SLM Corp

Management’s Discussion and Analysis of Financial Condition and Results of Operations addresses our consolidated financial statements, which have been prepared in accordance with GAAP. Notes to Consolidated Financial Statements, Note 2, “Significant Accounting Policies” in this Form 10-K includes a summary of the significant accounting policies and methods used in the preparation of our consolidated financial statements. The preparation of these financial statements requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and the reported amounts of income and expenses during the reporting periods. Actual results may differ from these estimates under varying assumptions or conditions. On a quarterly basis, management evaluates its estimates, particularly those that include the most difficult, subjective, or complex judgments and are often about matters that are inherently uncertain. The most significant judgments, estimates, and assumptions relate to the following critical accounting estimates that are discussed in more detail below.

We maintain an allowance for credit losses for the lifetime expected credit losses on loans in our portfolios, as well as for future loan commitments, at the reporting date.

In determining the lifetime expected credit losses on our Private Education Loan portfolio loan segments, we use a discounted cash flow method. This method requires us to project future principal and interest cash flows on our loans in those portfolios.

To estimate the future expected cash flows, we use statistical loan-level models that consider life of loan expectations for defaults, prepayments, recoveries, and any other qualitative adjustments deemed necessary, to determine the adequacy of the allowance at each balance sheet date. These cash flows are discounted at the loan’s effective interest rate to calculate the present value of those cash flows. Management adjusts the effective interest rate used to discount expected cash flows to incorporate expected prepayments. The difference between the present value of those cash flows and the amortized cost basis of the underlying loans is the allowance for credit losses. Entities that measure credit losses based on the present value of expected future cash flows are permitted to report the entire change in present value as credit loss expense, but may alternatively report the change in present value due to the passage of time as interest income. We have elected to report the entire change in present value as credit loss expense.

We estimate future default rates used in our current expected credit losses at a loan level using historical loss experience, current borrower characteristics, current conditions, and economic factors forecasted over a reasonable and supportable period. At the end of the reasonable and supportable forecast period, we immediately revert our forecasted economic factors to long-term historical averages. We estimate future prepayment speeds used in our current expected credit losses at a loan level using historical prepayment experience, current borrower characteristics, current conditions, and economic factors forecasted over a reasonable and supportable period.

The reasonable and supportable forecast period is meant to represent the period in which we believe we can estimate the impact of forecasted economic factors in our expected losses. We use a two-year reasonable and supportable forecast period, although this period is subject to change as our view evolves on our ability to reasonably forecast economic conditions to estimate future losses.

In estimating future default rates and prepayment speeds in our current expected credit losses, we use a combination of expected economic scenarios coupled with our historical experience and adjust for any qualitative factors (as described below). We also develop an adverse and favorable economic scenario. At each reporting date, we determine the appropriate weighting of these alternate scenarios based upon the current economic conditions and our view of the risks of alternate outcomes. This weighting of expectations is used in calculating our current expected credit losses recorded each period.

We obtain forecasts for our expected loss model from an external economic data provider who provides a range of economic forecasts with various likelihoods of occurrence. Management reviews and weighs the economic forecasts for each of these inputs to calculate our allowance for credit losses. Our forecasting process reflects management’s continuous review of forecasting assumptions and model inputs and is consistent with our internal governance, risk management framework and CECL methodologies. Management continues to review both the scenarios and their respective weightings each quarter in determining the allowance for credit losses. The most recent adjustment to scenario weightings occurred in the first quarter of 2025.

2025 Form 10-K — SLM CORPORATION 79

In estimating recoveries, we use both estimates of what we expect to receive from the sale of defaulted loans as well as historical borrower payment behavior to estimate the timing and amount of future recoveries on charged-off loans.

