AMERICAN EXPRESS CO

GOVERNANCE

Risk management is overseen by our Board of Directors through three Board committees: the Risk Committee, the Audit and Compliance Committee, and the Compensation and Benefits Committee. Each committee consists entirely of independent directors and provides regular reports to the full Board regarding matters reviewed at their committee. The committees meet regularly in private sessions with our Chief Risk Officer, the Chief Compliance Officer, the Chief Audit Executive and other senior management with regard to our risk management processes, risk profile and performance, controls, talent and capabilities. The Board monitors the “tone at the top,” our risk culture, and oversees emerging and strategic risks.

We use our comprehensive Enterprise Risk Management (ERM) program to identify, aggregate, monitor, measure, report and manage risks. The program also defines our risk appetite, governance, culture and capabilities. The implementation and execution of the ERM program is headed by our Chief Risk Officer. The Risk Committee reviews and concurs with the appointment, replacement, performance and compensation of our Chief Risk Officer and receives regular updates from the Chief Risk Officer on key risks and exposures.

The Risk Committee of our Board of Directors provides oversight of our ERM framework, processes and methodologies. The Risk Committee approves our ERM and select other risk policies. The ERM policy defines and governs risk governance, risk oversight and risk appetite, including credit risk (at both the individual and institutional levels), operational risk (e.g., operations and process, legal, conduct, third-party, information technology, information security, data management, privacy and people risks), compliance risk, reputational risk, market risk, funding and liquidity risk, model risk, strategic and business risk and country risk. The ERM policy also guides the monitoring of emerging risks, as appropriate. Risk appetite defines the authorized risk limits to control exposures within our risk capacity and risk tolerance, including stressed forward-looking scenarios. In addition, it establishes principles for risk taking in the aggregate and for each risk type, and is supported by a comprehensive system for monitoring performance (including limits and escalation triggers) and assessing control programs. On an ongoing basis, the Risk Committee reviews our risk profile against the tolerances specified in the Risk Appetite Framework, including significant risk exposures, risk trends in our portfolios and major risk concentrations.

The Risk Committee also provides oversight of our compliance with Regulatory capital and liquidity standards, and our Internal Capital Adequacy Assessment Process, including the CCAR submissions.

The Audit and Compliance Committee of our Board of Directors reviews and approves compliance policies, which include our Compliance Risk Tolerance Statement. In addition, the Audit and Compliance Committee reviews the effectiveness of our Corporate-wide Compliance Risk Management Program. More broadly, this committee is responsible for assisting the Board in its oversight responsibilities relating to the integrity of our financial statements and financial reporting process, internal and external auditing, including the qualifications and independence of the independent registered public accounting firm and the performance of our internal audit services function, and the integrity of our systems of internal controls.

The Audit and Compliance Committee provides oversight of our Internal Audit Group. The Audit and Compliance Committee reviews and concurs with the appointment, replacement, performance and compensation of our Chief Audit Executive, who reports to the Audit and Compliance Committee, and approves Internal Audit’s annual audit plan, charter, policies, budget and staffing levels, and overall risk assessment methodology. The Audit and Compliance Committee also receives regular updates on the audit plan’s status and results, including significant reports issued by Internal Audit and the status of our corrective actions.

The Compensation and Benefits Committee of our Board of Directors works with the Chief Risk Officer to ensure our overall compensation programs, as well as those covering our risk-taking employees, appropriately balance risk with business incentives and that business performance is achieved without taking imprudent or excessive risk. Our Chief Risk Officer is actively involved in setting risk goals for the Company. Our Chief Risk Officer also reviews the risk profiles of each business unit and, in conjunction with the Chief Audit Executive, provides input into performance evaluation through the Risk Performance Program. The Chief Risk Officer meets with the Compensation and Benefits Committee and attests whether performance goals and results have been achieved without taking imprudent risks. The Compensation and Benefits Committee uses a risk-balanced incentive compensation framework to decide on our bonus pools and the compensation of senior executives.

