Corebridge Financial Inc

Our businesses and operations are subject to regulation and supervision by many different types of regulatory authorities, including insurance, securities, derivatives and investment advisory regulators in the United States and abroad. We expect that the U.S. and international regulations applicable to us and our regulated entities will continue to evolve for the foreseeable future. Additionally, in the United States, where the majority of our businesses are based, while the federal government does not directly regulate insurance business, federal legislation and administrative policies in several areas, including pension regulation, age and sex discrimination, financial services regulation, securities regulation and federal taxation, can significantly affect the insurance industry and certain of our other operations. See “Risk Factors—Risks Relating to Regulation—Our business is heavily regulated.”Legislators, regulators and self-regulatory organizations may also consider changes to existing laws or regulations impacting our business, such as, for example, changes to reserving and accounting requirements, standard of care for financial professionals, and permitted investments. See “Risk Factors—Risks Relating to Regulation—New domestic or international laws and regulations, or new interpretations of current laws and regulations, may affect our ability to compete effectively.”Further, insurance and other regulatory authorities and law enforcement agencies, attorneys general and other governmental authorities from time to time make inquiries and conduct examinations or investigations regarding our compliance, as well as compliance by other companies in our industry, with applicable laws.

Corebridge | 2023 Form 10-K 26

U.S. REGULATION

State Insurance Regulation

Our U.S. insurance subsidiaries are licensed to transact insurance business and are subject to extensive regulation and supervision by insurance regulators in the jurisdictions in which they do business, including the 50 states, the District of Columbia, and U.S. territories. The primary regulator of an insurance company, however, is located in its state of domicile. AGC is domiciled in Missouri and is primarily regulated by the Missouri Department of Commerce and Insurance, each of AGL and VALIC is domiciled in Texas and is primarily regulated by the Texas Department of Insurance, and USL is domiciled in New York and is primarily regulated by the New York State Department of Financial Services (“NYDFS”).

The method of regulation of our insurance subsidiaries varies by jurisdiction but generally has its source in statutes that delegate regulatory and supervisory powers to state insurance officials. Such regulation and supervision relate primarily to the financial condition of the insurers, licensing, corporate conduct, including transactions among affiliates, market conduct activities, investments and operational security and resiliency, including data security and privacy. In general, such regulation is for the protection of policyholders rather than the creditors or equity owners of these companies.

As a holding company with no significant business operations of its own, Corebridge Parent depends on dividends from its subsidiaries to meet its obligations. State insurance statutes typically place restrictions and limitations on the amount of dividends or other distributions payable by insurance company subsidiaries to their parent companies, as well as on transactions between an insurer and its affiliates, which transactions may be used to upstream funds. For example, the insurance statutes of Missouri and Texas generally permit without regulatory approval the payment of dividends that, together with dividends paid during the preceding twelve months, do not exceed the greater of (i) 10% of statutory policyholders’ surplus as of the preceding December 31 and (ii) statutory net gain from operations for the preceding calendar year. Additionally, under the Missouri and Texas insurance statutes, dividends may be paid only to the extent the insurer has unassigned surplus (as opposed to contributed surplus). New York has similar dividend restrictions, in some cases with more restrictive requirements. Dividends in excess of applicable prescribed limits established by the applicable state regulations, which are based on the prior year’s earnings and surplus of the insurance company, are considered to be extraordinary transactions and require prior approval or non-disapproval from the applicable insurance regulator.

In the United States, the NAIC is a standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and U.S. territories. Among other things, the NAIC develops and recommends adoption of model insurance laws and regulations. With assistance from the NAIC, state insurance regulators establish standards and best practices, conduct peer reviews and coordinate regulatory oversight. Model laws and regulations promulgated by the NAIC become effective in a state once formally adopted and are subject to modification by each state. NAIC Accreditation Standards place limits on modifications by states to certain model law and regulation adoptions. Certain of such model laws and regulations are noted in more detail below.

The NAIC’s Insurance Holding Company System Regulatory Act and the Insurance Holding Company System Model Regulation (together, the “Holding Company Models”), versions of which have been enacted by all of the states in which we have domestic insurers, generally require registration and periodic reporting by insurance companies that are licensed in such jurisdictions and are controlled by other entities. They also require periodic disclosure concerning the entity that controls the registered insurer and the other companies in the holding company system and prior approval of intercompany transactions, including transfers of assets. Insurance holding company laws also generally provide that no person, corporation or other entity may acquire control of an insurance company, or a controlling interest in any direct or indirect parent company of an insurance company, without the prior approval of such insurance company’s domiciliary state insurance regulator. Under the laws of each of the domiciliary states of our U.S. insurance subsidiaries, Missouri, New York and Texas, any person acquiring, directly or indirectly, 10% or more of the voting securities of an insurance company is presumed to have acquired “control” of the company, which may consider voting securities held at both the parent company and subsidiaries collectively. This statutory presumption of control may be rebutted by a showing that control does not exist in fact. State insurance regulators, however, may find that “control” exists even in certain circumstances in which a person owns or controls less than 10% of the voting securities of an insurance company.

In December 2020, the NAIC amended the Holding Company Models to incorporate a liquidity stress test (“LST”) requirement for large life insurers based on a set of scope criteria and a Group Capital Calculation (“GCC”). LST is intended to support macroprudential surveillance by the NAIC regulators, including to assess the potential impact on broader financial markets of aggregate asset sales within a liquidity stress scenario. The NAIC encouraged states to implement the GCC provisions by November7, 2022, to satisfy group capital assessment requirements of covered agreements the United States reached with the EU and UK. Further, in December 2023, the NAIC adopted the GCC and LST amendments to the Holding Company Models accreditation standards, effective January 1, 2026. Our domiciliary insurance regulators have adopted the GCC requirements.

