Ameriprise Financial Inc.: 10-K Risk Factor Changes

Ameriprise Financial is subject to ongoing supervision by the FRB, including supervision and prudential standards, capital requirements, stress-testing, resolution planning, information security and privacy, and risk management requirements. Further, as a financial holding company, our activities are limited to those that are financial in nature, incidental to a financial activity or, with FRB approval, complementary to a financial activity. Our broker-dealers and bank subsidiary are limited in their ability to lend or transact with affiliates and are subject to minimum regulatory capital and other requirements, as well as limitations on their ability to use funds deposited with them in brokerage or bank accounts to fund their businesses. These requirements may hinder our ability to access funds from our subsidiaries. We may also become subject to a prohibition or limitations on our ability to pay dividends or repurchase our common stock. The federal banking regulators, including the OCC, FRB, FDIC, and SEC (through FINRA) have the authority and under certain circumstances, the obligation, to limit or prohibit dividend payments and stock repurchases by the banking organizations they supervise, including Ameriprise and its bank subsidiaries. Any changes to regulations or changes to the supervisory approach may also result in increased compliance costs to the extent we are required to modify our existing compliance policies, procedures and practices. Compliance with bank holding company laws and regulations, including the Volcker Rule, impacts the structure and availability of certain of our products and services and our costs in providing those products and services. Costs of compliance may be driven by how 26 26 26 26 26 26

Ameriprise Financial is subject to ongoing supervision by the FRB, including supervision and prudential standards, capital requirements, stress-testing, resolution planning, information security and privacy, and risk management requirements. Further, as a financial holding company, our activities are limited to those that are financial in nature, incidental to a financial activity or, with FRB approval, complementary to a financial activity. Our broker-dealers and bank subsidiary are limited in their ability to lend or transact with affiliates and are subject to minimum regulatory capital and other requirements, as well as limitations on their ability to use funds deposited with them in brokerage or bank accounts to fund their businesses. These requirements may hinder our ability to access funds from our subsidiaries. We may also become subject to a prohibition or limitations on our ability to pay dividends or repurchase our common stock. The federal banking regulators, including the OCC, FRB, FDIC, and SEC (through FINRA) have the authority and under certain circumstances, the obligation, to limit or prohibit dividend payments and stock repurchases by the banking organizations they supervise, including Ameriprise and its bank subsidiaries. Any changes to regulations or changes to the supervisory approach may also result in increased compliance costs to the extent we are required to modify our existing compliance policies, procedures and practices. Compliance with bank holding company laws and regulations, including the Volcker Rule, impacts the structure and availability of certain of our products and services and our costs in providing those products and services. Costs of compliance may be driven by how these laws and regulations and the scale of Ameriprise Bank evolves over the course of time as well as strategic acquisitions and other growth strategies we pursue in the future. Failure to meet one or more of these requirements could, depending on the violation, limit Ameriprise’s ability to undertake new activities, continue certain activities, or make acquisitions other than those permitted generally for bank holding companies. Execution of our business strategies also may require certain regulatory approvals or consents, which may include approvals of the FRB and other domestic and non-U.S. regulatory authorities. These regulatory authorities may impose conditions on the activities or transactions contemplated by our business strategies which may negatively impact our ability to realize fully the expected benefits of certain opportunities.

Our businesses operate in intensely competitive industries, including broker-dealers, banks, asset managers, insurers and other financial institutions, some of which have a larger market share, greater investments in technology and analytics, greater investment in advertising and brand, less regulation or greater financial resources than we do. Furthermore, new and existing competitors may be better able to address trends, structural changes, or movement of assets resulting from new technologies, including Generative AI and blockchain, or adapt to industry changes or in response to the uncertain regulatory environment in the U.S. and around the world. We could experience lower sales, higher costs, talent loss, technology obsolescence or other developments that could negatively impact our results of operations.

Our businesses operate in intensely competitive industries, including broker-dealers, banks, asset managers, insurers and other financial institutions, some of which have a larger market share, greater investments in technology and analytics, greater investment in advertising and brand, less regulation or greater financial resources than we do. Furthermore, our competitors may be better able to address trends, structural changes, or movement of assets resulting from industry changes or in response to the uncertain regulatory environment in the U.S. and around the world. We could experience lower sales, higher costs, technology obsolescence or other developments that could negatively impact our results of operations.

Our business is reliant upon internal and third-party-controlled, -developed and -operated software (which includes opensource software), technology systems and networks to process, transmit and store information, including our current, potential and former clients’, employees’ and advisors’ personal information, as well as our proprietary information, and to conduct many of our business activities and transactions. Maintaining the security and integrity of our software, information and these systems and networks, and appropriately responding to any cybersecurity and privacy incidents (including attempts to attack or access our network), is critical to the success of our business operations, including our reputation, the retention of our advisors and clients, and to the protection of our proprietary information and our clients’ personal information. We rely on the third parties with whom we do business to identify and remediate software and other vulnerabilities in the assets and systems they use to run their business before they can be exploited by bad actors, but the third parties cannot always do so. For example, zero-day vulnerabilities in software and other technology solutions are immediately exploitable by bad actors as occasionally happens with certain of our vendors in the industry. We routinely face attacks and seek to address evolving threats of which we become aware. We have been able to identify, protect, detect, respond to and recover from these attacks to date without a material loss of client financial assets or information through the use of ongoing internal and external threat monitoring and by making continual adjustments to our security and incident response capabilities. We and our advisors, as well as our service providers and clients, have also been threatened by, among others, phishing, vishing, and spear phishing scams, social engineering attacks (such as direct voice contact and any technology or communication mechanism to contact a person), account takeovers, introductions of malware, attempts at electronic break-ins, and the submission of fraudulent payment requests. The number of threats and events has increased substantially every year, which is expected to continue, particularly as the use of AI makes these attempts look more legitimate and is leveraged to improve their effectiveness. Attempted or successful breaches or interference by third parties or by insiders that may occur in the future could have a material adverse impact on our business, reputation, financial condition or results of operations. On a corporate basis, various laws and regulations, and in some cases contractual obligations, require us to establish and maintain corporate policies and technical and operational measures designed to protect sensitive client, employee, contractor and vendor information, and to respond to cybersecurity incidents in certain ways and timeframes. We have established policies and implemented 22 22 22 22 22 22

