AMERICAN INTERNATIONAL GROUP INC

GENERAL

Our (re)insurance subsidiaries are subject to extensive regulation and supervision in the jurisdictions in which our (re)insurance businesses are located or operate. Insurance regulatory authorities in those jurisdictions are the primary regulators for those businesses; however, our operations are subject to regulation by many different types of regulatory authorities, including insurance, securities, derivatives and investment advisory regulators in the United States and abroad.

Insurance regulators, other regulatory authorities, law enforcement agencies, and other governmental authorities from time to time make inquiries and conduct examinations or investigations regarding our compliance, as well as compliance by other companies in our industry, with applicable laws. In addition, regulation, legislation and administrative policies that are not limited in application solely to the insurance market may significantly affect the insurance industry and certain of our operations, including regulation, legislation and administrative policies related to privacy, cybersecurity, government sanctions, pensions, age and sex discrimination, financial services, securities, taxation and climate change. See Item 1A. Risk Factors – Regulation – "Our businesses are heavily regulated and changes in laws and regulations may affect our operations, increase our insurance subsidiary capital requirements or reduce our profitability".

We expect that the U.S. and international regulations applicable to us and our regulated entities will continue to evolve for the foreseeable future. See Item 1A. Risk Factors – Regulation – "New laws and regulations or new interpretations of current laws and regulations, both domestically and internationally, may affect our businesses, results of operations, financial condition and ability to compete effectively".

FINANCIAL, MARKET CONDUCT & CORPORATE GOVERNANCE OVERSIGHT

The method of insurance regulation of our (re)insurance subsidiaries varies, but generally has its source in statutes that delegate regulatory and supervisory powers to a state insurance official (in the United States) or another governmental agency (outside the United States). The regulation and supervision relate primarily to the financial condition of the (re)insurers, corporate conduct and market conduct activities. In general, such regulation is for the protection of policyholders rather than the creditors or equity owners of these companies. Financial, market conduct and corporate conduct oversight varies by jurisdiction, but can include activities such as:

(a)approval of policy language and rates;

(b)advertising practices;

(c)establishing minimum capital and liquidity requirements;

(d)licensing of insurers and their agents;

(e)requiring registration and periodic reporting by (re)insurance companies that are licensed in the jurisdiction;

(f)evaluating and, in some cases, requiring regulatory approval of, certain transactions between (re)insurance company subsidiaries and their affiliates;

(g)imposing restrictions and limitations on the amount of dividends or other distributions payable by a (re)insurance company;

(h)enforcing rules related to outsourcing of material functions;

(i)requiring deposits of securities for the benefit of policyholders;

(j)establishing requirements for acceptability of reinsurers and credit for reinsurance;

(k)establishing requirements for reserves; and

(l)enterprise risk management (including technology risk management) and corporate governance requirements.

Our (re)insurance subsidiaries are generally subject to laws and regulations that prescribe the type, quality and concentration of investments they can make and permissible investment practices, such as derivatives, securities lending and repurchase transactions. In non-U.S. jurisdictions, our (re)insurance subsidiaries may also be subject to laws requiring certain amounts and types of local investment. In addition, certain affiliates of our (re)insurance affiliates are themselves subject to laws and regulations concerning the investment advisory and investment management services they provide to our (re)insurance subsidiaries and other clients with respect to such investments.

Insurance laws in many jurisdictions also provide that no person, corporation or other entity may acquire control of an insurance company, or a controlling interest in (or prescribed percentage of capital of) any direct or indirect parent company of an insurance company, without the prior approval of, or notice to, such insurance company’s domiciliary insurance regulator.

As a holding company with no significant business operations of its own, AIG Parent depends on dividends from our subsidiaries to meet our obligations. U.S. state insurance laws typically provide that dividends in excess of certain prescribed limits are considered to be extraordinary dividends and require prior approval or non-disapproval from the applicable insurance regulator. Outside the U.S., (re)insurers, subject to certain exceptions, are permitted to pay dividends subject to maintaining prescribed capital and solvency requirements and ensuring that dividends are made out of profits/retained earnings.

