MORGAN STANLEY

As a major financial services firm, we are subject to extensive regulation by U.S. federal and state regulatory agencies and securities exchanges and by regulators and exchanges in each of the major markets where we conduct our business.

We continue to monitor the changing political, tax and regulatory environment. While it is likely that there will be changes in the way major financial institutions are regulated in both the U.S. and other markets in which we operate, it remains difficult to predict the exact impact these changes will have on our business, financial condition, results of operations and cash flows for a particular future period. We expect to remain subject to extensive supervision and regulation.

Financial Holding Company

Consolidated Supervision. We operate as a bank holding company (“BHC”) and FHC under the BHC Act and are subject to comprehensive consolidated supervision, regulation and examination by the Federal Reserve. In particular, we are subject to (among other things): significant regulation and supervision; intensive scrutiny of our businesses and plans for expansion of those businesses; limitations on activities; a systemic risk regime that imposes heightened capital and liquidity requirements; restrictions on activities and investments imposed by a section of the BHC Act added by the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”) referred to as the “Volcker Rule,” and comprehensive derivatives regulation. In addition, the Consumer Financial Protection Bureau (“CFPB”) has primary rulemaking, enforcement and examination authority over us

and our subsidiaries with respect to federal consumer protection laws.

Scope of Permitted Activities. The BHC Act limits the activities of BHCs and FHCs and grants the Federal Reserve authority to limit our ability to conduct activities. We must obtain the Federal Reserve’s approval before engaging in certain banking and other financial activities both in the U.S. and internationally.

The BHC Act grandfathers “activities related to the trading, sale or investment in commodities and underlying physical properties,” provided that we were engaged in “any of such activities as of September 30, 1997 in the U.S.” and provided that certain other conditions that are within our reasonable control are satisfied. We currently engage in our commodities activities pursuant to the BHC Act grandfather exemption, as well as other authorities under the BHC Act.

Activities Restrictions under the Volcker Rule. The Volcker Rule prohibits banking entities, including us and our affiliates, from engaging in certain proprietary trading activities, as defined in the Volcker Rule, subject to exemptions for underwriting, market-making, risk-mitigating hedging and certain other activities. The Volcker Rule also prohibits certain investments and relationships by banking entities with covered funds, as defined in the Volcker Rule, subject to a number of exemptions and exclusions.

Capital Requirements. The Federal Reserve establishes capital requirements largely based on the Basel III capital standards established by the Basel Committee on Banking Supervision (“Basel Committee”), including well-capitalized standards, for large BHCs and evaluates our compliance with such requirements. The Office of the Comptroller of the Currency (“OCC”) establishes similar capital requirements and standards for Morgan Stanley Bank, N.A. (“MSBNA”) and Morgan Stanley Private Bank, National Association (“MSPBNA”) (together, our “U.S. Bank Subsidiaries”).

The Federal Reserve, Federal Deposit Insurance Corporation (“FDIC”) and the OCC (collectively, “U.S. banking agencies”) have proposed a comprehe nsive set of revisions to their capital requirements based on changes to the Basel III capital standards finalized by the Basel Committee. The impact on us of any revisions to the capital requirements is uncertain and depends on the adoption of final rulemakings by the U.S. banking agencies. For additional information, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Regulatory Requirements—Regulatory Developments and Other Matters—Basel III Endgame Proposal.”

In addition, many of our regulated subsidiaries are subject to regulatory capital requirements, including regulated subsidiaries registered as swap dealers with the U.S. Commodity Futures Trading Commission (“CFTC”) or conditionally registered as security-based swap dealers with

Table of Contents

the SEC or registered as broker-dealers or futures commission merchants.

For more information about the specific capital requirements applicable to us and our U.S. Bank Subsidiaries, as well as our subsidiaries that are broker-dealers, swap dealers and security-based swap dealers, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Regulatory Requirements” and Note 16 to the financial statements.

Capital Planning, Stress Tests and Capital Distributions. The Federal Reserve has adopted capital planning and stress test requirements for large BHCs, including Morgan Stanley. For more information about our capital planning and stress test requirements, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Regulatory Requirements.”