Our business is reliant upon internal and third-party-controlled, -developed and -operated software (which includes opensource software), technology systems and networks to process, transmit and store information, including our current, potential and former clients’, employees’ and advisors’ personal information, as well as our proprietary information, and to conduct many of our business activities and transactions. Maintaining the security and integrity of our software, information and these systems and networks, and appropriately responding to any cybersecurity and privacy incidents (including attempts to attack or access our network), is critical to the success of our business operations, including our reputation, the retention of our advisors and clients, and to the protection of our proprietary information and our clients’ personal information. We rely on the third parties with whom we do business to identify and remediate software and other vulnerabilities in the assets and systems they use to run their business before they can be exploited by bad actors, but the third parties cannot always do so. For example, zero-day vulnerabilities in software and other technology solutions are immediately exploitable by bad actors as occasionally happens with certain of our vendors in the industry. We routinely face attacks and seek to address evolving threats of which we become aware. We have been able to identify, protect, detect, respond to and recover from these attacks to date without a material loss of client financial assets or information through the use of ongoing internal and external threat monitoring and by making continual adjustments to our security and incident response capabilities. We and our advisors, as well as our service providers and clients, have also been threatened by, among others, phishing, vishing, and spear phishing scams, social engineering attacks (such as direct voice contact and any technology or communication mechanism to contact a person), account takeovers, introductions of malware, attempts at electronic break-ins, and the submission of fraudulent payment requests. The number of threats and events has increased substantially every year, which is expected to continue, particularly as the use of artificial intelligence makes these attempts look more legitimate. Attempted or successful breaches or interference by third parties or by insiders that may occur in the future could have a material adverse impact on our business, reputation, financial condition or results of operations. On a corporate basis, various laws and regulations, and in some cases contractual obligations, require us to establish and maintain corporate policies and technical and operational measures designed to protect sensitive client, employee, contractor and vendor information, and to respond to cybersecurity incidents in certain ways and timeframes. We have established policies and implemented such technical and operational measures ourselves and have in place policies that require our service providers and franchisee advisors, each of which control locally their own technology operations, to do the same. The hybrid work environment among our employees adds complexity to monitoring and processing procedures. Changes in our business or technological advancements may also require corresponding changes in our systems, networks and data security and response measures. While accessing our products and services, our clients may use computers and other devices that sit outside of our security control environment. In addition, the ever-increasing reliance on technology systems and networks and the occurrence and potential adverse impact of attacks on such systems and networks (including in recent well-publicized security breaches at other companies), both generally and in the financial services industry, have enhanced government and regulatory scrutiny of the measures taken by companies to protect against cybersecurity threats and report incidents they suffer. As these threats, and government and regulatory oversight of associated risks, continue to evolve, we may be required to expend significant additional resources (both direct financial resources and indirect costs like people) to enhance or expand upon the technical and operational security and response measures we currently maintain or that we allow franchise advisors to maintain and control locally. These regulator-driven changes may adversely impact the client experience by, for example, requiring multiple or new means of verifying the identity of a client before they can interact with us. Despite the measures we have taken and may in the future take to address and mitigate cybersecurity, privacy and technology risks, we cannot be certain that our systems and networks, or those used by our vendors and franchisees, will not be subject to successful 23 23 23 23 23 23