In addition to the above modeling approach, we also take certain other qualitative factors into consideration when calculating the allowance for credit losses, which could result in management overlays (increases or decreases to the allowance for credit losses). These management overlays can encompass a broad array of factors not captured by model inputs, including, but not limited to, changes in lending policies and procedures, including changes in underwriting standards, changes in servicing policies and collection administration practices, including changes we have implemented to our loan modification programs, state law changes that could impact servicing and collection practices, charge-offs, recoveries not already included in the analysis, the effect of other external factors such as shifts in the macroeconomic environment or legal and regulatory requirements that impact the level of estimated current expected credit losses or prepayments, the performance of the model over time versus actual losses, and any other operational or regulatory changes that could materially affect our estimate of future losses.

The evaluation of the allowance for credit losses is inherently subjective, as it requires material estimates that may be susceptible to significant changes. If actual future performance in delinquency, charge-offs, and recoveries is significantly different than estimated, or management assumptions or practices were to change, this could materially affect the estimate of the allowance for credit losses, the timing of when losses are recognized, and the related provision for credit losses in our consolidated statements of income.

When calculating our allowance for credit losses and liability for unfunded commitments, we incorporate several inputs that are subject to change period to period. These include, but are not limited to, CECL model inputs and any overlays deemed necessary by management. The most impactful CECL model inputs include:

•Economic forecasts;

•Weighting of economic forecasts; and

•Recovery rates.

Of the model inputs outlined above, economic forecasts, weighting of economic forecasts, and recovery rates are subject to estimation uncertainty, and changes in these inputs could have a material impact to our allowance for credit losses and the related provision for credit losses.

In 2023, we experienced slower prepayment rates due to the rising interest rate environment. Historically, when rates rise, loan prepayments generally decline due to a reduction in consolidation activity of our borrowers to third party lenders, and when rates decline, loan prepayments generally rise due to an increase in consolidation activity of our borrowers to third party lenders. During 2023, our estimates of future prepayment speeds reflected the then current interest rate environment and future expectations of increased prepayment speeds in line with market expectations of a decline in interest rates based on the scenarios produced by an external data provider described above. Slower prepayment speeds increase the allowance for credit losses because the loss rates applied in the future periods are applied to higher loan balances.

In the second quarter of 2024, we implemented a loan-level future default rate model that includes current portfolio characteristics and forecasts of real gross domestic product and college graduate unemployment. In the second quarter of 2024, we also implemented a future prepayment speeds model to include forecasts of real gross domestic product, retail sales, SOFR, and the U.S. 10-year treasury rate. These models reduced the reliance on certain qualitative overlays compared to the previous default rate and prepayment speeds models. Prior to these changes, our default rate and prepayment speeds models used forecasts of college graduate unemployment, retail sales, home price index, and median family income. Both the future default rate model and the future prepayment speeds model are used in determining the adequacy of the allowance for credit losses.

80 SLM CORPORATION— 2025 Form 10-K

To demonstrate the sensitivity of the allowance for credit losses for our Private Education Loan portfolio to a more pessimistic forecast of expected economic outcomes, we considered what our allowance for credit losses would be if we applied a 100 percent probability weighting to the S3 unfavorable (or downside/90th percentile) scenario (with a concurrent 0 percent weighting for both the Baseline and S1 stronger near-term growth scenarios) under the range of scenarios noted above. Excluding consideration of qualitative adjustments, this sensitivity analysis would result in a hypothetical increase in our allowance for credit losses as of December 31, 2025 of $196 million or 12.9 percent. In addition, we also considered a 100 percent probability weighting to the S4 unfavorable (or downside/96th percentile) scenario (with a concurrent 0 percent weighting for both the Baseline and S1 stronger near-term growth scenarios) under the range of scenarios noted above. Excluding consideration of any qualitative adjustments, this sensitivity analysis would result in a hypothetical increase in our allowance for credit losses as of December 31, 2025 of $298 million or 19.6 percent. These scenarios do not reflect our current expectations as of December 31, 2025, nor do they capture other qualitative adjustments or all the potential unknown variables that could arise in the forecast periods, but they provide an approximation of possible outcomes under hypothetical pessimistic conditions. The estimated impacts were calculated for the two-year reasonable and supportable periods, but were not calculated for the remaining periods since long-term assumptions used to calculate the allowance for the remaining periods are based on longer term averages and only change when we determine there is a fundamental change that will affect the long-term rate.