In addition, the Federal Reserve, the OCC and the FDIC have the authority to prohibit or limit the payment of dividends by the banking organizations they supervise, including us and our U.S. Bank Subsidiaries, if, in the banking regulator’s opinion, payment of a dividend would constitute an unsafe or unsound practice in light of the financial condition of the banking organization. For information about the Federal Reserve’s restrictions on capital distributions for large BHCs, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Regulatory Requirements—Capital Plans, Stress Tests and the Stress Capital Buffer.” All of these policies and other requirements could affect our ability to pay dividends and/or repurchase stock or require us to provide capital assistance to our U.S. Bank Subsidiaries under circumstances that we would not otherwise decide to do.

Liquidity Requirements. In addition to capital regulations, the U.S. banking agencies have adopted liquidity and funding standards, including the LCR, the NSFR, liquidity stress testing and associated liquidity reserve requirements.

For more information, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Balance Sheet—Regulatory Liquidity Framework.”

Systemic Risk Regime. Under rules issued by the Federal Reserve, large BHCs, including Morgan Stanley, must conduct internal liquidity stress tests, maintain unencumbered highly liquid assets to meet projected net cash outflows for 30 days over the range of liquidity stress scenarios used in internal stress tests, and comply with various liquidity risk management requirements. These large BHCs also must comply with a range of risk management and corporate governance requirements.

The Federal Reserve also imposes single-counterparty credit limits (“SCCL”) for large banking organizations. U.S. global systemically important banks (“G-SIBs”), including us, are

subject to a limit of 15% of Tier 1 capital for aggregate net credit exposures to any “major counterparty” (defined to include other U.S. G-SIBs, foreign G-SIBs and non-bank systemically important financial institutions supervised by the Federal Reserve). In addition, we are subject to a limit of 25% of Tier 1 capital for aggregate net credit exposures to any other unaffiliated counterparty.

The Federal Reserve may establish additional prudential standards for large BHCs, including with respect to an early remediation framework, contingent capital, enhanced public disclosures and limits on short-term debt, including off-balance sheet exposures. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Regulatory Requirements—Total Loss-Absorbing Capacity, Long-Term Debt and Clean Holding Company Requirements.”

If the Federal Reserve or the Financial Stability Oversight Council determines that a BHC with $250 billion or more in consolidated assets poses a “grave threat” to U.S. financial stability, the institution may be, among other things, restricted in its ability to merge or offer financial products and/or required to terminate activities and dispose of assets. See also “Capital Requirements” and “Liquidity Requirements” and “Resolution and Recovery Planning” herein.

Resolution and Recovery Planning. We are required to submit once every two years to the Federal Reserve and the FDIC a resolution plan that describes our strategy for a rapid and orderly resolution under the U.S. Bankruptcy Code in the event of our material financial distress or failure. Interim updates are required in certain limited circumstances, including material mergers or acquisitions or fundamental changes to our resolution strategy.

Our preferred resolution strategy, which is set out in our most recent resolution plan, is an SPOE strategy, which generally contemplates the provision of adequate capital and liquidity by the Parent Company to certain of its subsidiaries so that such subsidiaries have the resources necessary to implement the resolution strategy after the Parent Company has filed for bankruptcy.

Our next resolution plan submission will be a targeted resolution plan in July 2025. Further, we submit an annual recovery plan to the Federal Reserve that outlines the steps that management could take over time to generate or conserve financial resources in times of prolonged financial stress.

Certain of our domestic and foreign subsidiaries are also subject to resolution and recovery planning requirements in the jurisdictions in which they operate. The FDIC currently requires certain insured depository institutions (“IDI”), including our U.S. Bank Subsidiaries, to submit full resolution plans every two years and interim targeted information at certain times between full resolution plan submissions that describe the IDI’s strategy for a rapid and orderly resolution in the event of material financial distress or

Table of Contents

failure of the IDI. Submission of interim targeted information by our U.S. Bank Subsidiaries generally will not be required during a year which the Parent Company is required to submit a resolution plan to the Federal Reserve and FDIC. The first submission for our U.S. Bank Subsidiaries under this rule will be in 2026. In addition, the OCC requires IDIs with assets of $100 billion or more, including our U.S. Bank Subsidiaries, to develop recovery plans detailing the actions they would take to remain a going concern when they experience considerable financial or non-financial stress, but have not deteriorated to the point that resolution is imminent. Our U.S. Bank Subsidiaries are required to develop a recovery plan by January 2026.