Corebridge | 2023 Form 10-K 27

The NAIC’s Risk Management and Own Risk and Solvency Assessment Model Act (“ORSA”) requires that insurers maintain a risk management framework and conduct an internal own risk and solvency assessment of the insurer’s material risks in normal and stressed environments and submit annual ORSA summary reports to the insurance group’s lead U.S.-state regulator. The NAIC has also adopted a Corporate Governance Annual Disclosure Model Act that requires insurers to submit an annual filing regarding their corporate governance structure, policies and practices.

Further, the NAIC has had an increased focus on private equity-owned life insurers following sizeable increases in the number of private equity-owned life insurers, as noted by its Capital Markets Bureau and the Federal Insurance Office in 2021. The NAIC adopted Regulatory Considerations Applicable (But Not Exclusive) to Private Equity (“PE”) Owned Insurers (the “Regulatory Considerations”) in 2022, intended to identify areas where existing disclosures, policies, control and affiliation requirements, and other procedures should be modified, or new ones created, to address any gaps based on the increase in the number of private equity-owned insurers, the role of asset managers in insurance and the potential for control via asset management arrangements, and the increase of private investments in insurers’ portfolios, among other potential gaps. Many of the Regulatory Considerations have been referred to NAIC working groups and task forces, including analysis of the definition and evaluation of control and review of the insurance industry’s reliance on rating agency ratings, while others, such as new reporting on investment schedules relative to investment transactions with related parties and additional disclosures relative to private equity and complex assets, are already effective. As part of these efforts, the NAIC recently exposed a Framework for Regulation of Insurer Investments. Their stated goal is to provide a holistic review of the NAIC groups and initiatives, which are focused on investments, and determine the most effective use of regulatory resources. Changes to model laws and regulations or NAIC handbooks resulting from an analysis for the Regulatory Considerations may impact our insurance company subsidiaries’ affiliate relationships and pursuit of strategic transactions, investment portfolios and financial condition.

Every state has adopted, in substantial part, the Risk-Based Capital (“RBC”) Model Law promulgated by the NAIC that allows states to act upon the results of RBC ratio calculations and provides four incremental levels of regulatory action regarding insurers whose RBC ratio calculations fall below specific thresholds. Those levels of action range from the requirement to submit a plan describing how an insurer would regain a specified RBC ratio to a mandatory regulatory takeover of the company. The RBC ratio formula is designed to measure the adequacy of an insurer’s statutory surplus in relation to the risks inherent in its business. The RBC formula computes a risk-adjusted surplus level by applying discrete factors to various asset, premium, reserve and other financial statement items, or in the case of interest rate and equity return (C-3) market risk, applying stochastic scenario analyses. These factors are developed to be risk-sensitive so that higher RBC requirements are applied to items exposed to greater risk. Further, state insurance regulators have discretion in interpreting their reserving and valuation laws and regulations, which may impact the RBC ratio calculation. Certain such regulators have, from time to time, taken more stringent positions than other state insurance regulators on matters affecting, among other things, statutory capital and reserves as applied to their licensed insurance companies. The RBC ratio of each of our U.S. based insurance companies, determined in accordance with NAIC instructions, exceeded minimum required levels as of December 31, 2023. Additionally, the NAIC has adopted, or is considering, several changes impacting how RBC is calculated, including initiatives aimed at a comprehensive review of RBC investment framework as well as using modeling methodology to determine RBC charges for structured securities, potentially replacing the use of rating agency ratings in certain cases. There are also efforts in progress to implement a new Generator of Economic Scenarios for the RBC C-3 stochastic scenario analyses mentioned above, and the Principle-Based Reserves (“PBR”) mentioned below. We will continue to monitor these developments and evaluate their potential impact to our business, financial condition and legal entities.

The NAIC also provides standardized insurance industry accounting and reporting guidance through the NAIC Accounting Practices and Procedures Manual. Statutory accounting principles promulgated by the NAIC, including for our insurance company subsidiaries, have been, or may be, modified by individual state laws, regulations and permitted practices granted by our domiciliary insurance regulators. Changes to the NAIC Accounting Practices and Procedures Manual or modifications by the various state insurance departments may impact the investment portfolios and the statutory capital and surplus of our U.S. insurance companies.

The NAIC has adopted a proposal to allow some portion of net negative interest maintenance reserve to be an admitted asset, for the first time. The treatment expires in 2026 unless extended and the NAIC is working toward a long-term plan. A limit of 10% of an insurer’s capital and surplus applies, subject to certain adjustments and a minimum RBC ratio of 300% following such adjustments.

The NAIC Valuation Manual contains a principle-based approach to life insurance company reserves. PBR is designed to tailor the reserving process to more closely reflect the risks of specific products, rather than the factor-based approach employed historically. Subsection 20 of the Valuation Manual (“VM-20”) applies to individual life insurance reserves, most notably term insurance and universal life policies with secondary guarantees (“ULSGs”), and Subsection 21 (“VM-21”) applies to variable annuities. The NAIC’s work to update the Valuation Manual and address issues relating to the PBR framework, including VM-20, VM-21, and Subsection 22 of the Valuation Manual related to PBR for non-variable annuities, is ongoing, and we will continue to monitor such developments as they evolve. See also Notes 8 and 21 to the Consolidated Financial Statements for additional information related to these statutory reserving requirements.

Corebridge | 2023 Form 10-K 28

In addition to the NAIC’s model laws and regulations, state insurance and consumer protection laws and regulations also include numerous provisions governing the marketplace activities of life and annuity insurers, including provisions governing the form and content of disclosure to consumers, illustrations, advertising, sales practices, customer privacy protection, permissible use of data in insurance practices, and complaint handling. The regulatory landscape is developing with respect to the use of external data and artificial intelligence in insurance practices, including underwriting, marketing and claims practices. The NAIC adopted Artificial Intelligence Principles in August 2020, and a number of states have had legislative or regulatory initiatives relating to the use of external data and artificial intelligence in the insurance industry, including Colorado’s algorithmic and external data accountability law. The NAIC has adopted a model bulletin with regulatory guidance on the use of big data and artificial intelligence. We continue to engage through industry trade groups with our regulators with the intention of maximizing optimal customer outcomes.