Our policies and procedures to identify, monitor and manage risks may not be fully effective in mitigating our risk exposure in all market environments or against all types of risk. Many of our methods of managing risk and the associated exposures are based upon our use of observed historical experience or expectations about future experience (e.g., market behavior, client/policyholder behavior, employee behavior, mortality, etc.) or statistics based on historical models. Experience may not emerge as expected and during periods of market volatility, or due to unforeseen events, the historically derived experience and correlations may not be valid. As a result, these methods and models may not predict future exposures accurately, which could be significantly greater than what our models indicate. Further some controls are manual and are subject to inherent limitations and we have a general model risk where there is a risk of loss associated with insufficient or inaccurate models that we use to support our decisions. This could cause us to incur investment losses or cause our hedging and other risk management strategies to be ineffective. Other risk management methods depend upon the evaluation of information regarding markets, clients, catastrophe occurrence or other matters that are publicly available or otherwise accessible to us, which may not always be accurate, complete, up-to-date or properly evaluated. Our financial performance also requires us to develop, effectively manage, and market new or existing products and services that appropriately anticipate or respond to changes in the industry and evolving client demands. The development and introduction of new products and services, including the creation of Asset Management and other products with a focus on values-based matters, require continued innovative effort and may require significant time, resources, and ongoing support. Further, avoiding introducing or encouraging certain new products (such as cryptocurrency) creates the risk of losing assets or new flows to competitors who encourage or support those products. Substantial risk and uncertainties are associated with the introduction and ongoing maintenance of new products and services, including the implementation of new and appropriate operational controls and procedures, shifting and sometimes contradictory client and market preferences, the introduction of competing products or services and compliance with regulatory requirements. AI, including Generative AI, presents many benefits in terms of operating efficiency, but also certain risks that we need to seek to mitigate through our strategic and risk management policies, such as reliance on information that may be inaccurate or unfairly discriminatory results. We and our vendors, along with developers of AI solutions, rely on third‑party and commercial AI technologies that could introduce risks that are not anticipated by existing governance, vendor risk management and model oversight frameworks. Failure to adequately mitigate such risks at the design or development stage could lead to problems when AI technologies are deployed. A growing patchwork of state AI laws with differing definitions, obligations and compliance expectations may require adjustments to our processes, documentation and oversight of third‑party technology, and how we manage AI use in our business. At the same time, more prescriptive frameworks in certain jurisdictions—such as the European Union—include detailed governance, transparency and reporting expectations that may not align with expectations or requirements elsewhere, increasing operational complexity. Management of operational, legal and regulatory risks requires, among other things, policies and procedures to record properly and verify a large number of transactions and events, and these policies and procedures may not be fully effective in mitigating our risk exposure in all market environments or against all types of risk, including those associated with our key vendors. Insurance and other traditional risk-shifting tools may be held by or available to us in order to manage certain exposures, but they are subject to terms such as deductibles, coinsurance, limits and policy exclusions, as well as risk of counterparty denial of coverage, default or insolvency.

Our policies and procedures to identify, monitor and manage risks may not be fully effective in mitigating our risk exposure in all market environments or against all types of risk. Many of our methods of managing risk and the associated exposures are based upon our use of observed historical experience or expectations about future experience (e.g., market behavior, client/policyholder behavior, employee behavior, mortality, etc.) or statistics based on historical models. Experience may not emerge as expected and during periods of market volatility, or due to unforeseen events, the historically-derived experience and correlations may not be valid. As a result, these methods and models may not predict future exposures accurately, which could be significantly greater than what our models indicate. Further some controls are manual and are subject to inherent limitations and we have a general model risk where there is a risk of loss associated with insufficient or inaccurate models that we use to support our decisions. This could cause us to incur investment losses or cause our hedging and other risk management strategies to be ineffective. Other risk management methods depend upon the evaluation of information regarding markets, clients, catastrophe occurrence or other matters that are publicly available or otherwise accessible to us, which may not always be accurate, complete, up-to-date or properly evaluated. Our financial performance also requires us to develop, effectively manage, and market new or existing products and services that appropriately anticipate or respond to changes in the industry and evolving client demands. The development and introduction of new products and services, including the creation of Asset Management and other products with a focus on environmental, social and governance matters, require continued innovative effort and may require significant time, resources, and ongoing support. Further, avoiding introducing or encouraging certain new products (such as cryptocurrency) creates the risk of losing assets or new flows to 24 24 24 24 24 24

We have made acquisitions and divestitures in the past and may pursue similar strategic transactions in the future. Risks in acquisition transactions include difficulties in the integration of acquired businesses into our operations and control environment (including our risk management policies and procedures), difficulties in assimilating and retaining employees and intermediaries, difficulties in retaining the existing clients of the acquired entities, assumed or unforeseen liabilities that arise in connection with the acquired businesses, difficulties obtaining regulatory approval or integrating into regulatory regimes, difficulties with the software, technology and systems of the acquired entities that were subject to a different control posture before the acquisition (and until such time as we can replace these or make investments to uplift their capabilities), the failure of counterparties to satisfy any obligations to indemnify us against liabilities arising from the acquired businesses, and unfavorable market conditions that could negatively impact our growth expectations or expected synergies for the acquired businesses. Fully integrating an acquired company or business into our operations takes a significant amount of time and attention and incurs both expected and unexpected integration costs over several years. Integrations, particularly larger and more global integrations, are time-consuming and expensive and could significantly disrupt our business. Risks in divestiture transactions (many of which are present in sales of insurance blocks via reinsurance) include difficulties in the separation of the disposed business, retention of obligations to indemnify for certain liabilities, the failure of counterparties to satisfy 25 25 25 25 25 25

We have made acquisitions and divestitures in the past and may pursue similar strategic transactions in the future. Risks in acquisition transactions include difficulties in the integration of acquired businesses into our operations and control environment (including our risk management policies and procedures), difficulties in assimilating and retaining employees and intermediaries, difficulties in retaining the existing clients of the acquired entities, assumed or unforeseen liabilities that arise in connection with the acquired businesses, difficulties obtaining regulatory approval or integrating into regulatory regimes, difficulties with the software, technology and systems of the acquired entities that were subject to a different control posture before the acquisition (and until such time as we can replace these or make investments to uplift their capabilities), the failure of counterparties to satisfy any obligations to indemnify us against liabilities arising from the acquired businesses, and unfavorable market conditions that could negatively impact our growth expectations or expected synergies for the acquired businesses. Fully integrating an acquired company or business into our operations (such as our 2021 acquisition of the BMO Global Asset Management (EMEA) business) takes a significant amount of time and attention and incurs both expected and unexpected integration costs over several years. Integrations, particularly larger and more global integrations, are time-consuming and expensive and could significantly disrupt our business. Risks in divestiture transactions (many of which are present in sales of insurance blocks via reinsurance) include difficulties in the separation of the disposed business, retention of obligations to indemnify for certain liabilities, the failure of counterparties to satisfy payment obligations, unfavorable market conditions that may impact any earnout or contingency payment due to us, if any, and unexpected difficulties in losing employees of the disposed business. We cannot provide assurance that we will be successful in overcoming these risks or any other problems encountered with acquisitions, divestitures and other strategic transactions. Execution of our business strategies also may require certain regulatory approvals or consents, which may include approvals of the FRB and other domestic and non-U.S. regulatory authorities. These regulatory authorities may impose conditions on the activities or transactions contemplated by our business strategies which may negatively impact our ability to realize fully the expected benefits of certain opportunities. These risks may prevent us from realizing the expected benefits from acquisitions or divestitures and could result in the failure to realize the full economic value of a strategic transaction or the impairment of goodwill and/or intangible assets recognized at the time of an acquisition. These risks could be heightened if we complete a large acquisition or multiple acquisitions within a short period of time.