Further, as part of their regulatory oversight processes, insurance regulators conduct periodic examinations of our (re)insurance subsidiaries. Such examinations can cover a broad scope of the (re)insurance subsidiary’s operations, including the financial strength of the (re)insurance subsidiary; sales, marketing and claims handling practices; risk management; capital and liquidity management; and information technology operations (including emerging technology risks).

Insurance and securities regulators and other law enforcement agencies and attorneys general also, from time to time, make inquiries, issue data calls and conduct examinations or investigations regarding compliance with insurance and other laws or for informational purposes that can be company-specific or part of a broader industry-wide effort.

There can be no assurance that any noncompliance with such applicable laws, regulations or guidance would not have a material adverse effect on our business or results of operations.

REGULATORY REGIMES

United States

States

At the state-level, the National Association of Insurance Commissioners (NAIC) is a standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and five U.S. territories. The NAIC is not a regulator, but, with assistance from the NAIC, state insurance regulators establish standards and best practices, conduct peer reviews and coordinate regulatory oversight. Model laws and regulations promulgated by the NAIC only become effective in a state once formally adopted by such state and are subject to revision by each state. Examples of NAIC models adopted, in substantial part, by all states include:

•The Risk-Based Capital (RBC) for Insurers Model Act, which incorporates an RBC formula calculated in accordance with instructions updated annually by the NAIC that is designed to measure the adequacy of an insurer’s total adjusted capital, as calculated pursuant to the RBC formula, in relation to certain risks inherent in its business, and authorizes certain regulatory actions regarding insurers whose RBC levels fall below specific thresholds. The NAIC has adopted, or is considering, several changes impacting how RBC is calculated, including initiatives aimed at a comprehensive review of the RBC investment framework as well as a proposed modeling methodology to determine RBC for collateralized loan obligations and other structured securities to reduce reliance on the use of rating agency ratings. The RBC levels of each of our U.S. domiciled (re)insurance companies exceeded each of these specific thresholds as of December 31, 2023. In addition to RBC requirements, the insurance laws of our domiciliary states prescribe certain minimum capital and surplus requirements for insurance companies. If any of our (re)insurance entities fell below prescribed levels of statutory capital and surplus, it would be our intention to provide appropriate capital or other types of support to that entity. For additional information, see Part II, Item 7. MD&A – Liquidity and Capital Resources – Liquidity and Capital Resources of AIG Parent and Subsidiaries – Insurance Companies.

•The Insurance Holding Company System Regulatory Act and the Insurance Holding Company System Model Regulation (together, the Holding Company Models) include: provisions authorizing insurance commissioners to act as global group-wide supervisors for internationally active insurance groups and participate in international supervisory colleges; standards for transactions between a domestic (re)insurance company and its affiliates and regulatory approval requirements for certain of such transactions; requirements for obtaining regulatory approval for acquiring control of a domestic (re)insurance company; and the requirement that the ultimate controlling person of a U.S. insurer file an annual enterprise risk report with its lead state regulator identifying risks likely to have a material adverse effect upon the financial condition or liquidity of its licensed insurers or the insurance holding company system as a whole, among other requirements. The New York State Department of Financial Services (NYDFS) is AIG’s lead U.S.-state regulator, and leads AIG’s Supervisory College meetings, which consist of AIG’s key global regulatory bodies.

•The Risk Management and Own Risk and Solvency Assessment Model Act, which requires that insurers maintain a risk management framework, conduct an internal own risk and solvency assessment of the insurer’s material risks in normal and stressed environments, and submit annual Own Risk and Solvency Assessment (ORSA) summary reports to the insurance group’s lead U.S.-state regulator.

•The Corporate Governance Annual Disclosure Model Act (CGAD), which requires insurers to submit an annual filing regarding their corporate governance structure, policies and practices.

•And, specific to our life insurance subsidiaries, the NAIC's new Valuation Manual, which contains a principle-based reserving (PBR) approach to life insurance company reserves. PBR is designed to tailor the reserving process to more closely reflect the risks of specific products rather than the factor-based approach employed historically.

The NAIC also provides standardized insurance industry accounting and reporting guidance through the NAIC Accounting Manual, which establishes statutory accounting principles applicable to (re)insurance companies. Statutory accounting principles promulgated by the NAIC may be modified by individual state laws, regulations and permitted practices granted by our domiciliary insurance regulators.