Estimates are also made on our Private Education Loans regarding when each borrower will separate from school. The cash flow timing of when a borrower will begin making full principal and interest payments is dependent upon when the student either graduates or leaves school. These dates can change based upon many factors. We receive information regarding projected graduation dates from a third-party clearinghouse. The separation from school date is updated quarterly based on updated information received from the clearinghouse.

Additionally, when we have a contractual obligation to fund a loan or a portion of a loan at a later date, we make an estimate regarding the percentage of this obligation that will be funded. This estimate is based on historical experience. For unfunded commitments, we recognize the related life of loan allowance as a liability. Once the loan is funded, that liability transfers to the allowance for Private Education Loan losses. For newly originated loans that will be sold to strategic partners, due to the near-term timing of the loan sale and credit quality of the loans, we believe there is no risk of credit loss and do not record an allowance for the unfunded loan commitments related to the loans classified as held for sale.

Key Credit Quality Indicators - Private Education Loans

We determine the collectability of our Private Education Loan portfolio by evaluating certain risk characteristics. We consider credit score at original approval and periodically refreshed/updated credit scores through the loan’s term, existence of a cosigner, loan status, and loan seasoning as the key credit quality indicators because they have the most significant effect on the determination of the adequacy of our allowance for credit losses. Credit scores are an indicator of the creditworthiness of borrowers, and the higher the credit scores the more likely it is the borrowers will be able to make all of their contractual payments. Loan status affects the credit risk because a past due loan is more likely to result in a credit loss than a current loan. Additionally, loans in the deferred payment status have different credit risk profiles compared with those in current pay status. Loan seasoning affects credit risk because a loan with a history of making payments generally has a lower incidence of default than a loan with a history of making infrequent or no payments. The existence of a cosigner lowers the likelihood of default as well. We monitor and update these credit quality indicators in the analysis of the adequacy of our allowance for credit losses on a quarterly basis.

In the second quarter of 2023, we changed how we collect on defaulted loans. Previously, we used a mix of in-house collectors and sales to third parties. We continue to sell a segment of defaulted loans immediately after charge-off but no longer sell retained defaulted loans (that have been subject to internal collection attempts for six months) to third parties and instead continue our collection efforts using in-house collectors and third-party collectors. When we estimate the timing and amount of future recoveries on charged-off loans, we no longer include expectations of future sales on retained defaulted loans. We continue to monitor how we collect on defaulted loans and may modify the approach from time to time based on performance, industry conventions, and/or regulatory feedback.

Private Education Loans generally do not require borrowers to begin principal and interest repayment until at least six months after the borrowers have graduated or otherwise separated from school. Consequently, the loss estimates for these loans are generally low while the borrower is in school and then increase upon the end of the grace period after separation from school. At December 31, 2025 and 2024, 25 percent and 26 percent, respectively, of the principal balance of the Private Education Loan portfolio was related to borrowers who were then in an in-school (fully deferred), grace, or other deferment status and not required to make payments.

2025 Form 10-K — SLM CORPORATION 81

Our collection policies for Private Education Loans allow for periods of nonpayment (forbearance) for certain borrowers requesting an extended grace period upon leaving school or experiencing temporary difficulty meeting payment obligations.

As part of concluding on the adequacy of the allowance for credit losses for Private Education Loans, we review key allowance and loan metrics. The most relevant of the metrics considered are the allowance coverage of net charge-offs ratio; the allowance as a percentage of ending total loans plus unfunded loan commitments and total accrued interest receivable; and delinquency and forbearance percentages.