Insurance regulators have also shown interest in climate change risk and disclosure. In 2022, the NAIC adopted revisions to its Climate Risk Disclosure Survey, which numerous states mandate for insurers with premiums exceeding certain thresholds. The NAIC Climate and Resiliency (EX) Task Force Solvency Workstream is also considering potential enhancements to existing regulatory tools relative to the solvency effects of climate change (e.g., on underwriting and investments) which may be incorporated into the NAIC’s Financial Analysis Handbook, the Financial Condition Examiners Handbook and the ORSA Guidance Manual, and recently adopted the NAIC National Climate Resilience Strategy for Insurance, a forward-looking climate strategy document. In addition, in 2021, the NYDFS issued final Guidance for New York Domestic Insurers on Managing the Financial Risks from Climate Change, detailing the NYDFS’s expectations related to insurers’ management of the financial risks from climate change and integration into their governance frameworks, risk management frameworks, and business and investment strategies. See “Environmental, Social and Governance Regulation” for further information.

State regulatory authorities generally enforce provisions relating to marketplace activities through periodic market conduct inquiries, data calls, investigations and examinations. Further, as part of their regulatory oversight process, state insurance departments conduct periodic financial examinations, generally once every three to five years, of the books, records, accounts and business practices of insurers domiciled in their states. Examinations are generally carried out under guidelines promulgated by the NAIC and, in the case of financial exams, in cooperation with the insurance regulators of other domiciliary states of an insurance holding company group.

Unclaimed Property

We are subject to the laws and regulations of states and other jurisdictions concerning identification, reporting and escheatment of unclaimed or abandoned funds, and are subject to audit and examination for compliance with these requirements.

State Guaranty Associations

U.S. states have state insurance guaranty associations in which insurers doing business in the state are required by law to be members. Member insurers may be assessed by the associations for certain obligations of insolvent insurance companies to policyholders and claimants. Typically, states assess member insurers in amounts related to the member’s proportionate share of the relevant type of business written by all members in the state. Some jurisdictions permit member insurers to recover assessments that they paid through full or partial premium tax offsets, usually over a period of years. The protection afforded by a state’s guaranty association to policyholders of insolvent insurers varies from state to state. The aggregate assessments levied against us have not been material to our financial condition in any of the past three years.

Dodd-Frank

The Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), signed into law in 2010, brought about extensive changes to financial regulation in the United States and established the Financial Stability Oversight Council. Dodd-Frank also established the Federal Insurance Office (“FIO”) to serve as the central insurance authority in the federal government. While not serving a regulatory function, FIO performs certain duties related to the business of insurance, represents the U.S. in international insurance forums, and has authority to collect information on the insurance industry and recommend prudential standards. Certain parts of Dodd-Frank are noted below in more detail.

Title V of Dodd-Frank authorizes the United States to enter into covered agreements with foreign governments or regulatory entities regarding the business of insurance and reinsurance. On September 22, 2017, the United States and the EU entered into such an agreement to address, among other things, reinsurance collateral and group capital requirements, and on December 18, 2018, the United States signed a covered agreement with the UK, which is similar to the agreement with the EU. The NAIC adopted amendments to the credit for reinsurance model law and regulation and adopted GCC to conform to the requirements of the covered agreements. Numerous states, including our domiciliary states, have adopted the GCC requirements in their statutes.

Corebridge | 2023 Form 10-K 29

Title VII of Dodd-Frank provides for significantly increased regulation of, and restrictions on, swap and security-based swap markets and transactions. This regulation has affected and, as additional regulations come into effect, could further affect, various activities of insurance and other financial services companies. Relevant regulatory requirements include (i) margin and collateral requirements, (ii) regulatory reporting and (iii) mandated clearing through central counterparties and execution through regulated swap execution facilities for certain swaps (other than security-based swaps, which are not currently subject to mandatory execution or clearing requirements but could be in the future). The Commodities Futures Trading Commission (“CFTC”), which oversees and regulates the U.S. swap, commodities and futures markets, and the SEC, which oversees and regulates the U.S. securities and security-based swap markets, have finalized the majority of the rules to carry out their mandates under Title VII of Dodd-Frank. Increased regulation of, and restrictions on, derivatives markets and transactions, including regulations related to initial margin for swaps and securities-based swaps, could increase the cost of our trading and hedging activities, reduce liquidity and reduce the availability of customized hedging solutions and derivatives.

Dodd-Frank also mandated a study to determine whether stable value contracts should be included in the definition of “swap.” If that study concludes that stable value contracts are swaps, Dodd-Frank authorizes certain federal regulators to determine whether an exemption from the definition of a swap for stable value contracts is appropriate and in the public interest. Our Institutional Markets business issues stable value contracts. We cannot predict what regulations might emanate from the aforementioned study or be promulgated applicable to this business in the future. In the event that the study determines that stable value contracts should be included in the definition of “swap,” Section 719(d)(1)(C) of Dodd-Frank provides that such determination would only apply to newly issued stable value contracts.

Title II of Dodd-Frank provides that a financial company whose largest United States subsidiary is an insurer may be subject to a special orderly liquidation process outside the Bankruptcy Code. U.S. insurance subsidiaries of any such financial company, however, would be subject to rehabilitation and liquidation proceedings under state insurance law.

Pursuant to Dodd-Frank, federal banking regulators adopted regulations that apply to certain qualified financial contracts, including many derivatives contracts, securities lending agreements and repurchase agreements, with certain banking institutions and certain of their affiliates. These regulations, which became effective on January 1, 2019, generally require the covered banking institutions and affiliates to include contractual provisions in their qualified financial contracts that limit or delay certain counterparty rights that may arise in connection with the banking institution or affiliate becoming subject to a bankruptcy or similar proceeding or impose such provisions as a matter of law in certain circumstances. Nearly all of our derivatives, securities lending agreements and repurchase agreements with certain banking institutions and certain of their affiliates are subject to these regulations, and as a result, we may be required to delay terminating transactions, realizing collateral posted, or otherwise mitigating exposures under these agreements. We are subject to greater risk and could receive a more limited or delayed recovery in the event of a default by such bank institution or the applicable affiliates.

