Bank of America Corporation: 10-K Risk Factor Changes

Climate change and related environmental sustainability matters present short-, medium- and long-term risks. The physical risks include an increase in the frequency and severity of extreme weather events and natural disasters, including floods, wildfires, hurricanes and tornados, and chronic longer-term shifts such as rising average global temperatures and sea levels. Such disasters and effects could adversely impact our facilities, employees and clients’ ability to repay outstanding loans, disrupt the operations of us and our clients or third parties, cause supply chain or distribution network disruptions, damage collateral and/or result in market volatility, rapid deposit outflows or drawdowns of credit facilities, the deterioration of the value of collateral or insurance shortfalls. There is also increasing risk related to the transition to a low-carbon economy. Changes in consumer preferences or financial condition of our clients and counterparties, market pressures, advancements in technology and additional legislation, regulatory, compliance and legal requirements could alter our strategic planning and the scope of our existing businesses, limit our ability to pursue certain business activities and offer certain products and services, amplify credit and market risks, negatively impact asset values, require capital expenditures and changes in technology and markets, including supply chain and insurance availability and cost, increase expenses and adversely impact our capital requirements and results of operations. Particularly, there is a global regulatory focus on climate change and existing and pending disclosure requirements in various jurisdictions, with jurisdictional divergence, which is expected to impact our legal, compliance and public disclosure risks and costs.Our climate change strategies, policies, and disclosures, which may evolve over time, our ability to achieve our climate-related goals and targets and/or the environmental or climate impacts attributable to our products, services or transactions may impact legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Due to divergent views of stakeholders, we are at increased risk that any action, or lack thereof, by us concerning our response to climate change will be perceived negatively by some stakeholders, which could adversely impact our reputation and businesses. Our ability to meet our climate-related goals and targets, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technological advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with clients, suppliers, investors, government officials and other stakeholders. Due to the evolving nature of climate-related risks, which are expected to increase over time, it is difficult to predict, identify, monitor and effectively mitigate climate-related risks and uncertainties.Furthermore, there are and will continue to be challenges related to the availability, quality and disclosure of climate-related data, including data obtained from third parties, which may result in legal, compliance and/or reputational harm.Our ability to attract, develop and retain qualified employees is critical to our success, business prospects and competitive position.Our performance and competitive position is heavily dependent on the talents, development and efforts of highly skilled individuals. Competition for qualified personnel is intense from within and outside the financial services industry. Our competitors include global institutions and institutions subject to different compensation and hiring regulations than those imposed on us. Also, our ability to attract, develop and retain employees could be impacted by our reputation, professional and development opportunities, changes in regulation or enforcement practices, changes in workforce concerns, expectations, practices and preferences (including remote work), and increasing labor shortages and competition for labor, which could increase labor costs. We must provide market-level compensation to attract and retain qualified personnel. As a large financial and banking institution, we are and may become subject to additional limitations on compensation practices by the Federal Reserve, the OCC, the FDIC and other global regulators, which may not affect our competitors. Also, because a substantial portion of compensation paid to many of our employees is equity-based awards based on the value of our common stock, declines in our profitability or outlook could adversely affect the ability to attract and retain employees. If we are unable to continue to attract, develop and retain qualified individuals, our business prospects and competitive position could be adversely affected. expenditures and changes in technology and markets, including supply chain and insurance availability and cost, increase expenses and adversely impact our capital requirements and results of operations. Particularly, there is a global regulatory focus on climate change and existing and pending disclosure requirements in various jurisdictions, with jurisdictional divergence, which is expected to impact our legal, compliance and public disclosure risks and costs. Our climate change strategies, policies, and disclosures, which may evolve over time, our ability to achieve our climate-related goals and targets and/or the environmental or climate impacts attributable to our products, services or transactions may impact legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Due to divergent views of stakeholders, we are at increased risk that any action, or lack thereof, by us concerning our response to climate change will be perceived negatively by some stakeholders, which could adversely impact our reputation and businesses. Our ability to meet our climate-related goals and targets, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technological advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with clients, suppliers, investors, government officials and other stakeholders. Due to the evolving nature of climate-related risks, which are expected to increase over time, it is difficult to predict, identify, monitor and effectively mitigate climate-related risks and uncertainties. Furthermore, there are and will continue to be challenges related to the availability, quality and disclosure of climate-related data, including data obtained from third parties, which may result in legal, compliance and/or reputational harm.

