NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

Overview

CFC has an Enterprise Risk Management (“ERM”) framework that is designed to identify, assess, monitor and manage the risks we assume in conducting our activities to serve the financial needs of our members. We face a variety of potential internal and external risks that can significantly affect our financial condition, liquidity position, reputation and ability to meet the expectations of our members, investors and other stakeholders. As a financial services company, the major categories of risk exposures inherent in our business activities include credit risk, liquidity risk, market risk and operational risk. These risk categories are summarized below.

•Credit risk is the risk that a borrower or other counterparty will be unable to meet its obligations in accordance with agreed-upon terms.

•Liquidity risk is the risk that we will be unable to fund our operations and meet our contractual financial obligations or that we will be unable to fund new loans to borrowers at a reasonable cost and tenor in a timely manner.

•Market risk is the risk that changes in market variables, such as movements in interest rates, may adversely affect the match between the timing of the contractual maturities, repricing and prepayments of our financial assets and the related financial liabilities funding those assets.

•Operational risk is the risk of loss resulting from inadequate or failed internal controls, processes, systems, human error or external events, including natural disasters or public health emergencies. Operational risk also includes cybersecurity risk, compliance risk, fiduciary risk, reputational risk and litigation risk.

Effective risk management is critical to our overall operations and to achieving our primary objective of providing cost-based financial products to our rural electric members while maintaining the sound financial results required to retain our investment-grade credit ratings on our rated debt instruments. In line with this, we have established a risk-management framework designed to oversee the key risks encountered in our operations and the maximum level of risk we are prepared to undertake, known as risk tolerance. This also includes risk limits and guidelines that are in alignment with CFC’s mission and strategic objectives. We provide a discussion of our risk management framework in our 2026 Form 10-K under “Item 7. MD&A—Enterprise Risk Management” and describe how we manage these risks under each respective MD&A section in our 2026 Form 10-K.