In addition, certain financial companies, including BHCs such as the Firm and certain of its subsidiaries, can be subject to a resolution proceeding under the orderly liquidation authority, with the FDIC being appointed as receiver, provided that determination of extraordinary financial distress and systemic risk is made by the U.S. Treasury Secretary in consultation with the U.S. president. Regulators have adopted certain orderly liquidation authority implementing regulations and may expand or clarify these regulations in the future. If we were subject to the orderly liquidation authority, the FDIC would have considerable powers, including: the power to remove directors and officers responsible for our failure and to appoint new directors and officers; the power to assign our assets and liabilities to a third party or bridge financial company without the need for creditor consent or prior court review; the ability to differentiate among our creditors, including treating certain creditors within the same class better than others, subject to a minimum recovery right on the part of disfavored creditors to receive at least what they would have received in bankruptcy liquidation; and broad powers to administer the claims process to determine distributions from the assets of the receivership. The FDIC has indicated that it expects to use an SPOE strategy if the FDIC were to implement the orderly liquidation authority for a U.S. G-SIB.

Regulators have also taken and proposed various actions to facilitate an SPOE strategy under the U.S. Bankruptcy Code, the orderly liquidation authority or other resolution regimes.

For more information about our resolution plan-related submissions and associated regulatory actions, see “Risk Factors—Legal, Regulatory and Compliance Risk,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Regulatory Requirements—Total Loss-Absorbing Capacity, Long-Term Debt and Clean Holding Company Requirements” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources—Regulatory Requirements—Resolution and Recovery Planning.”

Institutional Securities and Wealth Management

U.S. Bank Subsidiaries. Our U.S. Bank Subsidiaries are FDIC-insured depository institutions subject to supervision, regulation and examination by the OCC and are subject to the OCC’s risk governance guidelines, which establish heightened standards for a large IDI’s risk governance framework and the oversight of that framework by the IDI’s board of directors. Our U.S. Bank Subsidiaries are also subject to prompt corrective action standards, which require the relevant federal banking regulator to take prompt corrective action with respect to a depository institution if that institution does not meet certain capital adequacy standards. In addition, BHCs, such as Morgan Stanley, are required to serve as a source of strength to their U.S. bank subsidiaries and commit resources to support these subsidiaries in the event such subsidiaries are in financial distress. Our U.S. Bank Subsidiaries’ business activities are generally limited to supporting our Institutional Securities and Wealth Management business segments.

Our U.S. Bank Subsidiaries are subject to Sections 23A and 23B of the Federal Reserve Act, which impose restrictions on certain transactions with affiliates, including any extension of credit to, or purchase of assets from, an affiliate. These restrictions limit the total amount of credit exposure that our U.S. Bank Subsidiaries may have to any one affiliate and to all affiliates and require collateral for those exposures. Section 23B requires affiliate transactions to be on market terms.

As commonly controlled FDIC-insured depository institutions, each of our U.S. Bank Subsidiaries could be responsible for any loss to the FDIC from the failure of the other U.S. Bank Subsidiary.

Broker-Dealer and Investment Adviser Regulation. Our primary U.S. broker-dealer subsidiaries, Morgan Stanley & Co. LLC (“MS&Co.”) and Morgan Stanley Smith Barney LLC (“MSSB”) are registered broker-dealers with the SEC and in all 50 states, the District of Columbia, Puerto Rico and the U.S. Virgin Islands and are members of various self-regulatory organizations, including the Financial Industry Regulatory Authority (“FINRA”), and various securities exchanges and clearing organizations. Broker-dealers are subject to laws and regulations covering all aspects of the securities business, including sales and trading practices, securities offerings, publication of research reports, use of customers’ funds and securities, capital structure, risk management controls in connection with market access, recordkeeping and retention, and the conduct of their directors, officers, representatives and other associated persons. Broker-dealers are also regulated by securities administrators in those states where they do business. Our significant broker-dealer subsidiaries are members of the Securities Investor Protection Corporation.

MSSB is also a registered investment adviser with the SEC. MSSB’s relationship with its investment advisory clients is

Table of Contents

subject to the fiduciary and other obligations imposed on investment advisers. The SEC and other supervisory bodies generally have broad administrative powers to address non-compliance, including the power to restrict or limit MSSB from carrying on its investment advisory and other asset management activities.

The Firm is subject to various regulations that affect broker-dealer sales practices and customer relationships, including the SEC’s “Regulation Best Interest,” which requires broker-dealers to act in the “best interest” of retail customers at the time a recommendation is made without placing the financial or other interests of the broker-dealer ahead of the interest of the retail customer.

