EAST WEST BANCORP INC

Overview

The Company is exposed to a variety of risks in the normal course of business, including credit, liquidity, market, operational, reputational, legal, compliance, Bank Secrecy Act/Anti-Money Laundering & Office of Foreign Assets Control, strategic, and technology risk. The Company maintains a Board-approved enterprise risk management (“ERM”) framework designed to identify, assess, monitor, manage and report risks across the organization. The ERM framework supports risk-informed decision-making and provides a structured approach for managing both existing and emerging risks.

The Board of Directors, through its Risk Oversight Committee (“ROC”), oversees the Company’s risk profile, risk appetite and risk management framework. Under the authority of the ROC, management committees are responsible for implementing risk management strategies and monitoring risks within their respective areas of responsibility.

The Company’s ERM program is aligned with the three lines of defense model. The first line of defense is comprised of revenue generating, operational and support units, including the Senior Credit Supervision function, which oversees credit risk policies, risk ratings and credit portfolio monitoring. The second line of defense is comprised of risk management and control functions that provide independent risk oversight of first line activities and report to the Chief Risk Officer. The Chief Risk Officer reports to both the ROC and the Chief Executive Officer. The third line of defense is comprised of the Internal Audit and Independent Asset Review (“IAR”) functions. Internal Audit reports to the Chief Audit Executive (“CAE”), who reports to the Board’s Audit Committee. Internal Audit provides assurance and evaluates the effectiveness of risk management, control, and governance processes as established by the Company. IAR serves as an internal loan review and independent credit risk monitoring function within the Bank that works under the direction of the CAE and reports to the Audit Committee. IAR provides management and the Audit Committee with an objective and independent assessment of the Bank’s credit profile and credit risk management processes. The following sections discuss the Company’s primary risk categories and related risk management practices.