Bank of America Corporation: 10-K Risk Factor Changes

During 2023, the U.S. housing market continued to be impacted by higher mortgage rates, including 30-year fixed-rate mortgages that more than doubled from 2021. This has negatively impacted the demand in some cases and underlying collateral for many of our products. Additionally, our mortgage loan production volume is generally influenced by the rate of growth in residential mortgage debt outstanding and the size of the residential mortgage market, both of which have slowed due to higher interest rates and reduced affordability. A deeper downturn in the condition of the U.S. housing market could result in significant write-downs of asset values in several asset classes, notably mortgage-backed securities (MBS). If the U.S. housing market were to further weaken, the value of real estate could decline, which could result in increased credit losses and delinquent servicing expenses, negatively affect our Bank of America 12 Bank of America 12 Bank of America 12 Bank of America 12 representations and warranties exposures, and adversely affect our results of operations and financial condition.Our derivatives businesses may expose us to unexpected risks, which may result in losses and adversely affect liquidity.We are party to a large number of derivatives transactions that may expose us to unexpected market, credit and operational risks that could cause us to suffer unexpected losses. Fluctuations in asset values or rates or an unanticipated credit event, including unforeseen circumstances that may cause previously uncorrelated factors to become correlated, may lead to losses resulting from risks not taken into account or anticipated in the development, structuring or pricing of a derivative instrument. Certain derivative contracts and other trading agreements provide that upon the occurrence of certain specified events, such as a change to our or our affiliates’ credit ratings, we may be required to provide additional collateral or take other remedial actions, and we could experience increased difficulty obtaining funding or hedging risks. In some cases our counterparties may have the right to terminate or otherwise diminish our rights under these contracts or agreements upon the occurrence of such events.We are also a member of various CCPs, which results in credit risk exposure to those CCPs. In the event that one or more members of a CCP default on their obligations, we may be required to pay a portion of any losses incurred by the CCP as a result of that default. A CCP may also, at its discretion, modify the margin we are required to post, which could mean unexpected and increased funding costs and exposure to that CCP. As a clearing member, we are exposed to the risk of non-performance by our clients for which we clear transactions, which may not be covered by available collateral. Additionally, default by a significant market participant may result in further risk and potential losses.GeopoliticalWe are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate.We do business throughout the world, including in emerging markets. Economic or geopolitical stress in one or more countries could have a negative impact regionally or globally, resulting in, among other things, market volatility, reduced market value and economic output. Our liquidity and credit risk could be adversely impacted by, and our businesses and revenues derived from non-U.S. jurisdictions are subject to, risk of loss from financial, social or judicial instability, economic sanctions, changes in government leadership, including as a result of electoral outcomes or otherwise, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, high inflation, natural disasters, the emergence or continuation of widespread health emergencies or pandemics, capital controls, currency re-denomination risk from a country exiting the EU or otherwise, currency fluctuations, foreign exchange controls or movements (caused by devaluation or de-pegging), unfavorable political and diplomatic developments, oil price fluctuations and changes in legislation. These risks are especially elevated in emerging markets.Continued tensions between the U.S. and important trading partners, particularly China, may result in sanctions, further tariff increases or other restrictive actions on cross-border trade, investment and transfer of information technology, which could reduce trade volumes, result in further supply chain disruptions, increase costs for producers, and adversely affect our businesses and revenues, as well as our customers and counterparties, including their credit quality.Slowing growth, recessionary conditions, adverse geopolitical conditions and/or political or civil unrest, labor shortages, wage pressures and elevated inflation in certain countries pose challenges, including in the form of volatility in financial markets. Foreign exchange rates against the U.S. dollar remain an area of uncertainty and potential volatility, and depreciation could increase our financial risks with clients that deal in non-U.S. currencies but have U.S. dollar-denominated debt.We invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less liquid and more volatile than U.S. trading markets. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors.Elevated government debt levels raise the risk of volatility, significant valuation changes, political tensions among EU members regarding fiscal policy or defaults on or devaluation of sovereign debt, which could expose us to substantial losses. Financial markets have been and may continue to be sensitive to government plans to lower taxes or increase spending.Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges and regulators, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are less predictable, prone to change and uncertainty, and regularly evolving. Significant resources are spent on determining, understanding and monitoring foreign laws, rules and regulations, as well as managing our relationships with multiple regulators in various jurisdictions. Our inability to remain in compliance with local laws and manage our relationships with regulators could result in increased expenses, changes to our organizational structure and adversely affect our businesses, reputation and results of operations in that market.We are also subject to complex and extensive U.S. and non-U.S. laws, rules and regulations, which subject us to costs and risks relating to bribery and corruption, know-your-customer requirements, anti-money laundering, embargo programs and economic sanctions, which can vary by jurisdiction and require implementation of complex operational capabilities and compliance programs. Non-compliance, including improper implementation, and/or violations could result in an increase in operational and compliance costs, and enforcement actions and civil and criminal penalties against us and individual employees. The increasing speed and novel ways in which funds circulate could make it more challenging to track the movement of funds and heighten financial crimes risk. Compliance with these evolving regulatory regimes and legal requirements depends on our ability to improve our processes, controls, surveillance, detection and reporting and analytic capabilities.In the U.S., the government’s debt ceiling and budget deficit concerns have increased the possibility of U.S. government defaults on its debt and/or further downgrades to its credit ratings, and prolonged government shutdowns, which could representations and warranties exposures, and adversely affect our results of operations and financial condition.Our derivatives businesses may expose us to unexpected risks, which may result in losses and adversely affect liquidity.We are party to a large number of derivatives transactions that may expose us to unexpected market, credit and operational risks that could cause us to suffer unexpected losses. Fluctuations in asset values or rates or an unanticipated credit event, including unforeseen circumstances that may cause previously uncorrelated factors to become correlated, may lead to losses resulting from risks not taken into account or anticipated in the development, structuring or pricing of a derivative instrument. Certain derivative contracts and other trading agreements provide that upon the occurrence of certain specified events, such as a change to our or our affiliates’ credit ratings, we may be required to provide additional collateral or take other remedial actions, and we could experience increased difficulty obtaining funding or hedging risks. In some cases our counterparties may have the right to terminate or otherwise diminish our rights under these contracts or agreements upon the occurrence of such events.We are also a member of various CCPs, which results in credit risk exposure to those CCPs. In the event that one or more members of a CCP default on their obligations, we may be required to pay a portion of any losses incurred by the CCP as a result of that default. A CCP may also, at its discretion, modify the margin we are required to post, which could mean unexpected and increased funding costs and exposure to that CCP. As a clearing member, we are exposed to the risk of non-performance by our clients for which we clear transactions, which may not be covered by available collateral. Additionally, default by a significant market participant may result in further risk and potential losses.GeopoliticalWe are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate.We do business throughout the world, including in emerging markets. Economic or geopolitical stress in one or more countries could have a negative impact regionally or globally, resulting in, among other things, market volatility, reduced market value and economic output. Our liquidity and credit risk could be adversely impacted by, and our businesses and revenues derived from non-U.S. jurisdictions are subject to, risk of loss from financial, social or judicial instability, economic sanctions, changes in government leadership, including as a result of electoral outcomes or otherwise, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, high inflation, natural disasters, the emergence or continuation of widespread health emergencies or pandemics, capital controls, currency re-denomination risk from a country exiting the EU or otherwise, currency fluctuations, foreign exchange controls or movements (caused by devaluation or de-pegging), unfavorable political and diplomatic developments, oil price fluctuations and changes in legislation. These risks are especially elevated in emerging markets.Continued tensions between the U.S. and important trading partners, particularly China, may result in sanctions, further tariff increases or other restrictive actions on cross-border trade, investment and transfer of information technology, which could reduce trade volumes, result in further supply chain disruptions, increase costs for producers, and adversely affect our representations and warranties exposures, and adversely affect our results of operations and financial condition.

We are party to a large number of derivatives transactions that may expose us to unexpected market, credit and operational risks that could cause us to suffer unexpected losses. Severe declines in asset values or an unanticipated credit event, including unforeseen circumstances that may cause previously uncorrelated factors to become correlated and vice versa, may create losses resulting from risks not appropriately taken into account or anticipated in the development, structuring or pricing of a derivative instrument. Certain OTC derivative contracts and other trading agreements provide that upon the occurrence of certain specified events, such as a change to our or our affiliates’ credit ratings, we may be required to provide additional collateral or take other Bank of America 12 Bank of America 12 Bank of America 12 Bank of America 12 remedial actions, and we could experience increased difficulty obtaining funding or hedging risks. In some cases our counterparties may have the right to terminate or otherwise diminish our rights under these contracts or agreements.We are also a member of various CCPs, which potentially increases our credit risk exposures to those CCPs. In the event that one or more members of a CCP default on their obligations, we may be required to pay a portion of any losses incurred by the CCP as a result of that default. A CCP may also, at its discretion, modify the margin we are required to post, which could mean unexpected and increased funding costs and exposure to that CCP. As a clearing member, we are exposed to the risk of non-performance by our clients for which we clear transactions, which may not be covered by available collateral. Additionally, default by a significant market participant may result in further risk and potential losses.GeopoliticalWe are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate.We do business throughout the world, including in emerging markets. Economic or geopolitical stress in one or more countries could have a negative impact regionally or globally, resulting in, among other things, market volatility, reduced market value and economic output. Our liquidity and credit risk could be adversely impacted by, and our businesses and revenues derived from non-U.S. jurisdictions are subject to, risk of loss from financial, social or judicial instability, economic sanctions, changes in government leadership, including as a result of electoral outcomes or otherwise, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, high inflation, natural disasters, the emergence or continuation of widespread health emergencies or pandemics, capital controls, currency re-denomination risk from a country exiting the EU or otherwise, currency fluctuations, foreign exchange controls or movements (caused by devaluation or de-pegging), unfavorable political and diplomatic developments, oil price fluctuations and changes in legislation. These risks are especially elevated in emerging markets. Continued tensions between the U.S. and important trading partners, particularly China, may result in sanctions, further tariff increases or other restrictive actions on cross-border trade, investment, and transfer of information technology that weigh on trade volumes, raise costs for producers, and adversely affect our businesses and revenues, as well as our customers and counterparties, including their credit quality.Slowing growth, recessionary conditions, market volatility and/or political or civil unrest, global supply chain disruptions, labor shortages, wage pressures and elevated inflation in many countries pose additional challenges, including in the form of volatility in financial markets. Foreign exchange rates against the U.S. dollar remain an area of uncertainty and potential volatility as the Federal Reserve and other central banks raise interest rates, and depreciation could increase our financial risks with clients that deal in non-U.S. currencies but have U.S. dollar-denominated debt.We invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less liquid and more volatile than U.S. trading markets. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors. Elevated government debt levels raise the risk of volatility, significant valuation changes, political tensions among EU members regarding fiscal policy or defaults on or devaluation of sovereign debt, which could expose us to substantial losses. Financial markets have been and may continue to be sensitive to government plans to lower taxes or increase spending.Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges and regulators, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are less predictable, prone to change and uncertainty and evolving, and it may be difficult to determine the requirements of local laws in every market or manage our relationships with multiple regulators in various jurisdictions. Significant resources are spent on understanding and monitoring foreign laws, rules and regulations. Our inability to remain in compliance with local laws and manage our relationships with regulators could result in increased expenses, changes to our organizational structure and adversely affect our businesses, reputation and results of operations in that market.We are also subject to complex and extensive U.S. and non-U.S. laws, rules and regulations, which subject us to costs and risks relating to bribery and corruption, anti-money laundering, embargo programs and economic sanctions, which can vary by jurisdiction and require implementation of complex operational capabilities and compliance programs. Non-compliance and/or violations could result in an increase in operational and compliance costs, and enforcement actions and civil and criminal penalties against us and individual employees. The increasing speed and novel ways in which funds circulate could make it more challenging to track the movement of funds and heighten financial crimes risk. Compliance with these evolving regulatory regimes and legal requirements depends on our ability to improve our processes, controls, surveillance, detection and reporting and analytic capabilities.In connection with the U.K.’s exit from the EU, we are now subject to different laws and regulations, which are expected to diverge further over time, and are subject to the oversight of additional regulatory authorities. As political and regulatory environments evolve, further changes to the legal and regulatory framework under which our subsidiaries provide products and services in the U.K. and in the EU may result in additional compliance costs and have negative tax consequences or an adverse impact on our results of operations.In the U.S., the government’s debt ceiling and budget deficit concerns have increased the possibility of U.S. government defaults on its debt and/or downgrades to its credit ratings, and prolonged government shutdowns, which could weaken the U.S. dollar, cause market volatility, negatively impact the global economy and banking system and adversely affect our financial condition, including our liquidity. Additionally, changes in fiscal, monetary or regulatory policy, including as a result of labor shortages, wage pressures, supply chain disruptions and higher inflation, could increase our compliance costs and adversely affect our business operations, organizational structure and results of operations. Monetary policy has contributed to a significant depreciation of many foreign currencies over the past remedial actions, and we could experience increased difficulty obtaining funding or hedging risks. In some cases our counterparties may have the right to terminate or otherwise diminish our rights under these contracts or agreements.We are also a member of various CCPs, which potentially increases our credit risk exposures to those CCPs. In the event that one or more members of a CCP default on their obligations, we may be required to pay a portion of any losses incurred by the CCP as a result of that default. A CCP may also, at its discretion, modify the margin we are required to post, which could mean unexpected and increased funding costs and exposure to that CCP. As a clearing member, we are exposed to the risk of non-performance by our clients for which we clear transactions, which may not be covered by available collateral. Additionally, default by a significant market participant may result in further risk and potential losses.GeopoliticalWe are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate.We do business throughout the world, including in emerging markets. Economic or geopolitical stress in one or more countries could have a negative impact regionally or globally, resulting in, among other things, market volatility, reduced market value and economic output. Our liquidity and credit risk could be adversely impacted by, and our businesses and revenues derived from non-U.S. jurisdictions are subject to, risk of loss from financial, social or judicial instability, economic sanctions, changes in government leadership, including as a result of electoral outcomes or otherwise, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, high inflation, natural disasters, the emergence or continuation of widespread health emergencies or pandemics, capital controls, currency re-denomination risk from a country exiting the EU or otherwise, currency fluctuations, foreign exchange controls or movements (caused by devaluation or de-pegging), unfavorable political and diplomatic developments, oil price fluctuations and changes in legislation. These risks are especially elevated in emerging markets. Continued tensions between the U.S. and important trading partners, particularly China, may result in sanctions, further tariff increases or other restrictive actions on cross-border trade, investment, and transfer of information technology that weigh on trade volumes, raise costs for producers, and adversely affect our businesses and revenues, as well as our customers and counterparties, including their credit quality.Slowing growth, recessionary conditions, market volatility and/or political or civil unrest, global supply chain disruptions, labor shortages, wage pressures and elevated inflation in many countries pose additional challenges, including in the form of volatility in financial markets. Foreign exchange rates against the U.S. dollar remain an area of uncertainty and potential volatility as the Federal Reserve and other central banks raise interest rates, and depreciation could increase our financial risks with clients that deal in non-U.S. currencies but have U.S. dollar-denominated debt.We invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less remedial actions, and we could experience increased difficulty obtaining funding or hedging risks. In some cases our counterparties may have the right to terminate or otherwise diminish our rights under these contracts or agreements. We are also a member of various CCPs, which potentially increases our credit risk exposures to those CCPs. In the event that one or more members of a CCP default on their obligations, we may be required to pay a portion of any losses incurred by the CCP as a result of that default. A CCP may also, at its discretion, modify the margin we are required to post, which could mean unexpected and increased funding costs and exposure to that CCP. As a clearing member, we are exposed to the risk of non-performance by our clients for which we clear transactions, which may not be covered by available collateral. Additionally, default by a significant market participant may result in further risk and potential losses.

Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Risks also may span across multiple key risk types, including cybersecurity risk, climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk. Bank of America 16 Bank of America 16 Bank of America 16 Bank of America 16 Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk, including operational, reputational and compliance risk. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses and adversely affect our results of operations.Regulatory, Compliance and LegalWe are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.Our businesses are highly regulated and we are subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various foreign jurisdictions in which we operate, including increasing and complex economic sanctions regimes. These laws and regulations significantly affect and have the potential to restrict the scope of our existing businesses, require changes to our business strategies, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates and/or make our products and services more expensive for our clients. We are also required to file various financial and nonfinancial regulatory reports to comply with laws, rules and regulations in the jurisdictions in which we operate, which results in additional compliance risk.We continue to adjust our business and operations, legal entity structure, disclosure and policies, processes, procedures and controls, including with regard to capital and liquidity management, risk management and data management, in an effort to comply with laws, rules and regulations, as well as evolving expectations, guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS) and OFAC), Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S., foreign regulators, other government authorities and self-regulatory organizations. Further, we expect to become subject to future laws, rules and regulations beyond those currently proposed, adopted or contemplated in the U.S. or abroad, as well as evolving interpretations of existing and future laws, rules and regulations, which may include policies and rulemaking related to FDIC assessments, loss allocations between financial institutions and customers with regard to the use of our products and services, including electronic payments, emerging technologies, such as the development and use of AI and machine learning, cybersecurity and data, and further climate risk management and ESG reporting, including emissions and sustainability disclosure. The cumulative effect of all of the current and possible future legislation and regulations, as well as related interpretations, on our litigation and regulatory exposure, businesses, operations and profitability remains uncertain and necessitates that we make certain assumptions with respect to the scope and requirements of existing, prospective and proposed laws, rules and regulations in our business planning and strategies. If these assumptions prove incorrect, we could be subject to increased regulatory, legal and compliance risks and costs, as well as potential reputational harm. Also, U.S. and regulatory initiatives abroad may overlap, and non-U.S. regulation and initiatives may be inconsistent or may conflict with current or proposed U.S. regulations, which could lead to compliance risks and increased costs.Our regulators’ prudential and supervisory authority gives them broad power and discretion to direct our actions, and they have assumed an active oversight, inspection and investigatory role across the financial services industry. Regulatory focus is not limited to laws, rules and regulations applicable to the financial services industry, but includes other significant laws, rules and regulations that apply across industries and jurisdictions, including those related to anti-money laundering, anti-bribery, anti-corruption know-your-customer requirements, embargo programs and economic sanctions.We are also subject to laws, rules and regulations in the U.S. and abroad, including the GDPR and CCPA as modified by the CPRA, and a number of additional jurisdictions enacting or considering similar laws or amendments to existing laws, regarding privacy and the disclosure, collection, use, sharing and safeguarding of personally identifiable information, including our employees, customers, suppliers, counterparties and other third parties, the violation of which could result in litigation, regulatory fines, enforcement actions and operational loss. Additionally, we are and will continue to be subject to new and evolving data privacy laws in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines and enforcement actions. There remains complexity and uncertainty, including potential suspension or prohibition, regarding data transfer because of concerns over compliance with laws, rules and regulations for cross-border flows and transfers of personal data from the European Economic Area (EEA) to the U.S. and other jurisdictions outside of the EEA, resulting from judicial and regulatory guidance. To the extent that a new EU-U.S. Data Privacy Framework leads to a relaxation of applicable legislation and regulations, regardless of transfer mechanism, challenges are expected from consumer advocacy groups. Other jurisdictions, including China and India, have commenced consultation efforts or enacted new legislation or regulations to establish standards for personal data transfers. If cross-border personal data transfers are suspended or restricted or we are required to implement distinct processes for each jurisdiction’s standards, this could result in operational disruptions to our businesses, additional costs, increased enforcement activity, new contract negotiations with third parties, and/or modification of such data management.As part of their enforcement authority, our regulators and other government authorities have the authority to, among other things, conduct investigations and assess significant civil or criminal monetary fines, penalties or restitution, issue cease and desist orders, suspend or withdraw licenses and authorizations, initiate injunctive action, apply regulatory sanctions or cause us to enter into consent orders. The amounts paid by us and other financial institutions to settle proceedings or investigations have, in some instances, been substantial and may increase. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of such resolutions, which could have significant consequences, including reputational harm, loss of customers, restrictions on the ability to access capital markets, and the inability to operate certain businesses or offer certain products. Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk, including operational, reputational and compliance risk. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses and adversely affect our results of operations.Regulatory, Compliance and LegalWe are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.Our businesses are highly regulated and we are subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various foreign jurisdictions in which we operate, including increasing and complex economic sanctions regimes. These laws and regulations significantly affect and have the potential to restrict the scope of our existing businesses, require changes to our business strategies, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates and/or make our products and services more expensive for our clients. We are also required to file various financial and nonfinancial regulatory reports to comply with laws, rules and regulations in the jurisdictions in which we operate, which results in additional compliance risk.We continue to adjust our business and operations, legal entity structure, disclosure and policies, processes, procedures and controls, including with regard to capital and liquidity management, risk management and data management, in an effort to comply with laws, rules and regulations, as well as evolving expectations, guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS) and OFAC), Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S., foreign regulators, other government authorities and self-regulatory organizations. Further, we expect to become subject to future laws, rules and regulations beyond those currently proposed, adopted or contemplated in the U.S. or abroad, as well as evolving interpretations of existing and future laws, rules and regulations, which may include policies and rulemaking related to FDIC assessments, loss allocations between financial institutions and customers with regard to the use of our products and services, including electronic payments, emerging technologies, such as the development and use of AI and machine learning, cybersecurity and data, and further climate risk management and ESG reporting, including emissions and sustainability disclosure. The cumulative effect of all of the current and possible future legislation and regulations, as well as related interpretations, on our litigation and regulatory exposure, businesses, operations and profitability remains uncertain and necessitates that we make certain assumptions Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk, including operational, reputational and compliance risk. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses and adversely affect our results of operations.

Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Additionally, risks may span across multiple key risk types, including climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk. Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program and develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, enable effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk. For example, we have experienced increased operational, reputational and compliance risk as a result of the prior need to rapidly deploy and implement multiple and varying pandemic relief programs, including the processing of unemployment benefits for California and certain other states, which have resulted in and will continue to result in losses. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses. Bank of America 16 Bank of America 16 Bank of America 16 Bank of America 16 Regulatory, Compliance and LegalWe are subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.We are subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various jurisdictions in which we operate, including increasing and complex regulatory sanctions regimes. These laws and regulations significantly affect and have the potential to restrict the scope of our existing businesses, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates or make our products and services more expensive for our clients. We are also required to file various financial and non-financial regulatory reports to comply with laws, rules and regulations in the jurisdictions in which we operate.We continue to adjust our business and operations, legal entity structure, disclosure and policies, processes, procedures and controls, including with regard to capital and liquidity management, risk management and data management, to comply with laws, rules and regulations, as well as guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS)), Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S., foreign regulators, other government authorities and self-regulatory organizations. Further, we could become subject to future laws, rules and regulations beyond those currently proposed, adopted or contemplated in the U.S. or abroad, including policies and rulemaking related to emerging technologies, cybersecurity and data, and climate risk management and ESG governance and reporting, including emissions and sustainability disclosure. The cumulative effect of all of the current and possible future legislation and regulations on our litigation and regulatory exposure, businesses, operations and profitability remains uncertain and necessitates that we make certain assumptions with respect to the scope and requirements of prospective and proposed laws, rules and regulations in our business planning. If these assumptions prove incorrect, we could be subject to increased regulatory, legal and compliance risks and costs as well as potential reputational harm. Also, U.S. and regulatory initiatives abroad may overlap, and non-U.S. regulation and initiatives may be inconsistent or may conflict with current or proposed U.S. regulations, which could lead to compliance risks and increased costs.Our regulators’ prudential and supervisory authority gives them broad power and discretion to direct our actions, and they have assumed an active oversight, inspection and investigatory role across the financial services industry. Regulatory focus is not limited to laws, rules and regulations applicable to the financial services industry, but includes other significant laws, rules and regulations that apply across industries and jurisdictions, including those related to anti-money laundering, anti-bribery, anti-corruption and regulatory sanctions. We are also subject to laws, rules and regulations in the U.S. and abroad, including the GDPR and CCPA as modified by the CPRA, and a number of additional jurisdictions enacting or considering similar laws, regarding privacy and the disclosure, collection, use, sharing and safeguarding of personally identifiable information, including our employees, customers, suppliers, counterparties and other third parties, the violation of which could result in litigation, regulatory fines, enforcement actions and operational loss. The complexity and risk of compliance has been magnified by the collection of employee health and/or other information in response to the pandemic. Additionally, we will likely be subject to new and evolving data privacy laws in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines and enforcement actions. There remains complexity and uncertainty, including potential suspension or prohibition, regarding data transfer because of concerns over compliance with laws, rules and regulations for cross-border flows and transfers of personal data from the European Economic Area (EEA) to the U.S. and other jurisdictions outside of the EEA, resulting from judicial and regulatory guidance. To the extent that a new EU-U.S. Data Privacy Framework leads to a relaxation of applicable legislation and regulations, regardless of transfer mechanism, challenges are expected from consumer advocacy groups. Other jurisdictions, including China, Russia and India, have commenced consultation efforts or enacted new legislation or regulations to establish standards for personal data transfers. If cross-border personal data transfers are suspended or restricted or we are required to implement distinct processes for each jurisdiction’s standards, this could result in operational disruptions to our businesses, additional costs, increased enforcement activity, new contract negotiations with third parties, and/or modification of such data management.As part of their enforcement authority, our regulators and other government authorities have the authority to, among other things, conduct investigations and assess significant civil or criminal monetary fines, penalties or restitution, issue cease and desist orders, initiate injunctive action, apply regulatory sanctions or enter into consent orders. The amounts paid by us and other financial institutions to settle proceedings or investigations have, in some instances, been substantial and may increase. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of such resolutions, which could have significant consequences, including reputational harm, loss of customers, restrictions on the ability to access capital markets, and the inability to operate certain businesses or offer certain products. Our response to regulators and other government authorities may be time-consuming, be expensive and divert management attention from our business. The outcome of any matter, which may last years, may be difficult to predict or estimate.Additionally, the terms of settlements, orders and agreements that we have entered into with government entities and regulatory authorities have imposed, or could impose, significant operational and compliance costs on us with respect to enhancements to our procedures and controls, losses with respect to fraudulent transactions perpetrated against our customers, expansion of our risk and control functions within our lines of business, investment in technology and the hiring of significant numbers of additional risk, control and compliance personnel. If we fail to meet the requirements of the regulatory settlements, orders or agreements to which we are subject, or, more generally, fail to maintain risk and control procedures and processes that meet the heightened standards established by our regulators and other government authorities, we could be required to enter into further settlements, orders or agreements and pay additional fines, penalties or judgments, or accept material regulatory restrictions on our businesses. Improper actions, behaviors or practices by us, our employees or representatives that are illegal, unethical or contrary to our core values could harm us, our shareholders or customers or damage the integrity of the financial markets, and are subject to regulatory scrutiny across jurisdictions. The complexity of the regulatory and enforcement regimes in the Regulatory, Compliance and LegalWe are subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.We are subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various jurisdictions in which we operate, including increasing and complex regulatory sanctions regimes. These laws and regulations significantly affect and have the potential to restrict the scope of our existing businesses, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates or make our products and services more expensive for our clients. We are also required to file various financial and non-financial regulatory reports to comply with laws, rules and regulations in the jurisdictions in which we operate.We continue to adjust our business and operations, legal entity structure, disclosure and policies, processes, procedures and controls, including with regard to capital and liquidity management, risk management and data management, to comply with laws, rules and regulations, as well as guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS)), Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S., foreign regulators, other government authorities and self-regulatory organizations. Further, we could become subject to future laws, rules and regulations beyond those currently proposed, adopted or contemplated in the U.S. or abroad, including policies and rulemaking related to emerging technologies, cybersecurity and data, and climate risk management and ESG governance and reporting, including emissions and sustainability disclosure. The cumulative effect of all of the current and possible future legislation and regulations on our litigation and regulatory exposure, businesses, operations and profitability remains uncertain and necessitates that we make certain assumptions with respect to the scope and requirements of prospective and proposed laws, rules and regulations in our business planning. If these assumptions prove incorrect, we could be subject to increased regulatory, legal and compliance risks and costs as well as potential reputational harm. Also, U.S. and regulatory initiatives abroad may overlap, and non-U.S. regulation and initiatives may be inconsistent or may conflict with current or proposed U.S. regulations, which could lead to compliance risks and increased costs.Our regulators’ prudential and supervisory authority gives them broad power and discretion to direct our actions, and they have assumed an active oversight, inspection and investigatory role across the financial services industry. Regulatory focus is not limited to laws, rules and regulations applicable to the financial services industry, but includes other significant laws, rules and regulations that apply across industries and jurisdictions, including those related to anti-money laundering, anti-bribery, anti-corruption and regulatory sanctions. We are also subject to laws, rules and regulations in the U.S. and abroad, including the GDPR and CCPA as modified by the CPRA, and a number of additional jurisdictions enacting or considering similar laws, regarding privacy and the disclosure, collection, use, sharing and safeguarding of personally identifiable information, including our employees, customers, suppliers, counterparties and other third parties, the violation of which could result in litigation, regulatory fines, enforcement actions and operational loss. The complexity and risk of

