JPMORGAN CHASE & CO

Risk is an inherent part of JPMorganChase’s business activities. When the Firm extends a consumer or wholesale loan, advises customers and clients on their investment decisions, makes markets in securities, or offers other products or services, the Firm takes on some degree of risk. The Firm’s overall objective is to manage its business, and the associated risks, in a manner that balances serving the interests of its clients, customers and investors, and protecting the safety and soundness of the Firm.

The Firm believes that effective risk management requires, among other things:

•Acceptance of responsibility, including identification and escalation of risks by all individuals within the Firm;

•Ownership of risk identification, assessment, data and management within each of the LOBs and Corporate; and

•A Firmwide risk governance and oversight structure.

The Firm follows a disciplined and balanced compensation framework with strong internal governance and independent oversight by the Board of Directors (the “Board”). The impact of risk and control issues is carefully considered in the Firm’s performance evaluation and incentive compensation processes.

Risk governance framework

The Firm’s risk governance framework involves understanding drivers of risks, types of risks and impacts of risks.

Drivers of risks are factors that cause a risk to exist. Drivers of risks include the economic environment, regulatory or government policy, competitor or market evolution, business decisions, process or judgment error, deliberate wrongdoing, dysfunctional markets and natural disasters.

Types of risksare categories by which risks manifest themselves. The Firm’s risks are generally categorized in the following four risk types:

•Strategic risk is the risk to earnings, capital, liquidity or reputation associated with poorly-designed or failed business plans or an inadequate response to changes in the operating environment.

•Credit and investment risk is the risk associated with the default or change in credit profile of a client, counterparty or customer; or loss of principal or a reduction in expected returns on investments, including consumer credit risk, wholesale credit risk and investment portfolio risk.

•Market risk is the risk associated with the effect of changes in market factors, such as interest and foreign exchange rates, equity and commodity prices, credit spreads or implied volatilities, on the value of assets and liabilities held for both the short and long term.

•Operational risk is the risk of an adverse outcome resulting from inadequate or failed internal processes or systems; human factors; or external events impacting the Firm’s processes or systems. Operational risk includes cybersecurity, compliance, conduct, legal, and estimations and model risk.

Impacts of risks are consequences of risks, both quantitative and qualitative. There may be many consequences when risks manifest themselves, including quantitative impacts such as a reduction in earnings and capital, liquidity outflows, and fines or penalties, or qualitative impacts such as damage to the Firm’s reputation, loss of clients and customers, and regulatory and enforcement actions.

The Firm’s risk governance framework is managed on a Firmwide basis. The Firm has an Independent Risk Management (“IRM”) function, which is comprised of Risk Management and Compliance. The Firm’s Chief Executive Officer (“CEO”) appoints, subject to approval by the Risk Committee of the Board of Directors (the “Board Risk Committee”), the Firm’s Chief Risk Officer (“CRO”) to lead the IRM function and maintain the risk governance framework of the Firm. The framework is subject to approval by the Board Risk Committee through its review and approval of the Risk Governance and Oversight Policy.

The Firm’s CRO oversees and delegates authority to the Firmwide Risk Executives (“FREs”), the Chief Risk Officers of the LOBs and Corporate (“LOB CROs”), and the Firm’s Chief Compliance Officer (“CCO”), who, in turn, establish Risk Management and Compliance organizations, develop the Firm’s risk governance policies and standards, and define and oversee the implementation of the Firm’s risk governance framework. The LOB CROs oversee risks that arise in their LOBs and Corporate, while FREs oversee risks that span across the LOBs and Corporate, as well as functions and regions. Each area of the Firm that gives rise to risk is expected to operate within the parameters identified by the IRM function, and within the risk and control standards established by its own management.

Three lines of defense

The Firm’s “three lines of defense” are as follows:

The first line of defense consists of each LOB, Treasury and CIO, and certain Other Corporate initiatives, including their aligned Operations, Technology and Control Management. The first line of defense owns the risks, and identification of risks, associated with their respective activities and the design and execution of controls to manage those risks. Responsibilities also include adherence to applicable laws, rules and regulations and implementation of the risk governance framework established by IRM, which may include policies, standards, limits, thresholds and controls.

