SecProbe.io

CORRESP
1
filename1.htm

CORRESP

 CONFIDENTIAL TREATMENT REQUESTED BY DISCOVER FINANCIAL SERVICES

PURSUANT TO 17 C.F.R. § 200.83 (RULE 83)

 CERTAIN PORTIONS OF THIS LETTER HAVE BEEN OMITTED FROM THE VERSION FILED VIA EDGAR.
CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS. INFORMATION THAT WAS OMITTED IN THE EDGAR VERSION HAS BEEN NOTED IN THIS LETTER WITH A PLACEHOLDER IDENTIFIED BY THE MARK “[***].”

October 24, 2024

 Via
EDGAR

 U.S. Securities and Exchange Commission

 Division
of Corporation Finance

 100 F Street, NE

 Washington, D.C.
20549

Attention:
 Michael Henderson

 
 Marc Thomas

Re:
 Discover Financial Services

 
 Form 10-K for the Year Ended December 31, 2023

 
 File No. 001-33378

Dear Messrs. Henderson and Thomas:

 Discover Financial Services
(“Discover,” “DFS”, “the Company,” “we,” “our”), is pleased to provide this response to the comments of the Staff (the “Staff”) of the Division of
Corporation Finance (the “Division”) of the U.S. Securities and Exchange Commission set forth in its letter, dated September 20, 2024 with respect to the above-referenced annual report on Form
10-K.

 For the Staff’s convenience, the text of the Staff’s comments is set forth below in bold,
followed in each case by our response. For ease of reference, we have replaced the bulleted subpoints in the Staff’s comments with letters.

Form 10-K For the Year Ended December 31, 2023

Item 8. Financial Statements and Supplementary Data

Notes to the Consolidated Financial Statements

26. Immaterial Restatement of Prior Period Financial Statements, page 144

1.
 We note the response to comment 3 from the letter dated September 3, 2024 in connection with your
proposed merger and our review of the Form S-4 filed by Capital One Financial Corporation. The response discusses the control deficiencies identified in connection with Discover’s card product
misclassification matter. Please respond to the following:

a.
 The response indicates that Discover management determined that there was a “design deficiency in
internal controls over financial reporting in that Discover did not have a control to review that cards issued by Discover Bank were appropriately tiered in compliance with the Program Documents.” Please clarify if only a single design
deficiency was identified, and if the deficiency relates to all cards issued and the tiering of such cards. If so, please provide additional information to support your conclusion or otherwise explain in further detail all the control deficiencies
identified.

 1

 CONFIDENTIAL TREATMENT REQUESTED BY DISCOVER FINANCIAL SERVICES

PURSUANT TO 17 C.F.R. § 200.83 (RULE 83)

 Response:

As we stated in our letter September 3, 2024, management identified a single design deficiency in internal controls over financial reporting. Discover did
not have a control to review that cards1 issued by Discover Bank were appropriately tiered in compliance with the Program Documents2. This
significant deficiency potentially relates to the tiering of all Discover Bank cards.

 The root cause of the deficiency was that there was a control gap
in the process, that resulted in the inappropriate tiering of Discover Bank cards. The tiering determines the price assigned to each transaction. The controls related to the assignment of the price based on tier, the calculation of revenue based on
sales volume and assigned price, and the recording of the revenue to the general ledger in the appropriate amount and period were designed, implemented and operating effectively. The only issue was that certain Discover Bank cards were
inappropriately tiered to the commercial tier.

 Discover Bank, as the card issuer, is responsible for assigning individual Discover credit cards to card
product tiers using the criteria set by Discover Network in the relevant Program Documents. As noted above, there was a control design gap within Discover Bank’s tiering of cards using the tiering criteria set by Discover Network in the
relevant Program Documents.

b.
 The evaluation of the control deficiency does not discuss (i) the potential magnitude of the error, as
it appears your analysis is primarily focused on the actual size of the errors identified and (ii) the consideration of qualitative factors in evaluating the severity of the control deficiency. Please provide us with an analysis that considers
these components.

 Response:

In evaluating the control deficiency, we considered both the potential magnitude of the error as well as the potential likelihood of the error.