We do business throughout the world, including in emerging markets. Economic or geopolitical stress in one or more countries could have a negative impact regionally or globally, resulting in, among other things, market volatility, reduced market value and economic output. Our liquidity and credit risk could be adversely impacted by, and our businesses and revenues derived from non-U.S. jurisdictions are subject to, risk of loss from financial, social or judicial instability, economic sanctions, changes in government leadership, including as a result of electoral outcomes or otherwise, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, high inflation, natural disasters, the emergence or continuation of widespread health emergencies or pandemics, capital controls, currency re-denomination risk from a country exiting the EU or otherwise, currency fluctuations, foreign exchange controls or movements (caused by devaluation or de-pegging), unfavorable political and diplomatic developments, oil price fluctuations and changes in legislation. These risks are especially elevated in emerging markets. Continued tensions between the U.S. and important trading partners, particularly China, may result in sanctions, further tariff increases or other restrictive actions on cross-border trade, investment and transfer of information technology, which could reduce trade volumes, result in further supply chain disruptions, increase costs for producers, and adversely affect our businesses and revenues, as well as our customers and counterparties, including their credit quality.Slowing growth, recessionary conditions, adverse geopolitical conditions and/or political or civil unrest, labor shortages, wage pressures and elevated inflation in certain countries pose challenges, including in the form of volatility in financial markets. Foreign exchange rates against the U.S. dollar remain an area of uncertainty and potential volatility, and depreciation could increase our financial risks with clients that deal in non-U.S. currencies but have U.S. dollar-denominated debt.We invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less liquid and more volatile than U.S. trading markets. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors.Elevated government debt levels raise the risk of volatility, significant valuation changes, political tensions among EU members regarding fiscal policy or defaults on or devaluation of sovereign debt, which could expose us to substantial losses. Financial markets have been and may continue to be sensitive to government plans to lower taxes or increase spending.Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges and regulators, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are less predictable, prone to change and uncertainty, and regularly evolving. Significant resources are spent on determining, understanding and monitoring foreign laws, rules and regulations, as well as managing our relationships with multiple regulators in various jurisdictions. Our inability to remain in compliance with local laws and manage our relationships with regulators could result in increased expenses, changes to our organizational structure and adversely affect our businesses, reputation and results of operations in that market.We are also subject to complex and extensive U.S. and non-U.S. laws, rules and regulations, which subject us to costs and risks relating to bribery and corruption, know-your-customer requirements, anti-money laundering, embargo programs and economic sanctions, which can vary by jurisdiction and require implementation of complex operational capabilities and compliance programs. Non-compliance, including improper implementation, and/or violations could result in an increase in operational and compliance costs, and enforcement actions and civil and criminal penalties against us and individual employees. The increasing speed and novel ways in which funds circulate could make it more challenging to track the movement of funds and heighten financial crimes risk. Compliance with these evolving regulatory regimes and legal requirements depends on our ability to improve our processes, controls, surveillance, detection and reporting and analytic capabilities.In the U.S., the government’s debt ceiling and budget deficit concerns have increased the possibility of U.S. government defaults on its debt and/or further downgrades to its credit ratings, and prolonged government shutdowns, which could businesses and revenues, as well as our customers and counterparties, including their credit quality. Slowing growth, recessionary conditions, adverse geopolitical conditions and/or political or civil unrest, labor shortages, wage pressures and elevated inflation in certain countries pose challenges, including in the form of volatility in financial markets. Foreign exchange rates against the U.S. dollar remain an area of uncertainty and potential volatility, and depreciation could increase our financial risks with clients that deal in non-U.S. currencies but have U.S. dollar-denominated debt. We invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less liquid and more volatile than U.S. trading markets. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors. Elevated government debt levels raise the risk of volatility, significant valuation changes, political tensions among EU members regarding fiscal policy or defaults on or devaluation of sovereign debt, which could expose us to substantial losses. Financial markets have been and may continue to be sensitive to government plans to lower taxes or increase spending. Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges and regulators, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are less predictable, prone to change and uncertainty, and regularly evolving. Significant resources are spent on determining, understanding and monitoring foreign laws, rules and regulations, as well as managing our relationships with multiple regulators in various jurisdictions. Our inability to remain in compliance with local laws and manage our relationships with regulators could result in increased expenses, changes to our organizational structure and adversely affect our businesses, reputation and results of operations in that market. We are also subject to complex and extensive U.S. and non-U.S. laws, rules and regulations, which subject us to costs and risks relating to bribery and corruption, know-your-customer requirements, anti-money laundering, embargo programs and economic sanctions, which can vary by jurisdiction and require implementation of complex operational capabilities and compliance programs. Non-compliance, including improper implementation, and/or violations could result in an increase in operational and compliance costs, and enforcement actions and civil and criminal penalties against us and individual employees. The increasing speed and novel ways in which funds circulate could make it more challenging to track the movement of funds and heighten financial crimes risk. Compliance with these evolving regulatory regimes and legal requirements depends on our ability to improve our processes, controls, surveillance, detection and reporting and analytic capabilities. In the U.S., the government’s debt ceiling and budget deficit concerns have increased the possibility of U.S. government defaults on its debt and/or further downgrades to its credit ratings, and prolonged government shutdowns, which could 13 Bank of America 13 Bank of America 13 Bank of America 13 Bank of America weaken the U.S. dollar, cause market volatility, negatively impact the global economy and banking system and adversely affect our financial condition, including our liquidity. Additionally, changes in fiscal, monetary, regulatory and/or foreign policy, including as a result of the election cycle, labor shortages, wage pressures, supply chain disruptions and higher inflation, could increase our compliance costs and adversely affect our business operations, organizational structure and results of operations. Emerging market currency values and monetary policy settings are particularly sensitive to such changes in U.S. monetary policy. Additionally, further restrictive U.S. monetary policy, potentially including further rate increases, could result in additional currency volatility and recessionary conditions in a number of non-U.S. markets.We are also subject to geopolitical risks, including economic sanctions, acts or threats of international or domestic terrorism, including responses by the U.S. or other governments thereto, increased state-sponsored cyberattacks or campaigns, civil unrest and/or military conflicts, including the escalation of tensions between China and Taiwan, which could adversely affect business, market trade and general economic conditions abroad and in the U.S. The Russia/Ukraine conflict and the conflict in the Middle East have magnified such risks and resulted in regional instability and adversely impacted commodity and other financial markets, as well as economic conditions, especially in Europe. Widening regional conflicts resulting in the involvement of neighboring countries and/or North Atlantic Treaty Organization member countries could result in additional economic disruptions, financial market volatility, higher inflation and changes to asset valuations, which could disrupt our operations and adversely affect our results of operations.Business OperationsA failure in or breach of our operations or information systems, or those of third parties or the financial services industry, could cause disruptions, adversely impact our businesses, results of operations and financial condition, and cause legal or reputational harm.Operational risk exposure exists throughout our organization and as a result of our extensive interactions with, and reliance on, third parties and the financial services industry, including the processing and reporting of a large number of transactions in many currencies and jurisdictions. Our operations and information systems, which comprise the hardware, software, infrastructure, backup systems and other technology which we own or use to collect, process, maintain, use, share, disseminate or dispose of information, are integral to the performance of our businesses.Our operations and information systems and components thereof, and those of our third parties, have been, and in the future could be, ineffective or fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our or such third party’s control. Such events have adversely affected, and in the future could adversely affect, physical site access of our operations, our ability to process transactions, provide services and perform other operations. Short-term or prolonged disruptions to our critical business operations and customer services are possible due to computer, telecommunications, network, utility, electronic or physical infrastructure outages, including from abuse or failure of our electronic trading and algorithmic platforms, significant unplanned increases in customer transactions, fraudulent transactions, newly identified vulnerabilities in key hardware and software, failure of infrastructure or manual processes, technology project implementation challenges and supply chain disruptions. Operational disruptions and prolonged operational outages could also result from events arising from natural disasters, including acute and chronic weather events, such as wildfires, tornadoes, hurricanes and floods, some of which are happening with more frequency and severity, and earthquakes, as well as local or larger scale political or social matters, including civil unrest, terrorist acts and military conflict.We continue to have greater reliance on our and our third parties’ remote access tools and technology, and employees’ personal systems and increased data utilization and dependence upon our information systems to operate our businesses remotely, including as a result of evolving customer preferences, which has led to increased reliance on digital banking and other digital services provided by our businesses. Effective management of our business continuity increasingly depends on the security, reliability and adequacy of such systems.We also rely on our employees, representatives and third parties in our day-to-day operations, who may, due to illness, unavailability, the emergence or continuation of health emergencies or pandemics, human error, misconduct (including errors in judgment, malice, fraud or illegal activity), malfeasance or a failure or breach of information systems, cause disruptions to our organization and expose us to operational losses, regulatory risk and reputational harm. Our and our third parties’ inability to properly introduce, deploy and manage operational changes, including with regard to internal financial and governance processes, existing products, services and technology, and new product innovations and technology, could also result in additional operational and regulatory risk.Regardless of the measures we have taken to implement training, procedures, backup systems and other safeguards to support our operations and bolster our operational resilience, our ability to conduct business may be adversely affected by significant disruptions to us or to third parties with whom we interact or upon whom we rely, including localized or systemic cyber events that result in information systems outages and unavailability of part or all of the internet, cloud services and/or the financial services industry infrastructure (including electronic trading and algorithmic platforms and critical banking activities). Our ability to implement backup systems and other safeguards with respect to third-party systems and the financial services industry infrastructure is more limited than with respect to our systems. Weakness in our third parties’ processes or controls could impact our ability to deliver products or services to our clients and expose us to compliance and operational risks.There can be no assurance that our business continuity and information security response plans will effectively mitigate our operational risks. Any backup systems or manual processes may not process data accurately and/or as quickly or effectively as our primary systems, and some data might not have been backed up. Additionally, the speed in which we are able to remediate any failure or disruption of our operations and/or information systems may vary across jurisdictions. We regularly update the information systems we rely on to support our operations and growth as part of our efforts to comply with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new or modified information systems and integrating them with existing information systems, including business interruptions.A failure or breach of our or our third parties’ operations or information systems resulting in disruption to our critical weaken the U.S. dollar, cause market volatility, negatively impact the global economy and banking system and adversely affect our financial condition, including our liquidity. Additionally, changes in fiscal, monetary, regulatory and/or foreign policy, including as a result of the election cycle, labor shortages, wage pressures, supply chain disruptions and higher inflation, could increase our compliance costs and adversely affect our business operations, organizational structure and results of operations. Emerging market currency values and monetary policy settings are particularly sensitive to such changes in U.S. monetary policy. Additionally, further restrictive U.S. monetary policy, potentially including further rate increases, could result in additional currency volatility and recessionary conditions in a number of non-U.S. markets.We are also subject to geopolitical risks, including economic sanctions, acts or threats of international or domestic terrorism, including responses by the U.S. or other governments thereto, increased state-sponsored cyberattacks or campaigns, civil unrest and/or military conflicts, including the escalation of tensions between China and Taiwan, which could adversely affect business, market trade and general economic conditions abroad and in the U.S. The Russia/Ukraine conflict and the conflict in the Middle East have magnified such risks and resulted in regional instability and adversely impacted commodity and other financial markets, as well as economic conditions, especially in Europe. Widening regional conflicts resulting in the involvement of neighboring countries and/or North Atlantic Treaty Organization member countries could result in additional economic disruptions, financial market volatility, higher inflation and changes to asset valuations, which could disrupt our operations and adversely affect our results of operations.Business OperationsA failure in or breach of our operations or information systems, or those of third parties or the financial services industry, could cause disruptions, adversely impact our businesses, results of operations and financial condition, and cause legal or reputational harm.Operational risk exposure exists throughout our organization and as a result of our extensive interactions with, and reliance on, third parties and the financial services industry, including the processing and reporting of a large number of transactions in many currencies and jurisdictions. Our operations and information systems, which comprise the hardware, software, infrastructure, backup systems and other technology which we own or use to collect, process, maintain, use, share, disseminate or dispose of information, are integral to the performance of our businesses.Our operations and information systems and components thereof, and those of our third parties, have been, and in the future could be, ineffective or fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our or such third party’s control. Such events have adversely affected, and in the future could adversely affect, physical site access of our operations, our ability to process transactions, provide services and perform other operations. Short-term or prolonged disruptions to our critical business operations and customer services are possible due to computer, telecommunications, network, utility, electronic or physical infrastructure outages, including from abuse or failure of our electronic trading and algorithmic platforms, significant unplanned increases in customer transactions, fraudulent transactions, newly identified vulnerabilities in key hardware and software, failure of weaken the U.S. dollar, cause market volatility, negatively impact the global economy and banking system and adversely affect our financial condition, including our liquidity. Additionally, changes in fiscal, monetary, regulatory and/or foreign policy, including as a result of the election cycle, labor shortages, wage pressures, supply chain disruptions and higher inflation, could increase our compliance costs and adversely affect our business operations, organizational structure and results of operations. Emerging market currency values and monetary policy settings are particularly sensitive to such changes in U.S. monetary policy. Additionally, further restrictive U.S. monetary policy, potentially including further rate increases, could result in additional currency volatility and recessionary conditions in a number of non-U.S. markets. We are also subject to geopolitical risks, including economic sanctions, acts or threats of international or domestic terrorism, including responses by the U.S. or other governments thereto, increased state-sponsored cyberattacks or campaigns, civil unrest and/or military conflicts, including the escalation of tensions between China and Taiwan, which could adversely affect business, market trade and general economic conditions abroad and in the U.S. The Russia/Ukraine conflict and the conflict in the Middle East have magnified such risks and resulted in regional instability and adversely impacted commodity and other financial markets, as well as economic conditions, especially in Europe. Widening regional conflicts resulting in the involvement of neighboring countries and/or North Atlantic Treaty Organization member countries could result in additional economic disruptions, financial market volatility, higher inflation and changes to asset valuations, which could disrupt our operations and adversely affect our results of operations.

We do business throughout the world, including in emerging markets. Economic or geopolitical stress in one or more countries could have a negative impact regionally or globally, resulting in, among other things, market volatility, reduced market value and economic output. Our liquidity and credit risk could be adversely impacted by, and our businesses and revenues derived from non-U.S. jurisdictions are subject to, risk of loss from financial, social or judicial instability, economic sanctions, changes in government leadership, including as a result of electoral outcomes or otherwise, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, high inflation, natural disasters, the emergence or continuation of widespread health emergencies or pandemics, capital controls, currency re-denomination risk from a country exiting the EU or otherwise, currency fluctuations, foreign exchange controls or movements (caused by devaluation or de-pegging), unfavorable political and diplomatic developments, oil price fluctuations and changes in legislation. These risks are especially elevated in emerging markets. Continued tensions between the U.S. and important trading partners, particularly China, may result in sanctions, further tariff increases or other restrictive actions on cross-border trade, investment, and transfer of information technology that weigh on trade volumes, raise costs for producers, and adversely affect our businesses and revenues, as well as our customers and counterparties, including their credit quality. Slowing growth, recessionary conditions, market volatility and/or political or civil unrest, global supply chain disruptions, labor shortages, wage pressures and elevated inflation in many countries pose additional challenges, including in the form of volatility in financial markets. Foreign exchange rates against the U.S. dollar remain an area of uncertainty and potential volatility as the Federal Reserve and other central banks raise interest rates, and depreciation could increase our financial risks with clients that deal in non-U.S. currencies but have U.S. dollar-denominated debt. We invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less liquid and more volatile than U.S. trading markets. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors. Elevated government debt levels raise the risk of volatility, significant valuation changes, political tensions among EU members regarding fiscal policy or defaults on or devaluation of sovereign debt, which could expose us to substantial losses. Financial markets have been and may continue to be sensitive to government plans to lower taxes or increase spending.Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges and regulators, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are less predictable, prone to change and uncertainty and evolving, and it may be difficult to determine the requirements of local laws in every market or manage our relationships with multiple regulators in various jurisdictions. Significant resources are spent on understanding and monitoring foreign laws, rules and regulations. Our inability to remain in compliance with local laws and manage our relationships with regulators could result in increased expenses, changes to our organizational structure and adversely affect our businesses, reputation and results of operations in that market.We are also subject to complex and extensive U.S. and non-U.S. laws, rules and regulations, which subject us to costs and risks relating to bribery and corruption, anti-money laundering, embargo programs and economic sanctions, which can vary by jurisdiction and require implementation of complex operational capabilities and compliance programs. Non-compliance and/or violations could result in an increase in operational and compliance costs, and enforcement actions and civil and criminal penalties against us and individual employees. The increasing speed and novel ways in which funds circulate could make it more challenging to track the movement of funds and heighten financial crimes risk. Compliance with these evolving regulatory regimes and legal requirements depends on our ability to improve our processes, controls, surveillance, detection and reporting and analytic capabilities.In connection with the U.K.’s exit from the EU, we are now subject to different laws and regulations, which are expected to diverge further over time, and are subject to the oversight of additional regulatory authorities. As political and regulatory environments evolve, further changes to the legal and regulatory framework under which our subsidiaries provide products and services in the U.K. and in the EU may result in additional compliance costs and have negative tax consequences or an adverse impact on our results of operations.In the U.S., the government’s debt ceiling and budget deficit concerns have increased the possibility of U.S. government defaults on its debt and/or downgrades to its credit ratings, and prolonged government shutdowns, which could weaken the U.S. dollar, cause market volatility, negatively impact the global economy and banking system and adversely affect our financial condition, including our liquidity. Additionally, changes in fiscal, monetary or regulatory policy, including as a result of labor shortages, wage pressures, supply chain disruptions and higher inflation, could increase our compliance costs and adversely affect our business operations, organizational structure and results of operations. Monetary policy has contributed to a significant depreciation of many foreign currencies over the past liquid and more volatile than U.S. trading markets. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors. Elevated government debt levels raise the risk of volatility, significant valuation changes, political tensions among EU members regarding fiscal policy or defaults on or devaluation of sovereign debt, which could expose us to substantial losses. Financial markets have been and may continue to be sensitive to government plans to lower taxes or increase spending. Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges and regulators, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are less predictable, prone to change and uncertainty and evolving, and it may be difficult to determine the requirements of local laws in every market or manage our relationships with multiple regulators in various jurisdictions. Significant resources are spent on understanding and monitoring foreign laws, rules and regulations. Our inability to remain in compliance with local laws and manage our relationships with regulators could result in increased expenses, changes to our organizational structure and adversely affect our businesses, reputation and results of operations in that market. We are also subject to complex and extensive U.S. and non-U.S. laws, rules and regulations, which subject us to costs and risks relating to bribery and corruption, anti-money laundering, embargo programs and economic sanctions, which can vary by jurisdiction and require implementation of complex operational capabilities and compliance programs. Non-compliance and/or violations could result in an increase in operational and compliance costs, and enforcement actions and civil and criminal penalties against us and individual employees. The increasing speed and novel ways in which funds circulate could make it more challenging to track the movement of funds and heighten financial crimes risk. Compliance with these evolving regulatory regimes and legal requirements depends on our ability to improve our processes, controls, surveillance, detection and reporting and analytic capabilities. In connection with the U.K.’s exit from the EU, we are now subject to different laws and regulations, which are expected to diverge further over time, and are subject to the oversight of additional regulatory authorities. As political and regulatory environments evolve, further changes to the legal and regulatory framework under which our subsidiaries provide products and services in the U.K. and in the EU may result in additional compliance costs and have negative tax consequences or an adverse impact on our results of operations. In the U.S., the government’s debt ceiling and budget deficit concerns have increased the possibility of U.S. government defaults on its debt and/or downgrades to its credit ratings, and prolonged government shutdowns, which could weaken the U.S. dollar, cause market volatility, negatively impact the global economy and banking system and adversely affect our financial condition, including our liquidity. Additionally, changes in fiscal, monetary or regulatory policy, including as a result of labor shortages, wage pressures, supply chain disruptions and higher inflation, could increase our compliance costs and adversely affect our business operations, organizational structure and results of operations. Monetary policy has contributed to a significant depreciation of many foreign currencies over the past 13 Bank of America 13 Bank of America 13 Bank of America 13 Bank of America year. Emerging markets are particularly vulnerable to tighter U.S. monetary policy, and many have responded by tightening monetary policy and intervening in foreign exchange markets. Further monetary tightening by the Federal Reserve risks creating additional currency volatility and recessionary conditions in a number of non-U.S. markets.We are also subject to geopolitical risks, including economic sanctions, acts or threats of international or domestic terrorism, including responses by the U.S. or other governments thereto, increased risk of state-sponsored cyberattacks or campaigns, civil unrest and/or military conflicts, including the escalation of tensions between China and Taiwan, which could adversely affect business, market trade and general economic conditions abroad and in the U.S. The Russia/Ukraine conflict has magnified such risks and resulted in regional instability and adversely impacted commodity and other financial markets, as well as economic conditions, especially in Europe where there is significant risk of recession in some countries. The disruption of energy supplies and other goods and sanctions have contributed to inflationary pressures in Europe and other regions, which has resulted in greater monetary tightening by policymakers, and could adversely impact the profitability of businesses and our credit risk. Military escalation resulting in the involvement of neighboring countries and/or North Atlantic Treaty Organization member countries or new sanctions could result in additional economic disruptions, financial market volatility, and changes to asset valuations, which could disrupt our operations and adversely affect our results of operations.Business OperationsA failure in or breach of our operational or security systems or infrastructure, or those of third parties or the financial services industry, could cause disruptions, adversely impact our results of operations and financial condition, and cause legal or reputational harm.Operational risk exposure exists throughout our organization and as a result of our interactions with, and reliance on, third parties and the financial services industry infrastructure. Our operational and security systems infrastructure, including our computer systems, emerging technologies, data management and internal processes and controls, as well as those of third parties, are integral to our performance. Our financial, accounting, data processing and transmission, storage, backup and other operating or security systems and infrastructure, or those of third parties, may be ineffective or fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our or such third party’s control, which could adversely affect our ability to process transactions or provide services. Prolonged disruptions to our critical business operations and customer services are possible due to computer, telecommunications, network, utility, electronic or physical infrastructure outages, including from abuse or failure of our electronic trading and algorithmic platforms, significant unplanned increases in customer transactions, newly identified vulnerabilities in key hardware and software, failure of aging infrastructure or manual processes, retired or redundant software and/or hardware, technology project implementation challenges and supply chain disruptions. Operational disruptions and prolonged operational outages could also result from events arising from natural disasters, including acute and chronic weather events, such as wildfires, tornadoes, hurricanes and floods, some of which are happening with more frequency and severity, and earthquakes, as well as local or larger scale political or social matters, including civil unrest, terrorist acts and military conflict.We continue to have greater reliance on remote access tools and technology and employees’ personal systems (and our third parties’ employees’ personal systems) and increased data utilization and are increasingly dependent upon our information technology infrastructure to operate our businesses remotely due to the increased number of employees who work from home and evolving customer preferences, including increased reliance on digital banking and other digital services provided by our businesses. Effective management of our business continuity increasingly depends on the security, reliability and adequacy of such systems.We also rely on our employees, representatives and third parties in our day-to-day operations, who may, due to illness, unavailability, human error, misconduct (including errors in judgment, malice, fraudulent or illegal activity), malfeasance or a failure or breach of systems or infrastructure cause disruptions to our organization and expose us to operational losses, regulatory risk and reputational harm. Our and our third parties’ inability to properly introduce, deploy and manage changes to internal financial and governance processes, existing products, services and technology, and new product innovations and technology could also result in additional operational and regulatory risk.Regardless of the measures we have taken to implement training, procedures, backup systems and other safeguards to support our operations and bolster our operational resilience, our ability to conduct business may be adversely affected by significant disruptions to us or to third parties with whom we interact or upon whom we rely, including systemic cyber events that result in system outages and unavailability of part or all of the internet, cloud services and/or the financial services industry infrastructure (including electronic trading platforms and critical banking activities). Our ability to implement backup systems and other safeguards with respect to third-party systems and the financial services industry infrastructure is more limited than with our own systems.Any backup systems may not process data as quickly as our primary systems and some data might not have been backed up. We regularly update the systems we rely on to support our operations and growth and to remain compliant with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions.A failure or breach of our operational or security systems or infrastructure resulting in disruption to our critical business operations and customer services and/or failure to identify, effectively respond to operational risks in a timely manner, and continue to deliver our services through an operational disruption could expose us to a number of risks, including market abuse, regulatory, market, privacy and liquidity risk, and adversely impact our results of operations and financial condition, and cause legal or reputational harm.A cyberattack, information or security breach, or a technology failure of ours or of a third party could adversely affect our ability to conduct our business, result in the misuse or disclosure of information, result in additional costs, damage to our reputation, increase our regulatory and legal risks and cause financial losses. Our business is highly dependent on the security, controls and efficacy of our infrastructure, computer and data management systems, and those of our customers, suppliers, counterparties and other third parties, the financial services year. Emerging markets are particularly vulnerable to tighter U.S. monetary policy, and many have responded by tightening monetary policy and intervening in foreign exchange markets. Further monetary tightening by the Federal Reserve risks creating additional currency volatility and recessionary conditions in a number of non-U.S. markets.We are also subject to geopolitical risks, including economic sanctions, acts or threats of international or domestic terrorism, including responses by the U.S. or other governments thereto, increased risk of state-sponsored cyberattacks or campaigns, civil unrest and/or military conflicts, including the escalation of tensions between China and Taiwan, which could adversely affect business, market trade and general economic conditions abroad and in the U.S. The Russia/Ukraine conflict has magnified such risks and resulted in regional instability and adversely impacted commodity and other financial markets, as well as economic conditions, especially in Europe where there is significant risk of recession in some countries. The disruption of energy supplies and other goods and sanctions have contributed to inflationary pressures in Europe and other regions, which has resulted in greater monetary tightening by policymakers, and could adversely impact the profitability of businesses and our credit risk. Military escalation resulting in the involvement of neighboring countries and/or North Atlantic Treaty Organization member countries or new sanctions could result in additional economic disruptions, financial market volatility, and changes to asset valuations, which could disrupt our operations and adversely affect our results of operations.Business OperationsA failure in or breach of our operational or security systems or infrastructure, or those of third parties or the financial services industry, could cause disruptions, adversely impact our results of operations and financial condition, and cause legal or reputational harm.Operational risk exposure exists throughout our organization and as a result of our interactions with, and reliance on, third parties and the financial services industry infrastructure. Our operational and security systems infrastructure, including our computer systems, emerging technologies, data management and internal processes and controls, as well as those of third parties, are integral to our performance. Our financial, accounting, data processing and transmission, storage, backup and other operating or security systems and infrastructure, or those of third parties, may be ineffective or fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our or such third party’s control, which could adversely affect our ability to process transactions or provide services. Prolonged disruptions to our critical business operations and customer services are possible due to computer, telecommunications, network, utility, electronic or physical infrastructure outages, including from abuse or failure of our electronic trading and algorithmic platforms, significant unplanned increases in customer transactions, newly identified vulnerabilities in key hardware and software, failure of aging infrastructure or manual processes, retired or redundant software and/or hardware, technology project implementation challenges and supply chain disruptions. Operational disruptions and prolonged operational outages could also result from events arising from natural disasters, including acute and chronic weather events, such as wildfires, tornadoes, hurricanes and floods, some of which are happening with more frequency and severity, and earthquakes, as well as local or larger scale year. Emerging markets are particularly vulnerable to tighter U.S. monetary policy, and many have responded by tightening monetary policy and intervening in foreign exchange markets. Further monetary tightening by the Federal Reserve risks creating additional currency volatility and recessionary conditions in a number of non-U.S. markets. We are also subject to geopolitical risks, including economic sanctions, acts or threats of international or domestic terrorism, including responses by the U.S. or other governments thereto, increased risk of state-sponsored cyberattacks or campaigns, civil unrest and/or military conflicts, including the escalation of tensions between China and Taiwan, which could adversely affect business, market trade and general economic conditions abroad and in the U.S. The Russia/Ukraine conflict has magnified such risks and resulted in regional instability and adversely impacted commodity and other financial markets, as well as economic conditions, especially in Europe where there is significant risk of recession in some countries. The disruption of energy supplies and other goods and sanctions have contributed to inflationary pressures in Europe and other regions, which has resulted in greater monetary tightening by policymakers, and could adversely impact the profitability of businesses and our credit risk. Military escalation resulting in the involvement of neighboring countries and/or North Atlantic Treaty Organization member countries or new sanctions could result in additional economic disruptions, financial market volatility, and changes to asset valuations, which could disrupt our operations and adversely affect our results of operations.