We consider a Private Education Loan to be delinquent if the borrower has not made a required payment prior to the 31st day after such payment was contractually due.

Off-Balance Sheet Exposure for Contractual Loan Commitments

When we approve a Private Education Loan at the beginning of an academic year, that approval may cover the borrowing for the entire academic year. As such, we do not always disburse the full amount of the loan at the time of such approval, but instead have a commitment to fund a portion of the loan at a later date (usually the start of the second semester or subsequent trimesters). We estimate expected credit losses over the contractual period that we are exposed to credit risk via a contractual obligation to extend credit unless that obligation is unconditionally cancellable by us. The discounted cash flow approach described above includes expected future contractual disbursements. The portion of the allowance for credit losses related to future disbursements is shown as a liability on the face of the balance sheet, and related provision for credit losses is reflected on the income statement.

Uncollectible Interest

The majority of the total accrued interest receivable on our Private Education Loan portfolio represents accrued interest on deferred loans where no payments are due while the borrower is in school and on fixed-pay loans where the borrower makes a $25 monthly payment that is smaller than the interest accrued on the loan in that month. The accrued interest on these loans will be capitalized and increase the unpaid principal balance of the loans when the borrower exits the grace period after separation from school. The discounted cash flow approach and the allowance for credit losses described above consider both the collectability of principal and accrued interest. The allowance for uncollectible interest estimates the additional uncollectible interest that is not captured in the allowance for credit losses. The allowance for uncollectible interest uses historical experience to estimate the uncollectible interest on loans for which payment in full of principal or interest is not expected. This amount is recorded as a reduction of interest income. Accrued interest receivable is separately disclosed on the face of the balance sheet.

Allowance for FFELP Loan Losses

During the third quarter of 2024, we transferred our FFELP Loan portfolio to loans held for sale as we planned to sell our FFELP Loan portfolio. At that time, we wrote down this loan portfolio to its estimated fair value through an adjustment to the allowance for credit losses of $8 million. We subsequently sold the FFELP Loan portfolio to a third party in the fourth quarter of 2024.

FFELP Loans are insured as to their principal and accrued interest in the event of default, subject to a risk-sharing level based on the date of loan disbursement. These insurance obligations are supported by contractual rights against the United States. For loans disbursed on or after July 1, 2006, owners receive 97 percent reimbursement on all qualifying claims. For loans disbursed after October 1, 1993, and before July 1, 2006, owners receive 98 percent reimbursement on all qualifying claims. For loans disbursed prior to October 1, 1993, owners receive 100 percent reimbursement. Because owners bear a maximum of three percent loss exposure due to this federal guarantee, our allowance for credit losses for FFELP Loans and related periodic provision expense were relatively small.

For the year ended December 31, 2023, we used the gross loss approach when estimating the allowance for credit losses for the unguaranteed portion of our FFELP Loans. We maintained an allowance for credit losses for our FFELP Loans at a level sufficient to cover lifetime expected credit losses. The allowance for FFELP Loan losses used historical experience of customer default behavior. We applied the default rate projections, net of applicable risk sharing, to our FFELP Loans for the relevant period to perform our quantitative calculation. Once the quantitative calculation was performed, we reviewed the adequacy of the allowance for credit losses and determined if qualitative adjustments needed to be considered.

82 SLM CORPORATION— 2025 Form 10-K

Risk Management

Our Approach

Risk is inherent in our business activities and the specialized lending industry we serve. The ability of management to identify, manage, and remediate risk in a timely manner is critical to our continued success. Our risk management framework is designed to assess, manage, and report these risks and escalate as appropriate to the Board of Directors or its designee.

Risk Oversight

Our Board of Directors oversees our overall strategic direction, including our risk management capability and effectiveness. The Board of Directors has oversight of key policies as well as the risk management framework developed and administered by the management team. We also have a process that is designed to escalate meaningful departures from our risk appetite statements to the Board. The Board of Directors oversees the continued development of the risk management framework.