The NAIC has undertaken a multi-pronged effort to determine whether additional standards, safeguards or disclosures are required in connection with certain investments by U.S. insurance companies, including related party investments, structured securities and other complex assets.

In December 2020, the NAIC amended the Holding Company Models to incorporate a Liquidity Stress Testing (LST) requirement for large life insurers based on a set of scope criteria and a Group Capital Calculation (GCC) requirement. These amendments require the ultimate controlling person of every U.S. insurer that is scoped into the LST framework to submit LST results to the insurance group’s lead state insurance regulator on an annual basis. In addition, these amendments require the ultimate controlling person of every U.S. insurer to submit GCC reports to the insurance group’s lead state insurance regulator on an annual basis unless an exemption applies. The provisions of the December 2020 amendments to the Holding Company Models that authorize the GCC and LST were signed into law by New York State in August 2023, making AIG formally subject to them beginning in 2024.

U.S. states have state insurance guaranty associations in which insurers admitted in the state are required by law to be members. Member insurers may be assessed by the associations for certain obligations of insolvent insurance companies to policyholders and claimants. The aggregate assessments levied against us have not been material to our financial condition in any of the past three years.

Federal

At the U.S. federal level, AIG is impacted by the activities of policymakers and by the laws and regulations enforced by various federal agencies.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), signed into law in 2010, brought about extensive changes to financial regulation in the United States and established the Federal Insurance Office (FIO) to serve as the central insurance authority in the federal government. While not serving a regulatory function, FIO performs certain duties related to the business of insurance and has authority to collect information on the insurance industry and recommend prudential standards. In addition, FIO monitors market access issues, represents the United States in international insurance forums and has authority to determine if certain regulations are preempted by covered agreements. FIO’s approval is required to subject a financial company whose largest U.S. subsidiary is an insurer to the special orderly liquidation process outside the federal bankruptcy code, administered by the FDIC pursuant to Dodd-Frank. U.S. insurance subsidiaries of any such financial company, however, would remain subject to rehabilitation and liquidation proceedings under state insurance laws.

FIO also assists the Secretary of the Treasury in administering the U.S. Terrorism Risk Insurance Act (TRIA), enacted in 2002 to support insurance coverage for certain terrorist acts in the U.S. The program was continued under the Terrorism Risk Insurance Program Reauthorization Act of 2019 (TRIPRA) through December 31, 2027 and is intended to provide reinsurance coverage from the federal government in limited circumstances for certified acts of terrorism that exceed a certain threshold of industry losses.

Title I of Dodd-Frank established the Financial Stability Oversight Council (Council), which is authorized to determine that certain nonbank financial companies be designated as nonbank systemically important financial institutions (SIFIs) subject to supervision by the Board of Governors of the Federal Reserve System and enhanced prudential standards. Designation by the Council of any nonbank SIFI is subject to certain statutory and regulatory standards and to the Council’s guidance. The Council may also recommend that state insurance regulators or other regulators apply new or heightened standards and safeguards for activities or practices that insurers or other nonbank financial services companies engage in.

Title V of Dodd-Frank authorizes the United States to enter into covered agreements with foreign governments or regulatory entities regarding the business of insurance and reinsurance. On September 22, 2017, the U.S. and the European Union (EU) entered into such an agreement, and on December 18, 2018, the U.S. signed a covered agreement with the United Kingdom (UK), which is similar to the agreement with the EU. Under the agreements, AIG is supervised at the worldwide group level only by its relevant U.S. insurance supervisors, and generally does not have to satisfy EU Solvency II group capital, reporting and governance requirements for its worldwide group. The covered agreements also require various U.S. reinsurance collateral reforms, which have now been adopted by all U.S. states.

Title VII of Dodd-Frank provides for significantly increased regulation of, and restrictions on, derivatives markets and transactions that have affected various activities of insurance and other financial services companies, including (i) regulatory reporting for swaps, including security-based swaps, (ii) mandated clearing through central counterparties and execution through regulated swap execution facilities for certain swaps (other than security-based swaps) and (iii) margin and collateral requirements.

In the UK, the Prudential Regulation Authority (PRA) is the lead prudential supervisor for our UK insurance operations and the Financial Conduct Authority has oversight of AIG’s insurance operations for consumer protection and competition matters.