ERISA

We provide products and services to certain employee benefit plans that are subject to the Employee Retirement Income Security Act of 1974, as amended (“ERISA”), and/or the Internal Revenue Code of 1986, as amended (the “Code”). Plans subject to ERISA include certain pension and profit sharing plans and welfare plans, including health, life and disability plans. As a result, our activities are subject to the restrictions imposed by ERISA and the Code, including the requirement under ERISA that fiduciaries must perform their duties solely in the interests of ERISA plan participants and beneficiaries, and that fiduciaries may not cause a covered plan to engage in certain prohibited transactions. The applicable provisions of ERISA and the Code are subject to enforcement by the DOL, the Internal Revenue Service (“IRS”) and the Pension Benefit Guaranty Corporation.

Standard of Care Developments

We and our distributors are subject to laws and regulations regarding the standard of care applicable to sales of our products and the provision of advice to our customers. In recent years, many of these laws and regulations have been revised or reexamined while others have been newly adopted. We closely monitor these legislative and regulatory activities and evaluate the impact of these requirements on us and our customers, distribution partners and financial advisers. Where needed, we have made significant investments to implement and enhance our tools, processes and procedures, to comply with the final rules and interpretations. These efforts and enhancements have resulted in increased compliance costs and may impact sales results and increase regulatory and litigation risk. Additional changes in standard of care requirements or new standards issued by governmental authorities, such as the DOL, the SEC, the NAIC or state regulators and/or legislators, have impacted, and may impact our businesses, results of operations and financial condition.

Corebridge | 2023 Form 10-K 30

DOL Fiduciary Rule

On October 31, 2023, the DOL announced proposed changes to the regulatory criteria for determining whether a person is an “investment advice fiduciary” for purposes of transactions with ERISA qualified plans, related plan participants and IRAs. Significant changes were also proposed with respect to existing prohibited transaction exemptions (“PTEs”) relating to such advice, including PTE 84-24 and PTE 2020-02. The DOL’s proposed regulation changes would increase the number of recommendations that would be considered fiduciary, including retirement plan rollover recommendations. The DOL’s proposed revisions to applicable PTEs generally would:

•add certain obligations similar to those currently found in PTE 2020-02 to PTE 84-24, but limit PTE 84-24 so it is available only to independent insurance producers who offer non-securities products of two or more insurers. Under the proposed changes to PTE 84-24, insurers would be required to undertake significant supervisory responsibilities with respect to recommendations and sales of the insurer’s own products; however the insurer would not become a fiduciary solely by performing those supervisory responsibilities; and

•require that all other parties requiring exemptive relief with respect to covered transactions comply with PTE 2020-02, and also make additional substantive changes to the exemption.

The final DOL rule is currently expected in 2024. The provisions of that final rule could have an adverse effect on sales of annuities generally, and particularly through our independent insurance distribution channel.

SEC Best Interest Regulation

In June 2020, the SEC's Regulation Best Interest (“Regulation BI”) went into effect. Regulation BI established new duties of care, compliance, disclosure, and conflict mitigation that broker-dealers and their associated persons must meet when making a recommendation of a securities transaction or investment strategy involving securities to a retail customer. As part of the rulemaking package, Form CRS also went into effect, which requires enhanced disclosures by broker-dealers and investment advisers regarding retail client relationships and certain conflicts of interest. Regulation BI and Form CRS continue to be identified as examination priorities for the SEC and the Financial Industry Regulatory Authority (“FINRA”). We have implemented the requirements of Regulation BI and Form CRS, and continue to monitor interpretative guidance and enforcement activity from federal securities regulators.

State Standard of Care Developments

In 2020, the NAIC adopted revisions to its Suitability in Annuity Transactions Model Regulation (#275) (“NAIC Model”) implementing a best interest standard of care applicable to sales and recommendations of annuities. The new NAIC Model conforms in large part to Regulation BI, providing that all recommendations by agents and insurers must be in the best interest of the consumer under known circumstances at the time an annuity recommendation is made, without placing agents’ or insurers’ financial interests ahead of the consumer’s interest in making a recommendation. A substantial majority of states have adopted amendments to their suitability rules based on the NAIC Model revisions. In addition, certain state insurance and/or securities regulators and legislatures have adopted, or are considering adopting, their own standards of conduct, some of which are broader in scope than the NAIC Model. For example, in 2018, the NYDFS adopted the First Amendment to Insurance Regulation 187 — Suitability and Best Interests in Life Insurance and Annuity Transactions (“Regulation 187”). As amended, Regulation 187 requires producers to act in their client’s best interest when making both point-of-sale and in-force recommendations and to deliver to the client the written basis for the recommendation, as well as the facts and analysis to support the recommendation. The amended regulation also imposes additional duties on life insurance companies in relation to these transactions, such as requiring insurers to establish and maintain procedures designed to prevent financial exploitation and abuse. Besides New York, other states have also adopted, or are considering adopting, legislative and/or regulatory proposals implementing fiduciary duty standards with applicability to insurance producers, agents, financial advisors, investment advisers, broker-dealers and/or insurance companies. The proposals vary in scope, applicability and timing of implementation. We cannot predict whether any such proposals will be adopted. However, changes in standards of care could impose additional costs in the areas of compliance and employee training and affect how we manage our business and overall costs.

Federal Retirement Legislation

On December 20, 2019, the Setting Every Community Up for Retirement Enhancement (“SECURE”) Act was signed into law. The SECURE Act includes many provisions affecting qualified contracts, some of which became effective upon enactment on January 1, 2020, or later, and some of which were retroactively effective.

In December 2022, Congress enacted comprehensive retirement legislation known as “SECURE 2.0.” SECURE 2.0 included many provisions affecting qualified contracts, many of which became effective in 2023, and additional ones that become effective in 2024 or subsequent years. Some of the SECURE 2.0 provisions that became effective in 2023 include, without limitation: an increase in the age at which required minimum distributions generally must commence, to age 73 from the previous age of 72; elimination of the first day of the month requirement for governmental Section 457(b) plans; and optional treatment of employer contributions as Roth sources. We are implementing new processes and procedures, where needed, designed to comply with the new requirements.

