MORGAN STANLEY

Table of Contents

Risk Disclosures

Country Risk

Country risk exposure is the risk that events in, or that affect, a foreign country (any country other than the U.S.) might adversely affect us. We actively manage country risk exposure through a comprehensive risk management framework that combines credit and other market fundamentals and allows us to effectively identify, monitor and limit country risk.

Our obligor credit evaluation process defines country of risk as the country that has the largest economic impact on the obligor and may be different from the obligor's country of jurisdiction. Examples where this applies may include corporations that are incorporated in one country but that derive the bulk of their revenue from another and mutual funds incorporated in one jurisdiction but with a concentration of investments in a different country.

In addition to the direct country risk reflected in the “Top 10 Non-U.S. Country Exposures” table below, we also have indirect country exposure, for example, from collateral received in secured financing transactions or from providing client clearing services. These indirect exposures are managed through the credit and market risk frameworks.

We conduct periodic stress testing that seeks to measure the impact on our credit and market exposures of shocks stemming from negative economic or political scenarios including changes to global trade policies and the implementation of tariffs. When deemed appropriate by our risk managers, the stress test scenarios include possible contagion effects and second order risks. This analysis, and results of the stress tests, may result in the amendment of limits or exposure mitigation.

Our sovereign exposures consist of financial contracts and obligations entered into with sovereign and local governments. Our non-sovereign exposures consist of financial contracts and obligations entered into primarily with corporations and financial institutions.

Index credit derivatives are included in the following “Top 10 Non-U.S. Country Exposures” table. Each reference entity within an index is allocated to that reference entity’s country of risk. Index exposures are allocated to the underlying reference entities in proportion to the notional weighting of each reference entity in the index, adjusted for any fair value receivable or payable for that reference entity. Where credit risk crosses multiple jurisdictions, for example, a CDS purchased from an issuer in a specific country that references bonds issued by an entity in a different country, the fair value of the CDS is reflected in the Net counterparty exposure row based on the country of the CDS issuer. Further, the notional amount of the CDS adjusted for the fair value of the receivable or payable is reflected in the Net inventory row based on the country of the underlying reference entity.

Top 10 Non-U.S. Country Exposures

1. Net inventory represents exposure to both long and short single-name and index positions (i.e., bonds and equities at fair value and CDS based on a notional amount assuming zero recovery adjusted for the fair value of any receivable or payable).

2. Net counterparty exposure (e.g, repurchase transactions, securities lending and OTC derivatives) is net of the benefit of collateral received and also is net by counterparty when legally enforceable master netting agreements are in place. For more information, see “Additional Information—Top 10 Non-U.S. Country Exposures” herein.

3. Amounts represent net CDS hedges (purchased and sold) on net counterparty exposure and lending executed by trading desks responsible for hedging counterparty and lending credit risk exposures. Amounts are based on the CDS notional amount assuming zero recovery adjusted for the fair value of any receivable or payable. For further description of the contractual terms for purchased credit protection and whether they may limit the effectiveness of our hedges, see “Quantitative and Qualitative Disclosures about Risk—Credit Risk—Derivatives" herein.

Table of Contents

Risk Disclosures

Additional Information—Top 10 Non-U.S. Country Exposures

Collateral Held Against Net Counterparty Exposure 1

1. The benefit of collateral received is reflected in the Top 10 Non-U.S. Country Exposures at December 31, 2024.

2. Primarily consists of cash and government obligations of the countries listed.

Operational Risk

Operational risk refers to the risk of loss, or of damage to our reputation, resulting from inadequate or failed processes or systems, human factors (e.g., inappropriate or unlawful conduct) or external events (e.g., cyberattacks or third-party vulnerabilities) that may manifest as, for example, loss of information, business disruption, theft and fraud, legal and compliance risks, or damage to physical assets. We may incur operational risk across the full scope of our business activities, including revenue-generating activities and support and control groups (e.g., IT and trade processing).

We have established an operational risk framework to identify, measure, monitor and control risk across the Firm. Effective operational risk management is essential to reducing the impact of operational risk incidents and mitigating legal, regulatory and reputational risks. The framework is continually evolving to account for changes in the Firm and to respond to the changing regulatory and business environment.

We have implemented operational risk data and assessment systems to monitor and analyze internal and external operational risk events, to assess business environment and internal control factors, and to perform scenario analysis. The collected data elements are incorporated in the operational risk capital model. The model encompasses both quantitative and qualitative elements. Internal loss data and scenario analysis results are direct inputs to the capital model, while external operational incidents, business environment and internal control factors are evaluated as part of the scenario analysis process.

