NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

CFC has an Enterprise Risk Management (“ERM”) framework that is designed to identify, assess, monitor and manage the risks we assume in conducting our activities to serve the financial needs of our members. We face a variety of potential internal and external risks that can significantly affect our financial condition, liquidity position, reputation and ability to meet the expectations of our members, investors and other stakeholders. As a financial services company, the major categories of risk exposures inherent in our business activities include credit risk, liquidity risk, market risk and operational risk. These risk categories are summarized below.

•Credit riskis the risk that a borrower or other counterparty will be unable to meet its obligations in accordance with agreed-upon terms.

•Liquidity risk is the risk that we will be unable to fund our operations and meet our contractual financial obligations or that we will be unable to fund new loans to borrowers at a reasonable cost and tenor in a timely manner.

•Market risk is the risk that changes in market variables, such as movements in interest rates, may adversely affect the match between the timing of the contractual maturities, repricing and prepayments of our financial assets and the related financial liabilities funding those assets.

•Operational risk is the risk of loss resulting from inadequate or failed internal controls, processes, systems, human error or external events, including natural disasters or public health emergencies. Operational risk also includes cybersecurity risk, compliance risk, fiduciary risk, reputational risk and litigation risk.

Effective risk management is critical to our overall operations and to achieving our primary objective of providing cost-based financial products to our rural electric members while maintaining the sound financial results required to retain our investment-grade credit ratings on our rated debt instruments. In line with this, we have established a risk-management framework designed to oversee the key risks encountered in our operations and the maximum level of risk we are prepared to undertake, known as risk tolerance. This also includes risk limits and guidelines that are in alignment with CFC’s mission and strategic objectives.

Risk-Management Framework

Our ERM framework consists of a defined policy and process for managing key risks in alignment with CFC’s mission and the CFC Board of Director’s strategic objectives. The board of directors has responsibility for the oversight and strategic direction of the ERM framework and has adopted a comprehensive risk-management policy that describes the roles and responsibilities of the board and management within this framework for identifying and managing risks. In fulfilling its risk-management oversight duties, the board of directors receives periodic reports from management on business and risk-management activities, and periodically reviews important trends and emerging developments across key risks, including topics identified by management and those selected by the board for review at its meetings. The CFC board also establishes CFC’s loan policies and has established a Loan Committee of the board comprising no fewer than six directors that reviews the performance of the loan portfolio in accordance with those policies. For additional information about the role of the CFC Board of Directors in risk governance and oversight, see “Item 10. Directors, Executive Officers and Corporate Governance.”

The Enterprise Risk Group reports to the Chief Risk Officer and collectively provides independent oversight and support in the establishment of CFC’s ERM framework, and is responsible for establishing and maintaining internal controls to mitigate key risks. In addition, we have a number of management-level risk oversight committees across the organization and groups within the organization that have a defined set of authorities and responsibilities specific to one or more risk types, including the Corporate Credit Committee, Asset Liability Committee, Cybersecurity Committee, Investment Management Committee, Information Technology Steering Committee and Disclosure Committee. The Chief Risk Officer provides reports to the CFC Board of Directors at each regularly scheduled board meeting, and more frequently as requested by the board of directors, relating to, among other things, the ongoing progress of managing key risks at CFC given the ERM framework; management’s responses and mitigation plan for any critical business risk trending negatively or exceeding prevailing risk limits and guidelines as identified during the risk assessment process; the status of any gaps or deficiencies in the ERM process; CFC’s overall risk universe profile and important trends; and emerging risks and opportunities previously not identified or reported.