AMERICAN EXPRESS CO

GOVERNANCE AND BOARD OVERSIGHT

We maintain a risk governance framework that describes key components of risk management, including risk governance, oversight, roles and responsibilities across the lines of defense, our risk taxonomy, risk appetite and the risk management lifecycle. Our risk governance framework also provides expectations for risk culture, compensation and performance management.

Our Board and its committees provide oversight of risk management and monitor our risk culture and the “tone at the top.” Each committee of the Board consists entirely of independent directors and provides regular reports to the full Board regarding matters reviewed at their committee. The committees meet regularly in private sessions with our Chief Financial Officer, Chief Legal Officer, Chief Risk Officer, Chief Compliance Officer, Chief Audit Executive, Head of Credit Review and other members of senior management with regard to our risk management processes, risk profile and performance, controls, talent and capabilities.

The responsibilities of each of the committees of the Board in overseeing risk management include:

The Risk Committee is responsible for overseeing and approving our risk governance framework, processes and methodologies, and evaluating the independence and authority of our risk management function. On an annual basis, the Risk Committee reviews and approves the Company’s risk appetite framework, which defines the nature and level of risk we are willing to take and provides limits, thresholds and escalation processes that align risk taking with strategic objectives. The Risk Committee regularly reviews our risk profile against the tolerances in the risk appetite framework, including significant risk exposures, risk trends in our portfolios and major risk concentrations, and the steps taken by management to monitor, control and report such exposures, trends and concentrations. The Risk Committee also reviews and concurs with the appointment, replacement, performance and compensation of the Chief Risk Officer and receives regular reports from the Chief Risk Officer on key risks and exposures. The Risk Committee provides oversight of our compliance with regulatory capital and liquidity standards, and our Internal Capital Adequacy Assessment Process, including the CCAR submissions.

The Audit and Compliance Committee (ACC) is responsible for assisting the Board in its oversight responsibilities relating to the integrity of our financial statements and financial and regulatory reporting processes, internal and external auditing, the integrity of internal controls and legal and regulatory compliance. The ACC appoints, replaces, reviews and evaluates the qualifications and independence of our independent registered public accounting firm and periodically meets with management and the independent registered public accounting firm to review and discuss our accounting policies, critical accounting estimates and critical auditing matters. In addition, the ACC is responsible for the appointment, replacement, performance and compensation of the Chief Audit Executive and the Head of Credit Review, as well as the approval of the annual plans, charters, policies and budgets of the Internal Audit Group and the Credit Review Group. In its role in overseeing legal and regulatory compliance, the ACC reviews the effectiveness of our company-wide compliance risk management program and periodically meets with the Chief Compliance Officer to review and approve our compliance risk tolerance statement and related compliance policies.

The Compensation and Benefits Committee (CBC) is responsible for assisting the Board in its oversight responsibilities related to the adoption, amendment and termination of compensation plans and arrangements covering executive officers and certain other colleagues, our employee benefit plans of the Company and review of the overall management of our colleague experience. The CBC works with the Chief Colleague Experience Officer and the Chief Risk Officer to ensure our compensation programs appropriately balance risk with business incentives and that business performance is achieved without taking imprudent or excessive risk. Our Chief Risk Officer is actively involved in setting risk goals for the Company. Our Chief Risk Officer also reviews the risk profiles of each business unit and, together with the Chief Audit Executive, provides input into performance evaluations. The Chief Risk Officer attests to the CBC as to whether performance goals and results have been achieved without taking imprudent risks. Additionally, the CBC uses a risk-balanced incentive compensation framework to decide on the bonus pools for our colleagues and the compensation of senior executives.

The Nominating, Governance and Public Responsibility Committee (NGPRC) is responsible for assisting the Board in its oversight responsibilities relating to the Chief Executive Officer and key senior management succession, Board composition, corporate governance, non-employee director compensation and benefits and our practices and positions relating to public policy and sustainability issues. As part of its remit, the NGPRC regularly reviews risks related to corporate governance structure and practices. In addition, the NGPRC regularly reviews the composition of the Board, reassessing directors eligible for election or recruiting candidates with expertise in areas of importance to us.

