ANNALY CAPITAL MANAGEMENT INC

Risk management begins with our Board, through the review and oversight of the risk management framework, and executive management, through the ongoing formulation of risk management practices and related execution in managing risk. The Board exercises its oversight of risk management primarily through the Risk Committee and Audit Committee with support from the other Board Committees. The Risk Committee is responsible for oversight of our risk governance structure, risk management (operational and market risk) and risk assessment guidelines and policies and our risk appetite. The Audit Committee is responsible for oversight of the quality and integrity of our accounting, internal controls and financial reporting practices, including independent auditor selection, evaluation and review, and oversight of the internal audit function. The Risk Committee and the Audit Committee jointly oversee practices and policies related to cybersecurity and receive regular reports from management throughout the year on cybersecurity and related risks. The Management Development and Compensation Committee is responsible for oversight of risk related to our compensation policies and practices and other human capital matters such as succession and culture. The Nominating/Corporate Governance Committee assists the Board in its oversight of our corporate governance framework and the annual self-evaluation of the Board, and the Corporate Responsibility Committee assists the Board in its oversight of any matters that may present reputational or environmental sustainability risk to us. The full Board has overall responsibility for this oversight, and the Corporate Responsibility Committee meets jointly with other Committees from time to time in order to review areas of shared responsibility.

Risk assessment and risk management are the responsibility of our management. A series of management committees has oversight or decision-making responsibilities for risk management activities. Membership of these committees is reviewed regularly to ensure the appropriate personnel are engaged in the risk management process. Three primary management committees have been established to provide a comprehensive framework for risk management. The management committees responsible for our risk management include the Enterprise Risk Committee (“ERC”), Asset / Liability Committee (“ALCO”) and the Financial Reporting and Disclosure Committee (“FRDC”). Each of these committees reports to our management Operating Committee, which is responsible for oversight and management of our operations, including oversight and approval authority over all aspects of our enterprise risk management.

Audit Services is an independent function with reporting lines to the Audit Committee. Audit Services is responsible for performing our internal audit activities, which includes independently assessing and validating key controls within the risk management framework.

Our compliance group is responsible for oversight of our regulatory compliance. Our Chief Compliance Officer has reporting lines to the Audit Committee.