Climate change and related environmental sustainability matters present short-term and long-term risks. The physical risks include an increase in the frequency and severity of extreme weather events and natural disasters, including floods, wildfires, hurricanes and tornados, and chronic longer-term shifts such as rising average global temperatures and sea levels. Such disasters and effects could adversely impact our facilities, employees and customers’ ability to repay outstanding loans, disrupt the operations of us and our customers or third parties, cause supply chain or distribution network disruptions, damage collateral and/or result in market volatility, rapid deposit outflows or drawdowns of credit facilities, the deterioration of the value of collateral or insurance shortfalls. There is also increasing risk related to the transition to a low-carbon economy. Changes in consumer preferences or financial condition of our customers and counterparties, market pressures, advancements in technology and additional legislation, regulatory, compliance and legal requirements could alter our strategic planning and the scope of our existing businesses, limit our ability to pursue certain business activities and offer certain products and services, amplify credit and market risks, negatively impact asset values, require capital expenditures and changes in technology and markets, including supply chain and insurance availability and cost, increase expenses, impact capital requirements and adversely impact our results of operations. In particular, there is an increasing global regulatory focus, including state, federal and non-U.S. jurisdictions, on climate change resulting in new or heightened regulatory requirements, with potential jurisdictional divergence, which is expected to increase our legal, compliance and public disclosure risks and costs in the U.S. and globally.Our climate change strategies, policies, and disclosures, our ability to achieve our climate-related goals, targets and commitments and/or the environmental or climate impacts attributable to our products, services or transactions will likely result in heightened legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Due to divergent views of stakeholders, we are at increased risk that any action, or lack thereof, by us concerning our response to climate change will be perceived negatively by some stakeholders, which could adversely impact our reputation and businesses. Our ability to meet our climate-related goals, targets and commitments, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technological advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with customers, suppliers, investors, government officials and other stakeholders. Due to the evolving nature of climate-related risks, which are expected to increase over time, it is difficult to predict, identify, monitor and effectively mitigate climate-related risks and uncertainties.Furthermore, there are and will continue to be challenges related to the availability and capturing, measuring, verifying, analyzing and disclosing climate-related data, including data obtained from third parties, which may result in legal, compliance and/or reputational harm.Our ability to attract, develop and retain qualified employees is critical to our success, business prospects and competitive position.Our performance and competitive position is heavily dependent on the talents, development and efforts of highly skilled individuals. Competition for qualified personnel is intense from within and outside the financial services industry.Our competitors include global institutions and institutions subject to different compensation and hiring regulations than those imposed on U.S. institutions and financial institutions. Also, our ability to attract, develop and retain employees could be impacted by changing workforce concerns, expectations, practices and preferences (including remote work), and increasing labor shortages and competition for labor, which could increase labor costs.In order to attract and retain qualified personnel, we must provide market-level compensation. As a large financial and banking institution, we are and may become subject to additional limitations on compensation practices by the Federal Reserve, the OCC, the FDIC and other regulators globally, which may or may not affect our competitors. Furthermore, because a substantial portion of compensation paid to many of our employees is long-term equity-based awards based on the value of our common stock, declines in our profitability or outlook could adversely affect the ability to attract and retain employees. If we are unable to continue to attract, develop and retain qualified individuals, our business prospects and competitive position could be adversely affected. supply chain and insurance availability and cost, increase expenses, impact capital requirements and adversely impact our results of operations. In particular, there is an increasing global regulatory focus, including state, federal and non-U.S. jurisdictions, on climate change resulting in new