Corebridge | 2023 Form 10-K 31

Securities, Investment Adviser, Broker-Dealer and Investment Company Regulations

Our investment products and services are subject to applicable federal and state securities, investment advisory, fiduciary, and other laws and regulations. The principal U.S. regulators of these operations include the SEC, FINRA, CFTC, Municipal Securities Rulemaking Board, state securities commissions, state insurance departments and the DOL.

Our variable life insurance, variable annuity and mutual fund products generally are subject to regulation as “securities” under applicable federal securities laws, except where exempt. Such regulation includes registration of the offerings of these products with the SEC, unless exempt from such registration, and requirements of distribution participants to be registered as broker-dealers, as well as recordkeeping, reporting and other requirements. This regulation also involves the registration of mutual funds and other investment products offered by our businesses, and the separate accounts through which our variable life insurance and variable annuity products are issued, as investment companies under the Investment Company Act, except where exempt. The Investment Company Act imposes requirements relating to compliance, corporate governance, disclosure, recordkeeping, registration and other matters. In addition, the offering of these products may involve filing and other requirements under the securities, corporate, or other laws of the states and other jurisdictions where offered or organized, including the District of Columbia and U.S. territories. Our separate account investment products are also subject to applicable state insurance regulation.

We have several subsidiaries that are registered as broker-dealers under the Exchange Act and are members of FINRA and/or are registered as investment advisers under the Investment Advisers Act of 1940, as amended (the ‘‘Advisers Act’’). Certain of these broker-dealers and investment advisers are involved in our life and annuity product sales, including participating in their distribution and/or serving as an investment adviser to mutual funds that underlie variable products offered by us. Other subsidiaries are registered with the SEC as investment advisers under the Advisers Act and serve as an investment adviser to out-of-plan and in-plan participant customers, act as investment advisers to our insurance subsidiaries and certain non-insurance subsidiaries and also provide investment management and advisory services to unaffiliated institutional clients. In addition to registration requirements, the Exchange Act, the Advisers Act and the regulations thereunder impose various compliance, disclosure, qualification, recordkeeping, reporting and other requirements on these subsidiaries and their operations. State securities laws also impose filing and other requirements on broker-dealers, investment advisers and/or their licensed representatives, except where exempt. The SEC, FINRA and other regulatory bodies also have the authority to examine regulated entities, such as our broker-dealer and investment adviser subsidiaries, and to institute administrative or judicial proceedings that may result in censure, fines, prohibitions or restrictions on activities, or other administrative sanctions.

Further, our licensed sales professionals appointed with certain of our broker-dealer and/or investment adviser subsidiaries and our other employees, insofar as they sell products that are securities, including wholesale and retail activity, are subject to the Exchange Act and to examination requirements and regulation by the SEC, FINRA and state securities commissioners. Regulation and examination requirements also extend to our subsidiaries that employ or control those individuals.

The business of our investment adviser subsidiaries will be impacted by SEC regulatory initiatives with respect to the investment management business. The SEC is engaged in various initiatives and reviews that seek to modernize the regulatory structure governing the investment management industry, including investment advisers registered under the Advisers Act and investment companies registered under the Investment Company Act. The SEC has also adopted comprehensive rules changing the regulation of investment advisers to private funds, and has proposed rules that prohibit investment advisers from outsourcing certain services or functions without meeting minimum requirements, address investment adviser custody of client assets and require investment advisers (and broker-dealers) to neutralize or eliminate conflicts of interests associated with advisers’ use of predictive data analytics in connection with certain investor interactions. In November 2022, the SEC proposed a rule and related amendments that, among other things, change how open-end funds, other than money market funds and ETFs, manage their liquidity risk. The proposed rule requires these funds to use a liquidity management tool called “swing pricing” and to implement a “hard close,” and compelling funds to provide timelier and more detailed public reporting of fund information. If adopted as proposed, the regulatory, compliance, and operational burdens associated with these proposals will be costly and may impede the growth of certain investment adviser subsidiaries, and the hard close and swing pricing proposal in particular raises significant operational challenges for mutual funds and intermediaries that offer fund shares, including our insurance company and recordkeeping subsidiaries.

Corebridge | 2023 Form 10-K 32

Environmental, Social and Governance Regulation

Federal and state laws and regulations regarding ESG issues may be applicable to our operations. At the federal level, the SEC has instituted a comprehensive regulatory agenda focusing on ESG issues. The SEC commissioners and staff announced a number of actions, including forming an enforcement task force designed to harmonize the efforts of the SEC’s divisions and offices, proposed comprehensive rulemakings for ESG disclosure for investment advisers and funds registered under the Investment Company Act and climate-specific disclosure for public issuers and addressing stockholder rights and creating accountability in statements and conduct. The SEC’s Division of Examinations issued a risk alert in 2021 highlighting ESG deficiencies, internal control weaknesses and effective practices identified during recent examinations of investment advisers, registered investment companies and private funds. The SEC’s Division of Examinations has continued to focus on ESG-related advisory services and investment products and the ESG has continued to pursue ESG related enforcement actions. The increased regulatory and compliance burdens that we expect would result from the implementation of any of these initiatives could be costly.

On March 21, 2022, the SEC released proposed rule changes on climate-related disclosure, among other items. The proposed rule changes would require registrants, including public issuers such as us, to include certain climate-related disclosures in registration statements and periodic reports. These proposed disclosures include information about climate-related risks that are reasonably likely to have a material impact on the registrant’s business, results of operations, or financial condition, and include a new note to their audited financial statements that provides certain climate-related metrics and impacts on a line-item basis. The required information about climate-related risks also would include disclosure of a registrant’s greenhouse gas emissions (including Scope 3 emissions), information about climate-related targets and goals, and transition plan, if any, and would require extensive attestation requirements. If adopted as proposed, the rule changes are expected to result in additional compliance and reporting costs.

