MORGAN STANLEY

Country Risk

Country risk exposure is the risk that events in, or that affect, a foreign country (any country other than the U.S.) might adversely affect us. We actively manage country risk exposure through a comprehensive risk management framework that combines credit and other market fundamentals and allows us to effectively identify, monitor and limit country risk.

Our obligor credit evaluation process defines country of risk as the country that has the largest economic impact on the obligor and may be different from the obligor's country of jurisdiction. Examples where this applies may include corporations that are incorporated in one country but that derive the bulk of their revenue from another and mutual funds incorporated in one jurisdiction but with a concentration of investments in a different country.

In addition to the direct country risk reflected in the “Top 10 Non-U.S. Country Exposures” table below, we also have indirect country exposure, for example, from collateral received in secured financing transactions or from providing client clearing services. These indirect exposures are managed through the credit and market risk frameworks.

We conduct periodic stress testing that seeks to measure the impact on our credit and market exposures of shocks stemming from negative economic or political scenarios. When deemed appropriate by our risk managers, the stress test scenarios include possible contagion effects and second order risks. This analysis, and results of the stress tests, may result in the amendment of limits or exposure mitigation.

Our sovereign exposures consist of financial contracts and obligations entered into with sovereign and local governments. Our non-sovereign exposures consist of financial contracts and obligations entered into primarily with corporations and financial institutions.

Index credit derivatives are included in the following “Top 10 Non-U.S. Country Exposures” table. Each reference entity within an index is allocated to that reference entity’s country of risk. Index exposures are allocated to the underlying reference entities in proportion to the notional weighting of each reference entity in the index, adjusted for any fair value receivable or payable for that reference entity. Where credit risk crosses multiple jurisdictions, for example, a CDS purchased from an issuer in a specific country that references bonds issued by an entity in a different country, the fair value of the CDS is reflected in the Net counterparty exposure row based on the country of the CDS issuer. Further, the notional amount of the CDS adjusted for the fair value of the receivable or payable is reflected in the Net inventory row based on the country of the underlying reference entity.

Table of Contents

Risk Disclosures

Top 10 Non-U.S. Country Exposures

1. Net inventory represents exposure to both long and short single-name and index positions (i.e., bonds and equities at fair value and CDS based on a notional amount assuming zero recovery adjusted for the fair value of any receivable or payable).

2. Net counterparty exposure (e.g, repurchase transactions, securities lending and OTC derivatives) is net of the benefit of collateral received and also is net by counterparty when legally enforceable master netting agreements are in place. For more information, see “Additional Information—Top 10 Non-U.S. Country Exposures” herein.

3. Amounts represent net CDS hedges (purchased and sold) on net counterparty exposure and lending executed by trading desks responsible for hedging counterparty and lending credit risk exposures. Amounts are based on the CDS notional amount assuming zero recovery adjusted for the fair value of any receivable or payable. For further description of the contractual terms for purchased credit protection and whether they may limit the effectiveness of our hedges, see “Quantitative and Qualitative Disclosures about Risk—Credit Risk—Derivatives" herein.

Additional Information—Top 10 Non-U.S. Country Exposures

Collateral Held Against Net Counterparty Exposure 1

1. The benefit of collateral received is reflected in the Top 10 Non-U.S. Country Exposures at December 31, 2023.

2. Primarily consists of cash and government obligations of the countries listed.

Operational Risk

Operational risk refers to the risk of loss, or of damage to our reputation, resulting from inadequate or failed processes or systems, from human factors or from external events (e.g., cyberattacks or third-party vulnerabilities) that may manifest as, for example, loss of information, business disruption, theft and fraud, legal and compliance risks, or damage to physical assets. We may incur operational risk across the full scope of our business activities, including revenue-generating activities and support and control groups (e.g., IT and trade processing).

We have established an operational risk framework to identify, measure, monitor and control risk across the Firm. Effective operational risk management is essential to reducing the impact of operational risk incidents and mitigating legal, regulatory and reputational risks. The framework is continually evolving to account for changes in the Firm and to respond to the changing regulatory and business environment.

We have implemented operational risk data and assessment systems to monitor and analyze internal and external operational risk events, to assess business environment and internal control factors, and to perform scenario analysis. The collected data elements are incorporated in the operational risk capital model. The model encompasses both quantitative and qualitative elements. Internal loss data and scenario analysis results are direct inputs to the capital model, while external operational incidents, business environment and internal control factors are evaluated as part of the scenario analysis process.