We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value and are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate.Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively mitigated the risk of our exposures. Increases in interest rates may cause decreases in residential mortgage loan originations and could impact the origination of corporate debt. In addition, increases in interest rates or changes in spreads may continue to adversely impact the fair value of our debt securities and, accordingly, for debt securities classified as available-for-sale (AFS), adversely affect accumulated other comprehensive income and, thus, our capital levels. Increases in interest rates could also adversely impact our regulatory liquidity position and requirements, which include certain AFS debt securities and the use of repurchase agreements against a portion of the held-to-maturity (HTM) debt securities. As our liquidity is dependent on the fair value of these assets, increases in market interest rates, which have adversely impacted and may continue to adversely impact the fair value of debt securities, could adversely affect liquidity levels.Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets.LiquidityIf we are unable to access the capital markets, have prolonged net deposits outflows, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.Liquidity is essential to our businesses. We fund our assets primarily with globally sourced deposits in our bank entities, as well as secured and unsecured liabilities transacted in the capital markets. We rely on certain secured funding sources, such as repo markets, which are typically short-term and credit-sensitive. We also engage in asset securitization transactions, including with the government-sponsored enterprises (GSEs), to fund consumer lending activities. Our liquidity could be adversely affected by any inability to access the capital markets, illiquidity or volatility in the capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value and are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate. Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively mitigated the risk of our exposures. Increases in interest rates may cause decreases in residential mortgage loan originations and could impact the origination of corporate debt. In addition, increases in interest rates or changes in spreads may continue to adversely impact the fair value of our debt securities and, accordingly, for debt securities classified as available-for-sale (AFS), adversely affect accumulated other comprehensive income and, thus, our capital levels. Increases in interest rates could also adversely impact our regulatory liquidity position and requirements, which include certain AFS debt securities and the use of repurchase agreements against a portion of the held-to-maturity (HTM) debt securities. As our liquidity is dependent on the fair value of these assets, increases in market interest rates, which have adversely impacted and may continue to adversely impact the fair value of debt securities, could adversely affect liquidity levels. Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets. Liquidity

We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value and are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate. Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively hedged our exposures. Increases in interest rates may result in further decreases in residential mortgage loan originations and could impact the origination of corporate debt. In addition, increases in interest rates or changes in spreads may continue to adversely impact the fair value of debt securities and, accordingly, for debt securities classified as available for sale, may continue to adversely affect accumulated other comprehensive income and, thus, capital levels. These market moves could also adversely impact our regulatory liquidity requirements. Any decreases in interest rates may increase prepayment speeds of certain assets, and, therefore, could adversely affect net interest income. Changes in interest rates also may impact the value of mortgage service rights retained.Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets.LiquidityIf we are unable to access the capital markets, have prolonged net deposits outflows, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.Liquidity is essential to our businesses. We fund our assets primarily with globally sourced deposits in our bank entities, as well as secured and unsecured liabilities transacted in the capital markets. We rely on certain secured funding sources, such as repo markets, which are typically short-term and credit-sensitive. We also engage in asset securitization transactions, including with the government-sponsored enterprises (GSEs), to fund consumer lending activities. Our liquidity could be adversely affected by any inability to access the capital markets, illiquidity or volatility in the capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term borrowing), changes to our relationships with our funding providers based on real or perceived changes in our risk profile, prolonged federal government shutdowns, or changes in regulations, guidance or GSE status that impact our funding. Additionally, our liquidity or cost of funds may be negatively impacted by the unwillingness or inability of the Federal Reserve to act as lender of last resort, unexpected simultaneous draws on lines of credit, slower customer payment rates, restricted access to the assets of prime brokerage clients, the withdrawal of or failure to attract customer deposits or invested funds (which could result from attrition driven by customers seeking higher yielding deposits or securities products, customer desire to utilize an alternative financial institution perceived to be safer, changes in customer spending behavior due to inflation, decline in the economy or other drivers resulting in an increased need for cash), increased regulatory liquidity, capital and margin requirements for our U.S. or international banks and their nonbank subsidiaries, which could result in the inability to transfer liquidity internally and inefficient funding, changes in patterns of intraday liquidity usage resulting from a counterparty or technology failure or other idiosyncratic event or failure or increases in interest rates or changes in spreads may continue to adversely impact the fair value of debt securities and, accordingly, for debt securities classified as available for sale, may continue to adversely affect accumulated other comprehensive income and, thus, capital levels. These market moves could also adversely impact our regulatory liquidity requirements. Any decreases in interest rates may increase prepayment speeds of certain assets, and, therefore, could adversely affect net interest income. Changes in interest rates also may impact the value of mortgage service rights retained. Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets. Liquidity

We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ ability to timely adapt our business strategies, products and services and their respective features, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events.The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in accurately assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining customers. Our or our third-party providers’ inability or resistance to timely innovate or adapt its operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation.We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk.We use models extensively to forecast losses, project revenue and expenses, assess and control our operations and financial condition, assist in capital planning, manage liquidity and measure, forecast and assess capital and liquidity requirements for credit, market, operational and strategic risks. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform model oversight, including independent validation before initial use, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. However, models are subject to inherent limitations from simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks from applications that rely on AI or machine learning.Our models may not be sufficiently predictive of future results due to limited historical patterns, extreme or unanticipated market movements or customer behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events), which could limit their effectiveness and require timely recalibration. The models that we use to assess and control our market risk exposures also reflect assumptions about the degree of correlation among prices of various asset classes or other market indicators, which may not be representative of the next downturn and would magnify the limitations inherent in using historical data to distribution channels. Our success depends on our and our third-party providers’ ability to timely adapt our business strategies, products and services and their respective features, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events. The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in accurately assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining customers. Our or our third-party providers’ inability or resistance to timely innovate or adapt its operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation.

We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ of products and services abilities to adapt our business strategies, products and services and their respective features in a timely manner, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as DLT in payment, clearing and settlement processes creates additional risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining loyal customers. The Corporation’s, or its third-party providers’, inability or resistance to timely innovate or adapt its operations, products and services to evolving industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation.

We face significant legal risks in our business, with a high volume of claims against us and other financial institutions. The amount of damages, penalties and fines that litigants and regulators seek from us and other financial institutions continues to be significant. This includes disputes with consumers, customers and other counterparties. Financial institutions, including us, continue to be the subject of claims alleging anti-competitive conduct with respect to various products and markets, including U.S. antitrust class actions claiming joint and several liability for treble damages. As disclosed in Note 12 – Commitments and Contingencies to the Consolidated Financial Statements, we also face contractual indemnification and loan-repurchase claims arising from alleged breaches of representations and warranties in the sale of residential mortgages by legacy companies, which may result in a requirement that we repurchase the mortgage loans, or make whole or provide other remedies to counterparties.U.S. regulators and government agencies regularly pursue enforcement claims against financial institutions, including us, for alleged violations of law and customer harm, including under the Financial Institutions Reform, Recovery, and Enforcement Act, the federal securities laws, the False Claims Act, fair lending laws and regulations (including the Equal Credit Opportunity Act and the Fair Housing Act), the FCPA, the BSA, regulations issued by OFAC, Home Mortgage Disclosure Act, antitrust laws, and consumer protection laws and regulations related to products and services such as overdraft and sales practices, including prohibitions on unfair, deceptive, and/or abusive acts and practices (UDAAP) under the Consumer Financial Protection Act and the Federal Trade Commission Act, and EFTA, as well as other enforcement action taken by prudential regulators with respect to safety, soundness and appropriateness of our business practices. Such claims may carry significant penalties, restitution and, in certain cases, treble damages, and the ultimate resolution of regulatory inquiries, investigations and other proceedings which we are subject to from time-to-time is difficult to predict.There is also an increased focus on information security. This includes cybersecurity incidents perpetrated against us, our customers, providers of products and services, counterparties and other third parties, the collection, use and sharing of data, and safeguarding of personally identifiable information and corporate data, as well as the development, implementation, use and management of emerging technologies, including AI and machine learning. Related litigation or government enforcement, including with regard to compliance with U.S. and global laws, rules and regulations, could subject us to fines, judgments and/or settlements and involve reputational losses. Additionally, misconduct by our employees and representatives, including unethical, fraudulent, improper or illegal conduct, the failure to fulfill fiduciary obligations, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures, laws, rules or regulations, including conduct that affects compliance with books and records requirements, have resulted and could result in further litigation and/or government investigations and enforcement actions, and cause significant reputational harm. In particular, we are the subject of litigation and regulatory and government inquiries regarding our processing of electronic payments, our efforts to detect, prevent and address fraud perpetrated against our customers and/or the handling of fraud-related disputes, which could result in fines, judgments, and/or settlements, as well as adversely affect our businesses and strategies due to the treatment of loss allocations between customers and us, all of which could also have an adverse impact on other similar products and services. We are also subject to increasing scrutiny of sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm.The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and Financial institutions, including us, continue to be the subject of claims alleging anti-competitive conduct with respect to various products and markets, including U.S. antitrust class actions claiming joint and several liability for treble damages. As disclosed in Note 12 – Commitments and Contingencies to the Consolidated Financial Statements, we also face contractual indemnification and loan-repurchase claims arising from alleged breaches of representations and warranties in the sale of residential mortgages by legacy companies, which may result in a requirement that we repurchase the mortgage loans, or make whole or provide other remedies to counterparties. U.S. regulators and government agencies regularly pursue enforcement claims against financial institutions, including us, for alleged violations of law and customer harm, including under the Financial Institutions Reform, Recovery, and Enforcement Act, the federal securities laws, the False Claims Act, fair lending laws and regulations (including the Equal Credit Opportunity Act and the Fair Housing Act), the FCPA, the BSA, regulations issued by OFAC, Home Mortgage Disclosure Act, antitrust laws, and consumer protection laws and regulations related to products and services such as overdraft and sales practices, including prohibitions on unfair, deceptive, and/or abusive acts and practices (UDAAP) under the Consumer Financial Protection Act and the Federal Trade Commission Act, and EFTA, as well as other enforcement action taken by prudential regulators with respect to safety, soundness and appropriateness of our business practices. Such claims may carry significant penalties, restitution and, in certain cases, treble damages, and the ultimate resolution of regulatory inquiries, investigations and other proceedings which we are subject to from time-to-time is difficult to predict. There is also an increased focus on information security. This includes cybersecurity incidents perpetrated against us, our customers, providers of products and services, counterparties and other third parties, the collection, use and sharing of data, and safeguarding of personally identifiable information and corporate data, as well as the development, implementation, use and management of emerging technologies, including AI and machine learning. Related litigation or government enforcement, including with regard to compliance with U.S. and global laws, rules and regulations, could subject us to fines, judgments and/or settlements and involve reputational losses. Additionally, misconduct by our employees and representatives, including unethical, fraudulent, improper or illegal conduct, the failure to fulfill fiduciary obligations, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures, laws, rules or regulations, including conduct that affects compliance with books and records requirements, have resulted and could result in further litigation and/or government investigations and enforcement actions, and cause significant reputational harm. In particular, we are the subject of litigation and regulatory and government inquiries regarding our processing of electronic payments, our efforts to detect, prevent and address fraud perpetrated against our customers and/or the handling of fraud-related disputes, which could result in fines, judgments, and/or settlements, as well as adversely affect our businesses and strategies due to the treatment of loss allocations between customers and us, all of which could also have an adverse impact on other similar products and services. We are also subject to increasing scrutiny of sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm. The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and Bank of America 18 Bank of America 18 Bank of America 18 Bank of America 18 regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the adaptation of business strategies and/or limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our participation in implementing government relief measures related to the COVID-19 pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation that may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.U.S. federal banking agencies may require us to increase our regulatory capital, total loss-absorbing capacity (TLAC), long-term debt or liquidity requirements.We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956.Capital and liquidity requirements are frequently introduced and amended. Regulators may increase regulatory capital requirements, including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. In 2023, U.S. banking regulators issued proposals to revise the calculation of the G-SIB surcharge and TLAC and long-term debt requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge increased by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events.As part of its annual CCAR, we are subject to extensive regulatory evaluation of capital planning practices by the Federal Reserve, including stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level, requiring us to hold additional capital or causing changes in required capital buffers.A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure. In July 2023, U.S. banking regulators issued a notice of proposed rulemaking to revise several key methodologies for measuring RWA, including a standardized approach for operational risk, revised market risk and credit risk requirements and removal of the use of certain internal models, which would increase our regulatory capital requirements, if adopted as proposed. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts.Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, which may adversely affect our results of operations.Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments are erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in revisions to prior-period financial statements.We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.Governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the adaptation of business strategies and/or limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our participation in implementing government relief measures related to the COVID-19 pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation that may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.U.S. federal banking agencies may require us to increase our regulatory capital, total loss-absorbing capacity (TLAC), long-term debt or liquidity requirements.We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956.Capital and liquidity requirements are frequently introduced and amended. Regulators may increase regulatory capital requirements, including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. In 2023, U.S. banking regulators issued proposals to revise the calculation of the G-SIB surcharge and TLAC and long-term debt requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge increased by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events.As part of its annual CCAR, we are subject to extensive regulatory evaluation of capital planning practices by the Federal Reserve, including stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level, requiring us to hold additional capital or causing changes in required capital buffers.A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure. In July 2023, U.S. banking regulators issued a notice of proposed rulemaking to revise several key methodologies for measuring RWA, regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the adaptation of business strategies and/or limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our participation in implementing government relief measures related to the COVID-19 pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation that may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.

We face significant legal risks in our business, with a high volume of claims against us and other financial institutions. The amount of damages, penalties and fines that litigants and regulators seek from us and other financial institutions continues to be significant. This includes disputes with consumers, customers and other counterparties. Financial institutions, including us, continue to be the subject of claims alleging anti-competitive conduct with respect to various products and markets, including U.S. antitrust class actions claiming joint and several liability for treble damages. As disclosed in Note 12 – Commitments and Contingencies to the Consolidated Financial Statements, we also face contractual indemnification and loan-repurchase claims arising from alleged breaches of representations and warranties in the sale of residential mortgages by legacy companies, which may result in a requirement that we repurchase the mortgage loans, or make whole or provide other remedies to counterparties. U.S. regulators and government agencies regularly pursue enforcement claims against financial institutions including the Corporation for alleged violations of law and customer harm under the Financial Institutions Reform, Recovery, and Enforcement Act, the federal securities laws, the False Claims Act, fair lending laws and regulations (including the Equal Credit Opportunity Act and the Fair Housing Act), antitrust laws, and consumer protection laws and regulations related to products and services such as overdraft and sales practices, including prohibitions on unfair, deceptive, and/or abusive acts and practices under the Consumer Financial Protection Act and the Federal Trade Commission Act. Such claims may carry significant penalties, restitution and, in certain cases, treble damages, and the ultimate resolution of regulatory inquiries, investigations and other proceedings to which we are subject from time-to-time is difficult to predict. There is also an increased focus on compliance with U.S. and global laws, rules and regulations related to the collection, use, sharing and safeguarding of personally identifiable information and corporate data, as well as the implementation, use and management of emerging technologies, including AI and machine learning. Additionally, misconduct by our employees and representatives, including unethical, fraudulent, improper or illegal conduct, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures, laws, rules or regulations, including conduct that affects compliance with books and records requirements, can result in litigation and/or government investigations and enforcement actions, and cause significant reputational harm. We are also subject to litigation and regulatory and government actions regarding fraud perpetrated against our customers in connection with the use of our products and services and increased scrutiny of sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm.The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with government authorities regarding our participation in implementing government relief measures related to the pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation which may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could have material adverse effects on our business, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm. U.S. federal banking agencies may require us to increase our regulatory capital, total loss-absorbing capacity (TLAC), long-term debt or liquidity requirements.We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956.Capital and liquidity requirements are frequently introduced and amended. It is possible that regulators may increase regulatory capital requirements including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge is expected to increase by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could use and management of emerging technologies, including AI and machine learning. Additionally, misconduct by our employees and representatives, including unethical, fraudulent, improper or illegal conduct, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures, laws, rules or regulations, including conduct that affects compliance with books and records requirements, can result in litigation and/or government investigations and enforcement actions, and cause significant reputational harm. We are also subject to litigation and regulatory and government actions regarding fraud perpetrated against our customers in connection with the use of our products and services and increased scrutiny of sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm. The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with government authorities regarding our participation in implementing government relief measures related to the pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation which may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could have material adverse effects on our business, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.

