CITIZENS FINANCIAL GROUP INC/RI

We are committed to maintaining a strong, integrated, and proactive approach to the management of all risks to which we are exposed in pursuit of our business objectives. A key aspect of our Board’s responsibility as the main decision-making body is setting our risk appetite to ensure that the level of risk that we are willing to accept in the attainment of our strategic business and financial objectives is clearly understood.

To enable our Board to carry out its objectives, it has delegated authority for risk management activities, as well as governance and oversight of those activities, to a number of Board and executive management level risk committees. The Executive Risk Committee, chaired by the Chief Risk Officer, is responsible for oversight of risk across the enterprise and actively considers our inherent material risks, analyzes our overall risk profile, and seeks confirmation that the risks are being appropriately identified, assessed, and mitigated. Reporting to the Executive Risk Committee are the following committees covering specific areas of risk: Compliance and Operational Risk, Model Risk, Credit Policy, Asset Liability, Business Initiatives Review, and Conduct and Ethics.

Risk Framework

Our risk management framework is embedded in our business through a “Three Lines of Defense” model that defines responsibilities for risk management activities.

First Line of Defense

The business lines, including their associated support functions, are the first line of defense and are responsible for identifying, assessing, managing, and controlling the risks associated with the products and services they provide. The business lines are responsible for performing regular risk assessments to identify and assess the material risks that arise in their area of responsibility, complying with relevant risk policies, testing and certifying the adequacy and effectiveness of operational and financial reporting controls on a regular basis, establishing and documenting operating procedures, and establishing a governance structure for identifying and managing risk.

Second Line of Defense

The second line of defense includes independent monitoring and control functions responsible for the development and implementation of risk and control frameworks, along with related policies. This centralized risk function is independent from the business and is responsible for overseeing and challenging our business lines on the effective management of their risks including, but not limited to, credit, market, operational, regulatory, reputational, interest rate, liquidity, legal, and strategic risks.

Third Line of Defense

Our Internal Audit function is the third line of defense and provides independent assurance of the effectiveness of our internal controls and governance practices so that risk is managed appropriately for the size, complexity, and risk profile of the organization. Internal Audit has complete and unrestricted access to all of our records, physical properties and personnel. Internal Audit issues a report following each internal review and provides an audit opinion to the Board’s Audit Committee on a quarterly basis.

Credit Review reports to the Chief Risk Officer and provides the Board, senior management, and other stakeholders with independent assurance on the quality of credit portfolios and adherence to agreed Credit Risk Appetite and Credit Policies and processes. In line with its procedures and regulatory expectations, the Credit Review function undertakes a program of portfolio testing, assessing and reporting through four Risk Pillars of Asset Quality, Rating and Data Integrity, Risk Management, and Credit Risk Appetite.

Risk Appetite

Risk appetite is a strategic business and risk management tool that we define as the maximum limit of acceptable risk beyond which we could be unable to achieve our strategic objectives and capital adequacy obligations.

Citizens Financial Group, Inc. | 50

Our principal non-market risks include credit, operational, regulatory, reputational, liquidity, and strategic risks. We are also subject to certain market risks which include potential losses arising from changes in interest rates, foreign exchange rates, equity prices, commodity prices, and/or other relevant market rates or prices. Market risk in our business arises from trading activities that serve customer needs, including interest rate hedging, foreign exchange risk, and non-trading activities within capital markets. We have established enterprise-wide policies and methodologies to identify, measure, monitor, and report on market risk, actively managing both trading and non-trading market risks. See “Market Risk” for further information. Our risk appetite is reviewed and approved annually by the Board Risk Committee.