We also have management-level risk management committees that implement our risk governance framework and facilitate the execution of management’s risk management responsibilities. The Enterprise Risk Management Committee (ERMC) is the highest-level management risk committee and is responsible for monitoring risk-taking activities against our risk appetite framework as well as governing and overseeing risks we face. The ERMC is co-chaired by the Chief Executive Officer and the Chief Risk Officer, with membership representation across risk types, businesses, and lines of defense. The ERMC has a direct escalation path to the Risk Committee and the Risk Committee reviews and approves the charter of the ERMC annually.

There are three types of risk management committees that report to the ERMC: (i) business unit risk committees, which receive reporting and make decisions on risks applicable for a given revenue-generating business unit, and are co-chaired by the business unit head and the business unit chief risk officer; (ii) organizational risk committees, which receive reporting and make decisions associated with a given first line function, and are co-chaired by the first line unit lead and the second line risk type lead; and (iii) horizontal risk committees, which receive reporting and make decisions associated with one or more risk types and are chaired or co-chaired by the second line risk type lead(s). The ERMC delegates authority to these underlying risk management committees through review and approval of their charters on an annual basis.

THREE LINES OF DEFENSE MODEL

As part of our risk governance framework, we have implemented the “three lines of defense” approach to risk management.

The first line of defense is the primary owner of risk-taking and risk management. The first line includes colleagues who are responsible for generating revenue, providing operational support in the delivery of products and services to our customers, or providing technology services for the execution of business activities. All members of the first line are responsible for appropriately assessing and managing all risks associated with their business activities, consistent with our established risk appetite.

The second line of defense supports the Board in defining the framework by which risk should be managed across the enterprise. It then implements the framework by enacting policies, standards and procedures and creating governance structures. Additionally, the second line provides independent review, challenge, monitoring and oversight of first line activities to enforce adherence to the risk framework and determine the action required if first line activities do not align with the framework.

Our Internal Audit Group and Credit Review Group constitute the third line of defense and provide independent assurance by assessing the quality and effectiveness of our processes and systems of internal control, risk management, and risk governance, compliance with applicable regulations, and the reliability and integrity of our financial and operational information.

RISK MANAGEMENT PROCESSES

Risk Appetite

Our risk appetite statement describes the nature and level of risk that we are willing to take. Our risk appetite policy describes the overarching approach through which we set our target risk profile and includes our risk appetite statement, which defines specific risk limits for our principal risks. Our risk appetite statement and risk appetite policy are approved by our Risk Committee at least annually. The second line of defense reports to our Risk Committee on our adherence to risk appetite limits on a quarterly basis.

Risk Identification and Assessment

The purpose of our risk identification and assessment process is to recognize and understand existing risks and risks that may arise from new business initiatives, external market forces, or regulatory or statutory changes, so that these risks can be properly assessed and incorporated into our risk control, monitoring, reporting and escalation processes.

Enterprise Risk Taxonomy

We use a risk taxonomy to identify and categorize our principal risks. This taxonomy provides a common language and discipline for the identification and assessment of risks in existing and new business, products, initiatives and acquisitions. We have six principal risk categories: Strategic, Reputation, Operational and Compliance, Credit, Liquidity and Market.

Strategic Risk Management Process

We define strategic risk as the risk to our current or projected financial condition and resilience arising from adverse business decisions, poor implementation of business decisions, or lack of responsiveness to changes in the industry or operating environment, or declining demand for our products and services caused by any other risk.

Strategic decisions are reviewed and approved by business leaders and various risk management committees and must be aligned with our policies and established risk appetite. We seek to manage strategic risk through risk controls embedded in these processes as well as overall risk management oversight over business goals. Launch of key new products as well as existing product performance is reviewed periodically by committees and business leaders to inform business decisions as appropriate. Mergers, acquisitions and divestitures can only be approved following Executive Committee due diligence, a comprehensive risk assessment by operational, market, credit and oversight leaders provided to the Chief Risk Officer and approval by either the Chief Risk Officer or appropriate risk committees. The ERMC and its sub-committees oversee the strategic risks and impacts of decisions and matters brought to the committees.