In the EU, various Directives and Regulations affect our international (re)insurance operations. The Luxembourg insurance regulator, the Commissariat aux Assurances, is the insurance regulator for AIG Europe SA, which serves our European Economic Area (EEA) and Swiss policyholders. In addition, financial companies that operate in the EU are subject to a range of regulations enforced by the national regulators in each member state in which that firm operates. Solvency II governs the insurance industry’s solvency framework for the EU, including minimum capital and solvency requirements, governance requirements, risk management and public reporting standards.

AIG’s operating (re)insurance subsidiaries in Bermuda are regulated by the Bermuda Monetary Authority (BMA). Bermuda’s Insurance Act 1978, the applicable Codes of Conduct and related regulations impose solvency and liquidity standards and auditing and reporting requirements on Bermuda (re)insurance companies and grant the BMA powers to supervise, investigate and intervene in the affairs of (re)insurance companies. A variety of requirements and restrictions are imposed on our Bermuda operating (re)insurance subsidiaries including: periodic financial reporting; corporate governance framework; solvency and financial performance; compliance with minimum enhanced capital requirements; and minimum solvency margins and liquidity ratios (the latter for general business (re)insurers); and limitations on dividends and distributions.

The Monetary Authority of Singapore (MAS) supervises AIG’s insurance subsidiary in Singapore. It has broad authority under the Insurance Act 1966 to regulate insurance business in Singapore as well as insurers, insurance intermediaries and related institutions. Our Singapore insurance operations are subject to minimum capital and solvency requirements as well as financial reporting, corporate governance and conduct of business requirements. The MAS has authority to conduct inspections and investigations on insurers and to administer sanctions for regulatory non-compliance. Our Singapore insurance subsidiary holds insurance entities in the Asia Pacific region. The MAS holds the Chief Executive of the Singapore insurance subsidiary principally responsible for the management and conduct of the business of the subsidiary, including the business of its subsidiaries and overseas branches.

The Japan Financial Services Agency (JFSA) regulates AIG’s operating insurance subsidiaries and insurance holding company in Japan. The JFSA has extensive authority under the Insurance Business Act and related regulations to oversee licensing, sales practices, business conduct, investments, reserves and solvency, amongst other matters. Our Japanese insurance operations are required to maintain a minimum solvency margin ratio (SMR), which is a measure of capital adequacy. The failure to maintain an appropriate SMR, or comply with other similar indicators of financial health, could result in the JFSA imposing corrective actions on our operations.

FSB and IAIS

The Financial Stability Board (FSB) consists of representatives of national financial authorities of the G20 countries. The FSB is not a regulator but is focused primarily on promoting international financial stability. The FSB has issued a series of frameworks and recommendations to address such issues as systemic financial risk, financial group supervision, capital and solvency standards, effective recovery and resolution regimes, corporate governance including compensation, and a number of related issues associated with responses to the financial crisis.

The International Association of Insurance Supervisors (IAIS) represents insurance regulators and supervisors of more than 200 jurisdictions (including regions and states) in nearly 140 countries and seeks to promote globally consistent insurance industry supervision. The IAIS is not a regulator, but one of its activities is to develop insurance regulatory standards for use by local authorities across the globe. For example, the IAIS has adopted ComFrame, a Common Framework for the Supervision of Internationally Active Insurance Groups (IAIGs). ComFrame assists regulators in addressing an IAIG’s risks by providing supervisory standards for areas such as group supervision, governance and internal controls, enterprise risk management, and recovery and resolution planning. We currently meet the criteria set forth to identify an IAIG, and the NYDFS, as our group-wide supervisor, has publicly disclosed us as an IAIG on the IAIS’ register of IAIGs.

In addition, the FSB has charged the IAIS with developing a framework for measuring and mitigating systemic risks posed by the insurance sector, and in response the IAIS developed an enhanced set of supervisory policy measures for the assessment and mitigation of systemic risk in the insurance sector (Holistic Framework), with implementation beginning in 2020. The Holistic Framework recognizes that systemic risk can emanate from specific activities and exposures arising from either sector-wide trends or concentrations in individual insurers. In light of the IAIS adoption of the Holistic Framework, the FSB decided in December 2022 to discontinue the annual identification of Global Systemically Important Insurers in favor of instead applying the Holistic Framework to inform the FSB’s consideration of systemic risk in insurance.