In addition, we employ a variety of risk processes and mitigants to manage our operational risk exposures. These include a governance framework, a comprehensive risk management program and insurance. Operational risks and associated risk exposures are assessed relative to the risk appetite reviewed and confirmed by the Board and are prioritized accordingly.

The breadth and range of operational risk are such that the types of mitigating activities are wide-ranging. Examples of activities include: continuous enhancement of defenses against cyberattacks, use of legal agreements and contracts to

transfer and/or limit operational risk exposures, due diligence, implementation of enhanced policies and procedures, technology change management controls, exception management processing controls, and segregation of duties.

Primary responsibility for the management of operational risk is with the business segments, the control groups and the business managers therein. The business managers maintain processes and controls designed to identify, assess, manage, mitigate and report operational risk. Each of the business segments has a designated operational risk coordinator. The operational risk coordinator regularly reviews operational risk issues and reports to our senior management within each business. Each control group also has a designated operational risk coordinator and a forum for discussing operational risk matters with our senior management. Oversight of operational risk is provided by the Non-Financial Risk Committee, legal entity risk committees, regional risk committees and senior management. In the event of a merger, joint venture, divestiture, reorganization, or creation of a new legal entity, a new product, or a business activity, operational risks are considered, and any necessary changes in processes or controls are implemented.

The Operational Risk Department and Non-Financial Risk Cyber, Technology, and Information Security Department (“NFR CTIS”) provide independent oversight of operational risk and assess, measure and monitor operational risk against appetite. The Operational Risk Department and NFR CTIS work with the divisions and control groups to embed a transparent, consistent and comprehensive framework for managing operational risk within each area and across the Firm.

The NFR CTIS scope includes oversight of technology risk, cybersecurity risk, information security risk and compliance. The Operational Risk Department scope includes oversight of the fraud risk management and prevention program, and third-party risk management (supplier and affiliate risk oversight and assessment), among others.

Cybersecurity

Risk management and strategy

We, our businesses, and the broader financial services industry face an increasingly complex and evolving threat environment. We have made and continue to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead our Cybersecurity and Information Security organizations and program under the oversight of the Board and the BOTC. See “Risk Factors—Operational Risk” for information on risks to the Firm from cybersecurity threats.

As part of the ERM framework, we have implemented and maintain a program to assess, identify and manage risks arising from the cybersecurity threats confronting the Firm (“Cybersecurity Program”). Our Cybersecurity Program helps

Table of Contents

Risk Disclosures

protect our clients, customers, employees, property, products, services and reputation by seeking to preserve the confidentiality, integrity and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems. We continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.

Processes for assessing, identifying and managing material risks from cybersecurity threats

Our Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to our network, infrastructure, computing environment and the third parties that we rely on. We periodically assess the design of our cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and develop improvements to those controls in response to that assessment. Our Cybersecurity Program also includes cybersecurity and information security policies, procedures and technologies that are designed to address regulatory requirements and protect our clients’, employees’ and own data against unauthorized disclosure, modification and misuse. These policies, procedures and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response and recovery planning. See also “Firm Resilience” herein for a discussion of our resilience program that is designed to mitigate the impacts of cybersecurity events and other risks.

Our threat intelligence function within the Cybersecurity Program actively engages in private and public information-sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs our cybersecurity risk assessments and strategy. This information is also provided to an internal cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across our environment. Our vulnerability management team, as well as NFR, also reviews external cybersecurity incidents that may be relevant to the Firm to further inform the design of our Cybersecurity Program. To assess the efficacy of our controls and defenses designed to mitigate cybersecurity risk, we utilize internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, we maintain a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conduct regular phishing email simulations for our employees and consultants as preventative measures.

When a threat is identified in our environment, our incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm’s cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.

Our processes are designed to help oversee, identify and mitigate cybersecurity risks associated with our use of third-party vendors. We maintain a third-party risk management program that evaluates and responds to cybersecurity risks at our third-party vendors. Prior to engaging third-party vendors to provide services to the Firm, we assess the third-party vendors’ cybersecurity programs to identify cybersecurity risks arising from the use of those vendors’ services. Once onboarded, third-party vendors’ cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor’s security program, and, with limited exceptions, third-party vendors are required to meet our minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge and escalation through our risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.

Our Cybersecurity Program is regularly assessed by IAD through various assurance activities, with the results reported to the BAC and the BOTC. Annually, key elements of the Cybersecurity Program are subject to review by an independent third party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. Our Cybersecurity Program is also examined regularly by the Firm’s prudential and conduct regulators within the scope of their jurisdiction.