General economic, political, social and health conditions in the U.S. and abroad affect financial markets and our business. In particular, global markets may be affected by the level and volatility of interest rates, availability and market conditions of financing, changes in gross domestic product (GDP), economic growth or its sustainability, inflation, supply chain disruptions, consumer spending, employment levels, labor shortages, challenging labor market conditions, wage stagnation, federal government shutdowns, energy prices, home prices, commercial property values, bankruptcies and a default by a significant market participant or class of counterparties, including companies in emerging markets. Global markets also may be affected by adverse developments impacting the U.S. or global banking industry, including bank failures and liquidity concerns, fluctuations or other significant changes in both debt and equity capital markets and currencies, the transition of benchmark rates, including the Bloomberg Short-Term Bank Yield Index (BSBY), to alternative reference rates (ARRs), the impact of the volatility of digital assets on the broader market, the rate of growth of global trade and commerce, trade policies, the availability and cost of capital and credit, disruption of communication, transportation or energy infrastructure, recessionary fears, investor sentiment and the U.S. and global election cycles, including resulting changes to policy and the geopolitical environment. Global markets, including energy and commodity markets, may also be adversely affected by the current or anticipated impact of climate change, acute and/or chronic extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks, military conflict, terrorism, or other geopolitical events. Market fluctuations may impact our margin requirements and affect our liquidity. Any sudden or prolonged market downturn, as a result of the above factors or otherwise, could result in a decline in net interest income and noninterest income and adversely affect our results of operations and financial condition, including capital and liquidity levels. Elevated inflation and interest rate levels, monetary tightening by central banks, and geopolitical developments, including the Russia/Ukraine conflict and the conflict in the Middle East, have adversely impacted and may continue to adversely impact financial markets and macroeconomic conditions and could result in additional market volatility and disruptions.Global uncertainties regarding fiscal and monetary policies present economic challenges. Actions taken by the Federal Reserve or central banks in other jurisdictions, including changes in target rates, balance sheet management and lending facilities, are beyond our control and difficult to predict, particularly in an elevated inflation environment. This can affect interest rates and the value of financial instruments and other assets, such as debt securities, and impact our borrowers and potentially increase delinquency rates and may also raise government debt levels, adversely affect businesses and household incomes, adversely impact the banking sector generally, and increase uncertainty surrounding monetary policy. Monetary policy in response to high inflation has led to a significant increase in market interest rates and a flattening and/or inversion of the yield curve. This has resulted in and may continue to result in volatility of equity and other markets, further volatility of the U.S. dollar, a widening in credit spreads and higher interest rates and recessionary concerns, and could result in elevated unemployment, which could impact investor risk appetite and our borrowers, potentially increasing delinquency rates. Financial market volatility could also result from uncertainty about the timing and extent of rate cuts by the Federal Reserve in response to moderating inflation and/or weakening economic conditions. Elevated inflation may limit the scope of monetary support, including cuts to the federal funds rate, in the event of an economic downturn, resulting in a more protracted period of a flat and/or inverted yield curve.Any future change in monetary policy by the Federal Reserve, in an effort to stimulate the economy or otherwise, resulting in lower interest rates would likely result in lower revenue through lower net interest income, which could adversely affect our results of operations. Additionally, changes to existing U.S. laws and regulatory policies and evolving priorities, including those related to financial regulation, taxation, international trade, fiscal policy, climate change (including efforts to transition to a low-carbon economy) and healthcare, may adversely impact U.S. or global economic activity and our customers', our counterparties' and our earnings and operations. Globally, many central banks have simultaneously reduced monetary accommodation through interest rate or balance sheet policy, which has contributed and may continue to contribute to elevated financial and capital market volatility and significant changes to asset values. While higher interest rates have positively impacted our net interest income, higher interest rates have negatively impacted and could continue to negatively impact investment securities, deposits, loan demand and funding costs. In addition to higher interest rates, wider credit spreads can negatively impact capital by reducing the value of debt securities. High and rising federal debt levels and uncertainty about the U.S. budget process could lead to higher interest rates and financial market volatility, potentially impacting broader economic activity. Further, if the U.S. government’s debt ceiling limit is not raised in January 2025, the ramifications could result in market volatility, ratings downgrades and limit fiscal policy responses to recessionary conditions. This could have a negative and potentially severe impact on the U.S. and world economy and financial and capital markets, including higher interest rates, higher volatility, lower asset values, lower liquidity, downgrades to U.S. debt, and a weakened U.S. dollar.Changes to international trade and investment policies by the U.S. could negatively impact financial markets. Escalation of tensions between the U.S. and the People’s Republic of China financial markets and macroeconomic conditions and could result in additional market volatility and disruptions. Global uncertainties regarding fiscal and monetary policies present economic challenges. Actions taken by the Federal Reserve or central banks in other jurisdictions, including changes in target rates, balance sheet management and lending facilities, are beyond our control and difficult to predict, particularly in an elevated inflation environment. This can affect interest rates and the value of financial instruments and other assets, such as debt securities, and impact our borrowers and potentially increase delinquency rates and may also raise government debt levels, adversely affect businesses and household incomes, adversely impact the banking sector generally, and increase uncertainty surrounding monetary policy. Monetary policy in response to high inflation has led to a significant increase in market interest rates and a flattening and/or inversion of the yield curve. This has resulted in and may continue to result in volatility of equity and other markets, further volatility of the U.S. dollar, a widening in credit spreads and higher interest rates and recessionary concerns, and could result in elevated unemployment, which could impact investor risk appetite and our borrowers, potentially increasing delinquency rates. Financial market volatility could also result from uncertainty about the timing and extent of rate cuts by the Federal Reserve in response to moderating inflation and/or weakening economic conditions. Elevated inflation may limit the scope of monetary support, including cuts to the federal funds rate, in the event of an economic downturn, resulting in a more protracted period of a flat and/or inverted yield curve. Any future change in monetary policy by the Federal Reserve, in an effort to stimulate the economy or otherwise, resulting in lower interest rates would likely result in lower revenue through lower net interest income, which could adversely affect our results of operations. Additionally, changes to existing U.S. laws and regulatory policies and evolving priorities, including those related to financial regulation, taxation, international trade, fiscal policy, climate change (including efforts to transition to a low-carbon economy) and healthcare, may adversely impact U.S. or global economic activity and our customers', our counterparties' and our earnings and operations. Globally, many central banks have simultaneously reduced monetary accommodation through interest rate or balance sheet policy, which has contributed and may continue to contribute to elevated financial and capital market volatility and significant changes to asset values. While higher interest rates have positively impacted our net interest income, higher interest rates have negatively impacted and could continue to negatively impact investment securities, deposits, loan demand and funding costs. In addition to higher interest rates, wider credit spreads can negatively impact capital by reducing the value of debt securities. High and rising federal debt levels and uncertainty about the U.S. budget process could lead to higher interest rates and financial market volatility, potentially impacting broader economic activity. Further, if the U.S. government’s debt ceiling limit is not raised in January 2025, the ramifications could result in market volatility, ratings downgrades and limit fiscal policy responses to recessionary conditions. This could have a negative and potentially severe impact on the U.S. and world economy and financial and capital markets, including higher interest rates, higher volatility, lower asset values, lower liquidity, downgrades to U.S. debt, and a weakened U.S. dollar. Changes to international trade and investment policies by the U.S. could negatively impact financial markets. Escalation of tensions between the U.S. and the People’s Republic of China Bank of America 8 Bank of America 8 Bank of America 8 Bank of America 8 (China) could lead to further U.S. measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of tariffs, foreign exchange measures or the large-scale sale of U.S. Treasury bonds. Any restrictions on the activities of businesses, could also negatively affect financial markets.These developments could adversely affect our businesses, customers, securities and derivatives portfolios, including the risk of lower re-investment rates within those portfolios, our level of charge-offs and provision for credit losses, the carrying value of our deferred tax assets, our capital levels, our liquidity and our results of operations.Increased market volatility and adverse changes in financial or capital market conditions may increase our market risk.Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees, which have already been negatively impacted, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth.Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.If asset values decline, we may incur losses and negative impacts to capital and liquidity requirements.We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value and are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate.Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively mitigated the risk of our exposures. Increases in interest rates may cause decreases in residential mortgage loan originations and could impact the origination of corporate debt. In addition, increases in interest rates or changes in spreads may continue to adversely impact the fair value of our debt securities and, accordingly, for debt securities classified as available-for-sale (AFS), adversely affect accumulated other comprehensive income and, thus, our capital levels. Increases in interest rates could also adversely impact our regulatory liquidity position and requirements, which include certain AFS debt securities and the use of repurchase agreements against a portion of the held-to-maturity (HTM) debt securities. As our liquidity is dependent on the fair value of these assets, increases in market interest rates, which have adversely impacted and may continue to adversely impact the fair value of debt securities, could adversely affect liquidity levels.Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets.LiquidityIf we are unable to access the capital markets, have prolonged net deposits outflows, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.Liquidity is essential to our businesses. We fund our assets primarily with globally sourced deposits in our bank entities, as well as secured and unsecured liabilities transacted in the capital markets. We rely on certain secured funding sources, such as repo markets, which are typically short-term and credit-sensitive. We also engage in asset securitization transactions, including with the government-sponsored enterprises (GSEs), to fund consumer lending activities. Our liquidity could be adversely affected by any inability to access the capital markets, illiquidity or volatility in the capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term (China) could lead to further U.S. measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of tariffs, foreign exchange measures or the large-scale sale of U.S. Treasury bonds. Any restrictions on the activities of businesses, could also negatively affect financial markets.These developments could adversely affect our businesses, customers, securities and derivatives portfolios, including the risk of lower re-investment rates within those portfolios, our level of charge-offs and provision for credit losses, the carrying value of our deferred tax assets, our capital levels, our liquidity and our results of operations.Increased market volatility and adverse changes in financial or capital market conditions may increase our market risk.Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees, which have already been negatively impacted, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth.Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.If asset values decline, we may incur losses and negative impacts to capital and liquidity requirements. (China) could lead to further U.S. measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of tariffs, foreign exchange measures or the large-scale sale of U.S. Treasury bonds. Any restrictions on the activities of businesses, could also negatively affect financial markets. These developments could adversely affect our businesses, customers, securities and derivatives portfolios, including the risk of lower re-investment rates within those portfolios, our level of charge-offs and provision for credit losses, the carrying value of our deferred tax assets, our capital levels, our liquidity and our results of operations.

General economic, political, social and health conditions in the U.S. and abroad affect financial markets and our business. In particular, global markets may be affected by the level and volatility of interest rates, availability and market conditions of financing, changes in gross domestic product (GDP), economic growth or its sustainability, inflation, supply chain disruptions, consumer spending, employment levels, labor shortages, challenging labor market conditions, wage stagnation, federal government shutdowns, energy prices, home prices, commercial property values, bankruptcies, a default by a significant market participant or class of counterparties, including companies in emerging markets, fluctuations or other significant changes in both debt and equity capital markets and currencies, liquidity, the continued transition from InterBank Offered Rates (IBORs) and other benchmark rates to alternative reference rates (ARRs), the impact of volatility of digital assets on the broader market, the growth of global trade and commerce, trade policies, the availability and cost of capital and credit, disruption of communication, transportation or energy infrastructure, recessionary fears and investor sentiment. Global markets, including energy and commodity markets, may be adversely affected by the current or anticipated impact of climate change, acute and/or chronic extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks, military conflict, terrorism, or other geopolitical events. Market fluctuations may impact our margin requirements and affect our liquidity. Any sudden or prolonged market downturn, as a result of the above factors or otherwise, could result in a decline in net interest income and noninterest income and adversely affect our results of operations and financial condition, including capital and liquidity levels. High inflation, elevated interest rate levels, supply chain disruptions, and the Russia/Ukraine conflict, including the related energy impact in Europe, have adversely impacted and may continue to adversely impact financial markets and macroeconomic conditions and could result in additional market volatility and disruptions. Global uncertainties regarding fiscal and monetary policies present economic challenges. Actions taken by the Federal Reserve or other central banks, including changes in target rates, balance sheet management and lending facilities, are beyond our control and difficult to predict, particularly in a high inflation environment. This can affect interest rates and the value of financial instruments and other assets, such as debt securities, and impact our borrowers and potentially increase delinquency rates and may also raise government debt levels, adversely affect businesses and household incomes and increase uncertainty surrounding monetary policy. Monetary policy in response to high inflation has led to a significant increase in market interest rates and a flattening and/or inversion of the yield curve. This has resulted in and may continue to result in volatility of equity and other markets, further volatility of the U.S. dollar, a widening in credit spreads and higher interest rates and recessionary concerns, and could result in elevated unemployment, which could impact investor risk appetite and our borrowers, potentially increasing delinquency rates. It is also possible that high inflation may limit the scope of monetary support, including cuts to the federal funds rate, in the event of an economic downturn, resulting in a more protracted period of a flat and/or inverted yield curve.Any future change in monetary policy by the Federal Reserve, in an effort to stimulate the economy or otherwise, resulting in lower interest rates would likely result in lower revenue through lower net interest income, which could adversely affect our results of operations. Additionally, changes to existing U.S. laws and regulatory policies and evolving priorities, including those related to financial regulation, taxation, international trade, fiscal policy, climate change (including efforts to transition to a low-carbon economy) and healthcare, may adversely impact U.S. or global economic activity and our customers', our counterparties' and our earnings and operations. Globally, many central banks are simultaneously reducing monetary accommodation through interest rate or balance sheet policy, which has contributed and may continue to contribute to elevated financial and capital market volatility and significant changes to asset values. While higher interest rates have positively impacted our net interest income, higher interest rates have negatively impacted and could continue to negatively impact deposits, loan demand and funding costs. If the U.S. government’s debt ceiling limit is not raised, the ramifications could result in market volatility, ratings downgrades and limit fiscal policy responses to recessionary conditions. This could have a negative and potentially severe impact on the U.S. and world economy and financial and capital markets, including higher interest rates, higher volatility, lower asset values, lower liquidity, downgrades to U.S. debt, and a weakened U.S. dollar.Changes to international trade and investment policies by the U.S. could negatively impact financial markets. Escalation of tensions between the U.S. and the People’s Republic of China (China) could lead to further U.S. measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of tariffs, foreign exchange measures or the large-scale sale of U.S. Treasury bonds. Any restrictions on the activities of businesses, could also negatively affect financial markets.These developments could adversely affect our businesses, customers, securities and derivatives portfolios, including the risk of lower re-investment rates within those portfolios, our level of charge-offs and provision for credit losses, the carrying value of our deferred tax assets, our capital levels, our liquidity and our results of operations.Increased market volatility and adverse changes in financial or capital market conditions may increase our market risk.Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and securities, and impact our borrowers and potentially increase delinquency rates and may also raise government debt levels, adversely affect businesses and household incomes and increase uncertainty surrounding monetary policy. Monetary policy in response to high inflation has led to a significant increase in market interest rates and a flattening and/or inversion of the yield curve. This has resulted in and may continue to result in volatility of equity and other markets, further volatility of the U.S. dollar, a widening in credit spreads and higher interest rates and recessionary concerns, and could result in elevated unemployment, which could impact investor risk appetite and our borrowers, potentially increasing delinquency rates. It is also possible that high inflation may limit the scope of monetary support, including cuts to the federal funds rate, in the event of an economic downturn, resulting in a more protracted period of a flat and/or inverted yield curve. Any future change in monetary policy by the Federal Reserve, in an effort to stimulate the economy or otherwise, resulting in lower interest rates would likely result in lower revenue through lower net interest income, which could adversely affect our results of operations. Additionally, changes to existing U.S. laws and regulatory policies and evolving priorities, including those related to financial regulation, taxation, international trade, fiscal policy, climate change (including efforts to transition to a low-carbon economy) and healthcare, may adversely impact U.S. or global economic activity and our customers', our counterparties' and our earnings and operations. Globally, many central banks are simultaneously reducing monetary accommodation through interest rate or balance sheet policy, which has contributed and may continue to contribute to elevated financial and capital market volatility and significant changes to asset values. While higher interest rates have positively impacted our net interest income, higher interest rates have negatively impacted and could continue to negatively impact deposits, loan demand and funding costs. If the U.S. government’s debt ceiling limit is not raised, the ramifications could result in market volatility, ratings downgrades and limit fiscal policy responses to recessionary conditions. This could have a negative and potentially severe impact on the U.S. and world economy and financial and capital markets, including higher interest rates, higher volatility, lower asset values, lower liquidity, downgrades to U.S. debt, and a weakened U.S. dollar. Changes to international trade and investment policies by the U.S. could negatively impact financial markets. Escalation of tensions between the U.S. and the People’s Republic of China (China) could lead to further U.S. measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of tariffs, foreign exchange measures or the large-scale sale of U.S. Treasury bonds. Any restrictions on the activities of businesses, could also negatively affect financial markets. These developments could adversely affect our businesses, customers, securities and derivatives portfolios, including the risk of lower re-investment rates within those portfolios, our level of charge-offs and provision for credit losses, the carrying value of our deferred tax assets, our capital levels, our liquidity and our results of operations.

Climate change and related environmental sustainability matters present short-term and long-term risks. The physical risks include an increase in the frequency and severity of extreme weather events and natural disasters, including floods, wildfires, hurricanes and tornados, and chronic longer-term shifts such as rising average global temperatures and sea levels. Such disasters and effects could adversely impact our facilities, employees and customers’ ability to repay outstanding loans, disrupt the operations of us and our customers or third parties, cause supply chain or distribution network disruptions, damage collateral and/or result in market volatility, rapid deposit outflows or drawdowns of credit facilities, the deterioration of the value of collateral or insurance shortfalls. There is also increasing risk related to the transition to a low-carbon economy. Changes in consumer preferences or financial condition of our customers and counterparties, market pressures, advancements in technology and additional legislation, regulatory, compliance and legal requirements could alter our strategic planning and the scope of our existing businesses, limit our ability to pursue certain business activities and offer certain products and services, amplify credit and market risks, negatively impact asset values, require capital expenditures and changes in technology and markets, including supply chain and insurance availability and cost, increase expenses, impact capital requirements and adversely impact our results of operations. In particular, there is an increasing global regulatory focus, including state, federal and non-U.S. jurisdictions, on climate change resulting in new or heightened regulatory requirements, with potential jurisdictional divergence, which is expected to increase our legal, compliance and public disclosure risks and costs in the U.S. and globally.Our climate change strategies, policies, and disclosures, our ability to achieve our climate-related goals, targets and commitments and/or the environmental or climate impacts attributable to our products, services or transactions will likely result in heightened legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Due to divergent views of stakeholders, we are at increased risk that any action, or lack thereof, by us concerning our response to climate change will be perceived negatively by some stakeholders, which could adversely impact our reputation and businesses. Our ability to meet our climate-related goals, targets and commitments, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technological advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with customers, suppliers, investors, government officials and other stakeholders. Due to the evolving nature of climate-related risks, which are expected to increase over time, it is difficult to predict, identify, monitor and effectively mitigate climate-related risks and uncertainties.Furthermore, there are and will continue to be challenges related to the availability and capturing, measuring, verifying, analyzing and disclosing climate-related data, including data obtained from third parties, which may result in legal, compliance and/or reputational harm.Our ability to attract, develop and retain qualified employees is critical to our success, business prospects and competitive position.Our performance and competitive position is heavily dependent on the talents, development and efforts of highly skilled individuals. Competition for qualified personnel is intense from within and outside the financial services industry.Our competitors include global institutions and institutions subject to different compensation and hiring regulations than those imposed on U.S. institutions and financial institutions. Also, our ability to attract, develop and retain employees could be impacted by changing workforce concerns, expectations, practices and preferences (including remote work), and increasing labor shortages and competition for labor, which could increase labor costs.In order to attract and retain qualified personnel, we must provide market-level compensation. As a large financial and banking institution, we are and may become subject to additional limitations on compensation practices by the Federal Reserve, the OCC, the FDIC and other regulators globally, which may or may not affect our competitors. Furthermore, because a substantial portion of compensation paid to many of our employees is long-term equity-based awards based on the value of our common stock, declines in our profitability or outlook could adversely affect the ability to attract and retain employees. If we are unable to continue to attract, develop and retain qualified individuals, our business prospects and competitive position could be adversely affected. supply chain and insurance availability and cost, increase expenses, impact capital requirements and adversely impact our results of operations. In particular, there is an increasing global regulatory focus, including state, federal and non-U.S. jurisdictions, on climate change resulting in new or heightened regulatory requirements, with potential jurisdictional divergence, which is expected to increase our legal, compliance and public disclosure risks and costs in the U.S. and globally. Our climate change strategies, policies, and disclosures, our ability to achieve our climate-related goals, targets and commitments and/or the environmental or climate impacts attributable to our products, services or transactions will likely result in heightened legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Due to divergent views of stakeholders, we are at increased risk that any action, or lack thereof, by us concerning our response to climate change will be perceived negatively by some stakeholders, which could adversely impact our reputation and businesses. Our ability to meet our climate-related goals, targets and commitments, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technological advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with customers, suppliers, investors, government officials and other stakeholders. Due to the evolving nature of climate-related risks, which are expected to increase over time, it is difficult to predict, identify, monitor and effectively mitigate climate-related risks and uncertainties. Furthermore, there are and will continue to be challenges related to the availability and capturing, measuring, verifying, analyzing and disclosing climate-related data, including data obtained from third parties, which may result in legal, compliance and/or reputational harm.

Climate change and related environmental sustainability matters present short-term and long-term risks to us. The physical risks include an increase in the frequency and severity of extreme weather events and natural disasters, including floods, wildfires, hurricanes and tornados, as well as chronic longer-term shifts such as rising average global temperatures and sea levels. Such disasters could impact our facilities and employees and disrupt our operations or the operations of customers or third parties, and result in market volatility or negatively impact our customers’ ability to repay outstanding loans, result in rapid deposit outflows or drawdowns of credit facilities, cause supply chain and/or distribution network disruptions, damage collateral or result in the deterioration of the value of collateral or insurance shortfalls. There is also increasing risk related to the transition to a low-carbon economy. Changes in consumer preferences, market pressures, advancements in technology and additional legislation, regulatory and legal requirements could alter the scope of our existing businesses, limit our ability to pursue certain business activities and offer certain products and services, amplify credit and market risks, negatively impact asset values and increase expenses, including as a result of legal, compliance and public disclosure costs in the U.S. and globally with potential jurisdictional divergence, strategic planning, required capital expenditures and changes in technology and markets, including supply chain and insurance availability and cost. We have devoted and expect to continue to devote additional resources as a result of our response to climate change. Our climate change strategies, policies, and disclosures, our ability to achieve our climate-related goals, targets and commitments, and/or the environmental or climate impacts attributable to our products, transactions or services will likely result in heightened legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Our ability to meet our climate-related goals, targets and commitments, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technology advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with customers, suppliers, investors, government officials and other stakeholders.There are and will continue to be challenges related to capturing, verifying, analyzing and disclosing climate-related data, which includes nonfinancial data and other information that is subject to measurement uncertainties, may not be independently verified, and may result in legal or reputational harm.Our ability to attract, develop and retain qualified employees is critical to our success, business prospects and competitive position.Our performance and competitive position is heavily dependent on the talents, development and efforts of highly skilled individuals. Competition for qualified personnel within the financial services industry and from businesses outside the financial services industry is intense. Our competitors include global institutions and institutions subject to different compensation and hiring regulations than those imposed on U.S. institutions and financial institutions. Also, our ability to attract, develop and retain employees could be impacted by changing workforce concerns, expectations, practices and preferences (including remote work), and increasing labor shortages and competition for labor, which could increase labor costs.In order to attract and retain qualified personnel, we must provide market-level compensation. As a large financial and banking institution, we are and may become subject to additional limitations on compensation practices by the Federal Reserve, the OCC, the FDIC and other regulators around the world, which may or may not affect our competitors. Furthermore, because a substantial portion of our annual incentive compensation paid to many of our employees is long-term equity-based awards based on the value of our common stock, declines in our profitability or outlook could adversely affect the ability to attract and retain employees. If we are unable to continue to attract, develop and retain qualified individuals, our business prospects and competitive position could be adversely affected. legislation, regulatory and legal requirements could alter the scope of our existing businesses, limit our ability to pursue certain business activities and offer certain products and services, amplify credit and market risks, negatively impact asset values and increase expenses, including as a result of legal, compliance and public disclosure costs in the U.S. and globally with potential jurisdictional divergence, strategic planning, required capital expenditures and changes in technology and markets, including supply chain and insurance availability and cost. We have devoted and expect to continue to devote additional resources as a result of our response to climate change. Our climate change strategies, policies, and disclosures, our ability to achieve our climate-related goals, targets and commitments, and/or the environmental or climate impacts attributable to our products, transactions or services will likely result in heightened legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Our ability to meet our climate-related goals, targets and commitments, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technology advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with customers, suppliers, investors, government officials and other stakeholders. There are and will continue to be challenges related to capturing, verifying, analyzing and disclosing climate-related data, which includes nonfinancial data and other information that is subject to measurement uncertainties, may not be independently verified, and may result in legal or reputational harm.