There are several internal management committees, including the Enterprise Risk Management Committee (ERMC), chaired by our Chief Risk Officer. The ERMC is the highest-level management committee to oversee all firm-wide risks and is responsible for risk governance, risk oversight and risk appetite. It maintains the enterprise-wide risk appetite framework and monitors compliance with limits and escalations defined in it. The ERMC oversees implementation of risk policies Company-wide. The ERMC reviews key risk exposures, trends and concentrations, significant compliance matters, and provides guidance on the steps to monitor, control and report major risks. In addition, the Asset Liability Committee, chaired by our Chief Financial Officer, is responsible for managing our capital, funding and liquidity, investment, market risk and asset/liability activities in accordance with our policies and in compliance with applicable regulatory requirements.

As defined in the ERM policy, we follow the “three lines of defense” approach to risk management. The first line of defense comprises functions and management committees directly initiating risk taking. The Chief Executive Officer, business unit presidents and the Chief Financial Officer are part of the first line of defense. The second line comprises independent functions overseeing risk-taking activities of the first line. The Chief Risk Officer, the Chief Compliance Officer, the Chief Operational Risk Officer and certain control groups, both at the enterprise level and within regulated entities, are part of the second line of defense. The global risk oversight team oversees the policies, strategies, frameworks, models, processes and capabilities deployed by the first line teams and provides challenges and independent assessments on how the first line of defense is managing risks. Our Internal Audit Group constitutes the third line of defense and provides independent assessments and effective challenge of the first and second lines of defense.

CREDIT RISK MANAGEMENT PROCESS

We define credit risk as loss due to default or changes in the credit quality of a customer, obligor or security. Our credit risks are divided into two broad categories: individual and institutional. Each has distinct risk management profiles, capabilities, strategies, and tools. Business units that create individual or institutional credit risk exposures of significant importance are supported by dedicated risk management teams, each led by a Chief Credit Officer.

Individual Credit Risk

Individual credit risk arises from consumer and small business charge cards, credit cards, and term loans. These portfolios consist of millions of customers across multiple geographies, industries and levels of net worth. We benefit from the high-quality profile of our customers, which is driven by our brand, premium customer servicing, product features and risk management capabilities, which span underwriting, customer management and collections. The risk in these portfolios is generally correlated to broad economic trends, such as unemployment rates and gross domestic product (GDP) growth.

The business unit leaders and their Chief Credit Officers take the lead in managing the credit risk process. These Chief Credit Officers are guided by the Individual Credit Risk Committee (ICRC), which is responsible for implementation and enforcement of the Individual Credit Risk Management Policy. The ICRC ensures compliance with ERMC guidelines and procedures and escalates to the ERMC as appropriate.

Credit risk management is supported by sophisticated proprietary scoring and decision-making models that use up-to-date information on prospects and customers, such as spending and payment history and data feeds from credit bureaus. We have developed data-driven economic decision logic for customer interactions to better serve our customers.

Institutional Credit Risk

Institutional credit risk arises principally within our CS, ICS and GMNS businesses, as well as investment and liquidity management activities. Unlike individual credit risk, institutional credit risk is characterized by a lower loss frequency but higher severity. It is affected both by general economic conditions and by client-specific events. The absence of large losses in any given year or over several years is not necessarily representative of the level of risk of institutional portfolios, given the infrequency of loss events in such portfolios.

Similar to individual credit risk, business units taking institutional credit risks are supported by Chief Credit Officers. These officers are guided by the Institutional Risk Management Committee (IRMC), which is responsible for implementation and enforcement of the Institutional Credit Risk Management Policy and for providing guidance to the credit officers of each business unit with substantial institutional credit risk exposures. The committee, along with the business unit Chief Credit Officers, makes investment decisions in core risk capabilities, ensures proper implementation of the underwriting standards and contractual rights for risk mitigation, monitors risk exposures, and determines risk mitigation actions. The IRMC formally reviews large institutional risk exposures to ensure compliance with ERMC guidelines and procedures and escalates them to the ERMC as appropriate. At the same time, the IRMC provides guidance to the business unit risk management teams to optimize risk-adjusted returns on capital. A centralized risk rating unit provides risk assessment of our institutional obligors.

