BANK OF AMERICA CORP DE

Risk is inherent in all our business activities. The seven key types of risk faced by the Corporation are strategic, credit, market, liquidity, compliance, operational and reputational. Sound risk management enables us to serve our customers and deliver for our shareholders. If not managed well, risk can result in financial loss, regulatory sanctions and penalties, and damage to our reputation, each of which may adversely impact our ability to execute our business strategies. We take a comprehensive approach to risk management with a defined Risk Framework and an articulated Risk Appetite Statement, which are approved annually by the Board’s Enterprise Risk Committee (ERC) and the Board.

Our Risk Framework serves as the foundation for the consistent and effective management of risks facing the Corporation. The Risk Framework sets forth roles and responsibilities for the management of risk and provides a blueprint for how the Board, through delegation of authority to committees and executive officers, establishes risk appetite and associated limits for our activities.

Our risk appetite provides a common framework that includes a set of measures to assist senior management and the Board in assessing the Corporation’s risk profile across all risk types against our risk appetite and risk capacity. Our risk appetite is formally articulated in the Risk Appetite Statement, which includes both qualitative statements and quantitative limits.

For more information on the Corporation’s risks, see Item 1A. Risk Factors of the Corporation’s 2024 Annual Report on Form 10-K. These risks are being managed within our Risk Framework and supporting risk management programs. For more information on our Risk Framework, risk management activities and the key types of risk faced by the Corporation, see the Managing Risk section in the MD&A of the Corporation’s 2024 Annual Report on Form 10-K.