FIRST HORIZON CORP

BOARD MATTERS

each committee reports regularly to the full Board concerning risk.

Risk Committee. The Risk Committee charter provides that the Committee shall have, as its sole and exclusive function, responsibility for the risk management policies of the company's global operations and oversight of the operation of the company's global risk management framework. The charter authorizes and directs the Committee to assist the Board in its oversight of (i) the establishment and operation of our enterprise risk management framework, including policies and procedures establishing risk management governance, risk management procedures, risk control infrastructure, and processes and systems for implementing and monitoring compliance with the framework with respect to the management of the risks facing the company, (ii) the adoption, implementation and periodic review of significant risk management and compliance policies and (iii) our risk appetite statement. In fulfilling its risk responsibilities, the Board delegated the following duties to the Committee: to review periodically and recommend to the Board the risk appetite parameters to be employed by management in operating the company; to receive information on our business practices, policies and procedures related to the risks facing the company; to monitor results to ensure alignment with First Horizon’s risk appetite; to review periodic risk and compliance reports from the Chief Risk Officer and the Chief Credit Officer, including reports on major risk exposures and steps taken to monitor, mitigate and control such exposures, and reports from the Chief Risk Officer on risk management deficiencies and emerging risks; to review periodically with management regulatory reports, regulatory correspondence and actions; to review First Horizon’s capital stress testing program and results; and to establish (or recommend to the Board the establishment of) risk management and compliance policies and periodically review such policies, as appropriate. The reports from the Chief Risk Officer referred to above take place on a quarterly basis and include information on artificial intelligence and information security (including cybersecurity) risks and the steps taken to monitor, mitigate and control them. The Committee’s charter specifically states that the Committee may meet separately in executive session with any of the Chief Risk Officer, Chief Credit Officer, Chief Human Resources Officer, or Chief Audit Executive as often as the Committee deems necessary or appropriate and that it will meet quarterly with the Credit Assurance Services Director in separate executive session. The charter provides that the Chief Risk Officer reports directly to the Committee and the Chief Executive Officer.

In connection with its credit risk responsibilities, the Committee oversees First Horizon’s independent Credit Assurance Services department. The Committee charter requires the Committee to collaborate with management

to determine the qualifications and competencies expected of the Credit Assurance Services Director, appoint and remove the Credit Assurance Services Director, review and approve the performance, salary, and bonus of the Credit Assurance Services Director, advise the Credit Assurance Services Director, who reports functionally to the Board through the Committee, that he or she is expected to provide the Committee summaries of and, as appropriate, significant reports to management prepared by the department and management’s responses thereto as well as any additional information and reports as may be provided in the Credit Assurance Services charter; to approve the department’s Annual Review Plan, schedule of activities, resource requirements, and charter; to meet quarterly with the Credit Assurance Services Director in separate executive session to discuss any matters that the Committee or the Credit Assurance Services Director believes should be discussed privately; and to review the annual Credit Assurance Services department Statement of Independence.

Federal Reserve regulations require banking organizations with assets greater than $50 billion to establish an independent risk committee of the board of directors that has, as its sole and exclusive function, responsibility for the risk management policies of the organization’s global operations and oversight of the organization’s risk management framework. The regulations also specify that the organization must have a risk committee that is chaired by a director who is independent as defined in the regulations and that has at least one member with “experience in identifying, assessing and managing risk exposures of large, complex financial firms.” The Risk Committee complies in all respects with the requirements outlined above.

Audit Committee. In accordance with the NYSE listing standards and its charter, the Audit Committee receives reports from the Chief Audit Executive regarding risk governance, risk assessment and risk management, the adequacy of the company’s policies and compliance with legal and regulatory requirements. These include reports from the IT Audit area on the company’s information security, including risk assessment and planning relating to cybersecurity, network security and physical security. Pursuant to its charter, the Audit Committee also reviews associate complaints or material reports or inquiries received from regulators or government agencies and management’s responses; meets periodically with the company’s Chief Risk Officer to discuss any risk and compliance matters that may have a material effect on the company’s financial statements or internal controls; discusses any significant compliance issues raised in reports or inquiries received from regulators or government agencies; reviews periodic reports regarding the Compliance and Ethics Program on the effectiveness