Reputation Risk Management Process

We define reputational risk as the risk that negative stakeholder reaction to our products, services, client and partner relationships, business activities and policies, management and workplace culture, or our response to unexpected events, could cause sustained critical media coverage, a decline in revenue or investment, talent attrition, litigation, or government or regulatory scrutiny.

Our business leaders are responsible for considering the reputational risk implications of business activities and strategies and ensuring the relevant subject matter experts are engaged as needed. The ERMC is responsible for ensuring reputational risk considerations are included in the scope of appropriate subordinate risk policies and committees and properly reflected in all decisions escalated to the ERMC.

Operational Risk Management Process

We define operational risk as the risk to our current or projected financial condition and resilience arising from inadequate, failed processes or systems, human error or misconduct or adverse external events. Operational risk is inherent in all business activities and can impact an organization through direct or indirect financial loss, brand damage, customer dissatisfaction, or legal and regulatory penalties.

Our operational risk management policy sets forth requirements for (i) the identification of issues and operational risk events, (ii) control enhancements and (iii) reporting of key trends and escalation of risks. There is a range of operational risk types, including process, execution & change; human capital; technology; information security & cybersecurity; third party; data; business disruption; fraud (external and internal); legal; financial reporting; and model risk. Each operational risk type has its own risk management policy that details the requirements and guidelines for managing the specific risk types. Operational risk, in aggregate, is overseen by the Operational Risk and Controls Committee, which is chaired by the Chief Operational Risk Officer.

For additional information regarding cybersecurity risk management & strategy and cybersecurity governance, including information regarding our technology risk and information security program, see Part I, Item 1C. “Cybersecurity.”

Compliance Risk Management Process

We define compliance risk as the risk to current or anticipated earnings or capital arising from violations of, or failure to conform to, or comply with, laws or regulations, internal policies, procedures and related practices, or ethical standards.

Our Global Compliance and Ethics organization is responsible for establishing and maintaining our corporate-wide compliance risk management program. Pursuant to this program, we seek to manage and mitigate compliance risk by assessing, controlling, monitoring, measuring and reporting the legal and regulatory risks to which we are exposed.

Our global compliance risk management policy defines the regulatory compliance obligations applicable to our activities and establishes a framework and program for compliance risk management. Certain compliance risk types (e.g., financial crimes, privacy, conduct) have dedicated risk management policies that detail the requirements and guidelines for managing the specific risk type. Compliance risk, in aggregate, is overseen by the Compliance and Conduct Risk Committee, which is chaired by the Chief Compliance Officer. This committee has a dual reporting relationship to both the Risk Committee (through the ERMC) and the ACC. Additionally, a dedicated Financial Crimes Risk Management Committee, chaired by the Head of Financial Crimes Compliance, oversees financial crimes related risk management activities.

Credit Risk Management Process

We define credit risk as the risk to our current or projected financial condition arising from an obligor’s failure to meet the terms of any contract with American Express or otherwise perform as agreed. Our credit risks are divided into two broad categories: 1) consumer and small business, and 2) commercial. Each has distinct risk management profiles, capabilities, strategies and tools. Business units that create individual or institutional credit risk exposures of significant importance are supported by dedicated risk management teams, each led by a Chief Credit Officer.

Consumer and small business credit risk arises from consumer and small business credit cards, charge cards and term loans. These portfolios consist of millions of customers across multiple geographies, industries and levels of net worth. We benefit from the high-quality profile of our customers, which is driven by our brand, premium customer servicing, product features and risk management capabilities, which span underwriting, customer management and collections. The risk in these portfolios is generally correlated to broad economic trends, such as unemployment rates and gross domestic product (GDP) growth.

The business unit leaders and their Chief Credit Officers take the lead in managing the credit risk process. These Chief Credit Officers are guided by the Credit and External Fraud Risk Committee, which oversees the implementation and enforcement of the global credit risk management policy and is co-chaired by the Chief Credit Officer and the Head of Financial Risk Management.