OPERATIONAL RISK MANAGEMENT PROCESS

We consider operational risk to be the risk of loss due to, among other things, inadequate or failed processes, people or information systems, or impacts from the external environment, including failures to comply with laws and regulations as well as impacts from relationships with third parties. Operational risk is inherent in all business activities and can impact an organization through direct or indirect financial loss, brand damage, customer dissatisfaction, or legal and regulatory penalties.

To appropriately measure and manage operational risk, we have implemented a comprehensive operational risk framework that is defined in the Operational Risk Management Policy approved by the ERMC. The Operational Risk Management Committee (ORMC), chaired by the Chief Operational Risk Officer, coordinates with all control groups on effective risk assessments and controls. It also oversees the preventive, responsive and mitigation efforts by control management teams in the business units and staff groups.

We use the operational risk framework to identify, measure, monitor and report inherent and emerging operational risks. The framework includes programs established for risk management activities related to processes and the launch of new products and services. The framework also defines guidelines and risk management requirements for the (a) identification of issues and operational risk events, (b) related control enhancements and (c) reporting of key trends and escalation of risks. Outcomes from the operational risk framework are discussed and escalated to various risk management committees and incorporated within our accountability framework for executive compensation.

Information Security and Cybersecurity

We define information security and cybersecurity risk as the risk that the confidentiality, integrity or availability of American Express information and information systems are impacted by unauthorized or unintended access, use, disclosure, modification or destruction.

Our Technology Risk and Information Security (TRIS) program, which is our enterprise information security and cybersecurity program, is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information; and (iii) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to us, our colleagues or our customers. The program is built upon a foundation of advanced security technology, employs a highly trained team of experts, and is designed to operate in alignment with global regulatory requirements. The TRIS program includes controls designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities and engage in industry and government forums to promote advancements in our cybersecurity capabilities as well as the broader financial services cybersecurity ecosystem.

See “Cybersecurity” and “A major information or cybersecurity incident or an increase in fraudulent activity could lead to reputational damage to our brand and material legal, regulatory and financial exposure, and could reduce the use and acceptance of our products and services” under “Risk Factors” for additional information.

Information Technology

We define information technology risk as the risk that events or circumstances could compromise the processing, stability, capacity, performance, or resilience of information technology and cause financial, reputational, and/or regulatory impacts.

We manage information technology risk through our policies, procedures, governance structure, and control framework to preserve the confidentiality, integrity, and availability of systems and processes across our Company.

See “The uninterrupted operation of our information systems is critical to our success and a significant disruption could have a material adverse effect on our business and results of operations” under “Risk Factors” for additional information.

Privacy

We define privacy risk as the risk of financial loss, reputational damage, or regulatory or legal action resulting from decisions related to the violation of applicable laws, rules, regulations, contractual obligations, or the non-adherence to privacy policies, disclosures, or standards that apply to the processing of personal data.

The Global Privacy Policy, which establishes the privacy framework and defines the American Express Data Protection & Privacy Principles, governs the way we collect, use, store, share, transmit, delete or otherwise process our customer and colleague personal data globally. Chaired by the Chief Privacy Officer, the Privacy Risk Management Committee, a sub-committee of the ORMC, provides oversight and governance for our privacy program.

Data Management and Governance

We define data management and governance risk as the risk of financial, reputational, and/or regulatory impacts due to inadequate data governance and/or data management practices adversely impacting the accuracy, completeness, timeliness, comprehensiveness or usability of data throughout its lifecycle.

Our Enterprise Data Governance Policy establishes the framework for defining in-scope critical data and the requirements for managing such data effectively throughout its lifecycle as a critical corporate asset. This policy is approved by the ERMC.

Chaired by the Chief Data Officer, our Enterprise Data Committee, a sub-committee of the ERMC, provides governance and oversight for our enterprise-wide data governance and management activities.