Governance

Management’s role in assessing and managing material risks from cybersecurity threats

Our Cybersecurity Program is operated and maintained by management, including the Chief Information Officer of Cyber, Data, Risk and Resilience (“CIO”) and the Chief Information Security Officer (“CISO”). These senior officers are responsible for assessing and managing the Firm’s cybersecurity risks. Our Cybersecurity Program strategy, which is set by the CISO and overseen by the Head of Cyber, Technology, and Information Security Non-Financial Risk (“Head of NFR CTIS”), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Our Cybersecurity Program also includes processes

Table of Contents

Risk Disclosures

for escalating and considering the materiality of incidents that impact the Firm, including escalation to senior management and the Board.

The members of management that lead our Cybersecurity Program and strategy have extensive experience in technology, cybersecurity and information security. The CIO has over 30 years of experience in various engineering, IT, operations and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management and information security. The Head of NFR CTIS has over 20 years of experience in technology, security and compliance roles, including experience in government security agencies.

Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to our policies and procedures. Significant cybersecurity risks are escalated from these committees to our Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of our Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the FRC, the BOTC and the Board, as appropriate. For more information regarding the Firm’s ERM framework, see “Quantitative and Qualitative Disclosures about Risk—Risk Management.”

Board of Directors’ oversight of risks from cybersecurity threats

As discussed above, material cybersecurity risks are addressed bymanagement-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.

In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on our Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR’s assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of our broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising

from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Board and, in accordance with the Board’s Corporate Governance Policies, all Board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of our Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior management, including the senior officers mentioned above, and reports to the Board on cybersecurity risks and threats and other related matters.

Firm Resilience

The Firm’s critical processes and businesses could be disrupted by events including cyberattacks, failure or loss of access to technology and/or associated data, military conflicts, acts of terror, natural disasters, severe weather events and infectious disease. The Firm maintains a Firmwide resilience program that is designed to provide for operational resilience and enable it to respond to and recover critical processes and supporting assets in the event of a disruption impacting our people, technology, facilities and third parties. The key elements of the Firm’s resilience program include business continuity management, technology disaster recovery, third party resilience and key business service resilience. Resilience testing is performed both internally and with critical third parties to validate recovery capability in accordance with business requirements.

Third-Party Risk Management

In connection with our ongoing operations, we utilize the products and/or services of third parties, which we anticipate will continue and may increase in the future. These products and/or services include, for example, outsourced processing and support functions and other professional services. Our risk-based approach to managing exposure to our third parties includes the performance of due diligence, implementation of service-level and other contractual agreements, consideration of operational risks and ongoing monitoring of the performance of our third parties. We maintain and continue to enhance our third-party risk management program, which is designed to align with our risk tolerance and meet regulatory requirements. The program includes appropriate governance, policies, procedures and enabling technology. The third-party risk management program includes the adoption of appropriate risk management controls and practices throughout the third-party management life cycle to manage risk of service failure, risk of data loss and reputational risk, among others.

Table of Contents

Risk Disclosures

Model Risk

Model risk is the potential for adverse consequences from decisions based on incorrect or misused model outputs. Model risk can lead to financial loss, poor business and strategic decision-making, noncompliance with applicable laws and/or regulations or damage to the Firm's reputation. The risk inherent in a model is a function of the materiality, complexity and uncertainty around inputs and assumptions.

Model risk is generated from the use of models impacting financial statements, regulatory filings, capital adequacy assessments and the formulation of strategy.

Sound model risk management is an integral part of our Risk Management Framework. The Model Risk Management Department (“MRM”) is a distinct department in Risk Management responsible for the oversight of model risk.

The MRM establishes a model risk tolerance in line with our risk appetite. The tolerance is based on an assessment of the materiality of the risk of financial loss or reputational damage due to errors in design, implementation and/or inappropriate use of models. The tolerance is monitored through model-specific and aggregate business-level assessments, which are based upon qualitative and quantitative factors.

The effective challenge of models consists of critical analysis by objective, informed parties who can identify model limitations and assumptions and drive appropriate changes. The MRM provides effective challenge of models, independently validates and approves models for use, annually recertifies models, periodically revalidates, identifies and tracks remediation plans for model limitations and reports on model risk metrics. The department also oversees the development of controls to support a complete and accurate Firmwide model inventory.