or heightened regulatory requirements, with potential jurisdictional divergence, which is expected to increase our legal, compliance and public disclosure risks and costs in the U.S. and globally. Our climate change strategies, policies, and disclosures, our ability to achieve our climate-related goals, targets and commitments and/or the environmental or climate impacts attributable to our products, services or transactions will likely result in heightened legal and compliance risk and could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence. Due to divergent views of stakeholders, we are at increased risk that any action, or lack thereof, by us concerning our response to climate change will be perceived negatively by some stakeholders, which could adversely impact our reputation and businesses. Our ability to meet our climate-related goals, targets and commitments, including our goal to achieve certain greenhouse gas (GHG) emissions targets by 2030 and net zero GHG emissions in our financing activities, operations and supply chain before 2050, is subject to risks and uncertainties, many of which are outside of our control, such as technological advances, clearly defined roadmaps for industry sectors, public policies and better emissions data reporting, and ongoing engagement with customers, suppliers, investors, government officials and other stakeholders. Due to the evolving nature of climate-related risks, which are expected to increase over time, it is difficult to predict, identify, monitor and effectively mitigate climate-related risks and uncertainties. Furthermore, there are and will continue to be challenges related to the availability and capturing, measuring, verifying, analyzing and disclosing climate-related data, including data obtained from third parties, which may result in legal, compliance and/or reputational harm.

We may be subject to concentrations of credit risk because of a common characteristic or common sensitivity to economic, financial, public health or business developments. Concentrations of credit risk may reside in a particular industry, geography, product, asset class, counterparty or within any pool of exposures with a common risk characteristic. A deterioration in the financial condition or prospects of a particular industry, geographic location, product or asset class, or a failure or downgrade of, or default by, any particular entity or group of entities could negatively affect our businesses, and it is possible our limits and credit monitoring exposure controls will not function as anticipated. We execute a high volume of transactions and have significant credit concentrations with respect to the financial services industry, predominantly comprised of broker-dealers, commercial banks, investment banks, insurance companies, mutual funds, hedge funds, CCPs and other institutional clients. Financial services institutions and other counterparties are inter-related because of trading, funding, clearing or other relationships. Defaults by one or more counterparties, or market uncertainty about the financial stability of one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity disruptions, losses, defaults and related disputes and litigation.Our credit risk may also be heightened by market risk when the collateral held by us cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the loan or derivatives exposure, which may occur from events that impact the value of the collateral, such as a sudden change in asset price or fraud. Disputes with obligors as to the valuation of collateral could increase with significant market stress, volatility or illiquidity, and we could suffer losses if we are unable to realize the fair value of the collateral or manage declines in the value of collateral. Also, our counterparty credit risk can increase if margin posted by counterparties is insufficient to cover exposures and elevated counterparty exposure is accompanied by the counterparty’s likelihood of default.We have concentrations of credit risk, including with respect to our consumer real estate and consumer credit card exposure, as well as our commercial real estate and asset managers and funds portfolios, which represent a significant percentage of our overall credit portfolio. Declining home price valuations and demand where we have large concentrations could result in increased servicing advances and expenses, defaults, delinquencies or credit losses. The impacts of earthquakes, as well as climate change, such as rising average global temperatures and sea levels, and the increasing frequency and severity of extreme weather events and natural disasters, including droughts, floods, wildfires and hurricanes, could negatively impact collateral, the valuations of home or commercial real estate or our clients’ ability and/or willingness to pay fees, outstanding loans or afford new products. This could also cause insurability risk and/or increased insurance costs to clients. Economic weaknesses, particularly from increases in inflation or sustained elevated inflation, adverse business conditions, market