dismissed. Plaintiffs are given until April 30, 2025, to file a motion for leave to amend, if they wish to do so and believe they can do so consistent with this opinion and Rule 11. A copy of the proposed amended complaint indicating what changes the amended complaint makes to the original complaint must be attached to the motion. If no motion is filed by April 30, 2025, the court will enter final judgment and terminate this case. Dated: March 31, 2025 /s/ Martha M. Pacold