ONITY GROUP INC.

Our risk management framework seeks to mitigate risk and appropriately balance risk and return. We have established policies and procedures intended to identify, assess, monitor and manage the types of risk to which we are subject, including strategic, market, credit, liquidity and operational risks.

Our Chief Risk and Compliance Officer is responsible for the design, implementation and oversight of our global risk management and compliance programs. Risks unique to our businesses are governed through various management processes and governance committees to oversee risk and related control activities across our company and provide a framework for potential issues to be identified, assessed and remediated under the direction of senior executives from our business, finance, risk, compliance, internal audit and law departments, as applicable. Information is aggregated and reports on risk matters are made to the Board of Directors, its Risk and Compliance Committee or its other committees, as applicable, to enable the Board of Directors and its committees to fulfill their governance and oversight responsibilities.

Strategic Risk

We are exposed to risk with respect to the strategic initiatives we have taken to deliver sustainable growth and profitability. Strategic risk represents the risk to shareholder or enterprise value, current or future earnings, capital and liquidity from adverse business decisions and/or improper implementation of business strategies. Management is responsible for developing and implementing business strategies that leverage our core competencies and are appropriately structured, resourced and executed. Oversight for our strategic actions is provided by the Board of Directors. Our performance, relative to our business plans and our longer-term strategic plans, is reviewed by senior management and the Board of Directors.

To achieve our financial objectives, we believe we need to execute on our business strategy discussed under “Item 7. Management Discussion and Analysis of Financial Condition and Results of Operations-Overview-Business Strategy”. Our ability to achieve our objectives is highly dependent on the success of our business relationships with our critical counterparties like the GSEs, Ginnie Mae, our lenders, regulators, significant customers and our ability to attract new customers, all of which are impacted by our capability to adequately address the competitive challenges we face.

Market Risk

See Item 7A. Quantitative and Qualitative Disclosures about Market Risk.

Liquidity Risk

We are exposed to liquidity risk through our ongoing needs to: originate, purchase, repurchase and finance mortgage loans; sell mortgage loans into secondary markets; retain, acquire, finance and hedge MSRs, make and finance advances; fund and sell additional future draws by borrowers under variable rate HECM loans; meet our HMBS issuer obligations with respect to MCA repurchases; repay maturing debt; meet our contractual obligations; and otherwise fund our operations. Liquidity is an essential component of our ability to operate and grow our business; therefore, it is crucial that we maintain adequate levels of excess liquidity to fund our businesses during normal economic cycles and events of market stress.

We estimate how our liquidity needs may be impacted by a number of factors, including fluctuations in asset and liability levels due to our business strategy, asset and hedging derivative valuations, changes in cash flows from operations or advance obligations, levels of interest rates, debt service requirements including contractual amortization, margin calls and maturities, and unanticipated events, including legal and regulatory expenses. We also assess market conditions and capacity for debt issuance in the various markets that we access to fund our business needs. We have established internal processes to anticipate future cash needs, evaluate stress scenarios and continuously monitor the availability of funds pursuant to our existing debt arrangements or certain liquidity actions. We monitor MSR asset valuations and communicate closely with our lenders for this asset class to ensure adequate liquidity is maintained for mark-to-market valuation changes within MSR financing facilities. We manage this risk in multiple ways, including but not limited to engaging in Originations pipeline and MSR hedging activities, and maintaining liquidity earmarks at levels to support potential changes in loans and MSR fair values.

We regularly evaluate capital structure options that we believe will most effectively provide the necessary capacity to support our investment objectives, address upcoming debt maturities and contractual amortization, and accommodate our business needs. Our objective is to maximize the total investment capacity through diversification of our funding sources while optimizing cost, advance rates and terms.

In general, we finance our business operations through a variety of activities - cash on hand, operating cash flow, strategic investor relationships and both committed and non-committed asset-based lending facilities for our significant MSR, mortgage warehouse and servicing advance activities. We address liquidity risk by actively managing our sources and uses of funds and maintaining contingency funding capacities, including but not limited to undrawn excess borrowing capacity on credit lines beyond our expected needs and by extending the tenor of our financing arrangements from time to time. Management closely monitors growth, and can adjust originations pricing quickly to manage its liquidity profile as needed. We have typically amended sizing on existing facilities or entered into new secured facilities in anticipation of our changing liquidity needs. Also refer to Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations, Liquidity and Capital Resources.

Operational Risk

Operational risk is inherent in each of our business lines and related support activities. This risk can manifest itself in various ways, including process execution errors, clerical or technological failures or errors, business interruptions and frauds, all of which could cause us to incur losses. Operational risk includes the following key risks:

•legal risk, as we can have legal disputes with borrowers or counterparties;

•compliance risk, as we are subject to many federal and state rules and regulations;

•third-party risk, as we have many processes that have been outsourced to third parties;

•information technology risk, as we operate many information systems that depend on proper functioning of hardware and software;

•information security risk, as our information systems and associates handle personal financial data of borrowers, and

•business continuity risk, as natural disasters, pandemics, extreme weather, and other unexpected events can cause disruption to our operations;

•model risk, as we measure instruments and risks, develop forecasts, and make decisions based on model estimation outputs that may be incorrect or misused.