Third Party Risk

We define third party risk as the risk that relationships with third parties (including their significant subcontractors) create unexpected outcomes and deviations from expectations or stated obligations. The Third Party Management Policy is approved by the Risk Committee of our Board and the ERMC. It sets forth the procurement, risk management, and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our Third Party Lifecycle Management program sets guidelines for identifying, measuring, monitoring, and reporting the risk associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring and termination.

Conduct Risk

We define conduct risk as the risk that colleagues, intentionally or unintentionally, fail to fulfill their responsibilities to American Express, our customers, colleagues or stakeholders in a manner consistent with our Code of Conduct, policies and values as well as applicable laws and regulations. Conduct issues also have the potential to increase several other risk types, including reputational risk, which may undermine the integrity and trust upon which our brand is built.

The Conduct Risk Management Policy is approved by the ERMC. It establishes the governance framework for conduct risk across the Company. The policy requires annual risk assessments, implementation of detective and preventive controls, colleague training and timely escalations of conduct issues. It also provides guidance on consequence management for any substantiated cases of misconduct. The Conduct Risk Committee oversees conduct risk related topics and escalates such matters to the ERMC, as appropriate.

COMPLIANCE RISK MANAGEMENT PROCESS

We define compliance risk as the risk of legal or reputational harm, fines, monetary penalties and payment of damages or other forms of sanction as a result of non-compliance with applicable laws and/or regulations, internal policies and procedures and related practices, or ethical standards.

We view our ability to effectively mitigate compliance risk as an important aspect of our business model. Our Global Compliance and Ethics organization is responsible for establishing and maintaining our corporate-wide Compliance Risk Management Program. Pursuant to this program, we seek to manage and mitigate compliance risk by assessing, controlling, monitoring, measuring and reporting the legal and regulatory risks to which we are exposed. The Compliance Risk Management Committee (CRMC), chaired by the Chief Compliance Officer, is responsible for identifying, evaluating, managing, and escalating compliance risks. The CRMC has a dual reporting relationship to both the Risk Committee (through the ERMC) and the Audit and Compliance Committee.

Additionally, we have a comprehensive Anti-Money Laundering program that monitors and reports suspicious activity to the appropriate government authorities. The program includes an independent risk assessment of the rules used by the Anti-Money Laundering team.

REPUTATIONAL RISK MANAGEMENT PROCESS

We define reputational risk as the risk that negative stakeholder reaction to our products, services, client and partner relationships, business activities and policies, management and workplace culture, or our response to unexpected events, could cause sustained critical media coverage, a decline in revenue or investment, talent attrition, litigation, or government or regulatory scrutiny.

We view protecting our reputation for excellent customer service, trust, security and high integrity as core to our vision of providing the world’s best customer experience and fundamental to our long-term success.

Our business leaders are responsible for considering the reputational risk implications of business activities and strategies and ensuring the relevant subject matter experts are engaged as needed. The ERMC is responsible for ensuring reputational risk considerations are included in the scope of appropriate subordinate risk policies and committees and properly reflected in all decisions escalated to the ERMC.

MARKET RISK MANAGEMENT PROCESS

We define market risk as the risk to earnings or asset and liability values resulting from movements in market prices. Our market risk exposures include (i) interest rate risk due to changes in the relationship between the interest rates on our assets (such as loans, receivables and investment securities) and the interest rates on our liabilities (such as debt and deposits) and (ii) foreign exchange risk related to transactions, funding, investments and earnings in currencies other than the U.S. dollar.

Our risk policies establish the framework that guides and governs market risk management, including quantitative limits and escalation triggers. These policies are approved by the ERMC, Asset Liability Committee or Market Risk Management Committee.

Market risk is managed by the Market Risk Management Committee. The Market Risk Oversight Officer provides an independent risk assessment and oversight over the policies and exposure management for market risk and Asset Liability Management activities.

Interest Rate Risk

We analyze a variety of interest rate scenarios to inform us of the potential impacts from interest rate changes on earnings and the value of assets, liabilities and the economic value of equity. Our interest rate exposure can vary over time as a result of, among other things, the proportion of our total funding provided by variable and fixed-rate debt and deposits compared to our Card Member loans and receivables. Interest rate swaps are used from time to time to effectively convert debt issuances to variable-rate from fixed-rate, or vice versa. Refer to Note 13 to the “Consolidated Financial Statements” for further discussion of our derivative financial instruments.