Bank of America Corporation, our parent holding company, is required to periodically submit a plan to the FDIC and Federal Reserve describing its resolution strategy under the U.S. Bankruptcy Code in the event of material financial distress or failure. Bank of America Corporation’s preferred resolution strategy is a “single point of entry” strategy, whereby only the parent holding company would file for bankruptcy under the U.S. Bankruptcy Code. Certain key operating subsidiaries would be provided with sufficient capital and liquidity to operate through severe stress and to enable such subsidiaries to continue operating or be wound down in a solvent manner following a bankruptcy of the parent holding company. Bank of America Corporation has entered into intercompany arrangements resulting in the contribution of most of its capital and liquidity to key subsidiaries. Pursuant to these arrangements, if Bank of America Corporation’s liquidity resources deteriorate so severely that resolution becomes imminent, it will no longer be able to draw liquidity from its key subsidiaries and will be required to contribute its remaining financial assets to a wholly-owned holding company subsidiary. This could adversely affect our liquidity and financial condition, including the ability to meet our payment obligations and the ability to return capital to shareholders, including through the payment of dividends and repurchase of the Corporation’s common stock. If the FDIC and Federal Reserve jointly determine that Bank of America Corporation’s resolution plan is not credible, they could impose more stringent capital, leverage or liquidity requirements or restrictions on our growth, activities or operations. We could also be required to take certain actions that could impose operating costs and result in the divestiture of assets or restructuring of businesses and subsidiaries. When a G-SIB such as Bank of America Corporation is in default or danger of default, the FDIC may be appointed receiver to conduct an orderly liquidation, and could, among other things, invoke the orderly liquidation authority, instead of the U.S. Bankruptcy Code, if the Secretary of the Treasury makes certain financial distress and systemic risk determinations. Additionally, the FDIC could replace Bank of America Corporation with a bridge holding company, which could continue operations and result in an orderly resolution of the underlying bank, but whose equity would be held solely for the benefit of our creditors. The FDIC’s “single point of entry” strategy may result in our security holders suffering greater losses than would have been the case under a bankruptcy proceeding or a different resolution strategy. If the Corporation is resolved under the U.S. Bankruptcy Code or the FDIC’s orderly liquidation authority, third-party creditors of our subsidiaries may receive significant or full recoveries on their claims, while security holders of Bank of America Corporation could face significant or complete losses.CreditEconomic or market disruptions and insufficient credit loss reserves may result in a higher provision for credit losses.A number of our products expose us to credit risk, including loans, letters of credit, derivatives, debt securities, trading account assets and assets held-for-sale. Deterioration in the financial condition of our consumer and commercial borrowers, counterparties or underlying collateral could adversely affect our results of operations and financial condition.Our credit portfolios may be impacted by U.S. and global macroeconomic and market conditions, events and disruptions, including declines in GDP, consumer spending or property values, asset price corrections, increasing consumer and corporate leverage, increases in corporate bond spreads, government shutdowns or policies such as student loan debt payment resumptions, tax changes, rising or elevated unemployment levels, elevated inflation, fluctuations in foreign exchange or interest rates, as well as the emergence or continuation of widespread health emergencies or pandemics, extreme weather events and the impacts of climate change, including acute and/or chronic extreme weather events and efforts to transition to a low-carbon economy. Significant economic or market stresses and disruptions typically have a negative impact on the business environment and financial markets, which could impact the underlying credit quality of our borrowers, counterparties and assets. Property value declines or asset price corrections could increase the risk of borrowers or counterparties defaulting or becoming delinquent in their obligations to us, and could decrease the value of the collateral we hold, which could increase credit losses. Credit risk could also be magnified by lending to leveraged borrowers or declining asset prices, including property or collateral values, unrelated to macroeconomic stress. Simultaneous drawdowns on lines of credit and/or an increase in a borrower’s leverage in a weakening economic environment, or otherwise, could result in deterioration in our credit portfolio, should borrowers be unable to fulfill competing financial obligations. Increased delinquency and default rates could adversely affect our credit portfolios, including consumer credit card, home equity and residential mortgage portfolios through increased charge-offs and provisions for credit losses.A recessionary environment and/or a rise in unemployment could adversely impact the ability of our consumer and/or commercial borrowers or counterparties to meet their financial obligations and negatively impact our credit portfolio. Consumers have been and may continue to be negatively impacted by inflation, resulting in drawdowns of savings or increases in household debt. Higher interest rates, which have increased debt servicing costs for some businesses and households, may adversely impact credit quality, particularly in a recessionary environment. Certain sectors also remain at risk (e.g., commercial real estate, particularly office) as a result of shifts in demand and tighter financial and credit conditions. Globally, conditions of slow growth or recession could further contribute to weaker credit conditions. If the macroeconomic environment or certain sectors worsen, our credit portfolio, net charge-offs, provision and allowance for credit losses could be adversely impacted. If the Corporation is resolved under the U.S. Bankruptcy Code or the FDIC’s orderly liquidation authority, third-party creditors of our subsidiaries may receive significant or full recoveries on their claims, while security holders of Bank of America Corporation could face significant or complete losses. Credit

Bank of America Corporation, our parent holding company, is required to periodically submit a plan to the FDIC and Federal Reserve describing its resolution strategy under the U.S. Bankruptcy Code in the event of material financial distress or failure. Bank of America Corporation’s preferred resolution strategy is a “single point of entry” strategy, whereby only the parent holding company would file for bankruptcy under the U.S. Bankruptcy Code. Certain key operating subsidiaries would be provided with sufficient capital and liquidity to operate through severe stress and to enable such subsidiaries to continue operating or be wound down in a solvent manner following a bankruptcy of the parent holding company. Bank of America Corporation has entered into intercompany arrangements resulting in the contribution of most of its capital and liquidity to key subsidiaries. Pursuant to these arrangements, if Bank of America Corporation’s liquidity resources deteriorate so severely that resolution becomes imminent, it will no longer be able to draw liquidity from its key subsidiaries and will be required to contribute its remaining financial assets to a wholly-owned holding company subsidiary. This could adversely affect our liquidity and financial condition, including the ability to meet our payment obligations and the ability to return capital to shareholders, including through the payment of dividends and repurchase of the Corporation’s common stock. If the FDIC and Federal Reserve jointly determine that Bank of America Corporation’s resolution plan is not credible, they could impose more stringent capital, leverage or liquidity requirements or restrictions on our growth, activities or operations. We could also be required to take certain actions that could impose operating costs and result in the divestiture of assets or restructuring of businesses and subsidiaries. When a G-SIB such as Bank of America Corporation is in default or danger of default, the FDIC may be appointed receiver to conduct an orderly liquidation, and could, among other things, invoke the orderly liquidation authority, instead of the U.S. Bankruptcy Code, if the Secretary of the Treasury makes certain financial distress and systemic risk determinations. Additionally, the FDIC could replace Bank of America Corporation with a bridge holding company, which could continue operations and result in an orderly resolution of the underlying bank, but whose equity would be held solely for the benefit of our creditors. The FDIC’s “single point of entry” strategy may result in our security holders suffering greater losses than would have been the case under a bankruptcy proceeding or a different resolution strategy. If the Corporation is resolved under the U.S. Bankruptcy Code or the FDIC’s orderly liquidation authority, third-party creditors of the Corporation’s subsidiaries may receive significant or full recoveries on their claims while security holders of Bank of America Corporation could face significant or complete losses. Credit

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees, which have already been negatively impacted, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth. Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and Bank of America 8 Bank of America 8 Bank of America 8 Bank of America 8 business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees, which have already been negatively impacted, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth. The continued flattening and/or inversion of the yield curve could also negatively impact our results of operations, including revenue and earnings.Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated and vice versa. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity. If asset values decline, we may incur losses and negative impacts to capital and liquidity requirements.We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value and are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate.Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively hedged our exposures. Increases in interest rates may result in further decreases in residential mortgage loan originations and could impact the origination of corporate debt. In addition, increases in interest rates or changes in spreads may continue to adversely impact the fair value of debt securities and, accordingly, for debt securities classified as available for sale, may continue to adversely affect accumulated other comprehensive income and, thus, capital levels. These market moves could also adversely impact our regulatory liquidity requirements. Any decreases in interest rates may increase prepayment speeds of certain assets, and, therefore, could adversely affect net interest income. Changes in interest rates also may impact the value of mortgage service rights retained.Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets.LiquidityIf we are unable to access the capital markets, have prolonged net deposits outflows, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.Liquidity is essential to our businesses. We fund our assets primarily with globally sourced deposits in our bank entities, as well as secured and unsecured liabilities transacted in the capital markets. We rely on certain secured funding sources, such as repo markets, which are typically short-term and credit-sensitive. We also engage in asset securitization transactions, including with the government-sponsored enterprises (GSEs), to fund consumer lending activities. Our liquidity could be adversely affected by any inability to access the capital markets, illiquidity or volatility in the capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term borrowing), changes to our relationships with our funding providers based on real or perceived changes in our risk profile, prolonged federal government shutdowns, or changes in regulations, guidance or GSE status that impact our funding. Additionally, our liquidity or cost of funds may be negatively impacted by the unwillingness or inability of the Federal Reserve to act as lender of last resort, unexpected simultaneous draws on lines of credit, slower customer payment rates, restricted access to the assets of prime brokerage clients, the withdrawal of or failure to attract customer deposits or invested funds (which could result from attrition driven by customers seeking higher yielding deposits or securities products, customer desire to utilize an alternative financial institution perceived to be safer, changes in customer spending behavior due to inflation, decline in the economy or other drivers resulting in an increased need for cash), increased regulatory liquidity, capital and margin requirements for our U.S. or international banks and their nonbank subsidiaries, which could result in the inability to transfer liquidity internally and inefficient funding, changes in patterns of intraday liquidity usage resulting from a counterparty or technology failure or other idiosyncratic event or failure or business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees, which have already been negatively impacted, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth. The continued flattening and/or inversion of the yield curve could also negatively impact our results of operations, including revenue and earnings.Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated and vice versa. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity. If asset values decline, we may incur losses and negative impacts to capital and liquidity requirements.We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value and are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate.Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively hedged our exposures. Increases in interest rates may result in further decreases in residential mortgage loan originations and could impact the origination of corporate debt. In addition, business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees, which have already been negatively impacted, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth. The continued flattening and/or inversion of the yield curve could also negatively impact our results of operations, including revenue and earnings. Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated and vice versa. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.

Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, customers and third parties, including counterparties, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our customers, and the handling of related disputes with regard to the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our customers, including overdraft and non-sufficient fund fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the reliability of our research and models and prohibiting clients from engaging in certain transactions. Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our customers and/or recognize and address customer complaints, compliance failures, technology changes, the implementation, management and/or use of emerging technologies, including quantum computing, AI and machine learning, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our third parties, which have occurred and we expect to continue to experience with increased frequency and severity due to the evolving threat environment, prolonged or repeated system outages, the Corporation’s privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of the Corporation’s fiduciary obligations and handling of the emergence or continuation of health emergencies and pandemics. Our reputation may be also be harmed by litigation and/or regulatory matters and their outcomes, relating to the topics discussed above or otherwise. For example, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Challenges to our ESG practices and disclosures, and those of our customers and third parties, including from diverging views regarding ESG-related practices and disclosures may also harm our reputation. Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects and results of operations. We are subject to complex and evolving laws, regulations and interpretations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR and the CCPA as modified by the CPRA, cross-border data movement, cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations.We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business.Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of customers and employees. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses.OtherReforms to benchmarks may adversely affect our reputation, business, financial condition and results of operations.Risks and challenges associated with reference rate reform, including the potential replacement of benchmark rates with ARRs (e.g., the expected cessation of BSBY), could expose us to various financial, operational, supervisory, conduct and legal risk.Usage of ARRs for impacted benchmarks may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs may have compositions and characteristics that differ from replaced benchmarks, including limited liquidity and less predictable performance over time. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, resulting in unanticipated market exposures. Transition to ARRs may adversely affect the yield on loans or securities held by us, amounts paid on our securities and received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our effective use of hedging instruments to manage risk. There is no assurance that impacted benchmarks will transition to ARRs without delay or potential disputes.The transition of any products using impacted benchmarks (Impacted Products) that do not include fallback provisions or adequate fallback mechanisms may require additional efforts to modify their terms, and may be more challenging to modify if all cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations. We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business. Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of customers and employees. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses. Other

Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, contractors, third parties, clients, counterparties and other representatives, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our responsiveness to fraud claims perpetrated against our customers, effectiveness of our internal controls, litigation or regulatory matters and their outcomes, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, including the reliability of our research and models, and prohibiting clients from engaging in certain transactions. Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, failure to recognize and address customer complaints, compliance failures, inability to implement or manage emerging technologies, including quantum computing, AI, machine learning and technology change, failure to maintain effective data management, security breaches, cyber incidents, prolonged or repeated system outages, unintended disclosure of personal, proprietary or confidential information, breach of fiduciary obligations and handling of the emergence or continuation of health emergencies or pandemics. For example, we entered into orders with certain government agencies regarding our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Our reputation may also be negatively impacted by our ESG practices and disclosures, and those of our customers and third parties. Actions by the financial services industry generally or by certain members or individuals in the industry also can adversely affect our reputation. Also, adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects or financial results. We are subject to complex and evolving laws and regulations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR, CCPA as modified by the CPRA, cross-border data movement, cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and 19 Bank of America 19 Bank of America 19 Bank of America 19 Bank of America regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations.We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business.Our actual or perceived failure to address these and other issues, such as operational risks, gives rise to reputational risk that could harm us and our business prospects. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses. OtherThe impacts of the pandemic have adversely affected and may in the future adversely affect us.The COVID-19 pandemic has directly and indirectly negatively impacted the global economy, disrupted global supply chains, adversely affected equity market valuations, created significant volatility and disruption in financial and capital markets, resulted in challenging labor market conditions, and adversely impacted our financial results to varying degrees and in various respects. The future direct and indirect effects of the pandemic on global health and economic conditions and activity remain uncertain, continue to evolve by region, country and state and depend on future developments that cannot be predicted, including impacts from the expiration of the federal COVID-19 Public Health Emergency, surges of COVID-19 cases and the spread of more dangerous variants of COVID-19, the availability, usage and acceptance of effective medical treatments and vaccines, changing client preferences and behavior and future public response and government actions, including travel bans and restrictions, and limitations on business. Such evolving impacts of the pandemic could disrupt the U.S. and global economy, including changes in financial and capital markets, and adversely affect our businesses and operations, liquidity, results of operations and financial condition, including from increased allowance for credit losses and noninterest expenses, which are dependent on the pandemic’s duration and severity.Reforms to and replacement of IBORs and certain other rates or indices may adversely affect our reputation, business, financial condition and results of operations.Though significant progress has been made in the global financial markets to replace products and contracts referencing London Interbank Offered Rate (LIBOR) or other IBORs (IBOR Products), the aggregate notional amount of these IBOR Products remains material to our business. Risks and challenges associated with the transition from IBORs remain and may result in consequences that cannot be fully anticipated, which expose us to various financial, operational, supervisory, conduct and legal risk. While there has been significant progress in market and client adoption of ARRs, usage of ARRs may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs have compositions and characteristics that differ from the benchmarks they replace, in some cases they have limited liquidity, and may demonstrate less predictable performance over time than the benchmarks they replace. For example, certain ARRs are calculated on a compounded or weighted-average basis and, unlike IBORs, do not reflect bank credit risk and therefore typically require a spread adjustment. There are important differences between the fallbacks, triggers and calculation methodologies being implemented in cash and derivatives markets. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, and we may experience unanticipated market exposures. Changes resulting from transition to successor or alternative rates may adversely affect the yield on loans or securities held by us, amounts paid on securities we have issued, amounts received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our ability to effectively use hedging instruments to manage risk. There can be no assurance that existing assets and liabilities based on or linked to IBORs that have not already transitioned to ARRs will transition without delay or potential disputes.Although a significant majority of the aggregate notional amount of our remaining IBOR Products maturing after 2022 include or have been amended to include fallbacks to ARRs, the transitioning of certain IBOR Products that do not include fallback provisions or adequate fallback mechanisms require additional efforts to modify their terms. Some outstanding IBOR Products are particularly challenging to modify due to the requirement that all impacted parties consent to such modification. To address outstanding IBOR Products that are difficult to modify, legislation has been adopted in the U.S. and in other jurisdictions. Litigation, disputes or other action may occur as a result of the interpretation or application of legislation or regulations, including if there is an overlap between laws or regulations in different jurisdictions or from interactions with any FCA-compelled “synthetic” LIBOR settings. Some of our IBOR Products may contain language giving the calculation agent (which may be us) discretion to determine the successor rate (including the applicable spread adjustment) to the existing benchmark. We may face a risk of litigation, disputes or other actions from clients, counterparties, customers, investors or others based on various claims, for example, that we incorrectly interpreted or enforced IBOR-based contract provisions, failed to appropriately communicate the effect that the transition to ARRs will have on existing and future products, treated affected parties unfairly or made inappropriate product recommendations to or investments on behalf of its clients, or engaged in anti-competitive behavior or unlawfully manipulated markets or benchmarks.ARR-based products that we develop, launch and/or support, including products using credit sensitive rates, may perform differently to IBOR Products during times of economic stress, regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations.We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business.Our actual or perceived failure to address these and other issues, such as operational risks, gives rise to reputational risk that could harm us and our business prospects. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses. OtherThe impacts of the pandemic have adversely affected and may in the future adversely affect us.The COVID-19 pandemic has directly and indirectly negatively impacted the global economy, disrupted global supply chains, adversely affected equity market valuations, created significant volatility and disruption in financial and capital markets, resulted in challenging labor market conditions, and adversely impacted our financial results to varying degrees and in various respects. The future direct and indirect effects of the pandemic on global health and economic conditions and activity remain uncertain, continue to evolve by region, country and state and depend on future developments that cannot be predicted, including impacts from the expiration of the federal COVID-19 Public Health Emergency, surges of COVID-19 cases and the spread of more dangerous variants of COVID-19, the availability, usage and acceptance of effective medical treatments and vaccines, changing client preferences and behavior and future public response and government actions, including travel bans and restrictions, and limitations on business. Such evolving impacts of the pandemic could disrupt the U.S. and global economy, including changes in financial and capital markets, and adversely affect our businesses and operations, liquidity, results of operations and financial condition, including from increased allowance for credit losses and noninterest expenses, which are dependent on the pandemic’s duration and severity.Reforms to and replacement of IBORs and certain other rates or indices may adversely affect our reputation, business, financial condition and results of operations.Though significant progress has been made in the global financial markets to replace products and contracts referencing London Interbank Offered Rate (LIBOR) or other IBORs (IBOR Products), the aggregate notional amount of these IBOR regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations. We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business. Our actual or perceived failure to address these and other issues, such as operational risks, gives rise to reputational risk that could harm us and our business prospects. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses. Other

We rely on the GSEs to guarantee or purchase mortgage loans that meet their conforming loan requirements. During 2023, we sold approximately $3.1 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship, with the Federal Housing Finance Agency (FHFA) acting as conservator. In 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship and reduce their role in the marketplace. In January 2021, the Treasury Department further amended the agreement that governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. Uncertainty regarding their future and the MBS they guarantee continues to exist for the foreseeable future. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.

We rely on the GSEs to guarantee or purchase mortgage loans that meet their conforming loan requirements. During 2022, we sold approximately $4.1 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship, with the Federal Housing Finance Agency (FHFA) acting as conservator. In 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship and reduce their role in the marketplace. In January 2021, the Treasury Department further amended the agreement that governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. Uncertainty regarding their future and the MBS they guarantee continues to exist for the foreseeable future. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Additionally, risks may span across multiple key risk types, including climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk.Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program and develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, enable effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk. For example, we have experienced increased operational, reputational and compliance risk as a result of the prior need to rapidly deploy and implement multiple and varying pandemic relief programs, including the processing of unemployment benefits for California and certain other states, which have resulted in and will continue to result in losses. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses. governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. Uncertainty regarding their future and the MBS they guarantee continues to exist for the foreseeable future. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.

We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956. Capital and liquidity requirements are frequently introduced and amended. Regulators may increase regulatory capital requirements, including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. In 2023, U.S. banking regulators issued proposals to revise the calculation of the G-SIB surcharge and TLAC and long-term debt requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge increased by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events. As part of its annual CCAR, we are subject to extensive regulatory evaluation of capital planning practices by the Federal Reserve, including stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level, requiring us to hold additional capital or causing changes in required capital buffers. A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure. In July 2023, U.S. banking regulators issued a notice of proposed rulemaking to revise several key methodologies for measuring RWA, including a standardized approach for operational risk, revised market risk and credit risk requirements and removal of the use of certain internal models, which would increase our regulatory capital requirements, if adopted as proposed. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts.Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, which may adversely affect our results of operations.Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments are erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in revisions to prior-period financial statements.We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.Governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. including a standardized approach for operational risk, revised market risk and credit risk requirements and removal of the use of certain internal models, which would increase our regulatory capital requirements, if adopted as proposed. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts. Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, which may adversely affect our results of operations.

We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956. Capital and liquidity requirements are frequently introduced and amended. It is possible that regulators may increase regulatory capital requirements including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge is expected to increase by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could Bank of America 18 Bank of America 18 Bank of America 18 Bank of America 18 also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events.As part of its CCAR, the Federal Reserve conducts stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact the level of our SCB, requiring us to hold additional capital. For example, based on CCAR 2022 stress test results, our SCB increased 90 bps to 3.4 percent on October 1, 2022. A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure, which may increase. The Basel Committee on Banking Supervision has also revised several key methodologies for measuring RWA that have not yet been implemented in the U.S., including a standardized approach for operational risk, revised market risk requirements and constraints on the use of internal models, as well as a capital floor based on the revised standardized approaches. It is expected in 2023 that U.S. banking regulators will propose updates to the U.S. capital framework to incorporate the Basel Committee revisions. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts.Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations and business activities or hold highly liquid assets, which may adversely affect our results of operations. Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments were erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in revisions to prior-period financial statements. We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.It is possible that governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. New guidelines issued by the Organization for Economic Cooperation and Development could adversely impact how the global profits of multinational enterprises are taxed. Any change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, contractors, third parties, clients, counterparties and other representatives, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our responsiveness to fraud claims perpetrated against our customers, effectiveness of our internal controls, litigation or regulatory matters and their outcomes, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, including the reliability of our research and models, and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, failure to recognize and address customer complaints, compliance failures, inability to implement or manage emerging technologies, including quantum computing, AI, machine learning and technology change, failure to maintain effective data management, security breaches, cyber incidents, prolonged or repeated system outages, unintended disclosure of personal, proprietary or confidential information, breach of fiduciary obligations and handling of the emergence or continuation of health emergencies or pandemics. For example, we entered into orders with certain government agencies regarding our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Our reputation may also be negatively impacted by our ESG practices and disclosures, and those of our customers and third parties.Actions by the financial services industry generally or by certain members or individuals in the industry also can adversely affect our reputation. Also, adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects or financial results.We are subject to complex and evolving laws and regulations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR, CCPA as modified by the CPRA, cross-border data movement, cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events.As part of its CCAR, the Federal Reserve conducts stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact the level of our SCB, requiring us to hold additional capital. For example, based on CCAR 2022 stress test results, our SCB increased 90 bps to 3.4 percent on October 1, 2022. A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure, which may increase. The Basel Committee on Banking Supervision has also revised several key methodologies for measuring RWA that have not yet been implemented in the U.S., including a standardized approach for operational risk, revised market risk requirements and constraints on the use of internal models, as well as a capital floor based on the revised standardized approaches. It is expected in 2023 that U.S. banking regulators will propose updates to the U.S. capital framework to incorporate the Basel Committee revisions. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts.Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations and business activities or hold highly liquid assets, which may adversely affect our results of operations. Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments were erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in revisions to prior-period financial statements. We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.It is possible that governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. New guidelines issued by the Organization for Economic Cooperation and Development could adversely impact how the global profits of multinational enterprises are taxed. Any change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events. As part of its CCAR, the Federal Reserve conducts stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact the level of our SCB, requiring us to hold additional capital. For example, based on CCAR 2022 stress test results, our SCB increased 90 bps to 3.4 percent on October 1, 2022. A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure, which may increase. The Basel Committee on Banking Supervision has also revised several key methodologies for measuring RWA that have not yet been implemented in the U.S., including a standardized approach for operational risk, revised market risk requirements and constraints on the use of internal models, as well as a capital floor based on the revised standardized approaches. It is expected in 2023 that U.S. banking regulators will propose updates to the U.S. capital framework to incorporate the Basel Committee revisions. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts. Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations and business activities or hold highly liquid assets, which may adversely affect our results of operations.

Our borrowing costs and ability to raise funds are directly impacted by our credit ratings. Credit ratings are also important to investors, customers or counterparties when we compete in certain markets and seek to engage in certain transactions, including over-the-counter (OTC) derivatives. Our credit ratings are subject to ongoing review by rating agencies, which consider a number of financial and nonfinancial factors, including our franchise, financial strength, performance and prospects, management, governance, risk management practices, capital adequacy, asset quality and operations, among other criteria, as well as factors not under our control, such as regulatory developments, the macroeconomic and geopolitical environment and changes to the methodologies used to determine our ratings. Rating agencies could adjust our credit ratings at any time and there can be no assurance as to whether or when a downgrade could occur. Any reduction could result in a wider credit spread and negatively affect our access to credit markets, the related cost of funds, our businesses and certain trading revenues, particularly in those businesses where counterparty creditworthiness is critical. If the short-term credit ratings of our parent company, bank or broker-dealer subsidiaries were downgraded, we may experience loss of access to short-term funding sources such as repo financing, and/or incur increased cost of funds and increased collateral requirements. Under the terms of certain OTC derivative contracts and other trading agreements, if our or our subsidiaries’ credit ratings are downgraded, the counterparties may require additional collateral or terminate these contracts or agreements. While certain potential impacts are contractual and quantifiable, the full consequences of a credit rating downgrade are inherently uncertain and depend upon numerous dynamic, complex and inter-related factors and assumptions, including the relationship between long-term and short-term credit ratings and the behaviors of customers, investors and counterparties.