The second line of defense is the IRM function, which is separate from the first line of defense and is responsible for independently measuring risk, as well as assessing and challenging the risk management activities of the first line of defense. IRM is also responsible for the identification of risks within its organization, its own adherence to applicable laws, rules and regulations and for the development and implementation of policies and standards with respect to its own processes.

The third line of defense is Internal Audit, an independent function that provides objective assessment of the adequacy and effectiveness of Firmwide processes, controls, governance and risk management. The Internal Audit function is led by the General Auditor, who reports to the Audit Committee and administratively to the CEO.

In addition, there are other functions that contribute to the Firmwide control environment but are not considered part of a particular line of defense, including Corporate Finance, Human Resources and Legal. These other functions are responsible for the identification of risks within their respective organizations, adherence to applicable laws, rules and regulations and implementation of the risk governance framework established by IRM.

Risk identification and ownership

The LOBs and Corporate are responsible for the identification of risks within their respective organizations, as well as the design and execution of controls, including IRM-specified controls, to manage those risks. The IRM function reviews and challenges the material risks identified by each LOB and Corporate, and maintains a risk identification framework and a central risk inventory.

Risk appetite

The Firm’s overall appetite for risk is governed by Risk Appetite frameworks for quantitative and qualitative risks. The Firm’s risk appetite is periodically set and approved by senior management (including the CEO and CRO) and approved by the Board Risk Committee. Quantitative and qualitative risks are assessed to monitor and measure the Firm’s capacity to take risk consistent with its stated risk appetite. Risk appetite results are reported to the Board Risk Committee.

Risk governance and oversight structure

The independent status of the IRM function is supported by a risk governance and oversight structure that provides channels for the escalation of risks and issues to senior management, the FRC and the Board of Directors, as appropriate.

The chart below illustrates the principal standing committees of the Board of Directors and key senior management-level committees in the Firm’s risk governance and oversight structure. In addition, there are other committees, forums and channels of escalation that support the oversight of risk that are not shown in the chart below or described in this Form 10-K.

(a)The Firm’s CEO is also the Chairman of the Board of Directors.

(b)The Firm’s CRO reports to the Firm’s CEO and the Board Risk Committee. The Firm’s CRO may escalate directly to the Board of Directors (including its committees), as appropriate.

(c)The Firm’s General Auditor reports to the Audit Committee and administratively to the Firm’s CEO.

(d)The Firmwide Risk Committee escalates to the Board Risk Committee, as appropriate.

(e)The Asset and Liability Committee escalates to the Firm’s CEO or the Board of Directors (including its committees), as appropriate.

The Firm’s Operating Committee, which consists of the Firm’s CEO, CRO, Chief Financial Officer (“CFO”), General Counsel, CEOs of the LOBs and other senior executives, is accountable to and may refer matters to the Firm’s Board of Directors. The Operating Committee and certain other members of senior management are responsible for escalating to the Board the information necessary to facilitate the Board’s exercise of its duties.

Board oversight

The Firm’s Board of Directors actively oversees the business and affairs of the Firm. This includes monitoring the Firm’s financial performance and condition and reviewing the strategic objectives and plans of the Firm. The Board carries out a significant portion of its oversight responsibilities through its principal standing committees, each of which consists solely of independent members of the Board.

The JPMorgan Chase Bank, N.A. Board of Directors is responsible for the oversight of management of the bank, which it discharges both acting directly and through the principal standing committees of the Firm’s Board of Directors. Risk and control oversight on behalf of JPMorgan Chase Bank N.A. is primarily the responsibility of the Board Risk Committee and the

Audit Committee, respectively, and, with respect to compensation and other management-related matters, the Compensation & Management Development Committee.

The Board Risk Committee assists the Board in its oversight of management’s responsibility to implement a global risk management framework reasonably designed to identify, assess and manage the Firm’s risks. The Board Risk Committee’s responsibilities include approval of applicable primary risk policies and review of certain associated frameworks, analysis and reporting established by management. Breaches in risk appetite and parameters, issues that may have a material adverse impact on the Firm, including capital and liquidity issues, and other significant risk-related matters are escalated to the Board Risk Committee, as appropriate.