The Board of Directors provides direction to senior executives by setting our organization’s risk appetite, and delegates to our Chief Executive Officer and senior executives the primary ownership and responsibility for operational risk management and control. Senior executives in our risk department oversee the establishment of policies and control frameworks that are designed, executed and administered to provide a sound and well-controlled operational environment in accordance with our risk appetite framework. We mandate training for our employees in respect to these policies, require business line change management control oversight, and we conduct targeted control assessment/reviews on a regular basis. Risk issues identified are tracked in our Governance, Risk and Compliance (GRC) system. Remediation and assurance testing are also tracked in our GRC system. We also have several channels for employees to report operational and/or technological issues affecting their operations to management, the operational risk or compliance teams or the Board.

We seek to embed a culture of compliance and business line responsibility for managing operational and compliance risks in our enterprise-wide approach toward risk management. Onity has adopted a “Three Lines of Defense” model to enable risks and controls to be properly managed on an on-going basis. The model delineates business line management's accountabilities and responsibilities over risk management and the control environment and includes mechanisms to assess the effectiveness of executing these responsibilities.

The first line of defense consists of business line management, dedicated control directors and quality assurance personnel who are accountable and responsible for their day-to-day activities, processes and controls. The first line of defense is responsible for ensuring that key risks within their activities and operations are identified, assessed, mitigated and monitored by an appropriate control environment that is commensurate with the operations risk profile.

The second line of defense is independent from the business and comprises a Risk Management function (including Third-Party Risk and Information Security) and a Compliance function, which are responsible for:

•providing assurance, oversight, and credible challenge over the effectiveness of the risk and control activities conducted by the first line;

•establishing frameworks to identify and measure the risks being taken by different parts of the business;

•monitoring risk levels, through key indicators and oversight/assurance and testing programs; and

•providing periodic reporting to senior management and the Board of Directors for transparency.

The third line of defense, Internal Audit, provides independent assurance as to the effectiveness of the design, implementation and embedding of the risk management frameworks, as well as the management of the risks and controls by the first line and control oversight by the second line. The Internal Audit function provides periodic reporting on its activities to senior management and the Board of Directors for transparency.

All business units and overhead functions are subject to unrestricted audits by our internal audit department. Internal audit is granted unrestricted access to our records, physical properties, systems, management and employees in order to perform these audits. The internal audit department reports to the Audit Committee of the Board and assists the Audit Committee in fulfilling its governance and oversight responsibility.

Compliance risk is managed through an enterprise-wide compliance risk management program designed to monitor, detect and deter compliance issues. Our compliance and risk management policies assign primary responsibility and accountability for the management of compliance risk in the lines of business to business line management.

Information Security Risk oversight is performed by our Chief Information Security Officer who reports to the Chief Administrative Officer. Onity’s information security plans are developed to meet or exceed Federal Financial Institutions Examination Council standards. See Item 1 C. “Cybersecurity” below.

Pursuant to our model risk management framework, models are generally subject to risk assessment and management by the model owners, developers, and users (i.e., first line of defense), and effective model risk oversight by Risk Management.

Credit Risk

Consumer Credit Risk

The typical obligor credit-related risks inherent in maintaining a mortgage loan portfolio as an investment tend to impact us less than a typical long-term investor because we generally sell the mortgage loans that we originate in the secondary market shortly after origination through GSE and Ginnie Mae guaranteed securitizations and whole loan transactions. We are exposed to early payment defaults from the time that we originate a loan to the time that the loan is sold in the secondary market or shortly thereafter. Early payment defaults are monitored and loans are audited by our quality assurance teams for origination defects. Our exposure to early payment defaults remains very limited and we do not anticipate material losses from this exposure.

Servicing costs are generally higher on higher credit risk loans. In addition, higher credit risk loans are generally affected to a greater extent by an economic downturn or a deterioration of the housing market. An increase in delinquencies and foreclosure rates generally results in increased advances for delinquent principal and interest, taxes and insurance, foreclosure costs and the upkeep of vacant property in foreclosure. Interest expense on advances and higher operating expenses decrease the value of our servicing portfolio. We track the credit risk profile of our servicing portfolio, including the recoverability of advances, with a view to ensuring that changes in portfolio credit risk are identified on a timely basis.

We have loan repurchase and indemnification obligations arising from potential breaches of the representation and warranty provisions in connection with loans we sell in the secondary market. In the event of a breach of these representations and warranties, we may be required to repurchase a mortgage loan or indemnify the purchaser, and we may bear any subsequent loss on the mortgage loan.

