MORGAN STANLEY

Country Risk

Country risk exposure is the risk that events in, or that affect, a foreign country (any country other than the U.S.) might adversely affect us. We actively manage country risk exposure through a comprehensive risk management framework that combines credit and other market fundamentals and allows us to effectively identify, monitor and limit country risk. For a further discussion of our country risk exposure see “Quantitative and Qualitative Disclosures about Risk—Country and Other Risks” in the 2025 Form 10-K.

Top 10 Non-U.S. Country Exposures

1. Net inventory represents exposure to both long and short single-name and index positions (i.e., bonds and equities at fair value and CDS based on a notional amount assuming zero recovery adjusted for the fair value of any receivable or payable).

2. Net counterparty exposure (e.g., repurchase transactions, securities lending and OTC derivatives) is net of the benefit of collateral received and also is net by counterparty when legally enforceable master netting agreements are in place.

3. Amounts represent net CDS hedges (purchased and sold) on net counterparty exposure and lending executed by trading desks responsible for hedging counterparty and lending credit risk exposures. Amounts are based on the CDS

Table of Contents

Risk Disclosures

notional amount assuming zero recovery adjusted for the fair value of any receivable or payable. For further description of the contractual terms for purchased credit protection and whether they may limit the effectiveness of our hedges, see “Quantitative and Qualitative Disclosures about Risk—Credit Risk—Derivatives” in the 2025 Form 10-K.

Operational Risk

Operational risk refers to the risk of loss, or of damage to our reputation, resulting from inadequate or failed processes or systems, human factors (e.g., inappropriate or unlawful conduct) or external events (e.g., cyberattacks or third-party vulnerabilities) that may manifest as, for example, loss of information, business disruption, theft and fraud, legal and compliance risks, or damage to physical assets. We may experience operational risk events across the full scope of our business activities, including revenue-generating activities and support and control groups (e.g., IT and trade processing). For a further discussion about our operational risk, see “Quantitative and Qualitative Disclosures about Risk—Operational Risk” in the 2025 Form 10-K.

Model Risk

Model risk is the potential for adverse consequences from decisions based on incorrect or misused model outputs. Model risk can lead to financial loss, poor business and strategic decision-making, noncompliance with applicable laws and/or regulations or damage to the Firm’s reputation. The risk inherent in a model is a function of the materiality, complexity and uncertainty around inputs and assumptions. Model risk is generated from the use of models impacting financial statements, regulatory filings, capital adequacy assessments and the formulation of strategy. For a further discussion about our model risk, see “Quantitative and Qualitative Disclosures about Risk—Model Risk” in the 2025 Form 10-K.

Liquidity Risk

Liquidity risk refers to the risk that we will be unable to finance our operations due to a loss of access to the capital markets or difficulty in liquidating our assets. Liquidity risk also encompasses our ability (or perceived ability) to meet our financial obligations without experiencing significant business disruption or reputational damage that may threaten our viability as a going concern. For a further discussion about our liquidity risk, see “Quantitative and Qualitative Disclosures about Risk—Liquidity Risk” in the 2025 Form 10-K and “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources” herein.

Legal, Regulatory and Compliance Risk

Legal, regulatory and compliance risk includes the risk of legal or regulatory sanctions, material financial loss, including fines, penalties, judgments, damages and/or settlements, limitations on our business, or loss to reputation that we may suffer as a result of failure to comply with laws, regulations, rules, related self-regulatory organization standards and codes

of conduct applicable to our business activities. This risk also includes contractual and commercial risk, such as the risk that a counterparty’s performance obligations will be unenforceable. It also includes compliance with AML, terrorist financing, and anti-corruption rules and regulations. For a further discussion about our legal and compliance risk, see “Quantitative and Qualitative Disclosures about Risk—Legal, Regulatory and Compliance Risk” in the 2025 Form 10-K.

Climate Risk

Climate-related risk consists of physical and transition risks. Physical risks include harm to people and property arising from acute climate-related events, such as floods, hurricanes, heatwaves, droughts and wildfires, and chronic, longer-term shifts in climate patterns, such as higher global average temperatures, rising sea levels and long-term droughts. Transition risks include policy, legal, technology and market changes. Examples of these transition risks include changes in consumer and business sentiment, related technologies, shareholder preferences and any additional regulatory and legislative requirements, including increased disclosure requirements or taxation of carbon emissions. Climate risk, which is not expected to have a significant effect on our consolidated results of operations or financial condition in the near term, is an overarching risk that can impact other categories of risk. For a further discussion about our climate risk, see “Quantitative and Qualitative Disclosures about Risk—Climate Risk” in the 2025 Form 10-K.