Liquidity Risk

Liquidity risk refers to the risk that we will be unable to finance our operations due to a loss of access to the capital markets or difficulty in liquidating our assets. Liquidity risk also encompasses our ability (or perceived ability) to meet our financial obligations without experiencing significant business disruption or reputational damage that may threaten our viability as a going concern. Liquidity risk also encompasses the associated funding risks triggered by the market or idiosyncratic stress events that may negatively affect our liquidity and may impact our ability to raise new funding or the cost of new funding. Generally, we incur liquidity and funding risk as a result of our trading, lending, investing and client facilitation activities.

Our Liquidity Risk Management Framework is critical to helping ensure that we maintain sufficient liquidity reserves and durable funding sources to meet our daily obligations and to withstand unanticipated stress events. The Liquidity Risk

Department is a distinct area in Risk Management responsible for the oversight and monitoring of liquidity risk. The Liquidity Risk Department ensures transparency of material liquidity and funding risks, compliance with established risk limits and escalation of risk concentrations to appropriate senior management.

To execute these responsibilities, the Liquidity Risk Department establishes limits in line with our risk appetite, identifies and analyzes emerging liquidity and funding risks to ensure such risks are appropriately mitigated, monitors and reports risk exposures against metrics and limits, and reviews the methodologies and assumptions underpinning our Liquidity Stress Tests to ensure sufficient liquidity and funding under a range of adverse scenarios.

The Treasury Department and applicable business units have primary responsibility for evaluating, monitoring and controlling the liquidity and funding risks arising from our business activities and for maintaining processes and controls to manage the key risks inherent in their respective areas. The Liquidity Risk Department coordinates with the Treasury Department and these business units to help ensure a consistent and comprehensive framework for managing liquidity and funding risk across the Firm. See also “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources” herein.

Legal, Regulatory and Compliance Risk

Legal, regulatory and compliance risk includes the risk of legal or regulatory sanctions, material financial loss, including fines, penalties, judgments, damages and/or settlements, limitations on our business, or loss to reputation that we may suffer as a result of failure to comply with laws, regulations, rules, related self-regulatory organization standards and codes of conduct applicable to our business activities. This risk also includes contractual and commercial risk, such as the risk that a counterparty’s performance obligations will be unenforceable. It also includes compliance with AML, terrorist financing, and anti-corruption rules and regulations. We are generally subject to extensive regulation in the different jurisdictions in which we conduct our business (see also “Business—Supervision and Regulation” and “Risk Factors”).

We have established procedures based on legal and regulatory requirements on a worldwide basis that are designed to facilitate compliance with applicable statutory and regulatory requirements and to require that our policies relating to business conduct, ethics and practices are followed globally. In addition, we have established procedures to mitigate the risk that a counterparty’s performance obligations will be unenforceable, including consideration of counterparty legal authority and capacity, adequacy of legal documentation, the permissibility of a transaction under applicable law and whether applicable bankruptcy or insolvency laws limit or alter contractual remedies. The heightened legal and

Table of Contents

Risk Disclosures

regulatory focus on the financial services and banking industries globally presents a continuing business challenge for us.

Climate Risk

Climate change manifests as physical and transition risks. The physical risks of climate change include harm to people and property arising from acute climate-related events, such as floods, hurricanes, heatwaves, droughts and wildfires, and chronic, longer-term shifts in climate patterns, such as higher global average temperatures, rising sea levels and long-term droughts. The transition risk of climate change include policy, legal, technology and market changes. Examples of these transition risks include changes in consumer and business sentiment, related technologies, shareholder preferences and any additional regulatory and legislative requirements, including increased disclosure or regulation of carbon emissions.

Climate risk, which is not expected to have a significant effect on our consolidated results of operations or financial condition in the near term, is an overarching risk that can impact other categories of risk. Physical risk may lead to increased credit risk by diminishing borrowers’ repayment capacity or impacting the value of collateral. In addition, physical risk could pose increased operational risk to our facilities and people. The impacts of transition risk may lead to and amplify credit or liquidity risk by reducing our customers’ operating income or the value of their assets as well as exposing us to reputational, compliance and/or litigation risk due to increased legal and regulatory scrutiny or negative public sentiment.

As climate risk is interconnected with other risk types, we have developed and continue to enhance processes to embed climate risk considerations into our risk management practices and governance structures. The BRC oversees Firmwide risks, which include climate risk, and, as part of its oversight, receives updates on our risk management approach to climate risk, including our approaches toward scenario analysis and integration of climate risk into our existing risk management processes. Our climate risk management efforts are overseen by the Climate Risk Committee, which is co-chaired by our Chief Risk Officer and Chief Sustainability Officer and shapes our approach to managing climate-related risks in line with our overall risk framework.