BANK OF AMERICA CORP DE

Risk is inherent in all our business activities. Sound risk management enables us to serve our customers and deliver for our shareholders. If not managed well, risk can result in financial loss, regulatory sanctions and penalties, litigation, and damage to our reputation, each of which may adversely impact our ability to execute our business strategies. We take a comprehensive approach to risk management with a defined Risk Framework and an articulated Risk Appetite Statement, which are approved annually by the Board’s Enterprise Risk Committee (ERC) and the Board.

The seven key types of risk faced by the Corporation are strategic, credit, market, liquidity, compliance, operational and reputational.

● Strategic risk is the risk to current or projected financial condition arising from incorrect assumptions about external or internal factors, inappropriate business plans, ineffective business strategy execution or failure to respond in a timely manner to changes in the regulatory, macroeconomic or competitive environments in the geographic locations in which we operate.

● Credit risk is the risk of loss arising from the inability or failure of a borrower or counterparty to meet its obligations.

● Market risk is the risk that changes in market conditions adversely impact the value of assets or liabilities or otherwise negatively impact earnings. Market risk is composed of price risk and interest rate risk.

● Liquidity risk is the risk of the inability to meet expected or unexpected cash flow and collateral needs while continuing to support our businesses and customers under a range of economic conditions.

● Compliance risk is the risk of legal action or regulatory sanctions, material financial loss or damage to the reputation of the Corporation arising from the failure of the Corporation to comply with the requirements of applicable laws, rules and regulations (LRRs) and our internal policies and procedures.

● Operational risk is the risk of loss resulting from inadequate or failed internal processes or systems, people or external events.

● Reputational risk is the risk that negative perception of the Corporation may adversely impact profitability or operations.

The following sections address in more detail the specific procedures, measures and analyses of the major categories of risk.

As set forth in our Risk Framework, a culture of managing risk well is fundamental to our values and our purpose, and how we drive Responsible Growth. It requires us to focus on risk in all activities and encourages the necessary mindset and behavior to enable effective risk management and promote sound risk-taking within our risk appetite. Sustaining a culture of managing risk well throughout the organization is critical to the success of the Corporation and is a clear expectation of our executive management team and the Board.

Our Risk Framework serves as the foundation for the consistent and effective management of risks facing the Corporation. The Risk Framework sets forth roles and responsibilities for the management of risk and provides a blueprint for how the Board, through delegation of authority to committees and executive officers, establishes risk appetite and associated limits for our activities.

Executive management assesses, with Board oversight, the risk-adjusted returns of each business. Management reviews and approves the strategic and financial operating plans, as well as the capital plan and Risk Appetite Statement, and recommends them annually to the Board for approval. Our strategic plan takes into consideration return objectives and financial resources, which must align with risk capacity and risk appetite. Management sets financial objectives for each business by allocating capital and setting a target for return on capital for each business. Capital allocations are regularly evaluated as part of our overall governance processes as the businesses and the economic environment in which we operate continue to evolve. For more information regarding capital allocations, see Business Segment Operations on page 35.

The Corporation’s risk appetite indicates the amount of capital, earnings or liquidity we are willing to put at risk to achieve our strategic objectives and business plans, consistent with applicable regulatory requirements. It also provides a common framework that includes a set of measures to assist senior management and the Board in assessing the Corporation’s risk profile across all risk types against our risk appetite and risk capacity. Our risk appetite is formally articulated in the Risk Appetite Statement, which includes both qualitative statements and quantitative limits.

Our overall capacity to take risk is limited. Accordingly, we prioritize the risks we take in order to maintain a strong and flexible financial position so we can weather challenging economic times and take advantage of organic growth opportunities while complying with all applicable regulatory requirements. Therefore, we set objectives and targets for capital and liquidity that permit us to continue to operate in a safe and sound manner at all times, including during periods of stress. We also maintain strong operational risk management and operational resiliency capabilities so we can meet the expectations of our customers and clients through a range of operating conditions.

Our lines of business operate with risk limits that align with the Corporation’s risk appetite. Management is responsible for tracking and reporting performance measurements as well as any breaches or exceptions to risk appetite limits. The Board, and its committees when appropriate, oversee financial performance, execution of the strategic and financial operating plans, adherence to risk appetite limits and the adequacy of internal controls.

For a more detailed discussion of our risk management activities, see the discussion below and pages 48 through 82.

Risk Management Governance

The Risk Framework describes delegations of authority whereby the Board and its committees may delegate authority to management-level committees or executive officers. Such delegations may authorize certain decision-making and approval functions, which may be evidenced in documents such as committee charters, job descriptions, meeting minutes and resolutions.

