EAST WEST BANCORP INC

In the normal course of business, the Company is exposed to a variety of risks, some of which are inherent to the financial services industry and others which are more specific to the Company’s business. The Company operates under a Board-approved ERM program. The Company’s ERM program outlines the company-wide approach to risk management and oversight, and describes the structures and practices employed to manage current and emerging risks inherent to the Company. The Company’s ERM program incorporates risk management throughout the organization in identifying, managing, monitoring, and reporting risks. It identifies the Company’s major risk categories as: credit, liquidity, market, operational, reputational, legal, compliance, BSA/AML & OFAC, strategic, and technology risk.

The ROC of the Board of Directors monitors the ERM program through such identified enterprise risk categories and provides oversight of the Company’s risk appetite and control environment. The ROC provides focused oversight of the Company’s identified enterprise risk categories on behalf of the full Board of Directors. Under the authority of the ROC, management committees apply targeted strategies to manage the risks to which the Company’s operations are exposed.

The Company’s ERM program is executed along the three lines of defense model, which provides for a consistent and standardized risk management control environment across the enterprise. The first line of defense is comprised of revenue generating, operational and support units. The second line of defense is comprised of risk management and control functions that provide independent risk oversight of first line activities and report to the Chief Risk Officer. The Chief Risk Officer reports to both the ROC and the Chief Executive Officer. The third line of defense is comprised of the Internal Audit and Independent Asset Review (“IAR”) functions. Internal Audit reports to the Chief Audit Executive (“CAE”) who reports to the Board’s Audit Committee. Internal Audit provides assurance and evaluates the effectiveness of risk management, control, and governance processes as established by the Company. IAR serves as an internal loan review and independent credit risk monitoring function within the Bank that works under the direction of the CAE and reports to the Audit Committee. IAR provides management and the Audit Committee with an objective and independent assessment of the Bank’s credit profile and credit risk management processes. Further discussion and analysis of selected primary risk areas are discussed in the following subsections of Risk Management.