MORGAN STANLEY

Risk is an inherent part of our businesses and activities. We believe effective risk management is vital to the success of our business activities. Accordingly, we have an ERM framework to integrate the diverse roles of risk management into a holistic enterprise structure and to facilitate the incorporation of risk assessment into decision-making processes across the Firm.

We have policies and procedures in place to identify, measure, monitor, escalate, mitigate and control the principal risks involved in the activities of the Institutional Securities, Wealth Management and Investment Management business segments, as well as at the Parent Company level. The principal risks involved in our business activities are both financial and non-financial and include market (including non-trading risks), credit, liquidity, model, operational (including cybersecurity), compliance (including conduct), financial crime, strategic and reputational risks. Strategic risk is integrated into our business planning, embedded in the evaluation of all principal risks and overseen by the Board.

The cornerstone of our risk management philosophy is the pursuit of risk-adjusted returns through prudent risk taking that protects our capital base and franchise. This philosophy is implemented through the ERM framework. Five key principles underlie this philosophy: integrity, comprehensiveness, independence, accountability and transparency. To help ensure the efficacy of risk management, which is an essential component of our reputation, senior

management requires thorough and frequent reporting and the appropriate escalation of risk matters. The fast-paced, complex and constantly evolving nature of global financial markets requires us to maintain a risk management culture that is incisive, knowledgeable about specialized products and markets, and subject to ongoing review and enhancement.

Our risk appetite defines the aggregate level and types of risk that the Firm is willing to accept to achieve its business objectives, taking into account the interests of clients and fiduciary duties to shareholders, as well as capital and other regulatory requirements. This risk appetite is embedded in our risk culture and linked to our short-term and long-term strategic, capital and financial plans, as well as compensation programs. This risk appetite and the related Board-level risk limits and risk tolerance statements are reviewed and approved by the BRC and the Board on at least an annual basis.

Risk Governance Structure

Risk management at the Firm requires independent Firm-level oversight, accountability of our business divisions, and effective communication of risk matters across the Firm, to senior management and ultimately to the Board. Our risk governance structure is set forth in the following chart and also includes risk managers, committees, and groups within and across business segments and operating legal entities. The ERM framework, composed of independent but complementary entities, facilitates efficient and comprehensive supervision of our risk exposures and processes.

RRP—Resolution and Recovery Planning

1. Committees include the Capital Commitment Committee, Global Large Loan Committee, Equity Underwriting Committee, Leveraged Finance Underwriting Committee and Municipal Capital Commitment Committee.

2. Committees include the Securities Risk Committee, Wealth Management Risk Committee and Investment Management Risk Committee.

Table of Contents

Risk Disclosures

Morgan Stanley Board of Directors

The Board has oversight of the ERM framework and is responsible for helping to ensure that our risks are managed in a sound manner. The Board has authorized the committees within the ERM framework to help facilitate our risk oversight responsibilities. As set forth in the Board’s Corporate Governance Policies, the Board also oversees, and receives reports on, our financial performance, strategy and business plans, as well as our practices and procedures relating to reputational and franchise risk, and culture, values and conduct.

Risk Committee of the Board

The BRC assists the Board in its oversight of the ERM framework; oversees significant financial risk exposures of the Firm, including market, credit, model and liquidity risk, against established risk measurement methodologies and the steps management has taken to monitor and control such exposures; oversees our risk appetite statement, including risk tolerance levels and limits; reviews capital, liquidity and funding strategy and planning and related guidelines and policies; reviews the contingency funding plan and capital planning process; oversees our significant risk governance, risk management and risk assessment guidelines and policies; oversees the performance of the Chief Risk Officer; reviews reports from our Strategic Transactions Committee, CCAR Committee and RRP Committee; reviews significant new product risk, emerging risks, regulatory matters and climate risk; and reviews reports from the Chief Audit Officer regarding the results of reviews and assessments of the risk management, liquidity and capital functions. The BRC reports to the Board on a regular basis and coordinates with the Board and other Board committees with respect to oversight of risk management and risk assessment guidelines.

Audit Committee of the Board

The BAC oversees the integrity of our financial statements, compliance with legal and regulatory requirements, and system of internal controls; oversees risk management and risk assessment guidelines in coordination with the Board and other Board committees; reviews the major legal, compliance and financial crime risk exposures of the Firm and the steps management has taken to monitor and control such exposures; appoints, compensates, retains, oversees, evaluates and, when appropriate, replaces the independent auditor; oversees the qualifications, performance and independence of our independent auditor and pre-approves audit and permitted non-audit services; oversees the performance of our Chief Audit Officer; and, after review, recommends to the Board the acceptance and inclusion of the annual audited financial statements in the Firm’s annual report on Form 10-K. The BAC reports to the Board on a regular basis.