Margin lending by our broker-dealers is regulated by the Federal Reserve’s restrictions on lending in connection with purchases and short sales of securities. Our broker-dealers are also subject to maintenance and other margin requirements imposed under FINRA and other self-regulatory organization rules.

Our U.S. broker-dealer subsidiaries are subject to the SEC’s net capital rule and the net capital requirements of various exchanges, other regulatory authorities and self-regulatory organizations. For more information about these requirements, see Note 16 to the financial statements.

Research Regulation. In addition to research-related regulations currently in place in the U.S. and other jurisdictions, regulators continue to focus on research conflicts of interest and may impose additional regulations.

Futures Activities and Certain Commodities Activities Regulation. MS&Co. and E*TRADE Futures LLC, as futures commission merchants, and MSSB, as an introducing broker, are subject to net capital requirements of, and certain of their activities are regulated by, the CFTC and the National Futures Association (“NFA”). MS&Co. is also subject to requirements of, and regulation by, the CME Group, in its capacity as MS&Co.’s designated self-regulatory organization, and various commodity futures exchanges of which MS&Co. is a member. Rules and regulations of the CFTC, NFA, the Joint Audit Committee and commodity futures exchanges address obligations related to, among other things, customer asset protections, including rules and regulations governing the segregation of customer funds, the use by futures commission merchants of customer funds, the margining of customer accounts and documentation entered into by futures commission merchants with their customers, record-keeping and reporting obligations of futures commission merchants and introducing brokers, risk disclosure and risk management. Our commodities activities are subject to extensive laws and regulations in the U.S. and abroad.

Derivatives Regulation. We are subject to comprehensive regulation of our derivatives businesses, including regulations that impose margin requirements, public and regulatory

reporting, central clearing and mandatory trading on regulated exchanges or execution facilities for certain types of swaps and security-based swaps (collectively, “Swaps”).

CFTC and SEC rules require registration of swap dealers and security-based swap dealers, respectively, and impose numerous obligations on such registrants, including adherence to business conduct standards for all in-scope Swaps. We have registered a number of U.S. and non-U.S. swap dealers and conditionally registered a number of U.S. and non-U.S security-based swap dealers. Swap dealers and security-based swap dealers regulated by a prudential regulator are subject to uncleared Swap margin requirements and minimum capital requirements established by the prudential regulators. Swap dealers and security-based swap dealers not subject to regulation by a prudential regulator are subject to uncleared Swap margin requirements and minimum capital requirements established by the CFTC and SEC, respectively. In some cases, the CFTC and SEC permit non-U.S. swap dealers and security-based swap dealers that do not have a prudential regulator to comply with applicable non-U.S. uncleared Swap margin and minimum capital requirements instead of direct compliance with CFTC or SEC requirements.

Investment Management

Many of the subsidiaries engaged in our investment management activities are registered as investment advisers with the SEC. Many aspects of our investment management activities are also subject to federal and state laws and regulations in place primarily for the protection of the investor or client. These laws and regulations generally grant supervisory agencies and bodies broad administrative powers, including the power to limit or restrict us from carrying on our investment management activities in the event that we fail to comply with such laws and regulations.

In addition, certain of our subsidiaries are U.S. registered broker-dealers and act as distributors to our proprietary mutual funds and as placement agents to certain private investment funds managed by our Investment Management business segment. Certain of our affiliates are registered as commodity trading advisors and/or commodity pool operators, or are operating under certain exemptions from such registration pursuant to CFTC rules and other guidance, and have certain responsibilities with respect to each pool they advise. Our investment management activities are subject to additional laws and regulations, including restrictions on sponsoring or investing in, or maintaining certain other relationships with, covered funds, as defined by the Volcker Rule, subject to certain limited exemptions. See also “Financial Holding Company—Activities Restrictions under the Volcker Rule,” “Institutional Securities and Wealth Management—Broker-Dealer and Investment Adviser Regulation,” “Institutional Securities and Wealth Management—Regulation of Futures Activities and Certain Commodities Activities,” and “Institutional Securities and Wealth Management—Derivatives Regulation” herein and “Non-U.S. Regulation” herein for a discussion of other

Table of Contents

regulations that impact our Investment Management business activities.