As noted in the response to the question above, the significant deficiency relates to all Discover Bank cards issued, therefore the potential magnitude
relates to a minimal portion of the recorded revenue of all card transactions. [***]

 [***] In addition, even if the card classification was viewed as an
error, the potential overstatement of revenue in any given year was deemed not material to the Company’s financial statements [***]

1
 Throughout this letter, references to “cards” refers to credit cards accepted on the Discover
Network, unless indicated otherwise.

2
 As used in this letter, the term Program Documents refers collectively to materials published and distributed
by Discover Network including Merchant Operating Regulations, Acquirer Operating Regulations, Credit Operating Regulations, fee guides and manuals, technical specifications, and other documents that govern the relationships between Discover Network,
on the one hand, and merchants, merchant acquirers, and issuers (including Discover Bank) on the other.

 2

 CONFIDENTIAL TREATMENT REQUESTED BY DISCOVER FINANCIAL SERVICES

PURSUANT TO 17 C.F.R. § 200.83 (RULE 83)

 Therefore, while the potential magnitude of misstatement is a portion of revenue recorded on all card
transactions, the likelihood of the misstatement impacting all Discover Bank cards is low as (1) [***] (2) the Company’s market acceptance would decline if the overall cost of acceptance was elevated, (3) [***] and (4) the qualitative
factors and compensating controls listed below.

 In considering qualitative factors in evaluating the severity of the control deficiency, in addition to
management’s assessment of the indicators of material weakness described in our response to the Staff in our letter dated September 3, 2024, the following factors were also considered:

•

 Warranted the attention of the Audit Committee: As described in our response to the Staff in our letter dated
September 3, 2024, given the reporting treatment of the card misclassification as an immaterial restatement of prior periods, and that it merited the attention of those responsible for oversight of the Company’s financial reporting (i.e.,
the Audit Committee), the matter would inherently be a significant deficiency.

•

 Nature of general ledger account and susceptibility to fraud: The discount and interchange revenue line item was
overwhelmingly composed of automated calculations of contractual rates applied to merchant transaction volume. The underlying process was governed by information technology general controls (“ITGC”) wherein established calculations were
subject to submission of system requirements and user testing in relation to those requirements prior to the implementation of the calculation in the system, after which there was minimal manual intervention. Management also assessed that there were
no subjective assessments, significant assumptions, management overlay or complexity noted within the related financial statement line item. These factors contributed to the account also having a low susceptibility to fraud.

•

 Summary of historical adjustments: The discount and interchange revenue line item did not have a history of prior
adjustments.

•

 Management assessed that the compensating controls, listed in response to item 1(c) below, were sufficiently
precise to prevent a material misstatement within the discount and interchange revenue financial statement line item.

•

 Management also assessed other qualitative factors, and a summary of this assessment is attached to this letter
as Appendix A.

c.
 The response indicates that there are other mitigating factors and compensating controls that could identify
and prevent a material misstatement in the merchant discount and interchange revenue line item. Please provide a detailed response describing these controls including the level of precision at which they operate.

Response:

 Discover’s assessment of the
severity of the control deficiency included the following compensating controls that would identify and prevent a material misstatement in the discount and interchange revenue financial statement line item as a result of an error in tiering. The
following represent controls for Internal Controls Over Financial Reporting (“ICFR”) purposes for which management has evaluated design and tested operating effectiveness:

 3

 CONFIDENTIAL TREATMENT REQUESTED BY DISCOVER FINANCIAL SERVICES

PURSUANT TO 17 C.F.R. § 200.83 (RULE 83)

 [***]

d.
 Please tell us whether your Independent Registered Public Accounting Firm evaluated your assessment of the
severity of the control deficiency and if so, explain whether they agree with the assessment and conclusions reached.

Response:

 The Company’s Independent
Registered Public Accounting Firm evaluated management’s assessment of the severity of the control deficiency. Furthermore, the Independent Registered Public Accounting Firm communicated to the Audit Committee that they performed a similar
evaluation of the facts and circumstances and agree with management’s conclusion of the significant deficiency.

e.
 Please provide us with a detailed analysis as to how you evaluated whether a deficiency exists within the
entity level control components of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control – Integrated Framework (2013) such as risk assessment, monitoring, etc.