Operations and Technology Committee of the Board

The BOTC oversees our operations and technology strategy and significant investments in support of such strategy; oversees operational risk, including information technology, information security, fraud, third-party oversight, business disruption and resilience and cybersecurity risks and the steps management has taken to monitor and control such exposures. The BOTC reviews and approves significant operations and technology policies. The BOTC also reviews risk management and risk assessment guidelines in coordination with the Board and other Board committees, and policies regarding operational risk. The BOTC reports to the Board on a regular basis.

Firm Risk Committee

The Board has also authorized the Firm Risk Committee (“FRC”), a management committee appointed and co-chaired by the Chief Executive Officer and Chief Risk Officer, which includes the most senior officers of the Firm from the business, independent risk functions and control groups, to help oversee the ERM framework. The FRC’s responsibilities include: oversight of our risk management principles, procedures, limits and tolerances; the monitoring of capital levels and material market, credit, model, operational, liquidity, legal, compliance and reputational risk matters, and other risks, as appropriate; and the steps management has taken to monitor and manage such risks. The FRC also establishes and communicates risk appetite, including aggregate Firm limits and tolerances, as appropriate. The Governance Process Review Subcommittee of the FRC oversees governance and process issues on behalf of the FRC. The FRC reports to the Board, the BAC, the BOTC and the BRC through the Chief Risk Officer, Chief Financial Officer, Chief Legal Officer and Head of Non-Financial Risk.

Functional Risk and Control Committees

Functional risk and control committees and other committees within the ERM framework facilitate efficient and comprehensive supervision of our risk exposures and processes.

Each business segment has a risk committee that is responsible for helping to ensure that the business segment, as applicable, adheres to established limits for market, credit, operational and other risks; implements risk measurement, monitoring, and management policies, procedures, controls and systems that are consistent with the risk framework established by the FRC; and reviews, on a periodic basis, our aggregate risk exposures, risk exception experience, and the efficacy of our risk identification, measurement, monitoring and management policies and procedures, and related controls.

Table of Contents

Risk Disclosures

Chief Risk Officer

The Chief Risk Officer, who is independent of business units, reports to the BRC and the Chief Executive Officer. The Chief Risk Officer oversees compliance with our risk limits; approves exceptions to our risk limits; independently reviews material market, credit, model and liquidity risks; and reviews results of risk management processes with the Board, the BRC, the BOTC and the BAC, as appropriate. The Chief Risk Officer also coordinates with the Head of NFR regarding non-financial risk, the Chief Financial Officer and the Chief Executive Officer regarding capital and liquidity management and works with the Compensation, Management Development and Succession Committee of the Board to help ensure that the structure and design of incentive compensation arrangements do not encourage unnecessary and excessive risk taking.

Head of Non-Financial Risk

The Head of Non-Financial Risk, who is independent of business units, reports to the Chief Legal Officer and Chief Administrative Officer. The Head of Non-Financial Risk oversees the compliance, financial crimes and operational risk management functions; independently reviews non-financial risks, including compliance (including conduct), financial crimes, and operational (including cybersecurity) risks, as well as material regulatory risks; and reviews results of risk management processes with the Board, the BAC, the BOTC and the BRC as appropriate. The Head of Non-Financial Risk also coordinates with the Chief Risk Officer regarding financial risks.

Independent Risk Management Functions

The Financial Risk Management functions (Market Risk, Credit Risk, Model Risk and Liquidity Risk Management Departments) and Non-Financial Risk Management functions (Compliance, Global Financial Crimes, and Operational Risk Departments) are independent of our business units and report to the Chief Risk Officer and Head of Non-Financial Risk, respectively. These functions assist senior management and the FRC in monitoring and controlling our risk through a number of control processes. Each function maintains its own risk governance structure with specified individuals and committees responsible for aspects of managing risk. Further discussion about the responsibilities of the risk management functions may be found under “Market Risk,” “Credit Risk,” “Operational Risk,” “Model Risk” and “Liquidity Risk” and “Legal, Regulatory and Compliance Risk” herein.

Support and Control Groups

Our support and control groups include, but are not limited to, Legal, the Finance Division, Technology, the Operations Division, the Human Capital Management & Global Services Division (“HCMGS”), Firm Strategy and Execution. Our support and control groups coordinate with the business segment control groups to review the risk monitoring and risk

management policies and procedures relating to, among other things, controls over financial reporting and disclosure; each business segment’s market, credit and operational risk profile; liquidity risks; model risks; sales practices; reputational, legal enforceability, compliance and regulatory risks; and technological risks. Participation by the senior officers of the Firm and business segment control groups helps ensure that risk policies and procedures, exceptions to risk limits, new products and business ventures, and transactions with risk elements undergo thorough review.

