CITIZENS FINANCIAL GROUP INC/RI

Operational risk is the risk of loss due to human error, third-party performance failures, or inadequate or failed internal systems and controls and includes certain risks such as fraud, legal, and natural disasters. To mitigate these risks, we maintain a comprehensive system of internal controls designed to identify, assess, and monitor potential threats to our operations. Our risk management framework includes regular audits, employee training, cybersecurity measures, and business continuity planning. We continuously evaluate and enhance these controls to adapt to evolving risks and regulatory requirements, ensuring the integrity, reliability, and efficiency of our operations.

Cybersecurity

The Company’s Cybersecurity Program (“CSP”) drives an end-to-end, continuous process that protects our customers, colleagues, assets, premises, systems, and information (electronic and non-electronic), and is designed to ensure compliance with current and emerging federal and state laws and regulations. The CSP is designed to ensure the effective implementation of the Corporate Security and Resilience Operating Model across all business lines of the Company and is under the supervision of the Chief Security Officer.

The CSP is designed to assess and mitigate threats and risks to the Company. New and emerging threats are assessed through an intelligence lifecycle, which includes threat modeling. In addition, risk assessment processes drive risk identification and measurement related to security. Once risks are identified and measured, the Company’s Enterprise Risk Management Governance Framework is leveraged to track and mitigate them. Control testing is utilized to demonstrate that risks are managed effectively, identify gaps in expected control operation, and develop appropriate remediation plans, in order to manage risk to the Company within tolerable limits.

The Company regularly reviews the nature of its business activities and modifies the CSP as appropriate. Many of the elements of the CSP are related to cyber defense and are in place to reduce our risk to a wide range of potential cyber threats that may target our assets and information daily. The effectiveness of the CSP is assessed and measured periodically by various lines of defense within the Company and is conducted primarily through risk assessments, assurance testing, and an independent audit. External organizations are also routinely engaged to assess our CSP and test our perimeter defenses. The effectiveness of the CSP is reported periodically to the appropriate governance committees. For more information regarding our cybersecurity risk management practices and governance, see Item 1C in our 2025 Form 10-K.