SLM Corp

Our Approach

Risk is inherent in our business activities and the specialized lending industry we serve. The ability of management to identify, manage, and remediate risk in a timely manner is critical to our continued success. Our risk management framework is designed to assess, manage, and report these risks and escalate as appropriate to the Board of Directors or its designee.

Risk Oversight

Our Board of Directors oversees our overall strategic direction, including our risk management capability and effectiveness. The Board of Directors has oversight of key policies as well as the risk management framework developed and administered by the management team. We have a robust process to escalate meaningful departures from our risk appetite statements to the Board. The Board of Directors oversees the continued development of the risk management framework.

The Governance Framework

Our overall objective is to ensure all significant risks inherent in our business can be identified and appropriately mitigated. To this end, we have adopted the “three lines of defense” approach to governance. Specifically, the business units form the “first line of defense” and are the “owners” of risks in their business activities. As the risk owner, the first line of defense is accountable for the day-to-day execution of risk and control policies and procedures (including activities performed by third-party contractors). The “second line of defense” is our Risk Management function, which is independent from the first line of defense. The second line of defense conducts oversight and effective challenge of the risk-taking activities within the first line of defense. Finally, the Internal Audit function comprises the “third line of defense.” The Internal Audit function provides opinions to the Board of Directors on the effectiveness of the first and second lines of defense, as reflected in audit reports.

Risk Management Policy and Risk Appetite Standard

The Risk Management Policy and Risk Appetite Standard are designed to establish a stable risk and control environment across the enterprise. The policy, which is approved by the Board of Directors, outlines the framework used to ensure that risk and control issues across the enterprise are identified, assessed, measured, monitored, and reported. The Risk Management Policy, the Risk Appetite Standard, and the related policies and procedures constitute the core of the risk management program.

Sallie Mae leverages risk appetite to outline the level of risk we are willing to accept within each risk category, as described below, in pursuit of our business objectives. Compliance with our risk appetite is monitored using a set of risk metrics, with defined thresholds and limits, for each risk category. The Enterprise Risk Committee provides oversight of the risk appetite standard with escalation to the Board of Directors, as appropriate.

Board of Directors Committee Structure

We have a robust Board of Directors committee structure as outlined below that facilitates oversight, effective challenge, and escalation of risk and control issues.

•Financial Risk Committee. The Financial Risk Committee assists the Board of Directors in fulfilling its risk management oversight responsibilities with regard to the Company’s major financial risks, including credit risk, market risk, and liquidity risk. The Financial Risk Committee, along with the Operational and Compliance Risk Committee, provides oversight of the development, maintenance, and monitoring of the Company’s risk management framework, risk governance structure, and risk appetite statements, metrics, and associated limits and thresholds, and the promotion of our risk management culture. The Financial Risk Committee receives periodic updates on compliance with the framework from the Chief Risk Officer.

•Operational and Compliance Risk Committee. The Operational and Compliance Risk Committee assists the Board of Directors in fulfilling its oversight responsibilities relating to the major non-financial risks, including compliance risks, operational risks, information and cyber security risk, and model risk. The Operational and Compliance Risk Committee, along with the Financial Risk Committee, provides oversight of the development, maintenance, and monitoring of our risk management framework, risk governance structure, and risk appetite statements, metrics, and associated limits and thresholds, and the promotion of our risk management culture. The

2023 Form 10-K — SLM CORPORATION 87

Operational and Compliance Risk Committee receives periodic updates on compliance with the framework from the Chief Risk Officer.

•Audit Committee. The Audit Committee is responsible for oversight of the quality and integrity of our financial statements, accounting and reporting processes, the performance of the Internal Audit function, and the qualifications, hiring, performance, and independence of our independent registered public accounting firm.

•Nominations and Governance Committee. The Nominations and Governance Committee recommends to the Board of Directors appropriate standards of corporate governance, and assists the Board of Directors in fulfilling its obligations with regard to oversight of the operations of the Board of Directors, the qualifications and independence of directors, nominations to the Board of Directors, and compliance with the corporate governance standards. The Nominations and Governance Committee also provides oversight of the ESG matters of the Company.