We set prices for insurance products as well as some annuity products based upon expected claims payment patterns, derived from assumptions we make about our policyholders and contractholders, including expenses, fees, investment returns, and morbidity and mortality rates. The long-term profitability of these products depends upon how our actual experience compares with our pricing assumptions. Actual experience can differ from our assumptions for many reasons over the time an insurance product is held. If mortality rates are higher than our pricing assumptions, we could be required to make greater payments under our life insurance policies and annuity contracts with guaranteed minimum death benefits than we have projected. The prices and profitability of our life insurance and deferred annuity products are based in part upon assumptions related to persistency (the probability that a policy or contract will remain in force from one period to the next). For most of our life insurance and deferred annuity products, actual persistency that is lower than our persistency assumptions could have an adverse impact on profitability, especially in the early years of a policy or contract because we would be required to accelerate the amortization of expenses we deferred in connection with the acquisition of the policy or contract. For our LTC insurance, universal life insurance policies with secondary guarantees and variable annuities with guaranteed minimum withdrawal benefits, actual persistency that is higher than our persistency assumptions could have a negative impact on profitability. If these policies remain in force longer than we assumed, we could be required to make greater benefit payments than we had anticipated when we priced or partially reinsured these products. The risk that our claims experience may differ significantly from our pricing assumptions is particularly significant for our LTC insurance products notwithstanding our ability to implement future price increases with regulatory approvals. Though we discontinued offering LTC products in 2003, LTC insurance policies provide for long-duration coverage and, therefore, our actual claims experience will continue to emerge over many years. Our ability to forecast future claim rates for LTC insurance is more limited than life insurance. We have sought to moderate these uncertainties to some extent by partially reinsuring LTC policies at the time the policies were underwritten and limiting our present stand-alone LTC insurance offerings to policies underwritten fully by unaffiliated third-party insurers, and we have also implemented rate increases and provided reduced benefit options on certain in force policies. Because our assumptions regarding persistency experience are inherently uncertain, reserves for future policy benefits and claims may prove to be inadequate if actual persistency experience is different from those assumptions. Although some of our products permit us to increase premiums during the life of the policy or contract, we cannot guarantee that these increases would be sufficient to maintain profitability. Additionally, some of these pricing changes require regulatory approval, which may not be forthcoming. Moreover, many of our products do not permit us to increase premiums or limit those increases during the life of the policy or contract, while premiums on certain other products (primarily LTC insurance) may not be increased without prior regulatory approval. Significant deviations in experience from pricing expectations regarding persistency could have an adverse effect on the profitability of our products.

and deferred annuity products, actual persistency that is lower than our persistency assumptions could have an adverse impact on profitability, especially in the early years of a policy or contract because we would be required to accelerate the amortization of expenses we deferred in connection with the acquisition of the policy or contract. For our LTC insurance, universal life insurance policies with secondary guarantees and variable annuities with guaranteed minimum withdrawal benefits, actual persistency that is higher than our persistency assumptions could have a negative impact on profitability. If these policies remain in force longer than we assumed, we could be required to make greater benefit payments than we had anticipated when we priced or partially reinsured these products. The risk that our claims experience may differ significantly from our pricing assumptions is particularly significant for our LTC insurance products notwithstanding our ability to implement future price increases with regulatory approvals. Though we discontinued offering LTC products in 2003, LTC insurance policies provide for long-duration coverage and, therefore, our actual claims experience will continue to emerge over many years. Our ability to forecast future claim rates for LTC insurance is more limited than life insurance. We have sought to moderate these uncertainties to some extent by partially reinsuring LTC policies at the time the policies were underwritten and limiting our present stand-alone LTC insurance offerings to policies underwritten fully by unaffiliated third-party insurers, and we have also implemented rate increases and provided reduced benefit options on certain in force policies. Because our assumptions regarding persistency experience are inherently uncertain, reserves for future policy benefits and claims may prove to be inadequate if actual persistency experience is different from those assumptions. Although some of our products permit us to increase premiums during the life of the policy or contract, we cannot guarantee that these increases would be sufficient to maintain profitability. Additionally, some of these pricing changes require regulatory approval, which may not be forthcoming. Moreover, many of our products do not permit us to increase premiums or limit those increases during the life of the policy or contract, while premiums on certain other products (primarily LTC insurance) may not be increased without prior regulatory approval. Significant deviations in experience from pricing expectations regarding persistency could have an adverse effect on the profitability of our products.