As part of ComFrame, the IAIS is developing a risk-based global insurance capital standard (ICS) applicable to IAIGs, with the purpose of creating a common language for supervisory discussions of group solvency of IAIGs. The IAIS has adopted ICS Version 2.0 for a five-year monitoring phase, with an initial phase that commenced January 2020. During the initial phase, ICS Version 2.0 is used for confidential reporting to group-wide supervisors and discussion in supervisory colleges, but will not trigger supervisory action.

Beginning after the conclusion of the five-year monitoring period in 2024, the IAIS has agreed to a second phase of implementation in which the ICS will be applied as a group-wide prescribed capital requirement, defined as a solvency control level above which the supervisor does not intervene on capital adequacy grounds. However, in recognition that the United States and potentially other interested jurisdictions are developing an alternative approach to a group capital calculation that, as with the GCC, utilizes an aggregation methodology of available capital and required capital of all insurance group members (Aggregation Method or AM), the IAIS is assessing whether the AM provides comparable outcomes to ICS Version 2.0, including by collecting data from interested jurisdictions. The IAIS aims to be in a position by the end of the monitoring phase to assess whether the AM provides substantially the same outcome as the ICS, in which case it will be considered an outcome-equivalent approach to the ICS.

The standards issued by the FSB and/or the IAIS are not binding on the United States or other jurisdictions around the world unless and until the appropriate local governmental bodies or regulators adopt laws or regulations implementing such standards.

PRIVACY, DATA PROTECTION, CYBERSECURITY AND ARTIFICIAL INTELLIGENCE REQUIREMENTS

We are subject to various laws and regulations that require financial institutions and other businesses to protect and safeguard personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information. We also are subject to U.S. federal and state laws and regulations requiring notification to affected individuals and regulators of a data breach(es). Below we highlight a few key privacy, data protection, cybersecurity and artificial intelligence (AI) laws and regulations.

In October 2017, the NAIC adopted the Insurance Data Security Model Law (NAIC Data Security Model Law), which, among other things, requires insurers, insurance producers and other entities required to be licensed under state insurance laws to develop and maintain a written information security program, conduct risk assessments, and oversee the data security practices of third-party service providers. As of December 31, 2023, more than 20 jurisdictions had adopted the NAIC Data Security Model Law. In addition, on March 1, 2019, the NYDFS’s cybersecurity regulation became fully effective, requiring covered financial institutions, including insurance entities licensed in New York, to, among other things, implement a cybersecurity program designed to protect information systems. On November 1, 2023 the NYDFS published amendments to this cybersecurity regulation, which include additional obligations for large insurers including enhanced and updated governance, risk assessment, and technology requirements, new notification obligations, and clarifying changes regarding enforcement.

The State of California enacted the California Consumer Privacy Act of 2018 (CCPA), which went into effect as of January 1, 2020, and imposes significant and often first-of-their-kind privacy obligations on businesses handling data related to California residents. The law has a number of exceptions as a result of amendments however; it does not apply to personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act (GLBA) and implementing regulations or the California Financial Information Privacy Act (FIPA). These amendments reduce the impact of the law on AIG in some, but not all, areas. The California Privacy Rights Act (CPRA) passed in November 2020 became effective January 1, 2023 and amends the CCPA to create additional privacy rights and obligations in California. Colorado, Connecticut, Utah and Virginia also enacted comprehensive consumer data privacy laws and many other states have proposed similar laws, albeit with similar exemptions for entities and/or data governed by the GLBA.

These privacy laws impose requirements on covered businesses that are similar to those imposed by the CCPA with respect to privacy notices, data subject rights and data security standards.

The Securities and Exchange Commission (SEC) Rules of Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure by Public Companies require among other things, disclosure by registrants of any material cybersecurity incident on Form 8-K within four business days of determining that the incident the registrant has experienced is material. They also require periodic disclosures of, among other things, (i) details on the company’s cybersecurity policies and procedures, and (ii) cybersecurity governance and oversight policies, including the board of directors’ oversight of any material incidents (individually or in the aggregate).