The Governance Framework

Our overall objective is to ensure all significant risks inherent in our business can be identified and appropriately mitigated. To this end, we have adopted the “three lines of defense” approach to governance. Specifically, the business units form the “first line of defense” and are the “owners” of risks in their business activities. As the risk owner, the first line of defense is accountable for the day-to-day execution of risk and control policies and procedures (including activities performed by third-party contractors). The “second line of defense” is our Risk Management function, which is independent from the first line of defense. The second line of defense conducts oversight and effective challenge of the risk-taking activities within the first line of defense. Finally, the Internal Audit function comprises the “third line of defense.” The Internal Audit function provides opinions to the Board of Directors on the effectiveness of the first and second lines of defense, as reflected in audit reports.

Risk Management Policy and Risk Appetite Standard

The Risk Management Policy and Risk Appetite Standard are designed to establish a stable risk and control environment across the enterprise. The policy, which is approved by the Board of Directors, outlines the framework used to ensure that risk and control issues across the enterprise are identified, assessed, measured, monitored, and reported. The Risk Management Policy, the Risk Appetite Standard, and the related policies and procedures constitute the core of the risk management program.

Sallie Mae leverages risk appetite to outline the level of risk we are willing to accept within each risk category, as described below, in pursuit of our business objectives. Compliance with our risk appetite is monitored using a set of risk metrics, with defined thresholds and limits, for each risk category. The management-level Enterprise Risk Committee provides oversight of the risk appetite standard with escalation to the Board of Directors, as appropriate.

Board of Directors Committee Structure

We have a Board of Directors committee structure as outlined below that facilitates oversight, effective challenge, and escalation of risk and control issues.

•Financial Risk Committee. The Financial Risk Committee assists the Board of Directors in fulfilling its risk management oversight responsibilities with regard to the Company’s major financial risks, including credit risk, market risk, and liquidity risk. The Financial Risk Committee, along with the Operational and Compliance Risk Committee, provides oversight of the development, maintenance, and monitoring of the Company’s risk management framework, risk governance structure, and risk appetite statements, metrics, and associated limits and thresholds, and the promotion of our risk management culture. The Financial Risk Committee receives periodic updates on compliance with the framework from the Chief Risk Officer.

•Operational and Compliance Risk Committee. The Operational and Compliance Risk Committee assists the Board of Directors in fulfilling its oversight responsibilities relating to the major non-financial risks, including compliance risks, operational risks, information and cyber security risk, and model risk. The Operational and Compliance Risk Committee, along with the Financial Risk Committee, provides oversight of the development, maintenance, and monitoring of our risk management framework, risk governance structure, and risk appetite statements, metrics, and associated limits and thresholds, and the promotion of our risk management culture. The

2025 Form 10-K — SLM CORPORATION 83

Operational and Compliance Risk Committee receives periodic updates on compliance with the framework from the Chief Risk Officer.

•Audit Committee. The Audit Committee is responsible for oversight of the quality and integrity of our financial statements, accounting and reporting processes, the performance of the Internal Audit function, and the qualifications, hiring, performance, and independence of our independent registered public accounting firm.

•Nominations and Governance Committee. The Nominations and Governance Committee recommends to the Board of Directors appropriate standards of corporate governance, and assists the Board of Directors in fulfilling its obligations with regard to oversight of the operations of the Board of Directors, the qualifications and independence of directors, nominations to the Board of Directors, and compliance with the corporate governance standards.

•Compensation Committee. The Compensation Committee assists the Board of Directors in fulfilling its oversight responsibilities related to the compensation and benefits of our Chief Executive Officer (“CEO”) and the non-employee members of the Board of Directors, our incentive compensation and benefits practices for employees of all levels, and management’s succession planning. Additionally, the Compensation Committee provides oversight of human capital management.

