LPL Financial Holdings Inc

Risk is an inherent part of our businesses and activities. To effectively manage these risks, we have an ERM framework designed to facilitate the incorporation of risk assessment into decision-making processes across the Company, enable execution our business strategy, and protect our Company and its franchise. This framework aims to ensure policies and procedures are in place and appropriately designed to identify and manage risk at appropriate levels throughout our organization and within various departments.

Our framework is designed to promote clear lines of risk management ownership and accountability while providing a structured escalation process for key risk information and events. Additionally, risk is managed and monitored within business units by embedded risk groups providing guidance on governance, controls, policies and other risk management activities.

We operate a three lines of defense model to manage risk throughout the organization. Primary ownership for risk and control processes is with the business units and control owners, who are the first line of defense in effectively managing risks, and who are responsible for day-to-day compliance and risk management, including execution of operating and supervisory procedures. These business units and certain control owners implement and execute controls to manage risk, execute risk assessments, identify emerging risks and comply with risk management policies. Within these business units a risk management function monitors, provides guidance and works with the business units and control owners to deploy risk management ownership within the first line of defense. The second line of defense consists of certain functions within our Finance and Business Operations department, which provides risk oversight and compliance, and Legal department, which provides related legal counsel. The third line of defense is independent verification of the effectiveness of risk management practices and internal controls and is conducted by the Internal Audit department.

Our risk management governance approach includes the Board and certain of its committees; our ROC and its subcommittees; and our three lines of defense model. We regularly reevaluate and, when necessary, modify our processes to improve the identification and escalation of risks and events.

In addition to the ERM framework, we also have written policies and procedures that govern the conduct of business by our advisors, employees and the terms and conditions of our relationships with product manufacturers. Our client and advisor policies address the extension of credit for client accounts, data, cyber and physical security, compliance with industry regulations and codes of conduct and ethics to govern employee and advisor conduct, among other emerging risk types.

Risk Governance Structure

Audit and Risk Committee of the Board

The ARC oversees and monitors, among other things, the Company’s enterprise risk management (except for risks assigned to other committees of the Board or retained by the Board), and is responsible for reviewing and assessing the Company’s processes to manage and control risk. In this capacity, the ARC reviews reports from risk-focused management committees; reviews emerging risks and regulatory matters; and reviews Internal Audit reports on the assessment of the Company’s control environment. The ARC reports to the Board on a regular basis and coordinates with the Board and other Board committees with respect to the oversight of risk management and risk assessment guidelines.

Compensation and Human Resources Committee of the Board

In addition to its other responsibilities, the Compensation and Human Resources Committee of the Board assesses whether our compensation arrangements encourage inappropriate risk-taking, and whether risks arising from our compensation arrangements are reasonably likely to have a material adverse effect on the Company.

Risk Oversight Committee of LPL Financial

The ROC, a management committee chaired by the chief risk officer, oversees our risk management activities, including those of our subsidiaries. The chief risk officer of LPL Financial serves as chair of the ROC, which generally meets once every two months, with additional ad hoc meetings as necessary. The members of the ROC include certain Managing Directors of LPL Financial, as well as other members of LPL Financial’s senior management team who serve as ex-officio members and represent key control areas of the Company. Participation in the ROC by senior officers is intended to ensure that the ROC covers the key risk areas of the Company, including its subsidiaries, and that the ROC thoroughly reviews significant matters relating to risk priorities, policies, control procedures and related exceptions, certain new and complex products and business arrangements, transactions with significant risk elements and identified emerging risks.

The chief risk officer provides updates on pertinent ROC discussions to the Audit and Risk Committee on a regular basis and, if necessary or requested, to the Board.

Subcommittees of the Risk Oversight Committee

The ROC has established multiple subcommittees to support effective supervision of our risk exposures and processes. The subcommittees meet regularly and are responsible for keeping the ROC informed and escalating issues in accordance with the Company’s escalation protocols. The responsibilities of such subcommittees include, for example, oversight of operational risk; oversight of the approval of new and complex investment products offered to advisors’ clients; oversight of the firm’s technology; and issues and trends related to advisor compliance.

Internal Audit Department

As the third line of defense, the Internal Audit department provides independent and objective assurance of the effectiveness of the Company’s governance, risk management and internal controls by conducting risk assessments and audits designed to identify and cover important risk categories. Internal Audit reports directly to the ARC, which provides oversight of Internal Audit’s activities and approves its annual plan. The Internal Audit department reports to the ARC at least quarterly.

Operational Risk

Operational Risk is reviewed, monitored and challenged by the Operational Risk Oversight Committee (the “OROC”), which is a subcommittee of the ROC. Operational risk is defined as the risk of loss resulting from failed or inadequate processes or systems, actions by people or external events. We are exposed to a variety of operational risks and actively monitor and manage them across the following risk categories:

•Information Security & Cybersecurity Risk – the potential disclosure, misuse or loss of our data (including client data) that may adversely impact the availability, integrity and/or confidentiality of our data or information through unintentional or malicious acts, either internal or external.

•Information Technology Risk – the potential for a technology failure, obsolescence or improper operation of our technology systems.

•Third Party Risk – the risk of exposure caused by our reliance on third-party service providers to execute critical processes.

•General Operational Risk – all other types of operational risks not detailed above, including external or internal fraud, execution, process or internal control failures, business disruptions unrelated to technology, or human capital risk, such as key person dependencies.

Regulatory and Legal Risk

The regulatory environment in which we operate is discussed in detail within Part I,“Item 1. Business” of this Annual Report on Form 10-K. In recent years, and during the period presented in this Annual Report on Form 10-K, we have observed the SEC, FINRA, DOL and state regulators broaden the scope, frequency and depth of their examinations and inquiries to include greater emphasis on the quality, consistency and oversight of our compliance systems and programs. Please consult the“Risks Related to Our Regulatory Environment” and the“Risks Related to Our Business and Industry” sections within Part I,“Item 1A. Risk Factors” for more information about the risks associated with operating within our regulatory environment, pending regulatory matters and the potential related effects on our operations.