disruptions, adverse economic or market events, rising interest or capitalization rates, declining asset prices, greater volatility in areas where we have concentrated credit risk or deterioration in real estate values or household incomes may cause us to experience higher credit losses in our portfolios or write down the value of certain assets. We could also experience continued and long-term negative impacts to our commercial credit exposure and an increase in credit losses within those industries that may be permanently impacted by a change in consumer preferences or other industry disruptions.We also enter into transactions with sovereign nations, U.S. states and municipalities. Uncertain economic or political conditions or policies, such as economic sanctions or increased tariffs, disruptions to capital markets, currency fluctuations, changes in commodity prices and social instability, could adversely impact the operating budgets or credit ratings of government entities and expose us to credit and liquidity risk.Liquidity disruptions in the financial markets may result in our inability to sell, syndicate or realize the value of our positions, increasing concentrations, which could increase RWA and the credit and market risk associated with our positions, and increase operational and litigation costs.We may be adversely affected by weaknesses in the U.S. housing market.During 2024, the U.S. housing market continued to be impacted by higher mortgage rates, including 30-year fixed-rate mortgages that more than doubled from 2021, and higher home prices (in varying degrees among markets) that have negatively impacted housing affordability and the demand for many of our products. Also, our mortgage loan production volume is generally influenced by the rate of growth in residential could lead to market-wide liquidity disruptions, losses, defaults and related disputes and litigation. Our credit risk may also be heightened by market risk when the collateral held by us cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the loan or derivatives exposure, which may occur from events that impact the value of the collateral, such as a sudden change in asset price or fraud. Disputes with obligors as to the valuation of collateral could increase with significant market stress, volatility or illiquidity, and we could suffer losses if we are unable to realize the fair value of the collateral or manage declines in the value of collateral. Also, our counterparty credit risk can increase if margin posted by counterparties is insufficient to cover exposures and elevated counterparty exposure is accompanied by the counterparty’s likelihood of default. We have concentrations of credit risk, including with respect to our consumer real estate and consumer credit card exposure, as well as our commercial real estate and asset managers and funds portfolios, which represent a significant percentage of our overall credit portfolio. Declining home price valuations and demand where we have large concentrations could result in increased servicing advances and expenses, defaults, delinquencies or credit losses. The impacts of earthquakes, as well as climate change, such as rising average global temperatures and sea levels, and the increasing frequency and severity of extreme weather events and natural disasters, including droughts, floods, wildfires and hurricanes, could negatively impact collateral, the valuations of home or commercial real estate or our clients’ ability and/or willingness to pay fees, outstanding loans or afford new products. This could also cause insurability risk and/or increased insurance costs to clients. Economic weaknesses, particularly from increases in inflation or sustained elevated inflation, adverse business conditions, market disruptions, adverse economic or market events, rising interest or capitalization rates, declining asset prices, greater volatility in areas where we have concentrated credit risk or deterioration in real estate values or household incomes may cause us to experience higher credit losses in our portfolios or write down the value of certain assets. We could also experience continued and long-term negative impacts to our commercial credit exposure and an increase in credit losses within those industries that may be permanently impacted by a change in consumer preferences or other industry disruptions. We also enter into transactions with sovereign nations, U.S. states and municipalities. Uncertain economic or political conditions or policies, such as economic sanctions or increased tariffs, disruptions to capital markets, currency fluctuations, changes in commodity prices and social instability, could adversely impact the operating budgets or credit ratings of government entities and expose us to credit and liquidity risk. Liquidity disruptions in the financial markets may result in our inability to sell, syndicate or realize the value of our positions, increasing concentrations, which could increase RWA and the credit and market risk associated with our positions, and increase operational and litigation costs.