To measure the sensitivity of net interest income to interest rate changes, we first project net interest income over the following twelve-month time horizon considering forecasted business growth and anticipated future market interest rates. The impact from rate changes is then measured by instantaneously increasing or decreasing the anticipated future interest rates by the amounts set forth in Table 23 below. Our current net interest income sensitivity analysis shows higher interest rates would have a detrimental impact on our net interest income. Our estimated repricing risk assumes that our interest-rate sensitive assets and liabilities that reprice within the twelve-month horizon generally reprice by the same magnitude, subject to applicable interest rate caps or floors, as benchmark rates change. It is further assumed that, within our interest-rate sensitive liabilities, certain deposits reprice at lower magnitudes than benchmark rate movements, and the magnitude of this repricing in turn could depend on, among other factors, the direction of rate movements. These assumptions are consistent with historical deposit repricing experience in the industry and within our own portfolio. Actual changes in our net interest income will depend on many factors, and therefore may differ from our estimated risk to changes in market interest rates.

TABLE 23: SENSITIVITY ANALYSIS OF INTEREST RATE CHANGES ON ANNUAL NET INTEREST INCOME AS OF DECEMBER 31, 2024

(a)Negative values represent a reduction in net interest income.

We use economic value of equity to inform us of the potential impacts from interest rate changes on the net present value of our assets and liabilities under a variety of interest rate scenarios. Economic value of equity is calculated based on our existing assets, liabilities and derivatives, and does not incorporate projected changes in our balance sheet. Key assumptions used in this calculation include the term structure of interest rates, as well as deposit repricing and liquidation profiles used to inform duration and cash flow schedules. The economic value of equity is calculated under multiple interest rate scenarios, including baseline and immediate upward and immediate downward interest rate shocks, to assess its sensitivity to changes in interest rates. Our current sensitivity profile demonstrates that our economic value of equity generally decreases in a declining interest rate scenario and increases in an increasing interest rate scenario. The level of this sensitivity is managed within board-approved policy limits.

Foreign Exchange Risk

Foreign exchange exposures arise in four principal ways: (1) Card Member spending in currencies that are not the billing currency, (2) cross-currency transactions and balances from our funding activities, (3) cross-currency investing activities, such as in the equity of foreign subsidiaries, and (4) revenues generated and expenses incurred in foreign currencies, which impact earnings.

These foreign exchange risks are managed primarily by entering into foreign exchange spot transactions or hedged with foreign exchange forward contracts when the hedge costs are economically justified and in notional amounts designed to offset pretax impacts from currency movements in the period in which they occur. As of December 31, 2024, foreign currency derivative instruments with total notional amounts of approximately $43 billion were outstanding.

With respect to Card Member spending and cross-currency transactions, including related foreign exchange forward contracts outstanding, the impact of a hypothetical 10 percent strengthening of the U.S. dollar would have been immaterial to projected earnings as of December 31, 2024. With respect to translation exposure of foreign subsidiary equity balances, including related foreign exchange forward contracts outstanding, a hypothetical 10 percent strengthening of the U.S. dollar would result in an immaterial reduction in other comprehensive income and equity as of December 31, 2024. With respect to anticipated earnings denominated in foreign currencies for the next twelve months, the adverse impact on pretax income of a hypothetical 10 percent strengthening of the U.S. dollar, net of hedges, would be approximately $136 million as of December 31, 2024.

The actual impact of interest rate and foreign exchange rate changes will depend on, among other factors, the timing of rate changes, the extent to which different rates do not move in the same direction or in the same direction to the same degree, changes in the cost, volume and mix of our hedging activities and changes in the volume and mix of our businesses.

FUNDING & LIQUIDITY RISK MANAGEMENT PROCESS

We define funding and liquidity risk as our inability to meet our ongoing financial and business obligations at a reasonable cost as they become due.