In addition, we employ a variety of risk processes and mitigants to manage our operational risk exposures. These include a governance framework, a comprehensive risk management program and insurance. Operational risks and associated risk exposures are assessed relative to the risk appetite reviewed and confirmed by the Board and are prioritized accordingly.

The breadth and range of operational risk are such that the types of mitigating activities are wide-ranging. Examples of activities include: continuous enhancement of defenses against cyberattacks, use of legal agreements and contracts to transfer and/or limit operational risk exposures, due diligence,

Table of Contents

Risk Disclosures

implementation of enhanced policies and procedures, technology change management controls, exception management processing controls, and segregation of duties.

Primary responsibility for the management of operational risk is with the business segments, the control groups and the business managers therein. The business managers maintain processes and controls designed to identify, assess, manage, mitigate and report operational risk. Each of the business segments has a designated operational risk coordinator. The operational risk coordinator regularly reviews operational risk issues and reports to our senior management within each business. Each control group also has a designated operational risk coordinator and a forum for discussing operational risk matters with our senior management. Oversight of operational risk is provided by the Non-Financial Risk Committee, legal entity risk committees, regional risk committees and senior management. In the event of a merger, joint venture, divestiture, reorganization, or creation of a new legal entity, a new product, or a business activity, operational risks are considered, and any necessary changes in processes or controls are implemented.

The Operational Risk Department provides independent oversight of operational risk and assesses, measures and monitors operational risk against appetite. The Operational Risk Department works with the divisions and control groups to embed a transparent, consistent and comprehensive framework for managing operational risk within each area and across the Firm.

The Operational Risk Department scope includes oversight of technology risk, cybersecurity risk, information security risk, the fraud risk management and prevention program, and third-party risk management (supplier and affiliate risk oversight and assessment), among others.

Cybersecurity

For a discussion of our Cybersecurity Program, see “Cybersecurity.”

Firm Resilience

The Firm’s critical processes and businesses could be disrupted by events including cyberattacks, failure or loss of access to technology and/or associated data, military conflicts, acts of terror, natural disasters, severe weather events and infectious disease. The Firm maintains a resilience program designed to provide for operational resilience and enable it to respond to and recover critical processes and supporting assets in the event of a disruption impacting our people, technology, facilities and third parties. The key elements of the Firm’s resilience program include business continuity management, technology disaster recovery, third party resilience and key business service resilience. Resilience testing is performed both internally and with critical third parties to validate recovery capability in accordance with business requirements. The Firm’s resilience program is

applied consistently Firmwide and is aligned with regulatory requirements.

Third-Party Risk Management

In connection with our ongoing operations, we utilize the services of third-party suppliers, which we anticipate will continue and may increase in the future. These services include, for example, outsourced processing and support functions and other professional services. Our risk-based approach to managing exposure to these services includes the performance of due diligence, implementation of service-level and other contractual agreements, consideration of operational risks and ongoing monitoring of third-party suppliers’ performance. We maintain and continue to enhance our third-party risk management program, which is designed to align with our risk tolerance and meet regulatory requirements. The program includes appropriate governance, policies, procedures and enabling technology. The third-party risk management program includes the adoption of appropriate risk management controls and practices throughout the third-party management life cycle to manage risk of service failure, risk of data loss and reputational risk, among others.

Model Risk

Model risk refers to the potential for adverse consequences from decisions based on incorrect or misused model outputs. Model risk can lead to financial loss, poor business and strategic decision-making or damage to our reputation. The risk inherent in a model is a function of the materiality, complexity and uncertainty around inputs and assumptions.

Model risk is generated from the use of models impacting financial statements, regulatory filings, capital adequacy assessments and the formulation of strategy.

Sound model risk management is an integral part of our Risk Management Framework. The Model Risk Management Department (“MRM”) is a distinct department in Risk Management responsible for the oversight of model risk.

The MRM establishes a model risk tolerance in line with our risk appetite. The tolerance is based on an assessment of the materiality of the risk of financial loss or reputational damage due to errors in design, implementation and/or inappropriate use of models. The tolerance is monitored through model-specific and aggregate business-level assessments, which are based upon qualitative and quantitative factors.

The effective challenge of models consists of critical analysis by objective, informed parties who can identify model limitations and assumptions and drive appropriate changes. The MRM provides effective challenge of models, independently validates and approves models for use, annually recertifies models, periodically revalidates, identifies and tracks remediation plans for model limitations and reports on model risk metrics. The department also oversees the

Table of Contents

Risk Disclosures

development of controls to support a complete and accurate Firmwide model inventory.