At the state level, California adopted climate disclosure and financial reporting legislation, the Climate Corporate Data Accountability Act, and the Climate Related Financial Risk Act, in 2023, which will require, beginning in 2026, reporting from large U.S. public and private companies doing business in California on greenhouse gas emissions and biennial climate-related financial risk reports. States continue to adopt laws and regulations governing corporate ESG activity and there is increasing scrutiny and evolving expectations from investors, customers, regulators and other stakeholders on ESG practices and disclosures, including those related to environmental stewardship, climate change, diversity, equity and inclusion, racial justice, workplace conduct and other social and political mandates.

Privacy, Data Protection and Cybersecurity

We are subject to U.S. federal and state laws and regulations that require financial institutions and other businesses to implement and maintain technical, organizational and physical measures designed to protect the confidentiality, availability and integrity of personal information and sensitive non-public information and the information systems used to process this information and conduct important business operations. These laws and regulations impose a broad range of obligations including collecting , disclosing, using, transferring, retaining, deleting, and otherwise processing (collectively, “Processing”) personal information in compliance with certain restrictions; notifying data subjects regarding our personal information Processing practices; and maintaining a security program designed to protect the confidentiality, availability and integrity of personal information, sensitive non-public information and our information systems. Some of these laws and regulations require us to notify affected individuals, regulators and self-regulatory bodies of certain events involving the unauthorized access to, use of or loss of, personal information, sensitive non-public information and information systems.

On November 1, 2023, the NYDFS published an amendment to its Part 500 Cybersecurity Regulation (“NYDFS Cybersecurity Regulation”). The amended NYDFS Cybersecurity Regulation went into effect upon publication and compliance with the amended requirements occurs in phases starting December 1, 2023 and continuing through December 2025 and includes additional certification obligations, enhanced governance requirements, new audit requirements, additional technology and business continuity requirements, enhanced security control and training requirements and new notification obligations. Requirements under the NYDFS Cybersecurity Regulation are similar in certain respects to those under the NAIC Insurance Data Security Model Law (“Model Law”), which requires insurers, insurance producers and other entities required to be licensed under state insurance laws to develop and maintain a written information security program, conduct risk assessments, oversee the data security practices of third-party service providers and other related requirements. Approximately 22 U.S. states have adopted a version of the Model Law as of the end of 2023.

The SEC continues to focus on cybersecurity for a range of regulated entities, including public companies, registered investment companies, broker-dealers, investment advisers and funds and has published periodic guidance on the topic, recommending periodic assessments of information, how it is stored and how vulnerable it is, as well as strategies to prevent, detect and respond to cyber threats, including as it relates to risks faced by the advisers’ third-party service providers. In July 2023, the U.S. Securities and Exchange Commission adopted the Risk Management, Strategy, Governance, and Incident Disclosure Final Rule (the “Cybersecurity Final Rule”) that enhances the disclosure requirements for registered companies covering cybersecurity risk and management and requires registrants to disclose material cybersecurity incidents on Form 8-K within four business days of a determination that the

Corebridge | 2023 Form 10-K 33 impact of a cybersecurity incident is material. These disclosure requirements under the Cybersecurity Final Rule became effective in December 2023.

On January 1, 2023, the California Privacy Rights Act (“CPRA”), which amends the California Consumer Privacy Act of 2018 (“CCPA”) became effective. The CCPA imposes a number of requirements on businesses that collect the personal information of California consumers, including requirements that provide individuals with certain rights to their personal information and make mandatory disclosures regarding how the businesses use and disclose consumers’ personal information, establishes a private right of action in some cases if consumers’ personal information is subject to a data breach as a result of the business’s violation of the duty to implement and maintain reasonable security practices and creates the California Privacy Protection Agency which is charged with drafting and adopting regulations in furtherance of the CCPA and enforcing the CCPA , as amended by the CPRA. Similar consumer privacy legislation has been enacted in other states and became effective in 2023, such as Virginia, Colorado, Connecticut and Utah.

U.S. federal and state legislatures and government agencies and self-regulatory bodies are expected to continue to consider additional laws, regulations and guidelines relating to privacy and other aspects of customer information and to protecting the ongoing confidentiality, availability and integrity of personal information, sensitive non-public information and information systems. These continued changes in the U.S. privacy and cybersecurity regulatory landscape will require additional compliance investment, including changes to policies, procedures, information systems and operations.

INTERNATIONAL REGULATION

Insurance and Financial Services Regulation

A portion of our business is conducted in foreign countries. Generally, our subsidiaries operating in foreign jurisdictions must satisfy local regulatory requirements; licenses issued by foreign authorities to our subsidiaries are subject to modification or revocation by such authorities, and therefore these subsidiaries could be prevented from conducting business in certain of the jurisdictions where they currently operate. For our international operations, a decline in capital and surplus over capital requirements would limit the ability of our insurance subsidiaries to make dividend payments or distributions. Additionally, regulators in the countries in which such subsidiaries operate may deem it necessary to impose restrictions on dividend distributions in the event of a significant financial market or insurance event which creates uncertainty over our future capital and solvency position.

Our UK insurance subsidiary, AIG Life, which is currently subject to a definitive agreement signed on September 25, 2023 to sell the company to Aviva, subject to the required regulatory approvals being obtained (see “Our Segments—Life Insurance—Overview”), is subject to dual regulation by the UK Prudential Regulation Authority (the “PRA”) and the UK Financial Conduct Authority (the “FCA”). The PRA oversees the financial health and stability of insurance companies and is responsible for the prudential regulation and day-to-day supervision of insurance companies. The PRA also oversees statutory requirements for UK insurers, including capital adequacy and liquidity requirements and minimum solvency margins, to which AIG Life must adhere. The FCA seeks to protect consumers and is responsible for conduct regulation and oversees financial services products and practices, including those governing insurance companies in the UK.