We may be subject to concentrations of credit risk because of a common characteristic or common sensitivity to economic, financial, public health or business developments. Concentrations of credit risk may reside in a particular industry, geography, product, asset class, counterparty or within any pool of exposures with a common risk characteristic. A deterioration in the financial condition or prospects of a particular industry, geographic location, product or asset class, or a failure or downgrade of, or default by, any particular entity or group of entities could negatively affect our businesses, and it is possible our limits and credit monitoring exposure controls will not function as anticipated. We execute a high volume of transactions and have significant credit concentrations with respect to the financial services industry, predominantly comprised of broker-dealers, commercial banks, investment banks, insurance companies, mutual funds, hedge funds, CCPs and other institutional clients. Financial services institutions and other counterparties are inter-related because of trading, funding, clearing or other relationships. Defaults by one or more counterparties, or market uncertainty about the financial stability of one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity disruptions, losses, defaults and related disputes and litigation. Our credit risk may also be heightened by market risk when the collateral held by us cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the loan or derivatives exposure due to us, which may occur as a result of events that impact the value of the collateral, such as a sudden change in asset price or fraud. Disputes with obligors as to the valuation of collateral could increase in times of significant market stress, volatility or illiquidity, and we could suffer losses during such periods if we are unable to realize the fair value of the collateral or manage declines in the value of collateral.We have concentrations of credit risk, including with respect to our consumer real estate and consumer credit card exposure, as well as our commercial real estate and asset managers and funds portfolios, which represent a significant percentage of our overall credit portfolio. Declining home price valuations and demand where we have large concentrations could result in increased servicing advances and expenses, defaults, delinquencies or credit losses. The impacts of earthquakes, as well as climate change, such as rising average global temperatures and sea levels, and the increasing frequency and severity of extreme weather events and natural disasters, including droughts, floods, wildfires and hurricanes, could negatively impact collateral, the valuations of home or commercial real estate or our customers’ ability and/or willingness to pay fees, outstanding loans or afford new products. This could also cause insurability risk and/or increased insurance costs to customers.Economic weaknesses, sustained elevated inflation, adverse business conditions, market disruptions, adverse economic or market events, rising interest or capitalization rates, declining asset prices, greater volatility in areas where we have concentrated credit risk or deterioration in real estate values or household incomes may cause us to experience higher credit losses in our portfolios or write down the value of certain assets. We could also experience continued and long-term negative impacts to our commercial credit exposure and an increase in credit losses within those industries that may be permanently impacted by a change in consumer preferences or other industry disruptions.We also enter into transactions with sovereign nations, U.S. states and municipalities. Unfavorable economic or political conditions, disruptions to capital markets, currency fluctuations, changes in oil prices, social instability and changes in government or monetary policies could adversely impact the operating budgets or credit ratings of these government entities and expose us to credit and liquidity risk.Liquidity disruptions in the financial markets may result in our inability to sell, syndicate or realize the value of our positions, increasing concentrations, which could increase RWA and the credit and market risk associated with our positions.We may be adversely affected by weaknesses in the U.S. housing market.During 2023, the U.S. housing market continued to be impacted by higher mortgage rates, including 30-year fixed-rate mortgages that more than doubled from 2021. This has negatively impacted the demand in some cases and underlying collateral for many of our products. Additionally, our mortgage loan production volume is generally influenced by the rate of growth in residential mortgage debt outstanding and the size of the residential mortgage market, both of which have slowed due to higher interest rates and reduced affordability. A deeper downturn in the condition of the U.S. housing market could result in significant write-downs of asset values in several asset classes, notably mortgage-backed securities (MBS). If the U.S. housing market were to further weaken, the value of real estate could decline, which could result in increased credit losses and delinquent servicing expenses, negatively affect our derivatives exposure due to us, which may occur as a result of events that impact the value of the collateral, such as a sudden change in asset price or fraud. Disputes with obligors as to the valuation of collateral could increase in times of significant market stress, volatility or illiquidity, and we could suffer losses during such periods if we are unable to realize the fair value of the collateral or manage declines in the value of collateral. We have concentrations of credit risk, including with respect to our