Jackson Financial Inc

Enterprise Risk Management Framework

Our risk management framework (the “Framework”) defines our approach for identifying, assessing, managing, monitoring and reporting material risks to our business and is reviewed by the Company’s management and Jackson Financial’s Board of Directors (the "Board of Directors" or the "Board") on an annual basis to ensure it meets stakeholders' expectations and remains in compliance with regulatory requirements. The Framework is designed to provide clear direction and embed risk management in day-to-day decision making and is organized around six core components, described below.

Enterprise Risk Management Framework - Core Components

Risk Governance & Culture

The Board oversees and approves the Framework and delegates risk oversight responsibilities to Board committees. We embed risk management in the business using a three lines model:

•Risk Ownership and Management (first line): Our business function leaders have primary ownership of risk management relating to their area of expertise.

•Risk Oversight and Challenge (second line): Our Risk team focuses on risk oversight and challenge, especially related to top financial, non-financial and business risks. Our Compliance team oversees and ensures appropriate frameworks are in place to manage compliance and regulatory requirements.

•Independent Assurance (third line): Our Internal Audit team provides independent, objective, and risk-based assessment and reporting on the overall effectiveness of risk management, control, and governance processes across the organization. The Internal Audit team is directly overseen by the Board Audit Committee and operates pursuant to a charter that is reviewed and approved annually by that Committee.

Risk Appetite and Limits

We manage our business under a Board-approved risk appetite statement (the "Risk Appetite") that specifies the risk we are willing to accept in pursuit of our objectives. Our Board's Finance and Risk Committee approves and monitors a set of risk limits ("Risk Limits") that support compliance with the Risk Appetite.

Part I |Item 1. Business |Risk Management

Risk Identification, Assessment, Measurement and Management

We operate an enterprise-wide risk identification and risk and control self-assessment ("RCSA") process to develop a holistic view of the material financial, non-financial and business risks we face and our control environment. We also monitor the external environment for emerging risks. See Item 1A. Risk Factors for a description of the risks we face.

Risk Monitoring, Reporting and Escalation

Risk monitoring and reporting processes facilitate risk-based decision making by management, and risk management oversight by management and Board committees. Risk escalation processes exist to ensure Risk Appetite or Risk Limit breaches along with material non-financial risk events are escalated in a timely manner to executive management, management forums, boards, and board committees, as appropriate, in a timely manner.

Risk Response and Recovery Plans

We maintain a financial recovery plan and other risk response and recovery plans to remediate breaches of Risk Appetite or Risk Limits, strengthen capital or liquidity, or respond to significant non-financial risk events.

Risk Stress and Scenario Testing

We regularly perform stress and scenario testing to assess our risk profile and test our ability to manage through material financial and non-financial risk events.

Risk Management Strategies

Financial Risk

We employ various financial risk management strategies to limit losses and manage exposures to significant risks within established Risk Limits.

Market Risk Management: Our primary market risk exposure results from interest rate fluctuations, equity price movements and changes in credit spreads. See Item 7A. Quantitative and Qualitative Disclosures about Market Risk for further information regarding our market risk exposures, and how we manage these risks.

Counterparty Risk Management: The inability of a banking, derivative or reinsurance counterparty to satisfy its obligations could expose us to material risk. A key component of our counterparty risk management strategy is collateralization of the value of contracts we hold with a given counterparty. Collateral requirements are specified contractually. In addition, we have placed formal limits on the amount of exposure we are willing to accept for a given counterparty, after consideration of collateral held both in aggregate and by risk source (banking, derivatives, reinsurance); these limits vary based on the credit worthiness of the counterparty.

Asset-Liability Management: We use asset-liability duration and cash flow management techniques to ensure that obligations arising from our products will be met when they become due. These techniques consider current and future investment returns, asset and liability durations, risk tolerance and cash flow requirements. We closely monitor our investment portfolio to assess our asset-liability position and adjust the allocation of assets within the investment portfolio as necessary to reduce the risk of mismatched cash flows between our assets and obligations to our policyholders. To further support our asset-liability management process, we analyze the adequacy of reserves annually. This analysis includes dynamic cash flow testing of assets and liabilities, by product, under a variety of interest rate scenarios to provide assurance that current assets and associated yields will be enough to satisfy obligations as they come due.

Hedging Program: Our hedging program seeks to balance three risk management objectives: protecting against the economic impact of adverse market conditions, protecting statutory capital, and stabilizing statutory distributable earnings throughout market cycles. See Item 7A. Quantitative and Qualitative Disclosures of Market Risk for further information regarding our hedging program, and how we use it to manage market risk.

Third-Party Reinsurance: We utilize third-party reinsurance to mitigate a portion of the risks that we face, principally in certain of our in-force annuity and life insurance products related to longevity and mortality risks and specific features of

Part I |Item 1. Business |Risk Management

our variable annuities. We have entered into reinsurance contracts to manage the full spectrum of risk exposure on certain blocks of business. The majority of our in-force fixed annuity and fixed index annuity businesses, as well as the legacy block of GMIBs on variable annuities, has been ceded to highly-rated unaffiliated reinsurers.

Pricing and Reserving: Factors considered in product pricing primarily include expected investment returns, interest rates, market volatility, mortality, longevity, persistency, benefit utilization and operating expenses as well as other features of certain annuity products. Our product pricing models also take into account capital requirements, risk profile, target returns and operating expenses. We set what we believe are appropriate assumptions as part of our pricing and reserving practices. Those assumptions are regularly updated and reflect a mix of available information and internal subject matter expert judgment.

Non-Financial Risk

In addition to the financial risks noted above, our business inherently faces operational and regulatory risks, which can lead to financial loss, negative impacts to customers and stakeholders, and regulatory scrutiny. Examples of key “non-financial” risks include cyberattacks and information security breaches, failure of third parties to provide contracted services, fraud, model risk and conflicts of interest.

We regularly assess and report on our key risks to the Board's Finance and Risk Committee and have management forums in place to manage and oversee our relevant non-financial risks. Our policies, processes and controls (collectively, our internal control environment) are designed and implemented with a goal to minimize exposure to these risks and prevent material financial losses and operational events (direct or indirect) that adversely affect our ability to meet our commitments to customers. In addition, we have risk-specific response plans and processes in place to quickly identify and appropriately address control failures or other risk events when they occur. Our internal control environment, including compliance with internal policies, is regularly assessed for effectiveness, and oversight is provided by our Risk and Internal Audit teams.