Management-Level Committee Structure

Executive Committee. The EC is authorized by the Board of Directors to assist the CEO in the general supervision of the business of the Company. Specifically, the EC will (i) provide to the CEO advice and counsel, subject matter expertise, and recommendations as requested, and (ii) through its subcommittees, facilitate the evaluation and decision-making on routine cross-functional matters, and assist management in the fulfillment of management’s duties related to specific risks. The EC has established the following sub-committees to assist in fulfilling its duties.

•Enterprise Risk Committee (“ERC”). The ERC provides independent oversight and monitoring of the risk and control environment. The ERC is jointly accountable to the Financial Risk Committee and the Operational and Compliance Risk Committee of the Board of Directors and provides for escalation accordingly.

•Credit Committee. The Credit Committee is responsible for credit and counterparty risk, product pricing, and credit and collections operations.

•Operational and Compliance Risk Committee. The OCRC is the oversight body for the identification, assessment, remediation, measurement, and reporting of operational and compliance risks.

•Asset and Liability Committee (“ALCO”). ALCO is responsible for the strategy, processes, and authorities with which the Bank’s interest rate risk, liquidity, and capital adequacy are managed.

Each of these sub-committees is comprised of subject matter experts from the senior management team and is accountable to the EC. Moreover, these sub-committees may be supported by steering or working groups, as appropriate.

Disclosure Committee. Our Disclosure Committee assists our CEO and Chief Financial Officer in their review of periodic SEC reporting documents, earnings releases, investor materials, and related disclosure policies and procedures.

Internal Audit

Internal Audit provides independent assurance to the Audit Committee of the Board of Directors as to the adequacy and effectiveness of our risk management, control, and governance processes. Internal Audit also assists management by providing objective assurance, credible challenge, and consulting services around matters involving risk management. Internal Audit regularly performs selected reviews of our risk management and compliance functions to assess the effectiveness of the overall risk management framework, identifies areas that may require increased focus and resources, and reports significant control issues and recommendations to executive management and the Audit Committee of the Board of Directors. Annually, Internal Audit performs an independent risk assessment to evaluate the risk of all significant components of the Company and uses the results to develop an annual, risk-based Internal Audit plan to provide the assurance services noted above.

Risk Categories

Risk categories are a foundational element of the risk management framework; they are widely used in risk

identification and provide the basis for risk aggregation and reporting. The Company has identified six major risk categories:

84 SLM CORPORATION— 2025 Form 10-K

Strategic Risk. Strategic risk is the risk of: adverse impacts to enterprise value, current or anticipated earnings, capital, or franchise value arising from the Company’s competitive and market position and evolving forces in the industry that can affect that position; lack of responsiveness to these conditions; strategic decisions to change the Company’s scale, market position, or operating model; or failure to appropriately consider implementation risks inherent in the Company’s strategy.

The overall development of the Company’s strategic plan includes extensive engagement with the Board of Directors. Similarly, the Board of Directors provides oversight and effective challenge on performance relative to the strategic plan.

Credit Risk. Credit risk is the risk of adverse impacts to earnings, capital, or reputation resulting from obligors’ failure, or the increased probability thereof, to meet the terms of a lending, issuer, or counterparty agreement. Credit risk is found in all activities where success depends on counterparty, issuer, or borrower performance.

The credit risk related to Private Education Loans is managed within a credit risk infrastructure that includes: (i) a well-defined underwriting, asset quality, and collection policy framework; (ii) an ongoing monitoring and review process of portfolio composition and trends; (iii) assignment and management of credit authorities and responsibilities; and (iv) establishment of an allowance for credit losses that covers estimated future losses based upon an analysis of portfolio metrics and economic factors.

Credit risk related to derivative contracts is managed by reviewing counterparties for credit strength on an ongoing basis and through our credit policies, which place limits on the amount of exposure we may take with any one counterparty and require collateral to secure the position. The credit and counterparty risk associated with derivatives is measured based on the replacement cost should the counterparty with contracts in a gain position to us fail to perform under the terms of the contract.