consumer real estate and consumer credit card exposure, as well as our commercial real estate and asset managers and funds portfolios, which represent a significant percentage of our overall credit portfolio. Declining home price valuations and demand where we have large concentrations could result in increased servicing advances and expenses, defaults, delinquencies or credit losses. The impacts of earthquakes, as well as climate change, such as rising average global temperatures and sea levels, and the increasing frequency and severity of extreme weather events and natural disasters, including droughts, floods, wildfires and hurricanes, could negatively impact collateral, the valuations of home or commercial real estate or our customers’ ability and/or willingness to pay fees, outstanding loans or afford new products. This could also cause insurability risk and/or increased insurance costs to customers. Economic weaknesses, sustained elevated inflation, adverse business conditions, market disruptions, adverse economic or market events, rising interest or capitalization rates, declining asset prices, greater volatility in areas where we have concentrated credit risk or deterioration in real estate values or household incomes may cause us to experience higher credit losses in our portfolios or write down the value of certain assets. We could also experience continued and long-term negative impacts to our commercial credit exposure and an increase in credit losses within those industries that may be permanently impacted by a change in consumer preferences or other industry disruptions. We also enter into transactions with sovereign nations, U.S. states and municipalities. Unfavorable economic or political conditions, disruptions to capital markets, currency fluctuations, changes in oil prices, social instability and changes in government or monetary policies could adversely impact the operating budgets or credit ratings of these government entities and expose us to credit and liquidity risk. Liquidity disruptions in the financial markets may result in our inability to sell, syndicate or realize the value of our positions, increasing concentrations, which could increase RWA and the credit and market risk associated with our positions.

We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ ability to timely change or adapt our business strategies, products and services and their respective features, including available payment processing services and technology, such as AI and machine learning, to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events.Widespread adoption and rapid evolution of, as well as developments in the regulatory landscape relating to emerging technologies, including analytic capabilities, AI (including machine learning and generative AI), automated decision-making, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of new competitors to the payments and trading ecosystems and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining clients. Further, our businesses may be negatively impacted if we, or our third-party providers, do not timely development and apply emerging technologies, like AI and quantum computing, or if our initiatives in these areas are deficient or fail. Our or our third-party providers’ inability or resistance to timely innovate or adapt operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions, harm our business and adversely affect our results of operations and reputation.We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk.We use models enterprise-wide, including to forecast losses, project revenue and expenses, assess and control our operations and financial condition, assist in capital planning, manage liquidity and measure, forecast and assess capital and liquidity requirements for credit, market, operational and strategic risks. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform end-to-end model oversight, including independent validation before initial use, implementation monitoring, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. However, models are subject to inherent limitations from simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks, including from applications that rely on AI.Our models may not be sufficiently predictive of future results, such as due to limited historical patterns, extreme or unanticipated market movements or clients’ behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events), which could limit their effectiveness and require timely recalibration. The models that we use to assess and control our market risk exposures also reflect assumptions about the degree of correlation among prices of various asset classes or other market indicators, which may not be representative of the next downturn and would magnify the limitations inherent in using historical data to widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events. Widespread adoption and rapid evolution of, as well as developments in the regulatory landscape relating to emerging technologies, including analytic capabilities, AI (including machine learning and generative AI), automated decision-making, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of new competitors to the payments and trading ecosystems and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining clients. Further, our businesses may be negatively impacted if we, or our third-party providers, do not timely development and apply emerging technologies, like AI and quantum computing, or if our initiatives in these areas are deficient or fail. Our or our third-party providers’ inability or resistance to timely innovate or adapt operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions, harm our business and adversely affect our results of operations and reputation.