The Bermuda Monetary Authority (the “BMA”) regulates our insurance subsidiary in Bermuda, Corebridge Insurance Company of Bermuda, Ltd. (“CRBG Bermuda”). The Insurance Act 1978, as amended, (the “Bermuda Insurance Act”) and its related regulations and other applicable Bermuda law, impose a variety of requirements and restrictions including the filing of annual and quarterly statutory financial returns; compliance with minimum enhanced capital requirements; compliance with the BMA’s Insurance Code of Conduct; provisional restrictions on the payment of dividends and distributions; and restrictions on certain changes in control of regulated (re)insurers. The term “insurer” includes “reinsurer” in the Bermuda Insurance Act.

CRBG Bermuda, which is currently licensed to carry on long-term business, is registered as a Class E insurer which is the license class for long-term insurers with total assets of more than $500 million. CRBG Bermuda is not licensed to carry on general business. CRBG Bermuda has received authorization as a reciprocal jurisdiction reinsurer from the state of Texas.

Pursuant to the terms of the Bermuda Insurance Act, as a Class E insurer, CRBG Bermuda will not be permitted to engage in non-insurance business unless that non-insurance business is ancillary to its core business. Non-insurance business means any business other than insurance business and includes carrying on investment business, underwriting debt or securities or otherwise engaging in investment banking and carrying on the business of management, sales or leasing of real property.

A Class E insurer must refrain from declaring or paying any dividends during any financial year if it would cause the company to fail to meet its minimum margin of solvency or enhanced capital requirement. Furthermore, a long‐term insurer may not declare or pay a dividend to any person other than a policyholder unless the value of the assets of its long‐term business fund (as certified by the company’s approved actuary) exceeds the value of the liabilities of its long‐term business and the amount of any such dividend shall not exceed the aggregate of that excess and any other funds properly available for the payment of dividends arising out of the company’s non- long‐term business. In addition to the foregoing restrictions under the Bermuda Insurance Act, as an incorporated Bermuda company, CRBG Bermuda remains subject to the provisions of the Bermuda Companies Act 1981, as amended, which has restrictions on when a company is able to pay dividends and distributions.

Corebridge | 2023 Form 10-K 34

On March 9, 2023, the BMA released a Guidance Note entitled “Management of Climate Change Risks for Commercial Insurers,” which focuses on the BMA’s expectations for commercial insurers, such as CRBG Bermuda, regarding their management and reporting of climate change risks.

Derivatives

Regulation of, and restrictions on, derivatives markets and transactions were adopted outside the United States in conjunction with similar regulation promulgated by U.S. regulators. (For U.S. derivatives discussion, see “U.S. Regulation—Dodd-Frank” for further information.) For instance, the EU and UK established a set of regulatory requirements for EU and UK derivatives activities and EU- and UK-regulated entities under the European Market Infrastructure Regulation (“EMIR”) and English law, respectively. These requirements include, among other things, various risk mitigation, risk management, margin posting, regulatory reporting and, for certain categories of derivatives, clearing requirements, that are broadly similar to, but also deviate in certain respects from, U.S. regulations of these activities.

Markets in Financial Instruments Directive II

The Markets in Financial Instruments Directive II (“MiFID II”) and Markets in Financial Instruments Regulation took effect in Europe on January 3, 2018. MiFID II and the related regulations are intended to create transparency in market trading by, for example, imposing trade and transaction reporting and other requirements. Corebridge Institutional Investments (Europe), Limited has implemented and continues to implement new policies, procedures and reporting protocols required to ensure compliance with this legislation and its related rules.

EMIR, which governs derivatives, and MiFID II were adopted by the UK government as part of the Brexit legislative “onshoring” process. The MiFID II requirements were implemented in the UK before the UK’s exit from the EU and then amended to reflect the UK’s exit from the EU. The Markets in Financial Instruments Regulation (“MiFIR”) and EMIR were “onshored” to become part of English law. The UK government has announced intended reforms to the MiFID II rules governing trading venues and equity markets in the UK, onshored versions of MiFID II and MiFIR in the Wholesale Markets Review and minor changes to EMIR. At present, it is anticipated that substantive obligations on Corebridge Institutional Investments (Europe), Limited arising from EMIR and MIFID II are unlikely to change in the UK context in the near future.

Securities, Investment Adviser, Broker-Dealer and Investment Company Regulation

We operate investment-related businesses in, among other jurisdictions, the UK. These businesses may advise on and market investment management products and services, investment funds and separately managed accounts. The regulatory authorities for these businesses include securities, investment advisory, financial conduct and other regulators that typically oversee such issues as: (1) company licensing; (2) the approval of individuals with positions of responsibility; (3) conduct of business to customers, including sales practices; (4) solvency and capital adequacy; (5) fund product approvals and related disclosures; and (6) securities, commodities and related laws, among other items. For example, our regulated asset manager in the UK is subject to the Senior Managers and Certification Regime (“SMCR”), which aims to reduce harm to consumers and strengthen market integrity by making senior individuals more accountable for their conduct and competence. The SMCR is currently being reviewed by HM Treasury, the PRA and the FCA following a joint Discussion Paper published by the PRA and the FCA. We also participate in investment-related joint ventures in jurisdictions outside the United States, primarily in Europe and Asia. In some cases, our international investment operations are also subject to U.S. securities laws and regulations.

FSB and IAIS

The Financial Stability Board (the “FSB”) consists of representatives of national financial authorities of the G20 countries. The FSB is not a regulator but is focused primarily on promoting international financial stability.

The International Association of Insurance Supervisors (“IAIS”) represents insurance regulators and supervisors of more than 200 jurisdictions (including regions and states) in nearly 140 countries and seeks to promote globally consistent insurance industry supervision. The IAIS is not a regulator, but one of its activities is to develop insurance regulatory standards for use by local authorities across the globe. The IAIS has adopted ComFrame, a Common Framework for the Supervision of Internationally Active Insurance Groups (“IAIGs”). ComFrame sets out qualitative and quantitative standards for group supervision, governance and internal controls, enterprise risk management, and recovery and resolution planning. As part of ComFrame, the IAIS is developing a risk-based global insurance capital standard applicable to IAIGs, with the purpose of creating a common language for supervisory discussions of group solvency of IAIGs. Although AIG has been designated as an IAIG, we are not to date separately designated as an IAIG.

