EAST WEST BANCORP INC

Overview

In the normal course of business, the Company is exposed to a variety of risks, some of which are inherent to the financial services industry and others of which are more specific to the Company’s business. The Company operates under a Board-approved enterprise risk management (“ERM”) framework, which outlines the company-wide approach to risk management and oversight, and describes the structures and practices employed to manage the current and emerging risks inherent to the Company. The Company’s ERM program incorporates risk management throughout the organization in identifying, managing, monitoring, and reporting risks. It identifies the Company’s major risk categories as: credit, liquidity, capital, market, operational, compliance, legal, strategic, technology and reputational.

The Risk Oversight Committee (“ROC”) of the Board of Directors monitors the ERM program through such identified risk categories and provides oversight of the Company’s risk appetite and control environment. The ROC provides focused oversight of the Company’s identified enterprise risk categories on behalf of the full Board of Directors. Under the authority of the ROC, management committees apply targeted strategies to manage the risks to which the Company’s operations are exposed.

The Company’s ERM program is executed along the three lines of defense model, which provides for a consistent and standardized risk management control environment across the enterprise. The first line of defense is comprised of production, operational and support units. The second line of defense is comprised of various risk management and control functions charged with monitoring and managing major risk categories and/or risk subcategories. The third line of defense is comprised of the Internal Audit and Independent Asset Review (“IAR”) functions. Internal Audit reports to the Chief Audit Executive (“CAE”) who reports to the Board’s Audit Committee. Internal Audit provides assurance and evaluates the effectiveness of risk management, control, and governance processes as established by the Company. IAR serves as an internal loan review and independent credit risk monitoring function within the Bank that works under the direction of the CAE and reports to the Audit Committee. IAR provides management and the Audit Committee with an objective and independent assessment of the Bank’s credit profile and credit risk management processes. Further discussion and analysis of selected primary risk areas are discussed in the following subsections of Risk Management.