such technical and operational measures ourselves and have in place policies that require our service providers and franchisee advisors, each of which control locally their own technology operations, to do the same. The hybrid work environment among our employees adds complexity to monitoring and processing procedures. Changes in our business or technological advancements may also require corresponding changes in our systems, networks and data security and response measures. While accessing our products and services, our clients may use computers and other devices that sit outside of our security control environment. In addition, the ever-increasing reliance on technology systems and networks and the occurrence and potential adverse impact of attacks on such systems and networks, both generally and in the financial services industry, have enhanced government and regulatory scrutiny of the measures taken by companies to protect against cybersecurity threats and report incidents they suffer. As these threats, and government and regulatory oversight of associated risks, continue to evolve, we may be required to expend significant additional resources (both direct financial resources and indirect costs like people) to enhance or expand upon the technical and operational security and response measures we currently maintain or that we allow franchise advisors to maintain and control locally. These regulator-driven changes may adversely impact the client experience by, for example, requiring multiple or new means of verifying the identity of a client before they can interact with us. Despite the measures we have taken and may in the future take to address and mitigate cybersecurity, privacy and technology risks, we cannot be certain that our systems and networks, or those used by our vendors and franchisees, will not be subject to successful attacks, breaches or interference. Nor can we guarantee that advisors and employees will comply with our policies and procedures in this regard, that clients will engage in safe and secure online practices, or that vendors and franchisees will effectively deploy and maintain the security measures and protocols that we impose. Furthermore, human error occurs from time to time and such mistakes can lead to the inadvertent disclosure of sensitive information. We have a vendor management process, but at times our software or service providers could push through updates that are not fully disclosed to us (or tested by them) and that could alter the control posture of their products. Any such event may result in operational disruptions, as well as unauthorized access to or the disclosure or loss of, our proprietary information or client, employee, vendor, or advisor personal information, which in turn may result in legal claims, regulatory scrutiny and liability, reputational damage, the incurrence of costs to respond to, eliminate, or mitigate further exposure, the loss of clients or advisors, or other damage to our business. While we maintain cyber liability insurance that provides both third-party liability and first-party liability coverages, it may not protect us against all cybersecurity- or privacy-related losses. Furthermore, we may be subject to indemnification costs and liability to third parties if we breach any confidentiality or security obligations regarding vendor data or for losses related to the data. In addition, the trend toward broad consumer and general-public notification of such incidents, including those where our vendors are the party being breached, could exacerbate the harm to our business, reputation, financial condition or results of operations in the event of a breach. Even if we successfully protect our technology infrastructure and the confidentiality of sensitive data and conduct appropriate incident response, we may incur significant expenses in connection with our responses to any such attacks, as well as the adoption, implementation and maintenance of appropriate security measures. In addition, our regulators may seek to hold our company responsible for the acts, mistakes or omissions of our vendors or franchise advisors even where they procure and control much of the physical office space and technology infrastructure they use to operate their businesses locally.

attacks, breaches or interference. Nor can we guarantee that advisors and employees will comply with our policies and procedures in this regard, that clients will engage in safe and secure online practices, or that vendors and franchisees will effectively deploy and maintain the security measures and protocols that we impose. Furthermore, human error occurs from time to time and such mistakes can lead to the inadvertent disclosure of sensitive information. We have a vendor management process, but at times our software or service providers could push through updates that are not fully disclosed to us (or tested by them) and that could alter the control posture of their products. Any such event may result in operational disruptions, as well as unauthorized access to or the disclosure or loss of, our proprietary information or client, employee, vendor, or advisor personal information, which in turn may result in legal claims, regulatory scrutiny and liability, reputational damage, the incurrence of costs to respond to, eliminate, or mitigate further exposure, the loss of clients or advisors, or other damage to our business. While we maintain cyber liability insurance that provides both third-party liability and first-party liability coverages, it may not protect us against all cybersecurity- or privacy-related losses. Furthermore, we may be subject to indemnification costs and liability to third parties if we breach any confidentiality or security obligations regarding vendor data or for losses related to the data. In addition, the trend toward broad consumer and general-public notification of such incidents, including those where our vendors are the party being breached, could exacerbate the harm to our business, reputation, financial condition or results of operations in the event of a breach. Even if we successfully protect our technology infrastructure and the confidentiality of sensitive data and conduct appropriate incident response, we may incur significant expenses in connection with our responses to any such attacks, as well as the adoption, implementation and maintenance of appropriate security measures. In addition, our regulators may seek to hold our company responsible for the acts, mistakes or omissions of our vendors or franchise advisors even where they procure and control much of the physical office space and technology infrastructure they use to operate their businesses locally.

We establish reserves as estimates of our liabilities to provide for future obligations under our insurance policies, annuities and investment certificate contracts. Reserves do not represent an exact calculation of the liability but, rather, are estimates of contract 20 20 20 20 20 20

We establish reserves as estimates of our liabilities to provide for future obligations under our insurance policies, annuities and investment certificate contracts. Reserves do not represent an exact calculation of the liability but, rather, are estimates of contract benefits and related expenses we expect to incur over time. The assumptions and estimates we make in establishing reserves require certain judgments about future experience and, therefore, are inherently uncertain. We cannot determine with precision the actual amounts that we will pay for contract benefits, the timing of payments, or whether the assets supporting our stated reserves will increase to the levels we estimate before payment of benefits or claims. We monitor our reserve levels continually. If we were to conclude that our reserves are insufficient to cover actual or expected contract benefits, we would be required to increase our reserves and incur income statement charges for the period in which we make the determination, which would adversely affect our results of operations and financial condition.