Credit risk management is supported by sophisticated proprietary scoring and decision-making models that use up-to-date information on prospects and customers, such as spending and payment history and data feeds from credit bureaus. We have developed data-driven economic decision logic for customer interactions to better serve our customers.

Commercial credit risk arises principally within our CS, ICS and GMNS businesses, as well as investment and liquidity management activities. Unlike consumer and small business credit risk, commercial credit risk is characterized by a lower loss frequency but higher severity. It is affected both by general economic conditions and by client-specific events. The absence of large losses in any given year or over several years is not necessarily representative of the level of risk of institutional portfolios, given the infrequency of loss events in such portfolios.

Similar to consumer and small business credit risk, business units taking commercial credit risks are supported by Chief Credit Officers, who are guided by the Credit and External Fraud Risk Committee. A centralized risk rating unit also provides risk assessment of our institutional obligors.

Liquidity Risk Management Process

We define liquidity risk as the risk to our current or projected financial condition arising from an inability to meet our current and future financial obligations at a reasonable cost when they become due.

Our Board-approved liquidity risk management policy establishes the framework that guides and governs liquidity risk management. The Finance Risk Committee oversees the management of liquidity risk and reviews and approves liquidity stress testing assumptions quarterly and scenarios annually. The Finance Risk Committee also approves our contingent funding plan as well as our funds transfer pricing framework.

The Asset/Liability Management Committee oversees the implementation of the liquidity risk management policy through the establishment of strategies, processes and procedures to manage liquidity risk within our established risk appetite, including annually approving our funding plan and reviewing outcomes of liquidity stress testing, liquidity coverage ratio and net stable funding ratio and adjusting funding and liquidity strategies to align with our risk appetite.

To manage liquidity risk, we seek to maintain access to a diverse set of cash, readily-marketable securities and contingent sources of liquidity, such that we can continuously meet our business requirements and expected future financing obligations for at least a twelve-month period under a variety of adverse circumstances. These include, but are not limited to, an event where we are unable to raise new funds under our regular funding programs during a substantial weakening in economic conditions. We consider the trade-offs between maintaining too much liquidity, which can be costly and limit financial flexibility, and having inadequate liquidity, which may result in financial distress during a liquidity event. Liquidity risk is managed at an aggregate consolidated level as well as at certain subsidiaries in order to ensure that sufficient and accessible liquidity resources are maintained.

Our liquidity risk management processes are designed in alignment with regulatory guidelines. As a Category III firm under U.S. federal bank regulatory agencies’ rules, we are subject to heightened capital, liquidity and prudential requirements, including more stringent liquidity risk management requirements. See “Supervision and Regulation – Capital and Liquidity Regulation” under “Business” for more information.

Market Risk Management Process

We define market risk as the risk to our current or projected financial condition, or the value of assets and liabilities, resulting from changes in market values like interest rates, asset prices, or foreign exchange rates. Our market risk exposures include (i) interest rate risk due to changes in the relationship between the interest rates on our assets (such as loans, receivables and investment securities) and the interest rates on our liabilities (such as debt and deposits) and (ii) foreign exchange risk related to transactions, funding, investments and earnings in currencies other than the U.S. dollar.

Our Finance Risk Committee, co-chaired by the Chief Financial Officer and Head of Financial Risk Management, approves our market risk management policy and oversees the management of market risk. Our Asset/Liability Management Committee oversees the implementation of the market risk management policy through the establishment of strategies, processes and procedures to manage market risk within established risk appetite.

Interest Rate Risk

We analyze a variety of interest rate scenarios to inform us of the potential impacts from interest rate changes on earnings and the value of assets, liabilities and the economic value of equity. Our interest rate exposure can vary over time as a result of, among other things, the proportion of our total funding provided by variable and fixed-rate debt and deposits compared to our Card Member loans and receivables. Interest rate swaps are used from time to time to effectively convert debt issuances to variable-rate from fixed-rate, or vice versa. Refer to Note 13 to the “Consolidated Financial Statements” for further discussion of our derivative financial instruments.