Response:

 Discover performed an evaluation of
all components and principles of the COSO framework and determined them to be present and functioning. In light of the identified significant deficiency, we performed an additional evaluation focusing on COSO principles which could reasonably be
considered to be the most relevant given the nature and root cause of the significant deficiency. Below are COSO principles which we believe could reasonably be considered to be the most relevant, along with the respective entity level control(s) we
identified and evaluated:

•

 COSO Principle 2: The board of directors demonstrates independence of management and exercises oversight of the
development and performance of internal control:

•

 Management assessed controls related to independent board oversight. [***]

•

 COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate
authorities and responsibilities in the pursuit of objectives.

•

 Management assessed that lines of accountability exist within governance and committee structures that specify
their roles and responsibilities, evidenced through standards, policies, and procedures. [***]

•

 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes
risks as a basis for determining how the risk should be managed

•

 Management assessed the performance of our annual risk assessment which considers both quantitative and
qualitative factors, as well as internal and external factors. As described in our response to 1 (b) above, the potential likelihood of a material misstatement resulting from inappropriate tiering is low. Therefore, a risk of material misstatement
related to tiering was not identified.

 4

 CONFIDENTIAL TREATMENT REQUESTED BY DISCOVER FINANCIAL SERVICES

PURSUANT TO 17 C.F.R. § 200.83 (RULE 83)

•

 COSO Principle 10: The organization selects and develops control activities that contribute to the mitigation of
risks to the achievement of objectives to acceptable levels.

•

 Management assessed the identification and evaluation of controls for the purposes of evaluating ICFR, which
reduce the risk of a material misstatement to our financial statements. Controls were identified and found to be effective to address the Company’s risks. As outlined within item 1(c) above, we appropriately identified sufficiently precise
compensating controls which were capable of identifying a material misstatement.

•

 COSO Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to
ascertain whether the components of internal control are present and functioning.

•

 Management assessed our Sarbanes Oxley (“SOX”) compliance program which tests and concludes on the
design, implementation and operating effectiveness of SOX relevant controls. In addition, our internal audit department tests and concludes on the design, implementation and operating effectiveness of operational and compliance related controls.

•

 COSO Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner
to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

•

 Management assessed our SOX deficiency working group, which considers all issues for SOX. Furthermore, SOX
deficiencies are presented to the SOX Steering Council and are monitored through resolution. In addition, upon the determination of a significant deficiency, it was formally communicated to the Audit Committee prior to the filing with the SEC.

 As we identified and evaluated entity level controls which fulfilled each principle, we determined there was not an additional
deficiency within the entity level control components of COSO.

2.
 We note the responses to comments 1, 2 and 4 from the letter dated September 3, 2024 in connection with
your proposed merger and our review of the Form S-4 filed by Capital One Financial Corporation. We continue to evaluate the responses provided and may have further comments.

In response to the Staff’s letter dated October 11, 2024 and following up on our conference call with the Staff on October 15, 2024, we have
provided our written responses to these comments in a separate letter to the Staff that we are transmitting to the Staff simultaneously with this letter.

* * * * * *

 We
appreciate the Staff’s consideration of these matters, and we would be pleased to provide additional clarification of the foregoing responses as necessary. If you wish to discuss any of this information further, please do not hesitate to
contact me at (224) 405-3601.

 5

 CONFIDENTIAL TREATMENT REQUESTED BY DISCOVER FINANCIAL SERVICES

PURSUANT TO 17 C.F.R. § 200.83 (RULE 83)

 Very truly
yours,                     

/s/ John T. Greene          

John T. Greene

Executive Vice President

Chief Financial Officer

cc:
 Ms. Hope D. Mehlman, GC and CLO, Discover Financial Services

Mr. Jason Hanson, EVP, President-Payment Services, Discover Financial Services

Mr. David Berrey, Deloitte & Touche LLP

Mr. Jared M. Fishman, Sullivan & Cromwell LLP

 6

 CONFIDENTIAL TREATMENT REQUESTED BY DISCOVER FINANCIAL SERVICES

PURSUANT TO 17 C.F.R. § 200.83 (RULE 83)

 Appendix A

[***]