Internal Audit Department

The Internal Audit Department (“IAD”) independently identifies and assesses risks facing the Firm and provides independent, objective and timely assurance to stakeholders about the effectiveness of risk management, governance and controls over key risks within the Firm’s businesses and functions. IAD develops and executes a comprehensive risk-based assurance plan to fulfill its role and purpose, which includes assessing compliance with policies, procedures and laws and regulations. IAD may also conduct other activities, such as retrospective reviews, pre-implementation reviews and investigations as requested by the BAC, senior management or the Firm’s regulators.

IAD executes its activities in accordance with the mandatory elements of The Institute of Internal Auditors’ International Professional Practices Framework as well as the Firm’s Code of Ethics and Business Conduct, regulatory requirements, and IAD’s policies, procedures, standards and guidance. The Chief Audit Officer, who reports functionally to the BAC and administratively to the Firm’s Chief Executive Officer, communicates the results of IAD activities to the BAC on a quarterly basis and periodically to the BRC and BOTC.

Culture, Values and Conduct of Employees

Employees of the Firm are accountable for conducting themselves in accordance with our core values: Put Clients First, Do the Right Thing, Lead with Exceptional Ideas, Commit to Diversity and Inclusion, and Give Back. We are committed to reinforcing and confirming adherence to our core values through our governance framework, tone from the top, management oversight, risk management and controls, and three lines of defense structure (business, Independent Risk Management functions such as Financial Risk Management and Non-Financial Risk Management, and Internal Audit).

The Board is responsible for overseeing the Firm’s practices and procedures relating to culture, values and conduct, as set forth in the Board’s Corporate Governance Policies. Senior management committees oversee the Firmwide culture, values and conduct program and report regularly to the Board. A fundamental building block of these programs is the Firm’s Code of Conduct, which establishes standards for employee conduct that further reinforce the Firm’s commitment to integrity and ethical conduct. Every new hire and every

Table of Contents

Risk Disclosures

employee annually is required to certify to their understanding of and adherence to the Code of Conduct. The Firm’s Global Conduct Risk Management Policy also sets out a consistent global framework for managing conduct risk (i.e., the risk arising from misconduct by employees or contingent workers) and conduct risk incidents at the Firm.

The employee annual performance review process includes evaluation of employee conduct related to risk management practices and the Firm’s expectations. We also have several mutually reinforcing processes to identify employee conduct that may have an impact on employment status, current-year compensation and/or prior-year compensation. For example, the Global Incentive Compensation Discretion Policy sets forth standards for managers when making annual compensation decisions and specifically provides that managers must consider whether their employees effectively managed and/or supervised risk control practices during the performance year. Control function management meets to discuss employees whose conduct is not in line with our expectations. These results are incorporated into identified employees’ performance reviews and compensation and promotion decisions.

The Firm’s clawback and cancellation provisions apply to deferred incentive compensation and cover a broad scope of employee conduct, including any act or omission (including with respect to direct supervisory responsibilities) that constitutes a breach of obligation to the Firm or causes a restatement of the Firm’s financial results, constitutes a violation of the Firm’s global risk management principles, policies and standards, or causes a loss of revenue associated with a position on which the employee was paid and the employee operated outside of risk management policies.

Risk Limits Framework

Risk limits and quantitative metrics provide the basis for monitoring risk-taking activity and avoiding outsized risk taking. Our risk-taking capacity is sized through the Firm’s capital planning process where losses are estimated under the Firm’s BHC Severely Adverse stress testing scenario. We also maintain a comprehensive suite of risk limits and quantitative metrics to support and implement our risk-appetite statement. Our risk limits support linkages between the overall risk appetite, which is reviewed by the Board, and more granular risk-taking decisions and activities.

Risk limits, once established, are reviewed and updated on at least an annual basis, with more frequent updates as necessary. Board-level risk limits address the most important Firmwide aggregations of risk. Additional risk limits approved by the FRC address more specific types of risk and are bound by the higher-level Board risk limits.

Risk Management Process

In subsequent sections, we discuss our risk management policies and procedures for our primary risks involved in the

activities of our Institutional Securities, Wealth Management and Investment Management business segments. These sections and the estimated amounts of our risk exposure generated by our statistical analyses are forward-looking statements. However, the analyses used to assess such risks are not predictions of future events, and actual results may vary significantly from such analyses due to events in the markets in which we operate and certain other factors described in the following paragraphs.