Our results of operations and financial condition may be materially affected by market fluctuations and by economic and other factors (whether actual or perceived). Such factors, which can be global, regional, national or local in nature, include: (i) the level and volatility of the markets, including equity prices, interest rates, commodity prices, currency values and other market indices and drivers; (ii) geopolitical strain, terrorism and armed conflicts, (iii) political dynamics or elections and social, economic and market conditions; (iv) the availability and cost of capital; (v) global health emergencies; (vi) technological changes and events; (vii) U.S. and foreign government regulatory, fiscal and tax policies; (viii) U.S. and foreign government ability, real or perceived, to avoid defaulting on government securities; (ix) the availability and cost of credit and hedge markets; (x) periods of elevated inflation; (xi) natural disasters such as weather catastrophes; and (xii) other factors affecting investor sentiment and confidence in the financial markets. Furthermore, changes in consumer economic variables, such as the number and size of personal bankruptcy filings, the rate of unemployment, decreases in property values, and the level of consumer confidence and consumer debt, may substantially affect consumer financials, which, in turn, could impact client activity in our businesses. These factors also may have an impact on our ability to achieve our strategic objectives or to pay dividends or otherwise return capital from our subsidiaries to our holding company. Declines and volatility in U.S. and global market conditions have impacted our businesses in the past, are impacting us now and may continue to impact us in the same, new or different ways in the future. Our businesses have been, and in the future may be, adversely affected by U.S. and global capital market and credit crises, the repricing of credit risk, equity market volatility and decline, and stress or recession in the U.S. and global economies generally. Each of our segments operates in these markets with exposure for us and our clients in securities, loans, derivatives, alternative investments, seed capital and other commitments. It is difficult to predict when, how long and to what extent the aforementioned adverse conditions will exist, which of our markets, products and businesses will be directly affected and to what extent our clients may seek to bring claims arising out of investment performance that is affected by these conditions. As a result, these factors could materially adversely impact our financial condition and results of operations. These factors may also impact client behavior. Market downturns, stagnation, and volatility may cause, and have caused, individual investors to limit or decrease their participation in global markets, which may negatively impact our retail business and/or our product sales. Market conditions, regulatory actions, tax laws, and our competitive industry environment are among the reasons current shareholders in our mutual funds, closed-end funds, ETFs, hedge funds, OEICs, SICAVs, unit trusts, investment trusts and other pooled investment vehicles, contractholders in our annuity products and policyholders in our protection products may opt to withdraw cash values for those products (or for certain protection products, to reduce their withdrawal activity). If we are unable to offer appropriate product alternatives which encourage clients to continue purchasing in the face of actual or perceived market volatility, our sales and management fee revenues could decline. Downturns and volatility in markets or the departure of key clients or advisors have had, and may in the future have, an adverse effect on the revenues and returns from our asset management services, retail advisory accounts, variable annuity contracts, banking products and other products. Because the profitability of these products and services depends on fees related primarily to the value of assets under management, declines in the markets will reduce our revenues because the value of the investment assets we manage will be reduced. In addition, a significant portion of our revenue is derived from investment management agreements with the Columbia Management family of mutual funds or other investment managers which are terminable on 60 days’ notice. Although some contracts governing investment management services are subject to termination for failure to meet performance benchmarks, institutional and individual clients can generally terminate their relationships with us or our financial advisors at will or on relatively short notice. Further, a number of the products and services we make available to our clients are those offered by third parties and negative perceptions of these financial products and services (or the financial industry in general) may impact the number of withdrawals and 16 16 16 16 16 16