Our borrowing costs and ability to raise funds are directly impacted by our credit ratings. Credit ratings may also be important to investors, customers or counterparties when we compete in certain markets and seek to engage in certain transactions, including over-the-counter (OTC) derivatives. Our credit ratings are subject to ongoing review by rating agencies, which consider a number of financial and non-financial factors, including our franchise, financial strength, performance and prospects, management, governance, risk management practices, capital adequacy, asset quality and operations, among other criteria, as well as factors not under our control, such as regulatory developments, the macroeconomic and geopolitical environment and changes to the methodologies used to determine our ratings, or ratings generally. Rating agencies could make adjustments to our credit ratings at any time and there can be no assurance as to whether or when any downgrades could occur. A reduction in our credit ratings could result in a wider credit spread and negatively affect our liquidity, access to credit markets, the related cost of funds, our businesses and certain trading revenues, particularly in those businesses where counterparty creditworthiness is critical. If the short-term credit ratings of our parent company, or bank or broker-dealer subsidiaries, were downgraded by one or more levels, we may experience loss of access to short-term funding sources such as repo financing, and/or incur increased cost of funds and increased collateral requirements. Under the terms of certain OTC derivative contracts and other trading agreements, if our or our subsidiaries’ credit ratings are downgraded, the counterparties may require additional collateral or terminate these contracts or agreements.While certain potential impacts are contractual and quantifiable, the full consequences of a credit rating downgrade are inherently uncertain and depend upon numerous dynamic, complex and inter-related factors and assumptions, including the relationship between long-term and short-term credit ratings and the behaviors of customers, investors and counterparties. Bank of America Corporation is a holding company, is dependent on its subsidiaries for liquidity and may be restricted from transferring funds from subsidiaries. Bank of America Corporation, as the parent company, is a separate and distinct legal entity from our bank and nonbank subsidiaries. We evaluate and manage liquidity on a legal entity basis. Legal entity liquidity is an important consideration as there are legal, regulatory, contractual and other limitations on our ability to utilize liquidity from one legal entity to satisfy the liquidity requirements of another, including the parent company, which could result in adverse liquidity events. The parent company depends on dividends, distributions, loans and other payments from our bank and nonbank subsidiaries to fund dividend payments on our preferred stock and common stock and to fund all payments on our other obligations, including debt obligations. Any inability of our subsidiaries to transfer funds, pay dividends or make payments to us may adversely affect our cash flow and financial condition.Many of our subsidiaries, including our bank and broker-dealer subsidiaries, are subject to laws that restrict dividend payments, or authorize regulatory bodies to block or reduce the flow of funds from those subsidiaries to the parent company or other subsidiaries. Our bank and broker-dealer subsidiaries are subject to restrictions on their ability to lend or transact with affiliates, minimum regulatory capital and liquidity requirements and restrictions on their ability to use funds deposited with them in bank or brokerage accounts to fund their businesses. Intercompany arrangements we entered into in connection with our resolution planning submissions could restrict the amount of funding available to the parent company from our subsidiaries under certain adverse conditions.Additional restrictions on related party transactions, increased capital and liquidity requirements and additional limitations on the use of funds on deposit in bank or brokerage accounts, as well as lower earnings, can reduce the amount of funds available to meet the obligations of the parent company and even require the parent company to provide additional funding to such subsidiaries. Also, regulatory action that requires additional liquidity at each of our subsidiaries could impede access to funds we need to pay our obligations or pay dividends. In addition, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to prior claims of the subsidiary’s creditors. credit ratings could result in a wider credit spread and negatively affect our liquidity, access to credit markets, the related cost of funds, our businesses and certain trading revenues, particularly in those businesses where counterparty creditworthiness is critical. If the short-term credit ratings of our parent company, or bank or broker-dealer subsidiaries, were downgraded by one or more levels, we may experience loss of access to short-term funding sources such as repo financing, and/or incur increased cost of funds and increased collateral requirements. Under the terms of certain OTC derivative contracts and other trading agreements, if our or our subsidiaries’ credit ratings are downgraded, the counterparties may require additional collateral or terminate these contracts or agreements. While certain potential impacts are contractual and quantifiable, the full consequences of a credit rating downgrade are inherently uncertain and depend upon numerous dynamic, complex and inter-related factors and assumptions, including the relationship between long-term and short-term credit ratings and the behaviors of customers, investors and counterparties.

Our business is highly dependent on the security, controls and efficacy of our information systems, and the information systems of our customers, third parties, the financial services industry and financial data aggregators with whom we interact, on whom we rely or who have access to our customers' personal or account information. We rely on effective access management and the secure collection, processing, maintenance, use, sharing, dissemination and disposition of information in our and our third parties’ information systems. Our cybersecurity risk and exposure remains heightened because of, among other things, our prominent size and scale, high-profile brand, geographic footprint and international presence and role in the financial services industry and the broader economy. The proliferation of third-party financial data aggregators and emerging technologies, including our and our third parties’ use of automation, artificial intelligence (AI) and robotics, increases our cybersecurity risks and exposure. We, our employees, customers, regulators and third parties are ongoing targets of an increasing number of cybersecurity threats and cyberattacks. The tactics, techniques and procedures used in cyberattacks are pervasive, sophisticated and designed to evade security measures, including computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or other security breach tactics that have and in the future could result in disruptions to our businesses and operations and the loss of funds, including from attempts to defraud us and/or our customers, and impact the confidentiality, integrity or availability of our information, including intellectual property, or that of our employees, customers and third parties. Cyberattacks are carried out on a worldwide scale and by a growing number of actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments, state-sponsored actors, activists, disgruntled employees and other persons or entities, including those involved in corporate espionage. Cybersecurity threats and the tactics, techniques and procedures used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as AI, machine learning and quantum computing. Despite substantial efforts to protect the integrity and resilience of our information systems and implement controls, processes, policies, employee training and other protective measures, we are not able to anticipate and/or detect all cybersecurity threats and incidents and/or develop or implement effective preventive or defensive measures designed to prevent, respond to or mitigate all cybersecurity threats and incidents. Internal access management failures could impact the confidentiality, integrity or availability of data. Additionally, the failure of our employees to exercise sound judgment and vigilance when targeted with social engineering or other cyberattacks increases our vulnerability.Our risk from and exposure to cybersecurity threats and incidents, information and security breaches and technology failures continues to increase due to the acceptance and use of digital banking and other digital products and services, including mobile banking products, and reliance on remote access tools and technology, which have increased our reliance on virtual or digital interactions and a larger number of access points to our information systems that must be secured, and results in greater amounts of information being available for access. Greater demand on our information systems and security tools and processes will likely continue.We also face significant third-party technology, cybersecurity and operational risks relating to the large number of customers and third parties with whom we do business, the financial services industry, upon whom we rely to facilitate or enable our business activities or upon whom our customers rely, including the secure collection, processing, maintenance, use, sharing, dissemination and disposition of customer and other sensitive information, providers of products and/or services, financial counterparties, financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, providers of outsourced infrastructure, such as internet access, cloud service providers and electrical power, and retailers for whom we process transactions. Such third-party information systems extend beyond our security and control systems, and such third parties have varying levels of security and cybersecurity resources, expertise, safeguards, controls and capabilities. Threat actors may actively seek to exploit security and cybersecurity weaknesses at our third parties and the relationships of our third parties with us may increase the risk that they are targeted by the same threats we face, and such third parties may be less prepared for such threats. We are also at additional risk resulting from critical third-party information security and open-source software vulnerabilities. We must rely on our third parties to adequately detect and promptly report cybersecurity incidents, and their failure to do so could adversely affect our ability to report or respond to cybersecurity incidents effectively or timely.Due to increasing consolidation, interdependence and complexity of financial entities and technology and information systems, a cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys or compromises the information systems or information of one or more financial entities or third parties could adversely impact us and increase the risk of operational failure and loss, as disparate systems need to be integrated, often on an accelerated basis. Similarly, any cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys or compromises our information systems or information could adversely impact third parties and the critical infrastructure of the financial services industry, thereby creating additional risk for us.Cybersecurity incidents or information or security breaches could persist for an extended period of time before being detected, and it often takes additional time to determine the scope, extent, amount and type of impact, including information altered, destroyed or otherwise compromised, following which the measures to recover and restore to a business-as-usual state may be difficult to assess. We have spent and expect to continue to spend significant resources to modify and enhance management failures could impact the confidentiality, integrity or availability of data. Additionally, the failure of our employees to exercise sound judgment and vigilance when targeted with social engineering or other cyberattacks increases our vulnerability. Our risk from and exposure to cybersecurity threats and incidents, information and security breaches and technology failures continues to increase due to the acceptance and use of digital banking and other digital products and services, including mobile banking products, and reliance on remote access tools and technology, which have increased our reliance on virtual or digital interactions and a larger number of access points to our information systems that must be secured, and results in greater amounts of information being available for access. Greater demand on our information systems and security tools and processes will likely continue. We also face significant third-party technology, cybersecurity and operational risks relating to the large number of customers and third parties with whom we do business, the financial services industry, upon whom we rely to facilitate or enable our business activities or upon whom our customers rely, including the secure collection, processing, maintenance, use, sharing, dissemination and disposition of customer and other sensitive information, providers of products and/or services, financial counterparties, financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, providers of outsourced infrastructure, such as internet access, cloud service providers and electrical power, and retailers for whom we process transactions. Such third-party information systems extend beyond our security and control systems, and such third parties have varying levels of security and cybersecurity resources, expertise, safeguards, controls and capabilities. Threat actors may actively seek to exploit security and cybersecurity weaknesses at our third parties and the relationships of our third parties with us may increase the risk that they are targeted by the same threats we face, and such third parties may be less prepared for such threats. We are also at additional risk resulting from critical third-party information security and open-source software vulnerabilities. We must rely on our third parties to adequately detect and promptly report cybersecurity incidents, and their failure to do so could adversely affect our ability to report or respond to cybersecurity incidents effectively or timely. Due to increasing consolidation, interdependence and complexity of financial entities and technology and information systems, a cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys or compromises the information systems or information of one or more financial entities or third parties could adversely impact us and increase the risk of operational failure and loss, as disparate systems need to be integrated, often on an accelerated basis. Similarly, any cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys or compromises our information systems or information could adversely impact third parties and the critical infrastructure of the financial services industry, thereby creating additional risk for us. Cybersecurity incidents or information or security breaches could persist for an extended period of time before being detected, and it often takes additional time to determine the scope, extent, amount and type of impact, including information altered, destroyed or otherwise compromised, following which the measures to recover and restore to a business-as-usual state may be difficult to assess. We have spent and expect to continue to spend significant resources to modify and enhance 15 Bank of America 15 Bank of America 15 Bank of America 15 Bank of America our protective measures, investigate and remediate software and network vulnerabilities, and defend against, detect and respond to cybersecurity threats and incidents whether specific to us, a third party, the industry or businesses in general, and enhance our capabilities to respond and recover.While we and our third parties have experienced cybersecurity incidents, information and security breaches and technology failures, as well as adverse impacts from such events, including as described in this risk factor, we have not experienced material losses or other material consequences relating to cybersecurity incidents, information or security breaches or technology failures, whether directed at us or our third parties. However, we expect to continue to experience such events and impacts with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, information and security breaches and technology failures, including as a result of cybersecurity incidents, information and security breaches and technology failures experienced by our third parties, will not have a material adverse impact on us, including our businesses, results of operations and financial condition.Any future cybersecurity incident, information or security breach or technology failure suffered by us or our third parties could result in disruption to our day-to-day business activities, an inability to effect transactions, execute trades, service our customers, manage our exposure to risk, expand our businesses, detect and prevent fraudulent or unauthorized transactions, including transactions impacting our customers, maintain information systems access and business operations and customer services, in the U.S. and/or globally. Additionally, we could experience the loss of customers and business opportunities, the withdrawal of customer deposits, the misappropriation, alteration or destruction of our or our third parties’ intellectual property or confidential information, the unauthorized access to or temporary or permanent loss or theft of personally identifiable information, including of our employees and customers, significant lost revenue, losses and claims brought by third parties, violations of applicable privacy, cybersecurity and other laws, rules and regulations, litigation exposure, economic sanctions, enforcement actions, government fines, penalties or intervention and other negative consequences. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. In addition, in the case of any cybersecurity incident, information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such cybersecurity incidents, information or security breaches or technology failures, including monetary losses of the Corporation. The occurrence of any of the events described above could adversely impact our businesses, results of operations, liquidity and financial condition, as well as cause reputational harm, whether such events are actual or perceived.Failure to satisfy our obligations as servicer for residential mortgage securitizations, loans owned by other entities and other related losses could adversely impact our reputation, servicing costs or results of operations.We service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. We may also have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.Changes in the structure of and relationship among the GSEs could adversely impact our business.We rely on the GSEs to guarantee or purchase mortgage loans that meet their conforming loan requirements. During 2023, we sold approximately $3.1 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship, with the Federal Housing Finance Agency (FHFA) acting as conservator. In 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship and reduce their role in the marketplace. In January 2021, the Treasury Department further amended the agreement that governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. Uncertainty regarding their future and the MBS they guarantee continues to exist for the foreseeable future. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Risks also may span across multiple key risk types, including cybersecurity risk, climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk. our protective measures, investigate and remediate software and network vulnerabilities, and defend against, detect and respond to cybersecurity threats and incidents whether specific to us, a third party, the industry or businesses in general, and enhance our capabilities to respond and recover.While we and our third parties have experienced cybersecurity incidents, information and security breaches and technology failures, as well as adverse impacts from such events, including as described in this risk factor, we have not experienced material losses or other material consequences relating to cybersecurity incidents, information or security breaches or technology failures, whether directed at us or our third parties. However, we expect to continue to experience such events and impacts with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, information and security breaches and technology failures, including as a result of cybersecurity incidents, information and security breaches and technology failures experienced by our third parties, will not have a material adverse impact on us, including our businesses, results of operations and financial condition.Any future cybersecurity incident, information or security breach or technology failure suffered by us or our third parties could result in disruption to our day-to-day business activities, an inability to effect transactions, execute trades, service our customers, manage our exposure to risk, expand our businesses, detect and prevent fraudulent or unauthorized transactions, including transactions impacting our customers, maintain information systems access and business operations and customer services, in the U.S. and/or globally. Additionally, we could experience the loss of customers and business opportunities, the withdrawal of customer deposits, the misappropriation, alteration or destruction of our or our third parties’ intellectual property or confidential information, the unauthorized access to or temporary or permanent loss or theft of personally identifiable information, including of our employees and customers, significant lost revenue, losses and claims brought by third parties, violations of applicable privacy, cybersecurity and other laws, rules and regulations, litigation exposure, economic sanctions, enforcement actions, government fines, penalties or intervention and other negative consequences. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. In addition, in the case of any cybersecurity incident, information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such cybersecurity incidents, information or security breaches or technology failures, including monetary losses of the Corporation. The occurrence of any of the events described above could adversely impact our businesses, results of operations, liquidity and financial condition, as well as cause reputational harm, whether such events are actual or perceived.Failure to satisfy our obligations as servicer for residential mortgage securitizations, loans owned by other entities and other related losses could adversely impact our reputation, servicing costs or results of operations.We service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. We may also have liability for any failure by us, as a servicer or master servicer, for our protective measures, investigate and remediate software and network vulnerabilities, and defend against, detect and respond to cybersecurity threats and incidents whether specific to us, a third party, the industry or businesses in general, and enhance our capabilities to respond and recover. While we and our third parties have experienced cybersecurity incidents, information and security breaches and technology failures, as well as adverse impacts from such events, including as described in this risk factor, we have not experienced material losses or other material consequences relating to cybersecurity incidents, information or security breaches or technology failures, whether directed at us or our third parties. However, we expect to continue to experience such events and impacts with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, information and security breaches and technology failures, including as a result of cybersecurity incidents, information and security breaches and technology failures experienced by our third parties, will not have a material adverse impact on us, including our businesses, results of operations and financial condition. Any future cybersecurity incident, information or security breach or technology failure suffered by us or our third parties could result in disruption to our day-to-day business activities, an inability to effect transactions, execute trades, service our customers, manage our exposure to risk, expand our businesses, detect and prevent fraudulent or unauthorized transactions, including transactions impacting our customers, maintain information systems access and business operations and customer services, in the U.S. and/or globally. Additionally, we could experience the loss of customers and business opportunities, the withdrawal of customer deposits, the misappropriation, alteration or destruction of our or our third parties’ intellectual property or confidential information, the unauthorized access to or temporary or permanent loss or theft of personally identifiable information, including of our employees and customers, significant lost revenue, losses and claims brought by third parties, violations of applicable privacy, cybersecurity and other laws, rules and regulations, litigation exposure, economic sanctions, enforcement actions, government fines, penalties or intervention and other negative consequences. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. In addition, in the case of any cybersecurity incident, information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such cybersecurity incidents, information or security breaches or technology failures, including monetary losses of the Corporation. The occurrence of any of the events described above could adversely impact our businesses, results of operations, liquidity and financial condition, as well as cause reputational harm, whether such events are actual or perceived.

Our business is highly dependent on the security, controls and efficacy of our infrastructure, computer and data management systems, and those of our customers, suppliers, counterparties and other third parties, the financial services Bank of America 14 Bank of America 14 Bank of America 14 Bank of America 14 industry and financial data aggregators, with whom we interact, on whom we rely or who have access to our customers' personal or account information. We rely on effective access management and the secure collection, processing, transmission, storage and retrieval of confidential, proprietary, personally identifiable and other information in our and our third parties’ computer and data management systems and networks. Our cybersecurity risk and exposure remains heightened because of, among other things, our prominent size and scale, high-profile brand, geographic footprint and international presence and role in the financial services industry and the broader economy. The proliferation of third-party financial data aggregators and emerging technologies, including our use of automation, artificial intelligence (AI) and robotics, increase our cybersecurity risks and exposure.We, our employees, customers, regulators and third parties are regularly the target of an increasing number of cyber threats and attacks. Cyber threats and techniques used in cyberattacks are pervasive, sophisticated and difficult to prevent, including computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or other security breach tactics that could result in disruptions to our businesses and operations, the loss of our funds and/or our clients’ and the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction or theft of confidential, proprietary and other information, including intellectual property, of ours, our employees, our customers or of third parties. Cyberattacks may be carried out on a worldwide scale and by a growing number of cyber actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments, state-sponsored actors, activists, disgruntled employees and other third parties, including those involved in corporate espionage.Cyber threats and the techniques used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as advanced forms of AI and quantum computing. Despite substantial efforts to protect the integrity and resilience of our systems and implement controls, processes, policies, employee training and other protective measures, we may not be able to anticipate or detect cyberattacks or information or security breaches and/or develop or implement effective preventive or defensive measures to address or mitigate such attacks or breaches. Internal access management failures could result in the compromise or unauthorized exposure of confidential data. Additionally, the failure of our employees to exercise sound judgment and vigilance when targeted with social engineering cyberattacks may increase our vulnerability.Our risk and exposure to cyberattacks and security breaches continue to increase due to the acceptance and use of digital banking products and services, including mobile banking products, and reliance on remote access tools and technology, which have increased our reliance on virtual/digital interactions and a larger number of access points to our networks that must be secured. This increased risk of unauthorized access to our networks results in greater amounts of information being available for access. Employees working remotely away from the office (whether on personal or our devices) also represent inherently greater risk than employees working in our offices. Greater demand on our information technology infrastructure and security tools and processes will likely continue. We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business and the financial services industry, upon whom we rely to facilitate or enable our business activities or upon whom our customers rely. Other indirect risks relate to providers of products and/or services, financial counterparties, financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, providers of critical infrastructure, such as internet access and electrical power, and retailers for whom we process transactions. We are also at additional risk resulting from critical third-party information security and open-source software vulnerabilities.We have exposure to cyber threats due to our continuous transmission of sensitive information to, and storage of such information by, third parties, including providers of products and/or services, and regulators, the outsourcing of some of our business operations, and system and customer account updates and conversions. Further, any such event may not be disclosed to us in a timely manner. Any failure, cyberattack or other information or security breach that significantly degrades, deletes or compromises our systems or data could adversely impact third parties, counterparties and the critical infrastructure of the financial services industry. Due to increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyberattack or other information or security vulnerability, failure or breach that significantly exposes, degrades, deletes or compromises the systems or data of one or more financial entities or third parties could adversely impact us and increase the risk of operational failure, as disparate systems need to be integrated, often on an accelerated basis.Cyberattacks or security breaches could persist for an extended period of time before being detected and take additional time to determine the scope, extent, amount, and type of information compromised, following which the impact and measures to recover and restore to a business-as-usual state may be difficult to assess. We continue to expend significant additional money and resources to modify or enhance our protective measures, investigate and remediate any information security, software or network vulnerabilities or incidents whether specific to us, a third party, the industry or businesses in general, and develop our capabilities to respond and recover. While we have experienced cyberattacks and security breaches, and expect to continue to, we have not experienced any material losses or other material consequences relating to technology failure, cyberattacks or other information or security breaches, whether directed at us or third parties. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Successful penetration or circumvention of system security could result in negative consequences, including loss of customers and business opportunities, the withdrawal of customer deposits, misappropriation or destruction of our intellectual property, proprietary information or confidential information and/or the confidential, proprietary or personally identifiable information of certain parties, such as our employees, customers, providers of products and services, counterparties and other third parties, or damage to their computers or systems. Any future technology failure, cyberattack or breach could adversely affect our ability to conduct day-to-day business activities, effect transactions, service our clients, manage our exposure to risk or expand our industry and financial data aggregators, with whom we interact, on whom we rely or who have access to our customers' personal or account information. We rely on effective access management and the secure collection, processing, transmission, storage and retrieval of confidential, proprietary, personally identifiable and other information in our and our third parties’ computer and data management systems and networks. Our cybersecurity risk and exposure remains heightened because of, among other things, our prominent size and scale, high-profile brand, geographic footprint and international presence and role in the financial services industry and the broader economy. The proliferation of third-party financial data aggregators and emerging technologies, including our use of automation, artificial intelligence (AI) and robotics, increase our cybersecurity risks and exposure.We, our employees, customers, regulators and third parties are regularly the target of an increasing number of cyber threats and attacks. Cyber threats and techniques used in cyberattacks are pervasive, sophisticated and difficult to prevent, including computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or other security breach tactics that could result in disruptions to our businesses and operations, the loss of our funds and/or our clients’ and the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction or theft of confidential, proprietary and other information, including intellectual property, of ours, our employees, our customers or of third parties. Cyberattacks may be carried out on a worldwide scale and by a growing number of cyber actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments, state-sponsored actors, activists, disgruntled employees and other third parties, including those involved in corporate espionage.Cyber threats and the techniques used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as advanced forms of AI and quantum computing. Despite substantial efforts to protect the integrity and resilience of our systems and implement controls, processes, policies, employee training and other protective measures, we may not be able to anticipate or detect cyberattacks or information or security breaches and/or develop or implement effective preventive or defensive measures to address or mitigate such attacks or breaches. Internal access management failures could result in the compromise or unauthorized exposure of confidential data. Additionally, the failure of our employees to exercise sound judgment and vigilance when targeted with social engineering cyberattacks may increase our vulnerability.Our risk and exposure to cyberattacks and security breaches continue to increase due to the acceptance and use of digital banking products and services, including mobile banking products, and reliance on remote access tools and technology, which have increased our reliance on virtual/digital interactions and a larger number of access points to our networks that must be secured. This increased risk of unauthorized access to our networks results in greater amounts of information being available for access. Employees working remotely away from the office (whether on personal or our devices) also represent inherently greater risk than employees working in our offices. Greater demand on our information technology infrastructure and security tools and processes will likely continue. We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other industry and financial data aggregators, with whom we interact, on whom we rely or who have access to our customers' personal or account information. We rely on effective access management and the secure collection, processing, transmission, storage and retrieval of confidential, proprietary, personally identifiable and other information in our and our third parties’ computer and data management systems and networks. Our cybersecurity risk and exposure remains heightened because of, among other things, our prominent size and scale, high-profile brand, geographic footprint and international presence and role in the financial services industry and the broader economy. The proliferation of third-party financial data aggregators and emerging technologies, including our use of automation, artificial intelligence (AI) and robotics, increase our cybersecurity risks and exposure. We, our employees, customers, regulators and third parties are regularly the target of an increasing number of cyber threats and attacks. Cyber threats and techniques used in cyberattacks are pervasive, sophisticated and difficult to prevent, including computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or other security breach tactics that could result in disruptions to our businesses and operations, the loss of our funds and/or our clients’ and the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction or theft of confidential, proprietary and other information, including intellectual property, of ours, our employees, our customers or of third parties. Cyberattacks may be carried out on a worldwide scale and by a growing number of cyber actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments, state-sponsored actors, activists, disgruntled employees and other third parties, including those involved in corporate espionage. Cyber threats and the techniques used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as advanced forms of AI and quantum computing. Despite substantial efforts to protect the integrity and resilience of our systems and implement controls, processes, policies, employee training and other protective measures, we may not be able to anticipate or detect cyberattacks or information or security breaches and/or develop or implement effective preventive or defensive measures to address or mitigate such attacks or breaches. Internal access management failures could result in the compromise or unauthorized exposure of confidential data. Additionally, the failure of our employees to exercise sound judgment and vigilance when targeted with social engineering cyberattacks may increase our vulnerability. Our risk and exposure to cyberattacks and security breaches continue to increase due to the acceptance and use of digital banking products and services, including mobile banking products, and reliance on remote access tools and technology, which have increased our reliance on virtual/digital interactions and a larger number of access points to our networks that must be secured. This increased risk of unauthorized access to our networks results in greater amounts of information being available for access. Employees working remotely away from the office (whether on personal or our devices) also represent inherently greater risk than employees working in our offices. Greater demand on our information technology infrastructure and security tools and processes will likely continue. We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business and the financial services industry, upon whom we rely to facilitate or enable our business activities or upon whom our customers rely. Other indirect risks relate to providers of products and/or services, financial counterparties, financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, providers of critical infrastructure, such as internet access and electrical power, and retailers for whom we process transactions. We are also at additional risk resulting from critical third-party information security and open-source software vulnerabilities.We have exposure to cyber threats due to our continuous transmission of sensitive information to, and storage of such information by, third parties, including providers of products and/or services, and regulators, the outsourcing of some of our business operations, and system and customer account updates and conversions. Further, any such event may not be disclosed to us in a timely manner. Any failure, cyberattack or other information or security breach that significantly degrades, deletes or compromises our systems or data could adversely impact third parties, counterparties and the critical infrastructure of the financial services industry. Due to increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyberattack or other information or security vulnerability, failure or breach that significantly exposes, degrades, deletes or compromises the systems or data of one or more financial entities or third parties could adversely impact us and increase the risk of operational failure, as disparate systems need to be integrated, often on an accelerated basis.Cyberattacks or security breaches could persist for an extended period of time before being detected and take additional time to determine the scope, extent, amount, and type of information compromised, following which the impact and measures to recover and restore to a business-as-usual state may be difficult to assess. We continue to expend significant additional money and resources to modify or enhance our protective measures, investigate and remediate any information security, software or network vulnerabilities or incidents whether specific to us, a third party, the industry or businesses in general, and develop our capabilities to respond and recover. While we have experienced cyberattacks and security breaches, and expect to continue to, we have not experienced any material losses or other material consequences relating to technology failure, cyberattacks or other information or security breaches, whether directed at us or third parties. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Successful penetration or circumvention of system security could result in negative consequences, including loss of customers and business opportunities, the withdrawal of customer deposits, misappropriation or destruction of our intellectual property, proprietary information or confidential information and/or the confidential, proprietary or personally identifiable information of certain parties, such as our employees, customers, providers of products and services, counterparties and other third parties, or damage to their computers or systems. Any future technology failure, cyberattack or breach could adversely affect our ability to conduct day-to-day business activities, effect transactions, service our clients, manage our exposure to risk or expand our third parties with whom we do business and the financial services industry, upon whom we rely to facilitate or enable our business activities or upon whom our customers rely. Other indirect risks relate to providers of products and/or services, financial counterparties, financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, providers of critical infrastructure, such as internet access and electrical power, and retailers for whom we process transactions. We are also at additional risk resulting from critical third-party information security and open-source software vulnerabilities. We have exposure to cyber threats due to our continuous transmission of sensitive information to, and storage of such information by, third parties, including providers of products and/or services, and regulators, the outsourcing of some of our business operations, and system and customer account updates and conversions. Further, any such event may not be disclosed to us in a timely manner. Any failure, cyberattack or other information or security breach that significantly degrades, deletes or compromises our systems or data could adversely impact third parties, counterparties and the critical infrastructure of the financial services industry. Due to increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyberattack or other information or security vulnerability, failure or breach that significantly exposes, degrades, deletes or compromises the systems or data of one or more financial entities or third parties could adversely impact us and increase the risk of operational failure, as disparate systems need to be integrated, often on an accelerated basis. Cyberattacks or security breaches could persist for an extended period of time before being detected and take additional time to determine the scope, extent, amount, and type of information compromised, following which the impact and measures to recover and restore to a business-as-usual state may be difficult to assess. We continue to expend significant additional money and resources to modify or enhance our protective measures, investigate and remediate any information security, software or network vulnerabilities or incidents whether specific to us, a third party, the industry or businesses in general, and develop our capabilities to respond and recover. While we have experienced cyberattacks and security breaches, and expect to continue to, we have not experienced any material losses or other material consequences relating to technology failure, cyberattacks or other information or security breaches, whether directed at us or third parties. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Successful penetration or circumvention of system security could result in negative consequences, including loss of customers and business opportunities, the withdrawal of customer deposits, misappropriation or destruction of our intellectual property, proprietary information or confidential information and/or the confidential, proprietary or personally identifiable information of certain parties, such as our employees, customers, providers of products and services, counterparties and other third parties, or damage to their computers or systems. Any future technology failure, cyberattack or breach could adversely affect our ability to conduct day-to-day business activities, effect transactions, service our clients, manage our exposure to risk or expand our 15 Bank of America 15 Bank of America 15 Bank of America 15 Bank of America businesses, result in fraudulent or unauthorized transactions or cause prolonged computer and network outages resulting in material disruptions to our or our customers’ or other third parties’ network access or critical business operations and customer services, in the U.S. and/or globally.Any cyberattack or breach, whether directed at us or third parties, may result in significant lost revenue, give rise to losses and claims brought by third parties, litigation exposure, regulatory sanctions, enforcement actions, government fines, penalties or intervention and other negative consequences. The actual or perceived success of a cyberattack on our systems may damage our reputation with customers and third parties with whom we do business and/or result in the loss of confidence in our security measures. Additionally, our failure to disclose or communicate cyber incidents appropriately to relevant parties could result in regulatory, privacy, operational and reputational risk. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. Cyberattacks or other information or security breaches could also result in a violation of applicable privacy and other laws, reimbursement or other compensatory costs, additional compliance costs, and our internal controls or disclosure controls being rendered ineffective. The occurrence of any of these events could adversely impact our businesses, results of operations, liquidity and financial condition.Failure to satisfy our obligations as servicer for residential mortgage securitizations, loans owned by other entities and other related losses could adversely impact our reputation, servicing costs or results of operations.We and our legacy companies service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. We may also have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.Changes in the structure of and relationship among the GSEs could adversely impact our business.We rely on the GSEs to guarantee or purchase mortgage loans that meet their conforming loan requirements. During 2022, we sold approximately $4.1 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship, with the Federal Housing Finance Agency (FHFA) acting as conservator. In 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship and reduce their role in the marketplace. In January 2021, the Treasury Department further amended the agreement that governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. Uncertainty regarding their future and the MBS they guarantee continues to exist for the foreseeable future. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Additionally, risks may span across multiple key risk types, including climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk.Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program and develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, enable effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk. For example, we have experienced increased operational, reputational and compliance risk as a result of the prior need to rapidly deploy and implement multiple and varying pandemic relief programs, including the processing of unemployment benefits for California and certain other states, which have resulted in and will continue to result in losses. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses. businesses, result in fraudulent or unauthorized transactions or cause prolonged computer and network outages resulting in material disruptions to our or our customers’ or other third parties’ network access or critical business operations and customer services, in the U.S. and/or globally.Any cyberattack or breach, whether directed at us or third parties, may result in significant lost revenue, give rise to losses and claims brought by third parties, litigation exposure, regulatory sanctions, enforcement actions, government fines, penalties or intervention and other negative consequences. The actual or perceived success of a cyberattack on our systems may damage our reputation with customers and third parties with whom we do business and/or result in the loss of confidence in our security measures. Additionally, our failure to disclose or communicate cyber incidents appropriately to relevant parties could result in regulatory, privacy, operational and reputational risk. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. Cyberattacks or other information or security breaches could also result in a violation of applicable privacy and other laws, reimbursement or other compensatory costs, additional compliance costs, and our internal controls or disclosure controls being rendered ineffective. The occurrence of any of these events could adversely impact our businesses, results of operations, liquidity and financial condition.Failure to satisfy our obligations as servicer for residential mortgage securitizations, loans owned by other entities and other related losses could adversely impact our reputation, servicing costs or results of operations.We and our legacy companies service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. We may also have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.Changes in the structure of and relationship among the GSEs could adversely impact our business.We rely on the GSEs to guarantee or purchase mortgage loans that meet their conforming loan requirements. During 2022, we sold approximately $4.1 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship, with the Federal Housing Finance Agency (FHFA) acting as conservator. In 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship and reduce their role in the marketplace. In January 2021, the Treasury Department further amended the agreement that businesses, result in fraudulent or unauthorized transactions or cause prolonged computer and network outages resulting in material disruptions to our or our customers’ or other third parties’ network access or critical business operations and customer services, in the U.S. and/or globally. Any cyberattack or breach, whether directed at us or third parties, may result in significant lost revenue, give rise to losses and claims brought by third parties, litigation exposure, regulatory sanctions, enforcement actions, government fines, penalties or intervention and other negative consequences. The actual or perceived success of a cyberattack on our systems may damage our reputation with customers and third parties with whom we do business and/or result in the loss of confidence in our security measures. Additionally, our failure to disclose or communicate cyber incidents appropriately to relevant parties could result in regulatory, privacy, operational and reputational risk. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. Cyberattacks or other information or security breaches could also result in a violation of applicable privacy and other laws, reimbursement or other compensatory costs, additional compliance costs, and our internal controls or disclosure controls being rendered ineffective. The occurrence of any of these events could adversely impact our businesses, results of operations, liquidity and financial condition.