Credit risk exposure is managed primarily through the Credit Committee, and regular reporting on credit programs and credit metrics is provided to the Financial Risk Committee of the Board of Directors.

Market Risk. Market risk is the risk of adverse impacts to earnings, capital, or reputation resulting from fluctuations in market conditions such as changes in interest rates, foreign exchange rates, commodity prices, equity prices, and other financial market factors. We are exposed to various types of market risk, in particular the risk of loss resulting from interest rate risk, basis risk, and other risks that arise through the management of our investment, debt, and loan portfolios. Market risk exposures are managed primarily through ALCO. These activities are closely tied to those related to the management of our funding and liquidity risks. The Financial Risk Committee of our Board of Directors periodically reviews and approves the investment and asset and liability management policies and contingency funding plan developed and administered by ALCO. The Chief Financial Officer provides reports to the Financial Risk Committee of the Board of Directors on market risk management.

Liquidity Risk. Liquidity risk is the risk of adverse impacts to earnings, capital, reputation, or survival resulting from not being able to meet the Company’s financial obligations when they become due, whether due to a lack of available funding or the inability to liquidate assets in a timely and cost-effective manner.

Our primary liquidity needs include our ongoing ability to: meet our funding needs through market cycles, including periods of financial stress; manage the relative maturities of assets and liabilities on our balance sheet; fund disbursements of Private Education Loans and other loans; and service our indebtedness and bank deposits. Ultimately, our liquidity risk relates to our ability to access the capital markets at reasonable rates and to maintain deposits and other funding sources through the Bank, as well as our maintenance of a reserve of cash and unencumbered highly liquid investment securities that may be readily converted to cash if needed.

Our liquidity risk activities are centralized within our Corporate Finance department, which is responsible for developing and executing our funding strategy. We analyze and monitor our liquidity risk, maintain excess liquidity, and access diverse funding sources depending on current market conditions. Liquidity risks are overseen and recommendations approved primarily through ALCO. The Financial Risk Committee of our Board of Directors is responsible for periodically reviewing the liquidity positions and contingency funding plan developed and administered by ALCO.

Operational Risk. Operational risk is the risk of adverse impacts to earnings, capital, or reputation resulting from inadequate or failed internal processes, people, and systems, or from external events. Operational risk is pervasive in that it exists in all business lines, functional units, legal entities, and geographic locations.

2025 Form 10-K — SLM CORPORATION 85

Operational risk exposures are managed through a combination of first line of defense and control activities and second line of defense oversight. The OCRC is the management committee responsible for operational risk, and it supports the EC in its oversight duties. The OCRC is responsible for escalation to the EC, as appropriate. Additionally, our key risk indicators include operational risk metrics, thresholds, and limits and are included in the periodic reporting to the Operational and Compliance Risk Committee of the Board of Directors.

Cybersecurity risk is one of our significant operational risks. We provide more detailed information on our cybersecurity risk management, strategy, and governance in Part I, Item 1C. of this Form 10-K.

Compliance Risk. Compliance risk is the risk of legal or regulatory sanctions, fines, penalties, financial losses, or loss to brand resulting from violations of, or non-conformance with, applicable laws, rules, regulations, and self-regulatory organizations’ standards, as well as the Code of Business Conduct.

Primary ownership and responsibility for compliance risk is placed with the first line of defense to identify and manage. Our Compliance function supports these activities by providing extensive training, monitoring, and testing of the processes, policies, and procedures utilized by the first line of defense, maintaining relevant legal and regulatory requirements, and working in close coordination with our Legal department. Compliance risk metrics and regular reporting on compliance programs are provided to the Operational and Compliance Risk Committee of the Board of Directors.

86 SLM CORPORATION— 2025 Form 10-K