The Audit Committee assists the Board in its oversight of management’s responsibilities to ensure that there is an effective system of controls reasonably designed to safeguard the Firm’s assets and income, ensure the integrity of the Firm’s financial statements, and maintain compliance with the Firm’s ethical standards, policies, plans and procedures, and with laws and regulations. It also assists the Board in its oversight of the qualifications, independence and performance of the Firm’s independent registered public accounting firm, and of the performance of the Firm’s Internal Audit function.

The Compensation & Management Development Committee (“CMDC”)assists the Board in its oversight of the Firm’s compensation principles and practices. The CMDC reviews and approves the Firm’s compensation and qualified benefits programs. The Committee reviews the performance of Operating Committee members against their goals, and approves their compensation awards. In addition, the CEO’s compensation award is subject to ratification by the independent directors of the Board. The CMDC also reviews the development of and succession for key executives. As part of the Board’s role of reinforcing, demonstrating and communicating the “tone at the top,” the CMDC oversees the Firm’s culture, including reviewing updates from management regarding significant conduct issues and any related actions with respect to employees, including compensation actions.

The Public Responsibility Committee oversees and reviews the Firm's positions and practices on public responsibility matters such as community investment, fair lending, sustainability, consumer practices and other public policy issues that reflect the Firm's values and character and could impact the Firm's reputation among its stakeholders. The Committee also provides guidance on these matters to management and the Board, as appropriate.

The Corporate Governance & Nominating Committee exercises general oversight with respect to the governance of the Board of Directors. It reviews the qualifications of and recommends to the Board proposed nominees for election to the Board. The Committee evaluates and recommends to the Board corporate governance practices applicable to the Firm. It also reviews the framework for assessing the Board’s performance and self-evaluation.

Management oversight

The Firm’s senior management-level committees that are primarily responsible for key risk-related functions include:

The Firmwide Risk Committee (“FRC”) is the Firm’s highest management-level risk committee. It oversees the risks inherent in the Firm’s business and provides a forum for discussion of risk-related and other topics and issues that are raised or escalated by its members and other committees.

The Firmwide Control Committee (“FCC”)is an escalation committee for senior management to review and discuss the Firmwide compliance and operational risk environment, including identified issues, compliance and operational risk metrics and significant events that have been escalated.

Line of Business and Regional Risk Committeesare responsible for overseeing the governance, limits and controls that have been established within the scope of their respective activities. These committees review the ways in which the particular LOB or the businesses operating in a particular region could be exposed to adverse outcomes, with a focus on identifying, accepting, escalating and/or requiring remediation of matters brought to these committees.

The Control Committees for the LOBs and certain of the Corporate functions oversee the risk and control environment of their respective business or function, inclusive of Operational Risk, Compliance and Conduct Risks. As part of that mandate, they are responsible for reviewing indicators of elevated or emerging risks and other data that may impact the level of compliance and operational risk in a business or function, addressing key compliance and operational risk issues, with an emphasis on processes with control concerns, and overseeing control remediation.

The Asset and Liability Committee (“ALCO”)is responsible for overseeing the Firm’s asset and liability management (“ALM”), including the activities and frameworks supporting management of the balance sheet, liquidity risk, interest rate risk and capital risk.

The Firmwide Valuation Governance Forum (“VGF”)is composed of senior finance and risk executives and is responsible for overseeing the management of risks arising from valuation activities conducted across the Firm.

Risk governance and oversight functions

The Firm monitors and measures its risk through risk governance and oversight functions. The scope of a particular function or business activity may include one or more drivers, types and/or impacts of risk. For example, Country Risk Management oversees country risk which may be a driver of risk or an aggregation of exposures that could give rise to multiple risk types such as credit or market risk.

The following sections discuss the risk governance and oversight functions that have been established to oversee the risks inherent in the Firm’s business activities.