Operational risk exposure exists throughout our organization and as a result of our extensive interactions with, and reliance on, third parties and the financial services industry, including the processing and reporting of a large number of transactions in many currencies and jurisdictions. Our operations and information systems, which comprise the hardware, software, infrastructure, backup systems and other technology which we own or use to collect, process, maintain, use, share, disseminate or dispose of information, are integral to the performance of our businesses. Our operations and information systems and components thereof, and those of our third parties, have been, and in the future could be, ineffective or fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our or such third party’s control. Such events have adversely affected, and in the future could adversely affect, physical site access of our operations, our ability to process transactions, provide services and perform other operations. Short-term or prolonged disruptions to our critical business operations and customer services are possible due to computer, telecommunications, network, utility, electronic or physical infrastructure outages, including from abuse or failure of our electronic trading and algorithmic platforms, significant unplanned increases in customer transactions, fraudulent transactions, newly identified vulnerabilities in key hardware and software, failure of infrastructure or manual processes, technology project implementation challenges and supply chain disruptions. Operational disruptions and prolonged operational outages could also result from events arising from natural disasters, including acute and chronic weather events, such as wildfires, tornadoes, hurricanes and floods, some of which are happening with more frequency and severity, and earthquakes, as well as local or larger scale political or social matters, including civil unrest, terrorist acts and military conflict.We continue to have greater reliance on our and our third parties’ remote access tools and technology, and employees’ personal systems and increased data utilization and dependence upon our information systems to operate our businesses remotely, including as a result of evolving customer preferences, which has led to increased reliance on digital banking and other digital services provided by our businesses. Effective management of our business continuity increasingly depends on the security, reliability and adequacy of such systems.We also rely on our employees, representatives and third parties in our day-to-day operations, who may, due to illness, unavailability, the emergence or continuation of health emergencies or pandemics, human error, misconduct (including errors in judgment, malice, fraud or illegal activity), malfeasance or a failure or breach of information systems, cause disruptions to our organization and expose us to operational losses, regulatory risk and reputational harm. Our and our third parties’ inability to properly introduce, deploy and manage operational changes, including with regard to internal financial and governance processes, existing products, services and technology, and new product innovations and technology, could also result in additional operational and regulatory risk.Regardless of the measures we have taken to implement training, procedures, backup systems and other safeguards to support our operations and bolster our operational resilience, our ability to conduct business may be adversely affected by significant disruptions to us or to third parties with whom we interact or upon whom we rely, including localized or systemic cyber events that result in information systems outages and unavailability of part or all of the internet, cloud services and/or the financial services industry infrastructure (including electronic trading and algorithmic platforms and critical banking activities). Our ability to implement backup systems and other safeguards with respect to third-party systems and the financial services industry infrastructure is more limited than with respect to our systems. Weakness in our third parties’ processes or controls could impact our ability to deliver products or services to our clients and expose us to compliance and operational risks.There can be no assurance that our business continuity and information security response plans will effectively mitigate our operational risks. Any backup systems or manual processes may not process data accurately and/or as quickly or effectively as our primary systems, and some data might not have been backed up. Additionally, the speed in which we are able to remediate any failure or disruption of our operations and/or information systems may vary across jurisdictions. We regularly update the information systems we rely on to support our operations and growth as part of our efforts to comply with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new or modified information systems and integrating them with existing information systems, including business interruptions.A failure or breach of our or our third parties’ operations or information systems resulting in disruption to our critical infrastructure or manual processes, technology project implementation challenges and supply chain disruptions. Operational disruptions and prolonged operational outages could also result from events arising from natural disasters, including acute and chronic weather events, such as wildfires, tornadoes, hurricanes and floods, some of which are happening with more frequency and severity, and earthquakes, as well as local or larger scale political or social matters, including civil unrest, terrorist acts and military conflict. We continue to have greater reliance on our and our third parties’ remote access tools and technology, and employees’ personal systems and increased data utilization and dependence upon our information systems to operate our businesses remotely, including as a result of evolving customer preferences, which has led to increased reliance on digital banking and other digital services provided by our businesses. Effective management of our business continuity increasingly depends on the security, reliability and adequacy of such systems. We also rely on our employees, representatives and third parties in our day-to-day operations, who may, due to illness, unavailability, the emergence or continuation of health emergencies or pandemics, human error, misconduct (including errors in judgment, malice, fraud or illegal activity), malfeasance or a failure or breach of information systems, cause disruptions to our organization and expose us to operational losses, regulatory risk and reputational harm. Our and our third parties’ inability to properly introduce, deploy and manage operational changes, including with regard to internal financial and governance processes, existing products, services and technology, and new product innovations and technology, could also result in additional operational and regulatory risk. Regardless of the measures we have taken to implement training, procedures, backup systems and other safeguards to support our operations and bolster our operational resilience, our ability to conduct business may be adversely affected by significant disruptions to us or to third parties with whom we interact or upon whom we rely, including localized or systemic cyber events that result in information systems outages and unavailability of part or all of the internet, cloud services and/or the financial services industry infrastructure (including electronic trading and algorithmic platforms and critical banking activities). Our ability to implement backup systems and other safeguards with respect to third-party systems and the financial services industry infrastructure is more limited than with respect to our systems. Weakness in our third parties’ processes or controls could impact our ability to deliver products or services to our clients and expose us to compliance and operational risks. There can be no assurance that our business continuity and information security response plans will effectively mitigate our operational risks. Any backup systems or manual processes may not process data accurately and/or as quickly or effectively as our primary systems, and some data might not have been backed up. Additionally, the speed in which we are able to remediate any failure or disruption of our operations and/or information systems may vary across jurisdictions. We regularly update the information systems we rely on to support our operations and growth as part of our efforts to comply with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new or modified information systems and integrating them with existing information systems, including business interruptions. A failure or breach of our or our third parties’ operations or information systems resulting in disruption to our critical Bank of America 14 Bank of America 14 Bank of America 14 Bank of America 14 business operations and customer services, a failure to identify or effectively respond to operational risks in a timely manner and/or a failure to continue to deliver our services through an operational disruption could impact the confidentiality, integrity or availability of data and expose us to a number of risks, including market abuse, customer attrition, regulatory, market, privacy and liquidity risk, adversely impact our results of operations and financial condition and cause legal, regulatory or reputational harm.The Corporation and third parties with whom we interact and/or on whom we rely, are subject to cybersecurity incidents, information and security breaches, and technology failures that have and in the future could adversely affect our ability to conduct our businesses, result in the misuse, destruction or disclosure of information, damage our reputation, increase our regulatory and legal risks, result in additional costs or financial losses and/or otherwise adversely impact our businesses and results of operations.Our business is highly dependent on the security, controls and efficacy of our information systems, and the information systems of our customers, third parties, the financial services industry and financial data aggregators with whom we interact, on whom we rely or who have access to our customers' personal or account information. We rely on effective access management and the secure collection, processing, maintenance, use, sharing, dissemination and disposition of information in our and our third parties’ information systems. Our cybersecurity risk and exposure remains heightened because of, among other things, our prominent size and scale, high-profile brand, geographic footprint and international presence and role in the financial services industry and the broader economy. The proliferation of third-party financial data aggregators and emerging technologies, including our and our third parties’ use of automation, artificial intelligence (AI) and robotics, increases our cybersecurity risks and exposure.We, our employees, customers, regulators and third parties are ongoing targets of an increasing number of cybersecurity threats and cyberattacks. The tactics, techniques and procedures used in cyberattacks are pervasive, sophisticated and designed to evade security measures, including computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or other security breach tactics that have and in the future could result in disruptions to our businesses and operations and the loss of funds, including from attempts to defraud us and/or our customers, and impact the confidentiality, integrity or availability of our information, including intellectual property, or that of our employees, customers and third parties. Cyberattacks are carried out on a worldwide scale and by a growing number of actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments, state-sponsored actors, activists, disgruntled employees and other persons or entities, including those involved in corporate espionage.Cybersecurity threats and the tactics, techniques and procedures used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as AI, machine learning and quantum computing. Despite substantial efforts to protect the integrity and resilience of our information systems and implement controls, processes, policies, employee training and other protective measures, we are not able to anticipate and/or detect all cybersecurity threats and incidents and/or develop or implement effective preventive or defensive measures designed to prevent, respond to or mitigate all cybersecurity threats and incidents. Internal access management failures could impact the confidentiality, integrity or availability of data. Additionally, the failure of our employees to exercise sound judgment and vigilance when targeted with social engineering or other cyberattacks increases our vulnerability.Our risk from and exposure to cybersecurity threats and incidents, information and security breaches and technology failures continues to increase due to the acceptance and use of digital banking and other digital products and services, including mobile banking products, and reliance on remote access tools and technology, which have increased our reliance on virtual or digital interactions and a larger number of access points to our information systems that must be secured, and results in greater amounts of information being available for access. Greater demand on our information systems and security tools and processes will likely continue.We also face significant third-party technology, cybersecurity and operational risks relating to the large number of customers and third parties with whom we do business, the financial services industry, upon whom we rely to facilitate or enable our business activities or upon whom our customers rely, including the secure collection, processing, maintenance, use, sharing, dissemination and disposition of customer and other sensitive information, providers of products and/or services, financial counterparties, financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, providers of outsourced infrastructure, such as internet access, cloud service providers and electrical power, and retailers for whom we process transactions. Such third-party information systems extend beyond our security and control systems, and such third parties have varying levels of security and cybersecurity resources, expertise, safeguards, controls and capabilities. Threat actors may actively seek to exploit security and cybersecurity weaknesses at our third parties and the relationships of our third parties with us may increase the risk that they are targeted by the same threats we face, and such third parties may be less prepared for such threats. We are also at additional risk resulting from critical third-party information security and open-source software vulnerabilities. We must rely on our third parties to adequately detect and promptly report cybersecurity incidents, and their failure to do so could adversely affect our ability to report or respond to cybersecurity incidents effectively or timely.Due to increasing consolidation, interdependence and complexity of financial entities and technology and information systems, a cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys or compromises the information systems or information of one or more financial entities or third parties could adversely impact us and increase the risk of operational failure and loss, as disparate systems need to be integrated, often on an accelerated basis. Similarly, any cybersecurity threat or incident, information or security breach or technology failure that significantly exposes, degrades, destroys or compromises our information systems or information could adversely impact third parties and the critical infrastructure of the financial services industry, thereby creating additional risk for us.Cybersecurity incidents or information or security breaches could persist for an extended period of time before being detected, and it often takes additional time to determine the scope, extent, amount and type of impact, including information altered, destroyed or otherwise compromised, following which the measures to recover and restore to a business-as-usual state may be difficult to assess. We have spent and expect to continue to spend significant resources to modify and enhance business operations and customer services, a failure to identify or effectively respond to operational risks in a timely manner and/or a failure to continue to deliver our services through an operational disruption could impact the confidentiality, integrity or availability of data and expose us to a number of risks, including market abuse, customer attrition, regulatory, market, privacy and liquidity risk, adversely impact our results of operations and financial condition and cause legal, regulatory or reputational harm.The Corporation and third parties with whom we interact and/or on whom we rely, are subject to cybersecurity incidents, information and security breaches, and technology failures that have and in the future could adversely affect our ability to conduct our businesses, result in the misuse, destruction or disclosure of information, damage our reputation, increase our regulatory and legal risks, result in additional costs or financial losses and/or otherwise adversely impact our businesses and results of operations.Our business is highly dependent on the security, controls and efficacy of our information systems, and the information systems of our customers, third parties, the financial services industry and financial data aggregators with whom we interact, on whom we rely or who have access to our customers' personal or account information. We rely on effective access management and the secure collection, processing, maintenance, use, sharing, dissemination and disposition of information in our and our third parties’ information systems. Our cybersecurity risk and exposure remains heightened because of, among other things, our prominent size and scale, high-profile brand, geographic footprint and international presence and role in the financial services industry and the broader economy. The proliferation of third-party financial data aggregators and emerging technologies, including our and our third parties’ use of automation, artificial intelligence (AI) and robotics, increases our cybersecurity risks and exposure.We, our employees, customers, regulators and third parties are ongoing targets of an increasing number of cybersecurity threats and cyberattacks. The tactics, techniques and procedures used in cyberattacks are pervasive, sophisticated and designed to evade security measures, including computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or other security breach tactics that have and in the future could result in disruptions to our businesses and operations and the loss of funds, including from attempts to defraud us and/or our customers, and impact the confidentiality, integrity or availability of our information, including intellectual property, or that of our employees, customers and third parties. Cyberattacks are carried out on a worldwide scale and by a growing number of actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments, state-sponsored actors, activists, disgruntled employees and other persons or entities, including those involved in corporate espionage.Cybersecurity threats and the tactics, techniques and procedures used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as AI, machine learning and quantum computing. Despite substantial efforts to protect the integrity and resilience of our information systems and implement controls, processes, policies, employee training and other protective measures, we are not able to anticipate and/or detect all cybersecurity threats and incidents and/or develop or implement effective preventive or defensive measures designed to prevent, respond to or mitigate all cybersecurity threats and incidents. Internal access business operations and customer services, a failure to identify or effectively respond to operational risks in a timely manner and/or a failure to continue to deliver our services through an operational disruption could impact the confidentiality, integrity or availability of data and expose us to a number of risks, including market abuse, customer attrition, regulatory, market, privacy and liquidity risk, adversely impact our results of operations and financial condition and cause legal, regulatory or reputational harm.

Operational risk exposure exists throughout our organization and as a result of our interactions with, and reliance on, third parties and the financial services industry infrastructure. Our operational and security systems infrastructure, including our computer systems, emerging technologies, data management and internal processes and controls, as well as those of third parties, are integral to our performance. Our financial, accounting, data processing and transmission, storage, backup and other operating or security systems and infrastructure, or those of third parties, may be ineffective or fail to operate properly or become disabled or damaged as a result of a number of factors, including events that are wholly or partially beyond our or such third party’s control, which could adversely affect our ability to process transactions or provide services. Prolonged disruptions to our critical business operations and customer services are possible due to computer, telecommunications, network, utility, electronic or physical infrastructure outages, including from abuse or failure of our electronic trading and algorithmic platforms, significant unplanned increases in customer transactions, newly identified vulnerabilities in key hardware and software, failure of aging infrastructure or manual processes, retired or redundant software and/or hardware, technology project implementation challenges and supply chain disruptions. Operational disruptions and prolonged operational outages could also result from events arising from natural disasters, including acute and chronic weather events, such as wildfires, tornadoes, hurricanes and floods, some of which are happening with more frequency and severity, and earthquakes, as well as local or larger scale political or social matters, including civil unrest, terrorist acts and military conflict.We continue to have greater reliance on remote access tools and technology and employees’ personal systems (and our third parties’ employees’ personal systems) and increased data utilization and are increasingly dependent upon our information technology infrastructure to operate our businesses remotely due to the increased number of employees who work from home and evolving customer preferences, including increased reliance on digital banking and other digital services provided by our businesses. Effective management of our business continuity increasingly depends on the security, reliability and adequacy of such systems.We also rely on our employees, representatives and third parties in our day-to-day operations, who may, due to illness, unavailability, human error, misconduct (including errors in judgment, malice, fraudulent or illegal activity), malfeasance or a failure or breach of systems or infrastructure cause disruptions to our organization and expose us to operational losses, regulatory risk and reputational harm. Our and our third parties’ inability to properly introduce, deploy and manage changes to internal financial and governance processes, existing products, services and technology, and new product innovations and technology could also result in additional operational and regulatory risk.Regardless of the measures we have taken to implement training, procedures, backup systems and other safeguards to support our operations and bolster our operational resilience, our ability to conduct business may be adversely affected by significant disruptions to us or to third parties with whom we interact or upon whom we rely, including systemic cyber events that result in system outages and unavailability of part or all of the internet, cloud services and/or the financial services industry infrastructure (including electronic trading platforms and critical banking activities). Our ability to implement backup systems and other safeguards with respect to third-party systems and the financial services industry infrastructure is more limited than with our own systems.Any backup systems may not process data as quickly as our primary systems and some data might not have been backed up. We regularly update the systems we rely on to support our operations and growth and to remain compliant with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions.A failure or breach of our operational or security systems or infrastructure resulting in disruption to our critical business operations and customer services and/or failure to identify, effectively respond to operational risks in a timely manner, and continue to deliver our services through an operational disruption could expose us to a number of risks, including market abuse, regulatory, market, privacy and liquidity risk, and adversely impact our results of operations and financial condition, and cause legal or reputational harm.A cyberattack, information or security breach, or a technology failure of ours or of a third party could adversely affect our ability to conduct our business, result in the misuse or disclosure of information, result in additional costs, damage to our reputation, increase our regulatory and legal risks and cause financial losses. Our business is highly dependent on the security, controls and efficacy of our infrastructure, computer and data management systems, and those of our customers, suppliers, counterparties and other third parties, the financial services political or social matters, including civil unrest, terrorist acts and military conflict. We continue to have greater reliance on remote access tools and technology and employees’ personal systems (and our third parties’ employees’ personal systems) and increased data utilization and are increasingly dependent upon our information technology infrastructure to operate our businesses remotely due to the increased number of employees who work from home and evolving customer preferences, including increased reliance on digital banking and other digital services provided by our businesses. Effective management of our business continuity increasingly depends on the security, reliability and adequacy of such systems. We also rely on our employees, representatives and third parties in our day-to-day operations, who may, due to illness, unavailability, human error, misconduct (including errors in judgment, malice, fraudulent or illegal activity), malfeasance or a failure or breach of systems or infrastructure cause disruptions to our organization and expose us to operational losses, regulatory risk and reputational harm. Our and our third parties’ inability to properly introduce, deploy and manage changes to internal financial and governance processes, existing products, services and technology, and new product innovations and technology could also result in additional operational and regulatory risk. Regardless of the measures we have taken to implement training, procedures, backup systems and other safeguards to support our operations and bolster our operational resilience, our ability to conduct business may be adversely affected by significant disruptions to us or to third parties with whom we interact or upon whom we rely, including systemic cyber events that result in system outages and unavailability of part or all of the internet, cloud services and/or the financial services industry infrastructure (including electronic trading platforms and critical banking activities). Our ability to implement backup systems and other safeguards with respect to third-party systems and the financial services industry infrastructure is more limited than with our own systems. Any backup systems may not process data as quickly as our primary systems and some data might not have been backed up. We regularly update the systems we rely on to support our operations and growth and to remain compliant with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions. A failure or breach of our operational or security systems or infrastructure resulting in disruption to our critical business operations and customer services and/or failure to identify, effectively respond to operational risks in a timely manner, and continue to deliver our services through an operational disruption could expose us to a number of risks, including market abuse, regulatory, market, privacy and liquidity risk, and adversely impact our results of operations and financial condition, and cause legal or reputational harm.

