LPL Financial Holdings Inc.

Risk is an inherent part of our business activities. To manage risk, we have implemented an ERM framework that supports a resilient and adaptive risk-focused organization, designed to enable us to navigate uncertainties, make informed and consistent decisions, and seize growth opportunities. This framework defines our risk appetite, facilitates the incorporation of risk assessment into decision-making processes, enables execution of our business strategy, and protects the Company and our franchise.

Our Company-wide risk appetite statement is a crucial component of our risk governance framework. It defines the overall level and types of risk we are prepared to accept in order to achieve our strategic objectives and business plan. This statement categorizes risks into strategic, technology, regulatory compliance, operational, liquidity, reputational, credit, interest rate, and market risks.

Additionally, this framework aims to ensure policies and procedures are in place and appropriately designed to identify and manage risk at appropriate levels throughout the Company and within various departments. We have established advisor-facing and internal written policies and procedures that govern the conduct of our advisors and employees. Our advisor-facing policies are specifically designed to provide guidelines and procedures that ensure advisors adhere to regulatory requirements and maintain ethical standards in their professional conduct while our internal policies cover a wide range of topics designed to promote compliance, consistency, risk management, and culture and values across the Company.

Our framework is designed to promote clear lines of risk management ownership and accountability while providing a structured escalation process for key risk information and events. Additionally, risk is managed and monitored within business units by embedded risk groups providing guidance on governance, controls, policies and other risk management activities.

We operate a three lines of defense model, an industry-standard framework that clarifies roles and responsibilities, and that supports a comprehensive risk management and governance framework. The three lines and associated responsibilities are as follows:

•First Line of Defense: This consists of business management, which owns and operates processes and manages day-to-day risks. Responsibilities include identifying and assessing risks, implementing controls, monitoring compliance, and escalating issues or breaches.

•Second Line of Defense: This includes the risk management and compliance functions. They provide guidance and oversight, and monitor the effectiveness of controls implemented by the first line.

•Third Line of Defense: This is the internal audit function, which provides independent assurance. They assess the effectiveness of our risk management and internal controls.

Internal Audit Department

As the third line of defense, the Internal Audit department provides independent and objective assurance of the effectiveness of the Company’s governance, risk management, and internal controls by conducting risk assessments and audits designed to identify and cover important risk categories. Internal Audit reports directly to the ARC, which provides oversight of Internal Audit’s activities and approves its annual plan. The Internal Audit department reports to the ARC at least quarterly.

Risk Governance Committee Structure

Risk management at the Company requires independent Company-level oversight, accountability of our business areas, and effective communication of risk matters to senior management and, ultimately, the Board. This risk management approach encompasses the Board and its committees, the ROC and its subcommittees, and our three lines of defense model. We regularly reevaluate and, when necessary, modify our processes to enhance the identification and escalation of risks and events.

Audit and Risk Committee of the Board

The ARC oversees and monitors, among other things, the Company’s enterprise risk management (except for risks assigned to other committees of the Board or retained by the Board) and is responsible for reviewing and assessing our processes to manage and control risk. In this capacity, the ARC reviews reports from risk-focused management committees; reviews emerging risks and regulatory matters; and reviews Internal Audit reports on the assessment of the Company’s control environment. The ARC reports to the Board on a regular basis and coordinates with the

Board and other Board committees with respect to the oversight of risk management and risk assessment guidelines.

Compensation and Human Resources Committee of the Board

In addition to its other responsibilities, the Compensation and Human Resources Committee of the Board assesses whether our compensation arrangements encourage inappropriate risk-taking, and whether risks arising from our compensation arrangements are reasonably likely to have a material adverse effect on the Company.

Risk Oversight Committee of LPL Financial

The ROC, a management committee chaired by the chief risk officer, oversees our risk management activities, including those of our subsidiaries. The ROC generally meets once every two months, with additional ad hoc meetings as necessary. The members of the ROC include certain Group Managing Directors of LPL Financial, as well as other members of LPL Financial’s senior management team who serve as ex-officio/non-voting members and represent key control areas of the Company. Participation in the ROC by senior officers is intended to ensure that the ROC covers the key risk areas of the Company, including its subsidiaries. The ROC thoroughly reviews significant matters relating to risk priorities, policies, control procedures and related exceptions. It also examines certain new and complex products and business arrangements, transactions with significant risk elements and identified emerging risks.

The chief risk officer provides updates on pertinent ROC discussions to the ARC on a regular basis and, if necessary or requested, to the Board.

Subcommittees of the Risk Oversight Committee

The ROC has established multiple subcommittees to support effective supervision of our risk exposures and processes. The subcommittees meet regularly and are responsible for keeping the ROC informed and escalating issues in accordance with the Company’s escalation protocols. The responsibilities of such subcommittees include, for example, oversight of operational risk; oversight of the approval of new and complex investment products offered to advisors’ clients; oversight of our technology; and issues and trends related to advisor compliance.

Regulatory and Compliance Risk

The regulatory environment in which we operate is discussed in detail within Part I,“Item 1. Business” of this Annual Report on Form 10-K. In recent years, and during the period presented in this Annual Report on Form 10-K, we have observed the SEC, FINRA, DOL and state regulators broaden the scope, frequency and depth of their examinations and inquiries to include greater emphasis on the quality, consistency and oversight of our compliance systems and programs. Please consult the“Risks Related to Our Regulatory Environment” and the“Risks Related to Our Business and Industry” sections within Part I,“Item 1A. Risk Factors” for more information about the risks associated with operating within our regulatory environment, pending regulatory matters and the potential related effects on our operations.

Operational Risk

Operational risk refers to the risk of loss resulting from inadequate or failed processes and/or systems as a result of external events and is inherent in all Company activities. Instances where operational risk exposure can manifest across our business include, but are not limited to: process or control failures; external or internal fraud resulting from unethical behavior or misconduct of employees and advisors; external events such as a pandemic, theft, or fraud; risks introduced by third-party vendors and/or counterparties; risks introduced by third-party financial institutions that we do not control, such as clearing agents, securities exchanges, clearing houses and other financial intermediaries, including any interruption in their operations; issues stemming from the use of AI, including misuse by advisors or third-party vendors or the use of AI by malicious third parties; and inadequate data governance, which could result in data breaches, loss, lack of compliance, or unauthorized access.

As a Company, we manage operational risk exposure through sound processes, tracking performance across key risk appetite metrics, making key investments that account for the complexity inherent in our operations, and proactively identifying risks, while ensuring the appropriate steps are taken to manage exceeding risk tolerance level. Operational risk is reviewed, monitored and challenged by the Operational Risk Oversight Committee, which is a subcommittee of the ROC.