The chart below illustrates the interrelationship among the Board, Board committees and management committees that have the majority of risk oversight responsibilities for the Corporation.

45 Bank of America

Board of Directors and Board Committees

The Board is composed of 14 directors, all but one of whom are independent. The Board authorizes management to maintain an effective Risk Framework and oversees compliance with safe and sound banking practices. In addition, the Board or its committees conduct inquiries of, and receive reports from senior management on, risk-related matters to assess scope or resource limitations that could impede the ability of Global Risk Management (GRM) and/or Corporate Audit to execute its responsibilities. The Board committees discussed below have the principal responsibility for enterprise-wide oversight of our risk management activities. Through these activities, the Board and applicable committees are provided with information on our risk profile and oversee senior management addressing key risks we face. Other Board committees, as described below, provide additional oversight of specific risks.

Each of the committees shown on the above chart regularly reports to the Board on risk-related matters within the committee’s responsibilities, which is intended to collectively provide the Board with integrated insight about our management of enterprise-wide risks.

Audit Committee

The Audit Committee oversees the qualifications, performance and independence of the Independent Registered Public Accounting Firm, the performance of our corporate audit function, the integrity of our consolidated financial statements, our compliance with legal and regulatory requirements, and makes inquiries of senior management or the Chief Audit Executive (CAE) to determine whether there are scope or resource limitations that impede the ability of Corporate Audit to execute its responsibilities. The Audit Committee is also responsible for overseeing compliance risks pursuant to the New York Stock Exchange listing standards.

Enterprise Risk Committee

The ERC oversees the Corporation’s Risk Framework, risk appetite and senior management’s responsibilities for the identification, measurement, monitoring and control of key risks facing the Corporation. The ERC may consult with other Board committees on risk-related matters such as the Audit Committee for compliance risks.

Other Board Committees

Our Corporate Governance, ESG, and Sustainability Committee oversees corporate governance matters, including periodically reviewing and making recommendations to the Board on Board succession planning and composition matters, conducting an annual review of the Board’s performance and leading itself and the Board’s other committees in an annual assessment of their performance. The committee also oversees sustainability matters (other than human capital matters), including the Corporation’s public policy engagement, sustainability initiatives, charitable contributions, and community reinvestment activities and performance.

Our Compensation and Human Capital Committee oversees establishing, maintaining and administering our compensation programs and employee benefit plans, including approving and recommending our Chief Executive Officer’s (CEO) compensation to our Board for further approval by all independent directors; reviewing and approving our executive officers’ compensation, as well as compensation for non-management directors; and reviewing certain other human capital management topics.

Management Committees

Management committees receive their authority from the Board, a Board committee, or another management committee. Our primary management risk committee is the MRC. Subject to Board oversight, the MRC is responsible for management oversight of key risks facing the Corporation, including an integrated evaluation of risk, earnings, capital and liquidity.

Executive Officers

Executive officers lead various functions representing the functional roles. Authority for functional roles may be delegated to executive officers from the Board, Board committees or management-level committees. Executive officers, in turn, may further delegate responsibilities, as appropriate, to management-level committees, management routines or individuals. Executive officers review our activities for consistency with our Risk Framework, risk appetite, and applicable strategic, capital and financial operating plans, as well as applicable policies and standards. Executive officers and other employees make decisions individually on a day-to-day basis, consistent with the authority they have been delegated.

Executive officers and other employees may also serve on committees and participate in committee decisions.

Lines of Defense

We have clear ownership and accountability for managing risk across three lines of defense: Front Line Units (FLUs), GRM and Corporate Audit. We also have control functions outside of FLUs and GRM (e.g., Legal and Global Human Resources). The three lines of defense are integrated into our management-level governance structure. Each of these functional roles is further described in this section.

Front Line Units and Control Functions

FLUs, which include the business segments and underlying businesses, as well as the organizations that support technology and operations for the Corporation, are responsible for appropriately assessing and effectively managing all of the risks associated with their activities. Control functions provide guidance and subject matter expertise on day-to-day activities affecting the Corporation, as well as by overseeing and managing risks that emanate from their own respective activities.

Global Risk Management

GRM is part of our control functions and operates as our independent risk management function. GRM, led by the Chief Risk Officer (CRO), is responsible for independently assessing and overseeing risks within FLUs and other control functions. GRM establishes written enterprise policies and procedures outlining how aggregate risks are identified, measured, monitored and controlled.

The CRO has the stature, authority and independence needed to develop and implement a meaningful risk management framework and practices to guide the Corporation in managing risk. The CRO has unrestricted access to the Board and reports directly to both the ERC and the CEO. GRM is organized into horizontal risk teams that cover a specific risk area and vertical CRO teams that cover a particular FLU or control function. These teams work collaboratively in executing their respective duties.