•Compensation Committee. The Compensation Committee assists the Board of Directors in fulfilling its oversight responsibilities related to the compensation and benefits of our Chief Executive Officer (“CEO”) and the non-employee members of the Board of Directors, our incentive compensation and benefits practices for employees of all levels, and management’s succession planning. Additionally, the Compensation Committee provides oversight of human capital management, including in the areas of diversity, equity, and inclusion.

•Preferred Stock Committee. The Preferred Stock Committee monitors and evaluates proposed actions that may impact the rights of holders of our preferred stock.

Management-Level Committee Structure

Executive Committee. The EC is authorized by the Board of Directors to assist the CEO in the general supervision of the business of the Company. Specifically, the EC will (i) provide to the CEO advice and counsel, subject matter expertise, and recommendations as requested, and (ii) through its subcommittees, facilitate the evaluation and decision-making on routine cross-functional matters, and assist management in the fulfillment of management’s duties related to specific risks. The EC has established the following sub-committees to assist in fulfilling its duties.

•Enterprise Risk Committee (“ERC”). The ERC provides independent oversight and monitoring of the risk and control environment. The ERC is jointly accountable to the Financial Risk Committee and the Operational and Compliance Risk Committee of the Board of Directors and provides for escalation accordingly.

•Credit Committee. The Credit Committee is responsible for credit and counterparty risk, product pricing, and credit and collections operations.

•Operational and Compliance Risk Committee. The OCRC is the oversight body for the identification, assessment, remediation, measurement, and reporting of operational and compliance risks.

•Asset and Liability Committee (“ALCO”). ALCO is responsible for the strategy, processes, and authorities with which the Bank’s interest rate risk, liquidity, and capital adequacy are managed.

•Policy Management Committee (“PMC”) The PMC is responsible for the effective and efficient administration of the Company’s policies, standards, and procedures.

Each of these sub-committees is comprised of subject matter experts from the senior management team and is accountable to the EC. Moreover, these sub-committees may be supported by steering or working groups, as appropriate.

Disclosure Committee. Our Disclosure Committee assists our CEO and Chief Financial Officer in their review of periodic SEC reporting documents, earnings releases, investor materials, and related disclosure policies and procedures.

Internal Audit

Internal Audit provides independent assurance to the Audit Committee of the Board of Directors as to the adequacy and effectiveness of our risk management, control, and governance processes. Internal Audit also assists management by providing objective assurance, credible challenge, and consulting services around matters involving risk management. Internal Audit regularly performs selected reviews of our risk management and compliance functions to assess the effectiveness of the overall risk management framework, identifies areas that may require increased focus and resources, and reports significant control issues and recommendations to executive management and the Audit Committee of the Board of Directors. Annually, Internal Audit performs an independent risk assessment to evaluate the risk of all significant components of the Company and uses the results to develop an annual, risk-based Internal Audit plan to provide the assurance services noted above.

88 SLM CORPORATION—2023 Form 10-K

Risk Categories

Risk categories are a foundational element of the risk management framework; they are widely used in risk

identification and provide the basis for risk aggregation and reporting. The Company has identified six major risk categories:

Strategic Risk. Strategic risk is the risk of: adverse impacts to enterprise value, current or anticipated earnings, capital, or franchise value arising from the Company’s competitive and market position and evolving forces in the industry that can affect that position; lack of responsiveness to these conditions; strategic decisions to change the Company’s scale, market position, or operating model; or failure to appropriately consider implementation risks inherent in the Company’s strategy.

The overall development of the Company’s strategic plan includes extensive engagement with the Board of Directors. Similarly, the Board of Directors provides oversight and effective challenge on performance relative to the strategic plan.

Credit Risk. Credit risk is the risk of adverse impacts to earnings, capital, or reputation resulting from obligors’ failure, or the increased probability thereof, to meet the terms of a lending, issuer, or counterparty agreement. Credit risk is found in all activities where success depends on counterparty, issuer, or borrower performance.

The credit risk related to Private Education Loans is managed within a credit risk infrastructure that includes: (i) a well-defined underwriting, asset quality, and collection policy framework; (ii) an ongoing monitoring and review process of portfolio composition and trends; (iii) assignment and management of credit authorities and responsibilities; and (iv) establishment of an allowance for credit losses that covers estimated future losses based upon an analysis of portfolio metrics and economic factors.