U.S. Consumer Protection

We are subject to supervision and regulation by the CFPB with respect to U.S. federal consumer protection laws. Federal consumer protection laws to which we are subject include the Gramm-Leach-Bliley Act’s privacy provisions, Equal Credit Opportunity Act, Home Mortgage Disclosure Act, Electronic Fund Transfer Act, Fair Credit Reporting Act, Real Estate Settlement Procedures Act, Truth in Lending Act and Truth in Savings Act, all of which are enforced by the CFPB. We are also subject to certain federal consumer protection laws enforced by the OCC, including the Servicemembers Civil Relief Act. Furthermore, we are subject to certain state consumer protection laws, and under the Dodd-Frank Act, state attorneys general and other state officials are empowered to enforce certain federal consumer protection laws and regulations. These federal and state consumer protection laws apply to a range of our activities.

Non-U.S. Regulation

Our businesses are regulated extensively by non-U.S. regulators, including governments, central banks and regulatory bodies, securities exchanges, commodity exchanges, and self-regulatory organizations, especially in those jurisdictions in which we maintain an office. Certain regulators have prudential, business conduct and other authority over us or our subsidiaries, as well as powers to limit or restrict us from engaging in certain businesses or to conduct administrative proceedings that can result in censures, fines, asset seizures and forfeitures, the issuance of cease-and-desist orders, or the suspension or expulsion of a regulated entity, its affiliates or its employees. Certain of our subsidiaries are subject to capital, liquidity, leverage and other prudential requirements that are applicable under non-U.S. law.

Firmwide Financial Crimes Program

Our Financial Crimes program is coordinated and implemented on an enterprise-wide basis and supports our financial crime prevention efforts across all regions and business units. The program includes anti-money laundering (“AML”), economic sanctions (“Sanctions”), anti-boycott, anti-corruption, anti-tax evasion, and government and political activities compliance programs and aligned business-line risk functions.

In the U.S., the Bank Secrecy Act, as amended by the USA PATRIOT Act of 2001 and the Anti-Money Laundering Act of 2020, imposes significant obligations on financial institutions to detect and deter money laundering and terrorist financing activity, including requiring banks, broker-dealers, futures commission merchants, introducing brokers and mutual funds to develop and implement AML programs, verify the identity of customers that maintain accounts, and

monitor and report suspicious activity to appropriate law enforcement or regulatory authorities. Outside of the U.S., applicable laws, rules and regulations similarly require designated types of financial institutions to implement AML programs.

We are also subject to Sanctions, such as regulations and economic sanctions programs administered by the U.S. government, including the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) and the U.S. Department of State, and similar sanctions programs imposed by foreign governments or global or regional multilateral organizations. In addition, we are subject to anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act, in the jurisdictions in which we operate. Anti-corruption laws generally prohibit offering, promising, giving or authorizing others to give anything of value, either directly or indirectly, to a government official or private party in order to influence official action or otherwise gain an unfair business advantage, such as to obtain or retain business.

Cyber and Information Security Risk Management and Protection of Client Information

The financial services industry faces increased global regulatory focus regarding cyber and information security risk management practices. Many aspects of our businesses are subject to cybersecurity legal, regulatory and disclosure requirements enacted by U.S. federal and state governments and other non-U.S. jurisdictions. These requirements are generally aimed at codifying basic cybersecurity protections and mandating data breach notification requirements.

Our businesses are also subject to increasing privacy and data protection legal requirements concerning the use and protection of certain personal information with regard to clients, employees and others. These requirements impose mandatory privacy and data protection obligations, including providing for individual rights, enhanced governance and accountability requirements, and significant fines and litigation risk for noncompliance. In addition, several jurisdictions have enacted or proposed personal and other data localization requirements and restrictions on cross-border transfer of personal and other data that may restrict our ability to conduct business in those jurisdictions or create additional financial and regulatory burdens to do so.

Numerous jurisdictions have passed laws, rules and regulations in these areas and many are considering new or updated ones that could impact our businesses, particularly as the application, interpretation and enforcement of these laws, rules and regulations are often uncertain and evolving. Many aspects of our businesses are subject to legal requirements concerning the use and protection of certain customer and other information, as well as the privacy and cybersecurity laws referenced above. We have adopted measures designed to comply with these and related applicable requirements in all relevant jurisdictions.

Table of Contents

For additional information on our cybersecurity strategy and processes, see “Quantitative and Qualitative Disclosures about Risk—Operational Risk—Cybersecurity.”