volatility of the markets, including equity prices, interest rates, commodity prices, currency values and other market indices and drivers; (ii) geopolitical strain, terrorism and armed conflicts, (iii) political dynamics or elections and social, economic and market conditions; (iv) the availability and cost of capital; (v) global health emergencies; (vi) technological changes and events; (vii) U.S. and foreign government fiscal and tax policies; (viii) U.S. and foreign government ability, real or perceived, to avoid defaulting on government securities; (ix) the availability and cost of credit and hedge markets; (x) periods of elevated inflation; (xi) natural disasters such as weather catastrophes; and (xii) other factors affecting investor sentiment and confidence in the financial markets. Furthermore, changes in consumer economic variables, such as the number and size of personal bankruptcy filings, the rate of unemployment, decreases in property values, and the level of consumer confidence and consumer debt, may substantially affect consumer financials, which, in turn, could impact client activity in all of our businesses. These factors also may have an impact on our ability to achieve our strategic objectives or to pay dividends or otherwise return capital from our subsidiaries to our holding company. Declines and volatility in U.S. and global market conditions have impacted our businesses in the past, are impacting us now and may continue to impact us in the same, new or different ways in the future. Our businesses have been, and in the future may be, adversely affected by U.S. and global capital market and credit crises, the repricing of credit risk, equity market volatility and decline, and stress or recession in the U.S. and global economies generally. Each of our segments operates in these markets with exposure for us and our clients in securities, loans, derivatives, alternative investments, seed capital and other commitments. It is difficult to predict when, how long and to what extent the aforementioned adverse conditions will exist, which of our markets, products and businesses will be directly affected and to what extent our clients may seek to bring claims arising out of investment performance that is affected by these conditions. As a result, these factors could materially adversely impact our financial condition and results of operations. These factors will also impact client behavior. Market downturns, stagnation, and volatility may cause, and have caused, individual investors to limit or decrease their participation in global markets negatively impacting our retail business and/or our product sales. Market conditions, regulatory actions, tax laws, and our competitive industry environment are among the reasons current shareholders in our mutual funds, closed-end funds, exchange traded funds (“ETFs”), hedge funds, OEICs, SICAVs, unit trusts, investment trusts and other pooled investment vehicles, contractholders in our annuity products and policyholders in our protection products may opt to withdraw cash values for those products (or for certain protection products, to reduce their withdrawal activity). If we are unable to offer appropriate product alternatives which encourage clients to continue purchasing in the face of actual or perceived market volatility, our sales and management fee revenues could decline. Downturns and volatility in markets or the departure of a key client have had, and may in the future have, an adverse effect on the revenues and returns from our asset management services, retail advisory accounts, variable annuity contracts, banking products and other products. Because the profitability of these products and services depends on fees related primarily to the value of assets under management, declines in the markets will reduce our revenues because the value of the investment assets we manage will be reduced. In addition, a significant portion of our revenue is derived from investment management agreements with the Columbia Management family of mutual funds or other investment managers which are terminable on 60 days’ notice. Although some contracts governing investment management services are subject to termination for failure to meet performance benchmarks, institutional and individual clients can generally terminate their relationships with us or our financial advisors at will or on relatively short notice. Further, a number of the products and services we make available to our clients are those offered by third parties and negative perceptions of these financial products and services (or the financial industry in general) may impact the number of withdrawals and redemptions or reduce purchases made by our clients, which would adversely impact the levels of our assets under management. Our clients can also reduce the aggregate amount of managed assets or shift their funds to other types of accounts with different fee rate structures, for any number of reasons, including investment performance, changes in prevailing interest rates, changes in investment preferences or investment management strategy (for example, “active” or “passive” investing styles or the proliferation of ETFs or other vehicles like separately managed accounts (“SMAs”)), changes in our (or our advisors’) reputation in the marketplace, a client’s view of ESG factors, changes in client or relationship management, loss of key investment management personnel and financial market performance. This reduction in managed assets or significant redemptions, and the associated decrease in revenues and earnings, could have a material adverse effect on our business, particularly in products or services where we have less scale and a reduction in managed assets can make the product not viable or even require us to exit the product. Most of our variable annuity products contain guaranteed minimum death benefits and a majority of our variable annuity products in force contain guaranteed minimum withdrawal and accumulation benefits. Decline or volatility in equity and/or bond markets could result in guaranteed minimum benefits being higher than what current account values would support, which would adversely affect our financial condition and results of operations. Discontinuing the sale of new fixed annuities and variable annuities with living benefits will lessen this risk over time. Although we have hedged a portion of the guarantees for the variable annuity contracts to mitigate the financial loss of equity and/or bond market declines or volatility, there can be no assurance that such a decline or volatility would not materially impact the profitability of certain products or product lines or our financial condition or results of operations. For example, market fluctuations will impact our statutory reserves and required capital, and that may not be aligned with the hedging impacts. In addition to risks from guarantees discussed above, structured variable annuity contracts contain index-linked risks that adjust the policyholder’s or contractholder’s account value based on equity movements. These risks are hedged with derivatives, which are a material component of our overall hedging program. Collateral requirements for the hedging program are market-sensitive, and certain market environments (e.g., rising interest rates) will result in increased needs for liquidity to satisfy these requirements. Depending on 17 17 17 17 17 17

We have exposure to many different industries and counterparties, and we routinely execute transactions with counterparties in the financial services industry, including broker-dealers, commercial banks, investment banks, hedge funds, insurers, reinsurers, investment funds and other institutions. The operations of U.S. and global financial services institutions are interconnected and a decline in the financial condition of one or more financial services institutions may expose us to credit losses or defaults, limit our access to liquidity or otherwise disrupt the operations of our businesses. While we regularly assess our exposure to different industries and counterparties, the performance and financial strength of specific institutions are subject to rapid change, the timing and extent of which cannot be known. Many transactions with and investments in the products and securities of other financial institutions expose us to credit risk in the event of default of our counterparty. With respect to secured transactions, our credit risk may be exacerbated when the collateral we hold cannot be realized upon or is liquidated at prices insufficient to recover the full amount of the loan or derivative exposure. We also have exposure to financial institutions in the form of unsecured debt instruments, derivative transactions (including with respect to derivatives hedging our exposure on variable annuity contracts with guaranteed benefits and structured variable annuities), reinsurance, repurchase and underwriting arrangements and equity investments. Any such losses or impairments to the carrying value of these assets could materially and adversely impact our business and results of operations. Issuers of the fixed maturity securities that we own may default on principal and interest payments. Some of our fixed maturity securities may have ratings below investment-grade. Default-related declines in the value of our fixed maturity securities portfolio or consumer credit holdings could cause our net earnings to decline and could also cause us to contribute capital to some of our regulated subsidiaries, which may require us to obtain funding during periods of unfavorable market conditions. Capital and credit market volatility or a sudden devaluation of a specific product or security can exacerbate, and has exacerbated, the risk of third-party defaults, bankruptcy filings, foreclosures, legal actions and other events that may limit the value of or restrict our access and our clients’ access to cash and investments. Although we are not required to do so, we may elect to compensate clients for losses incurred in response to such events, provide clients with temporary credit or liquidity or other support related to products that we manage, or provide credit liquidity or other support to the financial products we manage. If we elect to provide additional support, we could incur losses from the support we provide and incur additional costs, including financing costs, in connection with the support. These losses and additional costs could be material and could adversely impact our results of operations. If we were to take such actions we may also restrict or otherwise utilize our corporate assets, limiting our flexibility to use these assets for other purposes, and may be required to raise additional capital.