The IAIS has adopted a holistic framework (“Holistic Framework”) for the assessment and mitigation of systemic risk in the insurance sector. The Holistic Framework recognizes that systemic risk can emanate from specific activities and exposures arising from either sector-wide trends or concentrations in individual insurers.

Corebridge | 2023 Form 10-K 35

In light of the IAIS adoption of the Holistic Framework, the FSB decided in December 2022 to discontinue the annual identification of Global Systematically Important Insurers in favor of instead applying the Holistic Framework to inform the FSB’s consideration of systemic risk in insurance.

The standards issued by the FSB and/or the IAIS are not binding on the United States or other jurisdictions around the world unless and until the appropriate local governmental bodies or regulators adopt laws and regulations implementing such standards. At this time, as these standards have been adopted only relatively recently and in some cases remain under development, it is not known how the IAIS’s frameworks and/or standards might be implemented in the United States and other jurisdictions around the world or how they might ultimately apply to us.

Privacy, Data Protection and Cybersecurity

Our UK entities, and potentially certain entities not established in the UK, are subject to data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) (i.e., Regulation (EU) 2016/679) (“EU GDPR”) as it forms part of retained EU law (as defined in the European Union (Withdrawal) Act 2018) and the UK Data Protection Act of 2018. The UK GDPR imposes a range of compliance obligations in relation to the processing of personal information, including the rights of data subjects to, in certain circumstances, request access, correction and deletion of their personal information and not to be subject to a decision based solely on automated processing, robust internal accountability controls and short timelines for data breach notifications.

Sanctions for non-compliance with the UK GDPR include fines of up to the higher of £17.5 million or 4% of global worldwide turnover for the most serious infringements. In March 2022, the UK introduced the International Data Transfer Agreement (“IDTA”) and International Data Transfer Addendum (“Addendum”) for the cross-border transfer of personal data. All contracts signed on or after September 22, 2022, must use the new IDTA or Addendum in place of the previously used Standard Contractual Clauses (“SCCs”) for cross-border data transfers. All contracts entered into prior to September 22, 2022, incorporating the previously used SCCs must be updated to include the IDTA or Addendum by March 22, 2024, onwards. While data protection law in the UK remains closely aligned with that in the EU, it is possible that they diverge in the future. Proposals for general reform of the current data protection regime are under consideration by the UK government. At present, there is no timescale for any changes to be made.

Our entities established within the European Economic Area countries (“EEA”), and certain entities not established in the EEA, are subject to data protection legislation, including the EU GDPR. The EU GDPR imposes a range of compliance obligations in relation to the processing of personal information, including the rights of data subjects to, in certain circumstances, request access, correction and deletion of their personal information and not to be subject to a decision based solely on automated processing, robust internal accountability controls, and shorten timelines for data breach notifications. Sanctions for non-compliance include fines of up to the higher of €20 million or 4% of global worldwide turnover for the most serious infringements. The Data Protection Commissioner in Ireland is an active regulator issuing a number of fines across industries including extensive fines against companies for data protection violations. The European Commission issued new EU SCCs for international data transfers to address the requirements arising out of the decision of the Court of Justice of the European Union in Data Prot. Comm’r, v. Facebook Ireland Ltd. and align with the corresponding guidance from the European Data Protection Board (“EDPB”). All existing SCCs entered into prior to September 27, 2021, were required to be replaced with the new EU SCCs by December 27, 2022. All new agreements executed on or after September 26, 2021 have had to use the new EU SCCs where relevant. The EDPB has issued additional guidance, further clarifying what constitutes international data transfers, and such international data transfers have been subject to increasing scrutiny by data protection supervisory authorities in the EU.

The EEA and the UK have also taken steps to regulate the use of personal data, including external data, and algorithms used for the purpose of AI and automated decision-making. On December 8, 2023, the European Commission, the European Parliament and the European Council reached an agreement on the terms of the European Union Artificial Intelligence Act (“EU AI Act”). It is anticipated that the EU AI Act will be finalized in the first quarter of 2024, with its various provisions coming into force at different points over a two-year period. As currently proposed, the EU AI Act will impose risk-based regulation of AI and, inter alia, (i) prohibit certain AI applications / use cases, (ii) impose potentially significant compliance burdens on designated “high risk” AI, and (iii) introduce specific transparency and labeling requirements for lower risk AI applications / use cases, but which still pose a risk of confusion (e.g., the use of chatbots).

The BMA introduced the Insurance Sector Operational Cyber Risk Management Code of Conduct (“Cyber Code of Conduct”) which became effective on January 1, 2021, and full compliance has been required since December 31, 2021. The Cyber Code of Conduct requires that registrants, such as AIGB, (i) comply with certain new requirements including being able to evidence that there is adequate board visibility and governance of cyber risk, (ii) maintain an operational cyber risk management program, and (iii) establish an asset inventory detailing all information assets.

Corebridge | 2023 Form 10-K 36

Available Information

Our corporate website iswww.corebridgefinancial.com. We make available free of charge, through the Investor Relations section of our corporate website, the following reports (and related amendments as filed with the SEC) as soon as reasonably practicable after such materials are electronically filed with, or furnished to, the SEC:

•Annual Reports on Form 10-K

•Quarterly Reports on Form 10-Q

•Current Reports on Form 8-K

•Proxy Statements on Schedule 14A, as well as other filings with the SEC

Also available on our corporate website:

•Audit Committee Charter

•Corporate Governance Guidelines

•Director, Executive Officer and Senior Financial Officer Code of Business Conduct and Ethics (we will post on our website any amendment or waiver to this Code within the time period required by the SEC)

•Employee Code of Conduct

Except for the documents specifically incorporated by reference into this Annual Report on Form 10-K, information contained on our website or that can be accessed through our website is not incorporated by reference into this Annual Report on Form 10-K. Reference to our website is made as an inactive textual reference.