Corporate Audit

Corporate Audit and the CAE maintain their independence from the FLUs, GRM and other control functions by reporting directly to the Audit Committee. The CAE administratively reports to the CEO. Corporate Audit provides independent assessment and validation through testing of key processes and controls across the Corporation. Corporate Audit includes Credit Review, which provides an independent assessment of credit lending decisions and the effectiveness of credit processes across the Corporation’s credit platform through examinations and monitoring.

Risk Management Processes

The Risk Framework requires that strong risk management practices are integrated in key strategic, capital and financial planning processes and in day-to-day business processes across the Corporation, thereby ensuring risks are appropriately considered, evaluated and responded to in a timely manner. We employ an effective risk management process, referred to as Identify, Measure, Monitor and Control, as part of our daily activities.

Identify – To be effectively managed, risks must be proactively identified and well understood. Proper risk identification focuses on recognizing and understanding key risks inherent in our business activities or key risks that may arise from

external factors. Each employee is expected to identify and escalate risks promptly. Risk identification is an ongoing process that incorporates input from FLUs and control functions. It is designed to be forward-looking and to capture relevant risk factors across all of our lines of business.

Measure – Once a risk is identified, it must be prioritized and accurately measured through a systematic process including qualitative statements and quantitative limits. Risk is measured at various levels, including, but not limited to, risk type, FLU and legal entity, and also on an aggregate basis. This risk measurement process helps to capture changes in our risk profile due to changes in strategic direction, concentrations, portfolio quality and the overall economic environment. Senior management considers how risk exposures might evolve under a variety of stress scenarios.

Monitor – We monitor risk levels regularly to track adherence to risk appetite, policies and standards. We also regularly update risk assessments and review risk exposures. Through our monitoring, we know our level of risk relative to limits and can take action in a timely manner. We also know when risk limits are breached and have processes to appropriately report and escalate exceptions. This includes timely requests for approval to managers and alerts to executive management, management-level committees or the Board (directly or through an appropriate committee).

Control – We establish and communicate risk limits and controls through policies, standards, procedures and processes. The limits and controls can be adjusted by senior management or the Board when conditions or risk tolerances warrant. These limits may be absolute (e.g., loan amount, trading volume, operational loss) or relative (e.g., percentage of loan book in higher-risk categories). Our FLUs are held accountable for performing within the established limits.

The formal processes used to manage risk represent a part of our overall risk management process. We instill a strong and comprehensive culture of managing risk well through communications, training, policies, procedures and organizational roles and responsibilities. Establishing a culture reflective of our purpose to help make our customers’ financial lives better and delivering on Responsible Growth is also critical to effective risk management. We are committed to the highest principles of ethical and professional conduct. Conduct risk is the risk of improper actions, behaviors or practices by the Corporation, its employees or representatives that are illegal, unethical and/or contrary to our core values that could result in harm to the Corporation, our shareholders or our customers, damage the integrity of the financial markets, or negatively impact our reputation. We have established protocols and structures so that conduct risk is governed and reported across the Corporation appropriately. All employees are held accountable for adhering to the Code of Conduct, operating within our risk appetite and managing risk in their daily business activities. In addition, our performance management and compensation practices encourage responsible risk-taking that is consistent with our Risk Framework and risk appetite.

Corporation-wide Stress Testing

Integral to our Capital Planning, Financial Planning and Strategic Planning processes, we conduct capital scenario management and stress forecasting on a regular basis to better understand balance sheet, earnings and capital sensitivities to a wide range of economic and business scenarios, including economic and market conditions that are more severe than anticipated. These stress forecasts provide an understanding of the potential

47 Bank of America

impacts from our risk profile on the balance sheet, earnings and capital, and serve as a key component of our capital and risk management practices. The intent of stress testing is to develop a comprehensive understanding of potential impacts of on- and off-balance sheet risks at the Corporation and certain subsidiaries and how they impact financial resiliency, which provides confidence to management, regulators and our investors.

Contingency Planning

We have developed and maintain comprehensive contingency plans that are designed to prepare us in advance to respond in the event of potential adverse economic, operational, financial or market stress conditions. These contingency plans include our Financial Contingency and Recovery Plan, which provides monitoring, escalation, actions and routines designed to enable us to increase capital and/or liquidity, access funding sources and reduce risk through consideration of potential options that include asset sales, business sales, capital or debt issuances, and other risk reducing strategies at various levels of capital or liquidity depletion during a period of stress. We also maintain a Resolution Plan to limit adverse systemic impacts that could be associated with a potential resolution of Bank of America.