We service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. We may also have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.Changes in the structure of and relationship among the GSEs could adversely impact our business.We rely on the GSEs to guarantee or purchase mortgage loans that meet their conforming loan requirements. During 2023, we sold approximately $3.1 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship, with the Federal Housing Finance Agency (FHFA) acting as conservator. In 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship and reduce their role in the marketplace. In January 2021, the Treasury Department further amended the agreement that governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. Uncertainty regarding their future and the MBS they guarantee continues to exist for the foreseeable future. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Risks also may span across multiple key risk types, including cybersecurity risk, climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk. any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.

We and our legacy companies service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. We may also have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.

Risks and challenges associated with reference rate reform, including the potential replacement of benchmark rates with ARRs (e.g., the expected cessation of BSBY), could expose us to various financial, operational, supervisory, conduct and legal risk. Usage of ARRs for impacted benchmarks may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs may have compositions and characteristics that differ from replaced benchmarks, including limited liquidity and less predictable performance over time. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, resulting in unanticipated market exposures. Transition to ARRs may adversely affect the yield on loans or securities held by us, amounts paid on our securities and received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our effective use of hedging instruments to manage risk. There is no assurance that impacted benchmarks will transition to ARRs without delay or potential disputes. The transition of any products using impacted benchmarks (Impacted Products) that do not include fallback provisions or adequate fallback mechanisms may require additional efforts to modify their terms, and may be more challenging to modify if all Bank of America 20 Bank of America 20 Bank of America 20 Bank of America 20 impacted parties are required to consent to such modification. Litigation or other disputes may occur as a result of the interpretation or application of any transition-related legislation or regulations adopted in the U.S. and/or foreign jurisdictions, including if the laws or regulations in jurisdictions overlap.Impacted Products may contain language giving the Corporation discretion to determine the successor rate (including the applicable spread adjustment) to the existing benchmark. We may face a risk of litigation, disputes or other actions from customers, counterparties, investors or others based on various claims, for example, that we incorrectly interpreted or enforced contract provisions, failed to appropriately communicate the transition effects of ARRs to existing and future products, treated affected parties unfairly or made inappropriate product recommendations to or investments on behalf of our clients, engaged in anti-competitive behavior or unlawfully manipulated markets or benchmarks.ARR-based products that we develop, launch and/or support may perform differently from Impacted Products during times of economic stress, adverse or volatile market conditions and across the credit and economic cycle, which may impact the value, return on and profitability of our ARR-based assets. New financial products linked to ARRs may have additional legal, financial, accounting, tax, operational, market, compliance, reputational, competitive or other risks to us, our customers and other market participants. Scrutiny by banking regulators in the U.S. and globally on transition plans, preparations and readiness could result in regulatory action, litigation and/or the need to change the products offered by our businesses.We face significant and increasing competition in the financial services industry.We operate in a highly competitive environment and experience intense competition from local and global bank and nonbank financial institutions and new entrants in domestic and foreign markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees and higher interest rates on deposits, and lower cost investment strategies, which may impact our ability to effectively compete. The current and changing regulatory environment may also create competitive disadvantages, including from more stringent regulatory requirements applicable to the Corporation.Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an alternative to traditional banking products. Increased competition may reduce our market share, net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing or credit standards, requiring additional investment to improve the quality and delivery of our technology and/or affecting the willingness of our clients to do business with us.Our inability to adapt our business strategies, products and services could harm our business.We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ ability to timely adapt our business strategies, products and services and their respective features, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events.The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in accurately assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining customers. Our or our third-party providers’ inability or resistance to timely innovate or adapt its operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation.We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk.We use models extensively to forecast losses, project revenue and expenses, assess and control our operations and financial condition, assist in capital planning, manage liquidity and measure, forecast and assess capital and liquidity requirements for credit, market, operational and strategic risks. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform model oversight, including independent validation before initial use, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. However, models are subject to inherent limitations from simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks from applications that rely on AI or machine learning.Our models may not be sufficiently predictive of future results due to limited historical patterns, extreme or unanticipated market movements or customer behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events), which could limit their effectiveness and require timely recalibration. The models that we use to assess and control our market risk exposures also reflect assumptions about the degree of correlation among prices of various asset classes or other market indicators, which may not be representative of the next downturn and would magnify the limitations inherent in using historical data to impacted parties are required to consent to such modification. Litigation or other disputes may occur as a result of the interpretation or application of any transition-related legislation or regulations adopted in the U.S. and/or foreign jurisdictions, including if the laws or regulations in jurisdictions overlap.Impacted Products may contain language giving the Corporation discretion to determine the successor rate (including the applicable spread adjustment) to the existing benchmark. We may face a risk of litigation, disputes or other actions from customers, counterparties, investors or others based on various claims, for example, that we incorrectly interpreted or enforced contract provisions, failed to appropriately communicate the transition effects of ARRs to existing and future products, treated affected parties unfairly or made inappropriate product recommendations to or investments on behalf of our clients, engaged in anti-competitive behavior or unlawfully manipulated markets or benchmarks.ARR-based products that we develop, launch and/or support may perform differently from Impacted Products during times of economic stress, adverse or volatile market conditions and across the credit and economic cycle, which may impact the value, return on and profitability of our ARR-based assets. New financial products linked to ARRs may have additional legal, financial, accounting, tax, operational, market, compliance, reputational, competitive or other risks to us, our customers and other market participants. Scrutiny by banking regulators in the U.S. and globally on transition plans, preparations and readiness could result in regulatory action, litigation and/or the need to change the products offered by our businesses.We face significant and increasing competition in the financial services industry.We operate in a highly competitive environment and experience intense competition from local and global bank and nonbank financial institutions and new entrants in domestic and foreign markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees and higher interest rates on deposits, and lower cost investment strategies, which may impact our ability to effectively compete. The current and changing regulatory environment may also create competitive disadvantages, including from more stringent regulatory requirements applicable to the Corporation.Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an alternative to traditional banking products. Increased competition may reduce our market share, net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing or credit standards, requiring additional investment to improve the quality and delivery of our technology and/or affecting the willingness of our clients to do business with us.Our inability to adapt our business strategies, products and services could harm our business.We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple impacted parties are required to consent to such modification. Litigation or other disputes may occur as a result of the interpretation or application of any transition-related legislation or regulations adopted in the U.S. and/or foreign jurisdictions, including if the laws or regulations in jurisdictions overlap. Impacted Products may contain language giving the Corporation discretion to determine the successor rate (including the applicable spread adjustment) to the existing benchmark. We may face a risk of litigation, disputes or other actions from customers, counterparties, investors or others based on various claims, for example, that we incorrectly interpreted or enforced contract provisions, failed to appropriately communicate the transition effects of ARRs to existing and future products, treated affected parties unfairly or made inappropriate product recommendations to or investments on behalf of our clients, engaged in anti-competitive behavior or unlawfully manipulated markets or benchmarks. ARR-based products that we develop, launch and/or support may perform differently from Impacted Products during times of economic stress, adverse or volatile market conditions and across the credit and economic cycle, which may impact the value, return on and profitability of our ARR-based assets. New financial products linked to ARRs may have additional legal, financial, accounting, tax, operational, market, compliance, reputational, competitive or other risks to us, our customers and other market participants. Scrutiny by banking regulators in the U.S. and globally on transition plans, preparations and readiness could result in regulatory action, litigation and/or the need to change the products offered by our businesses.

Though significant progress has been made in the global financial markets to replace products and contracts referencing London Interbank Offered Rate (LIBOR) or other IBORs (IBOR Products), the aggregate notional amount of these IBOR Products remains material to our business. Risks and challenges associated with the transition from IBORs remain and may result in consequences that cannot be fully anticipated, which expose us to various financial, operational, supervisory, conduct and legal risk. While there has been significant progress in market and client adoption of ARRs, usage of ARRs may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs have compositions and characteristics that differ from the benchmarks they replace, in some cases they have limited liquidity, and may demonstrate less predictable performance over time than the benchmarks they replace. For example, certain ARRs are calculated on a compounded or weighted-average basis and, unlike IBORs, do not reflect bank credit risk and therefore typically require a spread adjustment. There are important differences between the fallbacks, triggers and calculation methodologies being implemented in cash and derivatives markets. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, and we may experience unanticipated market exposures. Changes resulting from transition to successor or alternative rates may adversely affect the yield on loans or securities held by us, amounts paid on securities we have issued, amounts received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our ability to effectively use hedging instruments to manage risk. There can be no assurance that existing assets and liabilities based on or linked to IBORs that have not already transitioned to ARRs will transition without delay or potential disputes.Although a significant majority of the aggregate notional amount of our remaining IBOR Products maturing after 2022 include or have been amended to include fallbacks to ARRs, the transitioning of certain IBOR Products that do not include fallback provisions or adequate fallback mechanisms require additional efforts to modify their terms. Some outstanding IBOR Products are particularly challenging to modify due to the requirement that all impacted parties consent to such modification. To address outstanding IBOR Products that are difficult to modify, legislation has been adopted in the U.S. and in other jurisdictions. Litigation, disputes or other action may occur as a result of the interpretation or application of legislation or regulations, including if there is an overlap between laws or regulations in different jurisdictions or from interactions with any FCA-compelled “synthetic” LIBOR settings. Some of our IBOR Products may contain language giving the calculation agent (which may be us) discretion to determine the successor rate (including the applicable spread adjustment) to the existing benchmark. We may face a risk of litigation, disputes or other actions from clients, counterparties, customers, investors or others based on various claims, for example, that we incorrectly interpreted or enforced IBOR-based contract provisions, failed to appropriately communicate the effect that the transition to ARRs will have on existing and future products, treated affected parties unfairly or made inappropriate product recommendations to or investments on behalf of its clients, or engaged in anti-competitive behavior or unlawfully manipulated markets or benchmarks.ARR-based products that we develop, launch and/or support, including products using credit sensitive rates, may perform differently to IBOR Products during times of economic stress, Products remains material to our business. Risks and challenges associated with the transition from IBORs remain and may result in consequences that cannot be fully anticipated, which expose us to various financial, operational, supervisory, conduct and legal risk. While there has been significant progress in market and client adoption of ARRs, usage of ARRs may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs have compositions and characteristics that differ from the benchmarks they replace, in some cases they have limited liquidity, and may demonstrate less predictable performance over time than the benchmarks they replace. For example, certain ARRs are calculated on a compounded or weighted-average basis and, unlike IBORs, do not reflect bank credit risk and therefore typically require a spread adjustment. There are important differences between the fallbacks, triggers and calculation methodologies being implemented in cash and derivatives markets. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, and we may experience unanticipated market exposures. Changes resulting from transition to successor or alternative rates may adversely affect the yield on loans or securities held by us, amounts paid on securities we have issued, amounts received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our ability to effectively use hedging instruments to manage risk. There can be no assurance that existing assets and liabilities based on or linked to IBORs that have not already transitioned to ARRs will transition without delay or potential disputes. Although a significant majority of the aggregate notional amount of our remaining IBOR Products maturing after 2022 include or have been amended to include fallbacks to ARRs, the transitioning of certain IBOR Products that do not include fallback provisions or adequate fallback mechanisms require additional efforts to modify their terms. Some outstanding IBOR Products are particularly challenging to modify due to the requirement that all impacted parties consent to such modification. To address outstanding IBOR Products that are difficult to modify, legislation has been adopted in the U.S. and in other jurisdictions. Litigation, disputes or other action may occur as a result of the interpretation or application of legislation or regulations, including if there is an overlap between laws or regulations in different jurisdictions or from interactions with any FCA-compelled “synthetic” LIBOR settings. Some of our IBOR Products may contain language giving the calculation agent (which may be us) discretion to determine the successor rate (including the applicable spread adjustment) to the existing benchmark. We may face a risk of litigation, disputes or other actions from clients, counterparties, customers, investors or others based on various claims, for example, that we incorrectly interpreted or enforced IBOR-based contract provisions, failed to appropriately communicate the effect that the transition to ARRs will have on existing and future products, treated affected parties unfairly or made inappropriate product recommendations to or investments on behalf of its clients, or engaged in anti-competitive behavior or unlawfully manipulated markets or benchmarks. ARR-based products that we develop, launch and/or support, including products using credit sensitive rates, may perform differently to IBOR Products during times of economic stress, Bank of America 20 Bank of America 20 Bank of America 20 Bank of America 20 adverse or volatile market conditions and across the credit and economic cycle, which may impact the value, return on and profitability of our ARR-based assets. New financial products linked to ARRs may have additional legal, financial, tax, operational, market, compliance, reputational, competitive or other risks to us, our clients and other market participants. Banking regulators in the U.S. and globally have maintained heightened regulatory scrutiny and intensified supervisory focus on financial institution LIBOR transition plans, preparations and readiness, including our use of credit-sensitive rates like the Bloomberg Short-Term Bank Yield Index and ARR-based term rates, which could result in regulatory action, litigation and/or the need to change the products offered by our businesses. Failure to meet industry-wide IBOR transition milestones and to cease issuance of IBOR Products by relevant cessation dates may, subject to certain regulatory exceptions, result in supervisory enforcement by applicable regulators, increase our cost of, and access to, capital or lead to other consequences.The ongoing market transition has altered, and additional developments may further alter, some aspects of our risk profile and risk management strategies, including derivatives and hedging strategies, modeling and analytics, valuation tools, product design and systems, controls, procedures and operational infrastructure. Further changes may increase costs and expose us to potential risks related to regulatory compliance, requirements or inquiries. Among other risks, various IBOR Products transition to ARRs at different times or in different manners, with the result that we may face unexpected interest rate, pricing or other exposures across business or product lines, and we may face operational risks related to planned processes at certain CCPs to convert outstanding USD LIBOR-cleared derivatives to ARR positions. Continuing reforms to market transition and other factors may adversely affect our business, including the ability to serve customers and maintain market share, financial condition or results of operations and could result in reputational harm to us.We face significant and increasing competition in the financial services industry.We operate in a highly competitive environment and experience intense competition from local and global financial institutions and new entrants in domestic and foreign markets. We compete on the basis of a number of factors, including customer service and convenience, the pricing, quality and range of products and services we offer, lending limits, the quality and delivery of our technology and our reputation, experience and relationships in relevant markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees and higher interest rates on deposits, and lower cost investment strategies, which may impact our ability to effectively compete. The changing regulatory environment may also create competitive disadvantages, including from different regulatory requirements. Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an alternative to traditional banking products. Increased competition may reduce our net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing or credit standards, requiring additional investment to improve the quality and delivery of our technology, reducing our market share and/or affecting the willingness of our clients to do business with us.Our inability to adapt our business strategies, products and services could harm our business.We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ of products and services abilities to adapt our business strategies, products and services and their respective features in a timely manner, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as DLT in payment, clearing and settlement processes creates additional risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining loyal customers. The Corporation’s, or its third-party providers’, inability or resistance to timely innovate or adapt its operations, products and services to evolving industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation. We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk.We use models extensively to forecast losses, project revenue and expenses, assess and control our operations and financial condition, assist in capital planning and measure, forecast and assess capital and liquidity requirements for credit, market, operational and strategic risks. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform model oversight, including independent validation before initial use, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. However, models are subject to inherent limitations from simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks from applications that rely on AI.Our models may not be sufficiently predictive of future results due to limited historical patterns, extreme or unanticipated market movements or customer behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events), which could limit adverse or volatile market conditions and across the credit and economic cycle, which may impact the value, return on and profitability of our ARR-based assets. New financial products linked to ARRs may have additional legal, financial, tax, operational, market, compliance, reputational, competitive or other risks to us, our clients and other market participants. Banking regulators in the U.S. and globally have maintained heightened regulatory scrutiny and intensified supervisory focus on financial institution LIBOR transition plans, preparations and readiness, including our use of credit-sensitive rates like the Bloomberg Short-Term Bank Yield Index and ARR-based term rates, which could result in regulatory action, litigation and/or the need to change the products offered by our businesses. Failure to meet industry-wide IBOR transition milestones and to cease issuance of IBOR Products by relevant cessation dates may, subject to certain regulatory exceptions, result in supervisory enforcement by applicable regulators, increase our cost of, and access to, capital or lead to other consequences.The ongoing market transition has altered, and additional developments may further alter, some aspects of our risk profile and risk management strategies, including derivatives and hedging strategies, modeling and analytics, valuation tools, product design and systems, controls, procedures and operational infrastructure. Further changes may increase costs and expose us to potential risks related to regulatory compliance, requirements or inquiries. Among other risks, various IBOR Products transition to ARRs at different times or in different manners, with the result that we may face unexpected interest rate, pricing or other exposures across business or product lines, and we may face operational risks related to planned processes at certain CCPs to convert outstanding USD LIBOR-cleared derivatives to ARR positions. Continuing reforms to market transition and other factors may adversely affect our business, including the ability to serve customers and maintain market share, financial condition or results of operations and could result in reputational harm to us.We face significant and increasing competition in the financial services industry.We operate in a highly competitive environment and experience intense competition from local and global financial institutions and new entrants in domestic and foreign markets. We compete on the basis of a number of factors, including customer service and convenience, the pricing, quality and range of products and services we offer, lending limits, the quality and delivery of our technology and our reputation, experience and relationships in relevant markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees and higher interest rates on deposits, and lower cost investment strategies, which may impact our ability to effectively compete. The changing regulatory environment may also create competitive disadvantages, including from different regulatory requirements. Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an adverse or volatile market conditions and across the credit and economic cycle, which may impact the value, return on and profitability of our ARR-based assets. New financial products linked to ARRs may have additional legal, financial, tax, operational, market, compliance, reputational, competitive or other risks to us, our clients and other market participants. Banking regulators in the U.S. and globally have maintained heightened regulatory scrutiny and intensified supervisory focus on financial institution LIBOR transition plans, preparations and readiness, including our use of credit-sensitive rates like the Bloomberg Short-Term Bank Yield Index and ARR-based term rates, which could result in regulatory action, litigation and/or the need to change the products offered by our businesses. Failure to meet industry-wide IBOR transition milestones and to cease issuance of IBOR Products by relevant cessation dates may, subject to certain regulatory exceptions, result in supervisory enforcement by applicable regulators, increase our cost of, and access to, capital or lead to other consequences. The ongoing market transition has altered, and additional developments may further alter, some aspects of our risk profile and risk management strategies, including derivatives and hedging strategies, modeling and analytics, valuation tools, product design and systems, controls, procedures and operational infrastructure. Further changes may increase costs and expose us to potential risks related to regulatory compliance, requirements or inquiries. Among other risks, various IBOR Products transition to ARRs at different times or in different manners, with the result that we may face unexpected interest rate, pricing or other exposures across business or product lines, and we may face operational risks related to planned processes at certain CCPs to convert outstanding USD LIBOR-cleared derivatives to ARR positions. Continuing reforms to market transition and other factors may adversely affect our business, including the ability to serve customers and maintain market share, financial condition or results of operations and could result in reputational harm to us.

Governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material. Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. 19 Bank of America 19 Bank of America 19 Bank of America 19 Bank of America ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, customers and third parties, including counterparties, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our customers, and the handling of related disputes with regard to the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our customers, including overdraft and non-sufficient fund fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the reliability of our research and models and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our customers and/or recognize and address customer complaints, compliance failures, technology changes, the implementation, management and/or use of emerging technologies, including quantum computing, AI and machine learning, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our third parties, which have occurred and we expect to continue to experience with increased frequency and severity due to the evolving threat environment, prolonged or repeated system outages, the Corporation’s privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of the Corporation’s fiduciary obligations and handling of the emergence or continuation of health emergencies and pandemics. Our reputation may be also be harmed by litigation and/or regulatory matters and their outcomes, relating to the topics discussed above or otherwise. For example, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Challenges to our ESG practices and disclosures, and those of our customers and third parties, including from diverging views regarding ESG-related practices and disclosures may also harm our reputation.Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects and results of operations.We are subject to complex and evolving laws, regulations and interpretations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR and the CCPA as modified by the CPRA, cross-border data movement, cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations.We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business.Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of customers and employees. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses.OtherReforms to benchmarks may adversely affect our reputation, business, financial condition and results of operations.Risks and challenges associated with reference rate reform, including the potential replacement of benchmark rates with ARRs (e.g., the expected cessation of BSBY), could expose us to various financial, operational, supervisory, conduct and legal risk.Usage of ARRs for impacted benchmarks may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs may have compositions and characteristics that differ from replaced benchmarks, including limited liquidity and less predictable performance over time. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, resulting in unanticipated market exposures. Transition to ARRs may adversely affect the yield on loans or securities held by us, amounts paid on our securities and received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our effective use of hedging instruments to manage risk. There is no assurance that impacted benchmarks will transition to ARRs without delay or potential disputes.The transition of any products using impacted benchmarks (Impacted Products) that do not include fallback provisions or adequate fallback mechanisms may require additional efforts to modify their terms, and may be more challenging to modify if all ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, customers and third parties, including counterparties, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our customers, and the handling of related disputes with regard to the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our customers, including overdraft and non-sufficient fund fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the reliability of our research and models and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our customers and/or recognize and address customer complaints, compliance failures, technology changes, the implementation, management and/or use of emerging technologies, including quantum computing, AI and machine learning, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our third parties, which have occurred and we expect to continue to experience with increased frequency and severity due to the evolving threat environment, prolonged or repeated system outages, the Corporation’s privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of the Corporation’s fiduciary obligations and handling of the emergence or continuation of health emergencies and pandemics. Our reputation may be also be harmed by litigation and/or regulatory matters and their outcomes, relating to the topics discussed above or otherwise. For example, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Challenges to our ESG practices and disclosures, and those of our customers and third parties, including from diverging views regarding ESG-related practices and disclosures may also harm our reputation.Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects and results of operations.We are subject to complex and evolving laws, regulations and interpretations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR and the CCPA as modified by the CPRA, cross-border data movement, Reputation

It is possible that governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. New guidelines issued by the Organization for Economic Cooperation and Development could adversely impact how the global profits of multinational enterprises are taxed. Any change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, contractors, third parties, clients, counterparties and other representatives, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our responsiveness to fraud claims perpetrated against our customers, effectiveness of our internal controls, litigation or regulatory matters and their outcomes, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, including the reliability of our research and models, and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, failure to recognize and address customer complaints, compliance failures, inability to implement or manage emerging technologies, including quantum computing, AI, machine learning and technology change, failure to maintain effective data management, security breaches, cyber incidents, prolonged or repeated system outages, unintended disclosure of personal, proprietary or confidential information, breach of fiduciary obligations and handling of the emergence or continuation of health emergencies or pandemics. For example, we entered into orders with certain government agencies regarding our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Our reputation may also be negatively impacted by our ESG practices and disclosures, and those of our customers and third parties.Actions by the financial services industry generally or by certain members or individuals in the industry also can adversely affect our reputation. Also, adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects or financial results.We are subject to complex and evolving laws and regulations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR, CCPA as modified by the CPRA, cross-border data movement, cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material. Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. Reputation

We operate in a highly competitive environment and experience intense competition from local and global bank and nonbank financial institutions and new entrants in domestic and foreign markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees and higher interest rates on deposits, and lower cost investment strategies, which may impact our ability to effectively compete. The current and changing regulatory environment may also create competitive disadvantages, including from more stringent regulatory requirements applicable to the Corporation. Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an alternative to traditional banking products. Increased competition may reduce our market share, net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing or credit standards, requiring additional investment to improve the quality and delivery of our technology and/or affecting the willingness of our clients to do business with us.

We operate in a highly competitive environment and experience intense competition from local and global financial institutions and new entrants in domestic and foreign markets. We compete on the basis of a number of factors, including customer service and convenience, the pricing, quality and range of products and services we offer, lending limits, the quality and delivery of our technology and our reputation, experience and relationships in relevant markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees and higher interest rates on deposits, and lower cost investment strategies, which may impact our ability to effectively compete. The changing regulatory environment may also create competitive disadvantages, including from different regulatory requirements. Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an alternative to traditional banking products. Increased competition may reduce our net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing or credit standards, requiring additional investment to improve the quality and delivery of our technology, reducing our market share and/or affecting the willingness of our clients to do business with us.Our inability to adapt our business strategies, products and services could harm our business.We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ of products and services abilities to adapt our business strategies, products and services and their respective features in a timely manner, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as DLT in payment, clearing and settlement processes creates additional risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining loyal customers. The Corporation’s, or its third-party providers’, inability or resistance to timely innovate or adapt its operations, products and services to evolving industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation. We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk.We use models extensively to forecast losses, project revenue and expenses, assess and control our operations and financial condition, assist in capital planning and measure, forecast and assess capital and liquidity requirements for credit, market, operational and strategic risks. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform model oversight, including independent validation before initial use, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. However, models are subject to inherent limitations from simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks from applications that rely on AI.Our models may not be sufficiently predictive of future results due to limited historical patterns, extreme or unanticipated market movements or customer behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events), which could limit alternative to traditional banking products. Increased competition may reduce our net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing or credit standards, requiring additional investment to improve the quality and delivery of our technology, reducing our market share and/or affecting the willingness of our clients to do business with us.