The EU General Data Protection Regulation (GDPR) took effect in May 2018. The GDPR’s scope extends to entities established within the EEA (i.e., EU member states plus Iceland, Liechtenstein and Norway) and to certain entities not established in the EEA (in certain instances, if they solicit or target individuals in the EU by offering goods or services to EEA data subjects or monitoring the personal behavior of EEA data subjects (e.g., in an online context)). The GDPR was also onshored in the UK through the European Union (Withdrawal) Act 2018, with adjustments as provided in the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. Sanctions for non-compliance with the GDPR are onerous, with the potential for fines of up to 4 percent of global revenue for the most serious infringements of the GDPR.

We have sought to address the GDPR’s requirements by demonstrating accountability for compliance with the GDPR’s principles relating to processing of personal data, maintaining records of processing and completing mandatory Data Protection Impact Assessments in connection with higher risk data processing activities.

The GDPR imposes requirements on the transfer of personal data outside of the EEA, including via standard contractual clauses supplemented by an assessment and due diligence of the legal and regulatory landscape of the jurisdiction of the data importer, the channels used to transmit personal data and the processors or subprocessors that may process personal data.

The NAIC and certain U.S. states have adopted or are considering regulations and guidance relating to the use of “big data,” AI, machine learning and other technology innovations in the insurance marketplace. For example, Colorado and New York have adopted regulations or guidance with respect to the use of external consumer data and information sources in underwriting for life insurance, including the use of algorithms and predictive models. In December 2023, the NAIC adopted a model bulletin on the use of AI by insurers that sets forth governance, risk management and other requirements that insurers using AI are expected to establish. In addition, state insurance regulators in the United States have issued and will continue to consider regulations or proposed guidelines in the use of external data, algorithms and AI in insurance practices, including underwriting, marketing, and claims practices.

The EEA and the UK have also taken steps to regulate the use of data and algorithms used for the purpose of AI and automated decision-making. On December 9, 2023, the European Parliament and European Council reached a provisional agreement on the European Union Artificial Intelligence Act, which, once formally adopted, will broadly regulate the use of AI within the European Union. European countries, and supranational political organizations like the EU and the Council of Europe, are expected to continue taking an active role in regulating AI in ways that may impact the insurance industry in the future.

We also are subject to other international laws and regulations that require financial institutions and other businesses to protect personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information and to obtain consent for specific processing activities. We are also subject to laws and regulations requiring notification to affected individuals and regulators of security breaches and laws and regulations regarding data localization and the cross-border transfer of information.

CLIMATE CHANGE

In recent years, federal- and state-level lawmakers and regulators in the United States and in other major countries in which we operate have increased their scrutiny on financial institutions’ and other companies’ governance, risk oversight, disclosures, plans, policies and practices in connection with climate change. Throughout 2023, there have been active and significant regulatory developments on these issues in the form of newly proposed, issued or implemented laws, rules, regulations, guidance and frameworks regarding climate change that impose, or will impose if and when effective, new requirements and expectations, including in connection with climate-related governance, risk management, disclosures, stress testing and scenario analysis. Regulators in several jurisdictions are considering the so-called protection gap as it relates to climate – which is the view that populations are under-insured or that there is insufficient coverage to protect policyholders against the risks associated with climate change. In addition, the SEC has proposed rule changes on climate-related disclosure. The proposed rule would require registrants, including public issuers such as us, to include certain climate-related disclosures in registration statements and periodic reports. These proposed disclosures include information about climate-related risks that are reasonably likely to have a material impact on the registrant’s business, results of operations, or financial condition, and include a new note to their audited financial statements that provides certain climate-related metrics and impacts on a line-item basis. The proposed climate-related disclosures would also include disclosure of a registrant’s greenhouse gas emissions (including Scope 3 emissions) and attestation thereof, as well as information about climate-related targets, goals, and transition plan, if any. If adopted as proposed, the rule changes are expected to result in additional compliance and reporting costs. We continue to actively monitor the regulatory landscape surrounding these issues.

U.S. SECURITIES, INVESTMENT ADVISER, BROKER-DEALER AND INVESTMENT COMPANY REGULATION

Our investment products and services are subject to applicable federal and state securities, investment advisory, fiduciary, including the Employee Retirement Income Security Act of 1974, as amended (ERISA), and other laws and regulations. The principal U.S. regulators of these operations include the SEC, Financial Industry Regulatory Authority (FINRA), Commodity Futures Trading Commission (CFTC), Municipal Securities Rulemaking Board, state securities commissions, state insurance departments and the Department of Labor (DOL).