Our Board-approved Liquidity Risk Policy establishes the framework that guides and governs liquidity risk management.

Funding and liquidity risk is managed by the Funding and Liquidity Committee. To manage this risk, we seek to maintain access to a diverse set of cash, readily-marketable securities and contingent sources of liquidity, such that we can continuously meet our business requirements and expected future financing obligations for at least a twelve-month period under a variety of adverse circumstances. These include, but are not limited to, an event where we are unable to raise new funds under our regular funding programs during a substantial weakening in economic conditions. We consider the trade-offs between maintaining too much liquidity, which can be costly and limit financial flexibility, and having inadequate liquidity, which may result in financial distress during a liquidity event.

Funding and liquidity risk is managed at an aggregate consolidated level as well as at certain subsidiaries in order to ensure that sufficient and accessible liquidity resources are maintained. The Funding and Liquidity Committee reviews forecasts of our aggregate and subsidiary cash positions and financing requirements, approves funding plans designed to satisfy those requirements under normal and stressed conditions, establishes guidelines to identify the amount of liquidity resources required and monitors positions and determines any actions to be taken.

Our liquidity risk management processes are designed in alignment with regulatory guidelines. As a Category III firm under U.S. federal bank regulatory agencies’ rules, we are subject to heightened capital, liquidity and prudential requirements, including more stringent liquidity risk management requirements. See “Supervision and Regulation – Capital and Liquidity Regulation” under “Business” for more information.

MODEL RISK MANAGEMENT PROCESS

We define model risk as the risk of adverse consequences, such as financial loss, poor business and strategic decision making, damage to our reputation or customer harm, from decisions based on incorrect or misused model outputs and outcomes.

The Enterprise-Wide Model Risk Policy establishes the comprehensive framework for governing model risk. This policy is approved by the ERMC. The comprehensive risk management and governance framework includes procedures for model development, independent model validation, model risk reporting and change management capabilities that seek to minimize erroneous model methodology, outputs, and misuse. We also assess model performance and model- related issues on an ongoing basis and seek to address deficiencies in a timely manner. In addition, we utilize artificial intelligence and machine learning (AI/ML) models, including Generative AI tools, for a variety of business use cases. We perform extensive reviews and testing to reduce the risk that these AI/ML techniques result in adverse consequences.

STRATEGIC AND BUSINESS RISK MANAGEMENT PROCESS

We define strategic and business risk as the risk related to our inability to achieve our business objectives due to poor strategic decisions, including decisions related to the launch or modification of products, mergers, acquisitions, and divestitures, poor implementation of strategic decisions or declining demand for our products and services.

Strategic decisions are reviewed and approved by business leaders and various committees and must be aligned with company policies. We seek to manage strategic and business risks through risk controls embedded in these processes as well as overall risk management oversight over business goals. Launch of key new products as well as existing product performance is reviewed periodically by committees and business leaders to inform business decisions as appropriate. Mergers, acquisitions and divestitures can only be approved following Executive Committee due diligence, a comprehensive risk assessment by operational, market, credit and oversight leaders provided to the Chief Risk Officer and approval by either the Chief Risk Officer or appropriate risk committees. All new and material changes to products and services are reviewed and approved by the New Products Committee and appropriate credit or risk committees.

COUNTRY RISK MANAGEMENT PROCESS

We define country risk as the risk that economic, social, and/or political conditions and events in a country present. They might adversely impact us, primarily as a result of greater credit losses, increased operational or market risk or the inability to repatriate capital.

We manage country risk as part of the normal course of business. Policies and procedures establish country risk escalation thresholds to control and limit exposure, driven by processes that enable the monitoring of conditions in countries where we have exposure.

EMERGING RISKS

We also identify, monitor and report on emerging risks through our risk governance framework. Emerging risks arise due to changes in the external environment or internal initiatives and may manifest across multiple risk types. For example, climate-related risk is currently identified as an emerging risk and may manifest as credit risk, operational risk, market risk, liquidity risk or other risk types. Emerging risks are monitored and reported periodically to members of management, as well as to the ERMC and the Risk Committee of our Board of Directors.