EAST WEST BANCORP INC

In the normal course of business, the Company is exposed to a variety of risks, some of which are inherent to the financial services industry and others of which are more specific to the Company’s business. The Company operates under a Board-approved ERM framework, which outlines the company-wide approach to risk management and oversight, and describes the structures and practices employed to manage the current and emerging risks inherent to the Company. The Company’s ERM program incorporates risk management throughout the organization in identifying, managing, monitoring and reporting risks. It identifies the Company’s major risk categories as: credit, liquidity, capital, market, operational, compliance, legal, strategic, technology and reputational.

The Risk Oversight Committee of the Board of Directors monitors the ERM program through such identified risk categories and provides oversight of the Company’s risk appetite and control environment. The Risk Oversight Committee provides focused oversight of the Company’s identified enterprise risk categories on behalf of the full Board of Directors. Under the direction of the Risk Oversight Committee, management committees apply targeted strategies to manage the risks to which the Company’s operations are exposed.

The Company’s ERM program is executed along the three lines of defense model, which provides for a consistent and standardized risk management control environment across the enterprise. The first line of defense is comprised of production, operational, and support units. The second line of defense is comprised of various risk management and control functions charged with monitoring and managing specific major risk categories and/or risk subcategories. The third line of defense is comprised of the Internal Audit and Independent Asset Review (“IAR”) functions. Internal Audit reports to the Chief Audit Executive (“CAE”) who reports to the Board’s Audit Committee. Internal Audit provides assurance and evaluates the effectiveness of risk management, control, and governance processes as established by the Company. IAR serves as an internal loan review and independent credit risk monitoring function within the Bank that works under the direction of the CAE and reports to the Board’s Risk Oversight Committee (“ROC”). IAR provides management and the ROC with an objective and independent assessment of the Bank’s credit profile and credit risk management process. Further discussion and analysis of selected primary risk areas are discussed in the following subsections of Risk Management.