Liquidity Risk

Liquidity risk refers to the risk that we will be unable to finance our operations due to a loss of access to the capital markets or difficulty in liquidating our assets. Liquidity risk also encompasses our ability (or perceived ability) to meet our financial obligations without experiencing significant business disruption or reputational damage that may threaten our viability as a going concern. Liquidity risk also encompasses the associated funding risks triggered by the market or idiosyncratic stress events that may negatively affect our liquidity and may impact our ability to raise new funding. Generally, we incur liquidity and funding risk as a result of our trading, lending, investing and client facilitation activities.

Our Liquidity Risk Management Framework is critical to helping ensure that we maintain sufficient liquidity reserves and durable funding sources to meet our daily obligations and to withstand unanticipated stress events. The Liquidity Risk Department is a distinct area in Risk Management responsible for the oversight and monitoring of liquidity risk. The Liquidity Risk Department ensures transparency of material liquidity and funding risks, compliance with established risk limits and escalation of risk concentrations to appropriate senior management.

To execute these responsibilities, the Liquidity Risk Department establishes limits in line with our risk appetite, identifies and analyzes emerging liquidity and funding risks to ensure such risks are appropriately mitigated, monitors and reports risk exposures against metrics and limits, and reviews the methodologies and assumptions underpinning our Liquidity Stress Tests to ensure sufficient liquidity and funding under a range of adverse scenarios.

The Treasury Department and applicable business units have primary responsibility for evaluating, monitoring and controlling the liquidity and funding risks arising from our business activities and for maintaining processes and controls to manage the key risks inherent in their respective areas. The Liquidity Risk Department coordinates with the Treasury Department and these business units to help ensure a consistent and comprehensive framework for managing liquidity and funding risk across the Firm. See also “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources” herein.

Legal, Regulatory and Compliance Risk

Legal, regulatory and compliance risk includes the risk of legal or regulatory sanctions, material financial loss, including fines, penalties, judgments, damages and/or settlements, limitations on our business, or loss to reputation that we may suffer as a result of failure to comply with laws, regulations,

rules, related self-regulatory organization standards and codes of conduct applicable to our business activities. This risk also includes contractual and commercial risk, such as the risk that a counterparty’s performance obligations will be unenforceable. It also includes compliance with AML, terrorist financing, and anti-corruption rules and regulations. We are generally subject to extensive regulation in the different jurisdictions in which we conduct our business (see also “Business—Supervision and Regulation” and “Risk Factors”).

We have established procedures based on legal and regulatory requirements on a worldwide basis that are designed to facilitate compliance with applicable statutory and regulatory requirements and to require that our policies relating to business conduct, ethics and practices are followed globally. In addition, we have established procedures to mitigate the risk that a counterparty’s performance obligations will be unenforceable, including consideration of counterparty legal authority and capacity, adequacy of legal documentation, the permissibility of a transaction under applicable law and whether applicable bankruptcy or insolvency laws limit or alter contractual remedies. The heightened legal and regulatory focus on the financial services and banking industries globally presents a continuing business challenge for us.

Climate Risk

Climate change manifests as physical and transition risks. The physical risks of climate change include harm to people and property arising from acute climate-related events, such as floods, hurricanes, heatwaves, droughts and wildfires, and chronic, longer-term shifts in climate patterns, such as higher global average temperatures, rising sea levels and long-term droughts. The transition risk of climate change include policy, legal, technology and market changes. Examples of these transition risks include changes in consumer behavior and business sentiment, related technologies, shareholder preferences and any additional regulatory and legislative requirements, including increased disclosure or carbon taxes.

Climate risk, which is not expected to have a significant effect on our consolidated results of operations or financial condition in the near term, is an overarching risk that can impact other categories of risk. Physical risk may lead to increased credit risk by diminishing borrowers’ repayment capacity or impacting the value of collateral. In addition, physical risk could pose increased operational risk to our facilities and people. The impacts of transition risk may lead to and amplify credit, market or liquidity risk by reducing our customers’ operating income or the value of their assets as well as exposing us to reputational, compliance and/or litigation risk due to increased legal and regulatory scrutiny or negative public sentiment.

As climate risk is interconnected with other risk types, we have developed and continue to enhance processes to embed climate risk considerations into our risk management

Table of Contents

Risk Disclosures

practices and governance structures. The BRC oversees Firmwide risks, which include climate risk, and, as part of its oversight, receives updates on our risk management approach to climate risk, including our approaches toward scenario analysis and integration of climate risk into our existing risk management processes. Our climate risk management efforts are overseen by the Climate Risk Committee, which is co-chaired by our Chief Risk Officer and Chief Sustainability Officer and shapes our approach to managing climate-related risks in line with our overall risk framework.