hold cannot be realized upon or is liquidated at prices insufficient to recover the full amount of the loan or derivative exposure. We also have exposure to financial institutions in the form of unsecured debt instruments, derivative transactions (including with respect to derivatives hedging our exposure on variable annuity contracts with guaranteed benefits and structured variable annuities), reinsurance, repurchase and underwriting arrangements and equity investments. Any such losses or impairments to the carrying value of these assets could materially and adversely impact our business and results of operations. Issuers of the fixed maturity securities that we own may default on principal and interest payments. Some of our fixed maturity securities may have ratings below investment-grade. Default-related declines in the value of our fixed maturity securities portfolio or consumer credit holdings could cause our net earnings to decline and could also cause us to contribute capital to some of our regulated subsidiaries, which may require us to obtain funding during periods of unfavorable market conditions. Capital and credit market volatility or a sudden devaluation of a specific product or security (such as the broad impacts experienced from the 2023 regional bank crisis) can exacerbate, and has exacerbated, the risk of third-party defaults, bankruptcy filings, foreclosures, legal actions and other events that may limit the value of or restrict our access and our clients’ access to cash and investments. Although we are not required to do so, we have elected in the past, and we may elect in the future, to compensate clients for losses incurred in response to such events, provide clients with temporary credit or liquidity or other support related to products that we manage, or provide credit liquidity or other support to the financial products we manage. If we elect to provide additional support, we could incur losses from the support we provide and incur additional costs, including financing costs, in connection with the support. These losses and additional costs could be material and could adversely impact our results of operations. If we were to take such actions we may also restrict or otherwise utilize our corporate assets, limiting our flexibility to use these assets for other purposes, and may be required to raise additional capital.

Misconduct by our employees and advisors may be difficult to detect and deter and may damage our reputation. This can include improper use of their authorized access to sensitive information. Misconduct or errors by our employees and advisors could result in violations of law, regulatory sanctions and/or serious reputational or financial harm. Misconduct or mistakes can occur in each of our businesses. We cannot always prevent misconduct by our employees and advisors, and the precautions we take to prevent and detect this activity may not be effective in all cases. We seek to aid our advisors and provide certain requirements and support to protect our non-employee franchise advisors’ technology solutions to run their businesses, but they control their own technology environment on a day-to-day basis and could have an adverse effect on our business. Our reputation depends on our continued identification of and mitigation against conflicts of interest. We have procedures and controls that are designed to identify, address and appropriately disclose perceived conflicts of interest, though our reputation could be damaged if we fail, or appear to fail, to address conflicts of interest appropriately. In addition, the SEC and other federal and state regulators, as well as foreign regulators, have increased their scrutiny of potential conflicts of interest and the actions we may be expected to take when a conflict is encountered. It is possible that potential or perceived conflicts could give rise to litigation or enforcement actions. Also, it is possible that the regulatory scrutiny of, and litigation in connection with, conflicts of interest will make our clients less willing to enter into transactions with us or in certain products or services we offer, which would adversely affect our businesses.

Our reputation is one of our most important assets. Our ability to attract and retain clients, investors, employees and advisors is highly dependent upon external perceptions of our company. Damage to our reputation could cause significant harm to our business and prospects. Reputational damage may arise from numerous sources, including litigation or regulatory actions, failing to deliver minimum standards of service and quality, compliance failures, any perceived or actual weakness in our financial strength or liquidity, clients’ or potential clients’ perceived failure of how we address certain political, environmental, social or governance topics, technological breakdowns, cybersecurity attacks, or other security breaches (including attempted breaches, breaches impacting our vendors or their subcontractors or inadvertent disclosures) resulting in system unavailability, improper disclosure or loss of data integrity relating to client or employee personal information, unethical or improper behavior and the misconduct or error of our employees, advisors and counterparties. Additionally, a failure to develop new products and services, or successfully manage associated operational risks, could harm our reputation and potentially expose us to additional costs, or negative public relations or social media campaigns. Any negative incidents can quickly erode trust and confidence, particularly if they result in adverse mainstream and social media publicity, governmental audits or investigations or litigation. Adverse developments with respect to our industry may also, by association, negatively impact our reputation or result in greater regulatory or legislative scrutiny or litigation against us. Misconduct by our employees and advisors may be difficult to detect and deter and may damage our reputation. This can include improper use of their authorized access to sensitive information. Misconduct or errors by our employees and advisors could result in violations of law, regulatory sanctions and/or serious reputational or financial harm. Misconduct or mistakes can occur in each of our businesses. We cannot always prevent misconduct by our employees and advisors, and the precautions we take to prevent and detect this activity may not be effective in all cases. We seek to aid our advisors and provide certain requirements and support to protect our non-employee franchise advisors’ technology solutions to run their businesses, but they control their own technology environment on a day-to-day basis and could have an adverse effect on our business. Our reputation depends on our continued identification of and mitigation against conflicts of interest. We have procedures and controls that are designed to identify, address and appropriately disclose perceived conflicts of interest, though our reputation could be damaged if we fail, or appear to fail, to address conflicts of interest appropriately. In addition, the SEC and other federal and state regulators, as well as foreign regulators, have increased their scrutiny of potential conflicts of interest and the actions we may be expected to take when a conflict is encountered. It is possible that potential or perceived conflicts could give rise to litigation or enforcement actions. Also, it is possible that the regulatory scrutiny of, and litigation in connection with, conflicts of interest will make our clients less willing to enter into transactions with us or in certain products or services we offer, which would adversely affect our businesses. 22 22 22 22 22 22