We endeavor to minimize our losses from loan repurchases and indemnifications by focusing on originating or purchasing fully compliant mortgage loans and closely monitoring investor and agency eligibility requirements for loan sales. Our quality assurance teams perform independent testing related to the processing and underwriting of mortgage loans to investor guidelines prior to closing, as well as after the closing but before the sale of loans, to identify potential repurchase exposures due to breach of representations and warranties. In addition, we perform a comprehensive review of the loan files where we receive investor requests for repurchase and indemnification to establish the validity of the claims and determine our obligation. In limited circumstances, we may retain the full risk of loss on loans sold to the extent that the liquidation value of the asset collateralizing the loan is insufficient to cover the loan itself and associated servicing expenses. In instances where we have purchased loans from third parties, we usually have the ability to recover the loss from the third-party originator.

Counterparty Credit Risk

Counterparty credit risk represents the potential loss that may occur because a party to a transaction fails to perform according to the terms of the contract. We regularly evaluate the financial position and creditworthiness of our counterparties and disperse risk among multiple counterparties to the extent possible. We manage derivative counterparty credit risk by entering into financial instrument transactions through national exchanges, primary dealers or approved counterparties and using mutual margining agreements whenever possible to limit potential exposure.

Rithm is contractually obligated, pursuant to our agreements with them related to the Rights to MSRs, to make all advances required in connection with the loans underlying such MSRs. If Rithm’s advance financing facilities do not perform as envisaged or should Rithm otherwise be unable to meets its advance financing obligations, we would be required to meet our advance financing obligations with respect to the loans underlying these Rights to MSRs, which could materially and adversely affect our liquidity, financial condition and servicing operations. Due to its concentration in our portfolio, we monitor Rithm’s payment performance, liquidity and capital on a regular basis.

Counterparty credit risk exists with our third-party originators, including our correspondent lenders, from whom we purchase originated mortgage loans. The third-party originators make certain representations and warranties to us when we acquire the mortgage loan from them, and they agree to reimburse us for losses incurred due to an origination defect. We become exposed to losses for origination defects if the third-party originator is not able to reimburse us for losses incurred for indemnification or repurchase. We mitigate this risk by monitoring purchase levels from our third-party originators (to reduce concentration risk), by performing regular quality control reviews of the third-party originators’ underwriting standards and by regular reviews of the creditworthiness of third-party originators.

Concentration Risk

We strive to develop a diversified and balanced business to mitigate any concentration risk in our segments and operations (also refer to discussion of our financing sources).

Client concentration -Rithm is our largest subservicing client, accounting for $32.2 billion of UPB or 10% of the UPB and 19% of the loan count of our total servicing and subservicing portfolio, and approximately 50% of all delinquent loans that Onity serviced as of December 31, 2025. On October 31, 2025, Rithm exercised its right to terminate the subservicing agreements for convenience, effective January 31, 2026. The servicing transfer to Rithm’s own servicing platform is expected to begin in the first half of 2026. The transfer of $8.3 billion of UPB of these agreements is subject to the receipt of necessary consents from trustees and others, the timing and success of which are uncertain. Upon transfer, we expect to downsize certain aspects of our servicing business as well as the related corporate support functions. In addition, the float amount associated with the advance collections and servicing fees of the servicing portfolio will be repaid to Rithm in cash based on the amount due upon transfer.

Market conditions, including interest rates and future economic projections, could impact investor demand to hold MSRs, which may result in our loss of subservicing relationships (including MAV, MSR capital partners and others), or significantly decrease the number of loans under such relationships.

Geographic concentration- The mortgaged properties securing the residential loans that we service are geographically dispersed throughout all 50 states, the District of Columbia and two U.S. territories. The five largest concentrations of properties are located in California, Texas, Florida, New Jersey and New York, comprising 38% of the number of loans serviced underlying our MSRs at December 31, 2025. California has the largest concentration with 14% of the total loans serviced.

AVAILABLE INFORMATION

Our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and all amendments to those reports are made available free of charge through our website (www.onitygroup.com) as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC. The SEC maintains an Internet site that contains reports, proxy and information statements and other information regarding issuers, including Onity, that file electronically with the SEC. The address of that site is www.sec.gov. We have also posted on our website, and have available in print upon request (1) the charters for our Audit Committee, Compensation and Human Capital Committee, Nomination/Governance Committee and Risk and Compliance Committee, (2) our Corporate Governance Guidelines, (3) our Code of Business Conduct and Ethics and (4) our Code of Ethics for Senior Financial Officers. These documents may be found athttp://www.onitygroup.com in the Shareholder Relations section. We also post information such as quarterly earnings presentations, press releases, and other information that may be important to investors on our website. However, the information located on, or accessible from, our website, is not, and should not be deemed to be, part of this report or incorporated into any other filing that we submit to the Securities and Exchange Commission.