Our variable life insurance, variable annuity and mutual fund products generally are subject to regulation as “securities” under applicable federal securities laws, except where exempt. Such regulation includes registration of the offerings of these products with the SEC, unless exempt from such registration, and requirements of distribution participants to be registered as broker-dealers, as well as recordkeeping, reporting, and other requirements. This regulation also involves the registration of mutual funds and other investment products offered by our businesses, and the separate accounts through which our variable life insurance and variable annuity products are issued, as investment companies under the Investment Company Act of 1940, as amended (Investment Company Act), except where exempt. The Investment Company Act imposes requirements relating to compliance, corporate governance, disclosure, recordkeeping, registration and other matters. In addition, the offering of these products may involve filing and other requirements under the securities laws of the states and other U.S. jurisdictions where offered. Our separate account investment products are also subject to applicable state insurance regulation.

We have several subsidiaries that are registered as broker-dealers under the Securities Exchange Act of 1934, as amended (Exchange Act) and are members of FINRA, and/or are registered as investment advisers under the Investment Advisers Act of 1940, as amended (Advisers Act). Certain of these broker-dealers and investment advisers are involved in our life and annuity product sales, including participating in their distribution and/or serving as an investment adviser to mutual funds that underlie variable products offered by us. Certain of these broker-dealers and investment advisers are also involved in the management of the investment portfolios of our (re)insurance subsidiaries and other affiliates. In addition to registration requirements, the Exchange Act, the Advisers Act, and the regulations thereunder, impose various compliance, disclosure, qualification, recordkeeping, reporting requirements and subject these subsidiaries and their operations to examination. State securities laws also impose filing and other requirements on broker-dealers, investment advisers and/or their licensed representatives, except where exempt.

Further, our licensed sales professionals appointed with certain of our broker-dealer and/or investment adviser subsidiaries and our other employees, insofar as they sell products that are securities, including wholesale and retail activity, are subject to the Exchange Act and to examination requirements and regulation by the SEC, FINRA and state securities commissioners. Regulation and examination requirements also extend to our subsidiaries that employ or control those individuals.

INTERNATIONAL SECURITIES, INVESTMENT ADVISER, BROKER-DEALER AND INVESTMENT COMPANY REGULATION

We operate investment-related businesses in, among other jurisdictions, the UK and Ireland. These businesses may advise on and market investment management products and services, investment funds and separately managed accounts. The regulatory authorities for these businesses include securities, investment advisory, financial conduct and other regulators that typically oversee such issues as: (1) company licensing; (2) the approval of individuals with positions of responsibility; (3) conduct of business to customers, including sales practices; (4) solvency and capital adequacy; (5) fund product approvals and related disclosures; and (6) securities, commodities and related laws, among other items. We also participate in investment-related joint ventures in jurisdictions outside the United States, primarily in Europe and Asia. In some cases, our international investment operations are also subject to U.S. securities laws and regulations.

ERISA

We provide products and services to certain employee benefit plans that are subject to ERISA and/or the Internal Revenue Code of 1986, as amended (the Internal Revenue Code). Plans subject to ERISA include certain pension and profit-sharing plans and welfare plans, including health, life and disability plans. As a result, our activities are subject to the restrictions imposed by ERISA and the Internal Revenue Code, including the requirement under ERISA that fiduciaries must perform their duties solely in the interests of ERISA plan participants and beneficiaries, and that fiduciaries may not cause a covered plan to engage in certain prohibited transactions. The applicable provisions of ERISA and the Internal Revenue Code are subject to enforcement by the DOL, the Internal Revenue Service (IRS) and the Pension Benefit Guaranty Corporation.

STANDARD OF CARE DEVELOPMENTS

We and our distributors are subject to laws and regulations regarding the standard of care applicable to sales of our products and the provision of advice to our customers. In recent years, many of these laws and regulations have been revised or reexamined while others have been newly adopted, such as:

•On October 31, 2023, the DOL announced proposed changes to the regulatory definition of an investment advice fiduciary for purposes of transactions with ERISA qualified plans, related plan participants and IRAs. The proposed changes also included significant changes to existing prohibited transactions exemptions (PTEs) relating to such advice, including PTE 84-24 and PTE 2020-02. The DOL’s proposed regulation changes would significantly increase the number of recommendations that would be considered fiduciary, including (but not limited to) retirement plan rollover recommendations. The DOL proposal established a 60-day comment period through January 2, 2024. Final DOL guidance is expected in 2024.