Credit risk related to derivative contracts is managed by reviewing counterparties for credit strength on an ongoing basis and through our credit policies, which place limits on the amount of exposure we may take with any one counterparty and require collateral to secure the position. The credit and counterparty risk associated with derivatives is measured based on the replacement cost should the counterparty with contracts in a gain position to us fail to perform under the terms of the contract.

Credit risk exposure is managed primarily through the Credit Committee, and regular reporting on credit programs and credit metrics is provided to the Financial Risk Committee of the Board of Directors.

Market Risk. Market risk is the risk of adverse impacts to earnings, capital, or reputation resulting from fluctuations in market conditions such as changes in interest rates, foreign exchange rates, commodity prices, equity prices, and other financial market factors. We are exposed to various types of market risk, in particular the risk of loss resulting from interest rate risk, basis risk, and other risks that arise through the management of our investment, debt, and loan portfolios. Market risk exposures are managed primarily through ALCO. These activities are closely tied to those related to the management of our funding and liquidity risks. The Financial Risk Committee of our Board of Directors periodically reviews and approves the investment and asset and liability management policies and contingency funding plan developed and administered by ALCO. The Chief Financial Officer provides reports to the Financial Risk Committee of the Board of Directors on market risk management.

Liquidity Risk. Liquidity risk is the risk of adverse impacts to earnings, capital, reputation, or survival resulting from not being able to meet the Company’s financial obligations when they become due, whether due to a lack of available funding or the inability to liquidate assets in a timely and cost-effective manner.

Our primary liquidity needs include our ongoing ability to: meet our funding needs through market cycles, including periods of financial stress; manage the relative maturities of assets and liabilities on our balance sheet; fund disbursements of Private Education Loans and other loans; and service our indebtedness and bank deposits. Ultimately, our liquidity risk relates to our ability to access the capital markets at reasonable rates and to maintain deposits and other funding sources through the Bank, as well as our maintenance of a reserve of cash and unencumbered highly liquid investment securities that may be readily converted to cash if needed.

2023 Form 10-K — SLM CORPORATION 89

Our liquidity risk activities are centralized within our Corporate Finance department, which is responsible for developing and executing our funding strategy. We analyze and monitor our liquidity risk, maintain excess liquidity, and access diverse funding sources depending on current market conditions. Liquidity risks are overseen and recommendations approved primarily through ALCO. The Financial Risk Committee of our Board of Directors is responsible for periodically reviewing the liquidity positions and contingency funding plan developed and administered by ALCO.

Operational Risk. Operational risk is the risk of adverse impacts to earnings, capital, or reputation resulting from inadequate or failed internal processes, people, and systems, or from external events. Operational risk is pervasive in that it exists in all business lines, functional units, legal entities, and geographic locations.

Operational risk exposures are managed through a combination of first line of defense and control activities and second line of defense oversight. The OCRC is the management committee responsible for operational risk, and it supports the EC in its oversight duties. The OCRC is responsible for escalation to the EC, as appropriate. Additionally, our key risk indicators include operational risk metrics, thresholds, and limits and are included in the periodic reporting to the Operational and Compliance Risk Committee of the Board of Directors.

Cybersecurity risk is one of our significant operational risks. We provide more detailed information on our cybersecurity risk management, strategy, and governance in Part I, Item 1C. of this Form 10-K.

Compliance Risk. Compliance risk is the risk of adverse impacts to earnings, capital, or reputation resulting from violations of, or non-conformance with, the Code of Business Conduct and with laws, rules, regulations, and self regulatory organizations’ standards.

Primary ownership and responsibility for compliance risk is placed with the first line of defense to identify and manage. Our Compliance function supports these activities by providing extensive training, monitoring, and testing of the processes, policies, and procedures utilized by the first line of defense, maintaining relevant legal and regulatory requirements, and working in close coordination with our Legal department. Compliance risk metrics and regular reporting on compliance programs are provided to the Operational and Compliance Risk Committee of the Board of Directors.

90 SLM CORPORATION—2023 Form 10-K