To measure the sensitivity of net interest income to interest rate changes, we first project net interest income over the following twelve-month time horizon considering forecasted business growth and anticipated future market interest rates. The impact from rate changes is then measured by instantaneously increasing or decreasing the anticipated future interest rates by the amounts set forth in Table 22 below. Our estimated repricing risk assumes that our interest-rate sensitive assets and liabilities that reprice within the twelve-month horizon generally reprice by the same magnitude, subject to applicable interest rate caps or floors, as benchmark rates change. It is further assumed that, within our interest-rate sensitive liabilities, certain deposits reprice at lower magnitudes and at a more gradual pace than benchmark rate movements. The magnitude and timing of this repricing in turn could depend on, among other factors, the direction of rate changes. These assumptions are consistent with historical deposit repricing experience in the industry and within our own portfolio. In 2025, we refined these forecast assumptions for deposits repricing to better reflect our observed business trends in response to benchmark rate changes. The same net interest income sensitivity analysis as of December 31, 2025 and 2024, using the previous forecast assumptions, is shown in Table 23 below. Actual changes in our net interest income will depend on many factors, and therefore may differ from our estimated risk to changes in market interest rates.

TABLE 22: SENSITIVITY ANALYSIS OF INTEREST RATE CHANGES ON ANNUAL NET INTEREST INCOME AS OF DECEMBER 31, 2025

(a)Negative values represent a reduction in net interest income.

TABLE 23: SENSITIVITY ANALYSIS OF INTEREST RATE CHANGES ON ANNUAL NET INTEREST INCOME AS OF DECEMBER 31, 2025 AND 2024, USING PREVIOUS DEPOSITS REPRICING ASSUMPTIONS

(a)Negative values represent a reduction in net interest income.

We use economic value of equity to inform us of the potential impacts from interest rate changes on the net present value of our assets and liabilities under a variety of interest rate scenarios. Economic value of equity is calculated based on our existing assets, liabilities and derivatives, and does not incorporate projected changes in our balance sheet. Key assumptions used in this calculation include the term structure of interest rates, as well as deposit repricing and liquidation profiles used to inform duration and cash flow schedules. The economic value of equity is calculated under multiple interest rate scenarios, including baseline and immediate upward and immediate downward interest rate shocks, to assess its sensitivity to changes in interest rates. Our current sensitivity profile demonstrates that our economic value of equity generally decreases in a declining interest rate scenario and increases in an increasing interest rate scenario. The level of this sensitivity is managed within board-approved policy limits.

Foreign Exchange Risk

Foreign exchange exposures arise in four principal ways: (1) Card Member spending in currencies that are not the billing currency, (2) cross-currency transactions and balances from our funding activities, (3) cross-currency investing activities, such as in the equity of foreign subsidiaries, and (4) revenues generated and expenses incurred in foreign currencies, which impact earnings.

These foreign exchange risks are managed primarily by entering into foreign exchange spot transactions or hedged with foreign exchange forward contracts when the hedge costs are economically justified and in notional amounts designed to offset pretax impacts from currency movements in the period in which they occur. As of December 31, 2025, foreign currency derivative instruments with total notional amounts of approximately $54 billion were outstanding.

With respect to Card Member spending and cross-currency transactions, including related foreign exchange forward contracts outstanding, the impact of a hypothetical 10 percent strengthening of the U.S. dollar would have been immaterial to projected earnings as of December 31, 2025. With respect to translation exposure of foreign subsidiary equity balances, including related foreign exchange forward contracts outstanding, a hypothetical 10 percent strengthening of the U.S. dollar would result in an immaterial reduction in other comprehensive income and equity as of December 31, 2025. With respect to anticipated earnings denominated in foreign currencies for the next twelve months, the adverse impact on pretax income of a hypothetical 10 percent strengthening of the U.S. dollar, net of hedges, would be approximately $200 million as of December 31, 2025.

The actual impact of interest rate and foreign exchange rate changes will depend on, among other factors, the timing of rate changes, the extent to which different rates do not move in the same direction or in the same direction to the same degree, changes in the cost, volume and mix of our hedging activities and changes in the volume and mix of our businesses.