•SEC Best Interest Regulation– In 2020, Regulation Best Interest (Regulation BI), which establishes new rules regarding the standard of care a broker must meet when making a recommendation to a retail customer in connection with the sale of a security or other covered recommendation, and Form CRS, which requires enhanced disclosure by broker-dealers and investment advisers regarding client relationships and certain conflicts of interest issues, became effective. Both had been adopted by the SEC in June 2019 as part of a package of final rulemakings and interpretations, at the same time as the SEC issued two interpretations under the Advisers Act. The first interpretation addressed the standard of conduct applicable to SEC-registered investment advisers, including details regarding the fiduciary duty owed to clients, required disclosures and the adviser’s continuous monitoring obligations. The second interpretation clarified when investment advice would be considered “solely incidental” to brokerage activity for purposes of the broker-dealer exclusion from SEC investment adviser registration. These two SEC interpretations became effective in 2019.

•FINRA Standard of Care Development– In 2020, FINRA Rule 2111 was amended to provide that FINRA’s suitability requirements do not apply to recommendations that are subject to Regulation BI. This amendment was intended to mitigate any potential confusion regarding which standard of conduct applies to retail consumers. FINRA’s suitability rules still apply to recommendations that are not covered by Regulation BI, such as recommendations to institutional customers.

•New York Standard of Care Developments – In July 2018, NYDFS adopted a best interest standard of care regulation applicable to annuity and life insurance transactions through issuance of the First Amendment to Insurance Regulation 187 – Suitability and Best Interests in Life Insurance and Annuity Transactions (Regulation 187). As amended, Regulation 187 requires life and annuity producers to act in their client’s best interest when making point-of-sale and in-force recommendations, and to deliver to the client the written basis for the recommendation, as well as the facts and analysis to support the recommendation. The amended regulation also imposes additional duties on life insurance companies in relation to these transactions, such as requiring insurers to establish and maintain procedures designed to prevent financial exploitation and abuse. The amended Regulation 187 was previously challenged in court, but was upheld by the State of New York Court of Appeals, which is New York’s highest state court, in October 2022.

•State Standard of Care Developments (Other than New York) – In February 2020, the NAIC adopted revisions to its Suitability in Annuity Transactions Model Regulation (#275) (NAIC Suitability Model) implementing a best interest standard of care applicable to sales and recommendations of annuities. The amended NAIC Suitability Model conforms in large part to Regulation BI, providing that all recommendations by agents and insurers must be in the best interest of the consumer under known circumstances at the time an annuity recommendation is made, without placing agents’ or insurers’ financial interests ahead of the consumer’s interest in making a recommendation. A majority of states have adopted amendments to their suitability rules based on the NAIC Suitability Model revisions, and we expect that a substantial majority of states will do so or consider adopting their own standards of conduct which could be broader than the NAIC Suitability Model.

We continue to closely follow these legislative and regulatory activities as changes in standard of care requirements and have evaluated the impact of these requirements on us and our customers, distribution partners and financial advisers. We have made significant investments to implement and enhance tools, processes and procedures, where needed, to comply with the final rules and interpretations. These efforts and enhancements have resulted in increased compliance costs and may impact sales results and increase regulatory and litigation risk.

FEDERAL RETIREMENT LEGISLATION

In December 2022, comprehensive retirement legislation entitled "SECURE 2.0 Act of 2022" (SECURE 2.0) was signed into law. SECURE 2.0 included many provisions affecting qualified contracts, many of which became effective in 2023, and additional ones that become effective in 2024 or subsequent years. Some of the SECURE 2.0 provisions that became effective in 2023 include, among others: an increase in the age at which required minimum distributions generally must commence to age 73 from the previous age of 72; elimination of the first day of the month requirement for governmental Section 457(b) plans; and optional treatment of employer contributions as Roth sources. We are implementing new processes and procedures, where needed, designed to comply with the new requirements.