We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ ability to timely adapt our business strategies, products and services and their respective features, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events.The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in accurately assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining customers. Our or our third-party providers’ inability or resistance to timely innovate or adapt its operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation.We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk.We use models extensively to forecast losses, project revenue and expenses, assess and control our operations and financial condition, assist in capital planning, manage liquidity and measure, forecast and assess capital and liquidity requirements for credit, market, operational and strategic risks. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform model oversight, including independent validation before initial use, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. However, models are subject to inherent limitations from simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks from applications that rely on AI or machine learning.Our models may not be sufficiently predictive of future results due to limited historical patterns, extreme or unanticipated market movements or customer behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events), which could limit their effectiveness and require timely recalibration. The models that we use to assess and control our market risk exposures also reflect assumptions about the degree of correlation among prices of various asset classes or other market indicators, which may not be representative of the next downturn and would magnify the limitations inherent in using historical data to distribution channels. Our success depends on our and our third-party providers’ ability to timely adapt our business strategies, products and services and their respective features, including available payment processing services and technology to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events. The widespread adoption and rapid evolution of emerging technologies, including analytic capabilities, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As such new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in accurately assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining customers. Our or our third-party providers’ inability or resistance to timely innovate or adapt its operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation.

We face significant legal risks in our business, with a high volume of claims against us and other financial institutions, including conduct related to various products, services and markets. The amount of damages, penalties and fines that private litigants, including clients and other counterparties, and regulators seek from us and other financial institutions continues to be significant and unpredictable. U.S. regulators and government agencies regularly pursue enforcement claims and litigation against financial institutions, including us, for alleged violations of law and client harm, including under the Financial Institutions Reform, Recovery, and Enforcement Act, the federal securities laws, the False Claims Act, fair lending laws and regulations (including the Equal Credit Opportunity Act and the Fair Housing Act), the FCPA, the BSA, regulations issued by OFAC, Home Mortgage Disclosure Act, antitrust laws, and consumer protection laws and regulations related to products and services such as overdraft and sales practices, including prohibitions on unfair, deceptive, and/or abusive acts and practices (UDAAP) under the Consumer Financial Protection Act and the Federal Trade Commission Act, and EFTA, as well as other enforcement action taken by prudential regulators with respect to safety, soundness and appropriateness of our business practices. Such claims may carry significant penalties, restitution and, in certain cases, treble damages, and the ultimate resolution of regulatory inquiries, investigations and other proceedings which we are subject to from time-to-time is difficult to predict. In particular, we are the subject of litigation regarding our processing of electronic payments through the Zelle network, Bank of America 18 Bank of America 18 Bank of America 18 Bank of America 18 our efforts to detect, prevent and address fraud perpetrated against our clients and/or the handling of fraud-related disputes, which could result in fines, judgments and/or settlements, and adversely affect our businesses and strategies due to the treatment of loss allocations between clients and us, all of which could also adversely impact other similar products and services. Further, in addition to the consent order referenced above regarding BSA/anti-money laundering and economic sanctions compliance programs, we have entered into orders or settlements with certain government agencies regarding the rates paid on uninvested cash in brokerage and investment advisory accounts that is swept into interest-paying bank deposits, credit card sales and marketing practices and representment fee practices and our participation in implementing COVID-19-related government relief measures and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states. We are subject to, or could become subject to, related litigation or investigations by other regulators with respect to the conduct that gave rise to these orders, or the orders or investigations we become subject to in the future, which may result in judgments and/or settlements. We and our regulators have an increased focus on information security. This includes cybersecurity incidents perpetrated against us, our clients, providers of products and services, counterparties and other third parties, the collection, use and sharing of data, and safeguarding of personally identifiable information and corporate data, as well as the development, implementation, use and management of emerging technologies, including AI, which have resulted in, and will likely continue to result in, related litigation or government enforcement, including with regard to compliance with U.S. and global LRRs, and could subject us to fines, judgments and/or settlements and involve reputational losses. We expect to also face increasing scrutiny regarding sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm. Misconduct, or the perception of misconduct, by our employees and representatives, including conflicts of interest, unethical, fraudulent, improper or illegal conduct, the failure to fulfill fiduciary obligations, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures or LRRs, including conduct that affects compliance with books and records requirements, have resulted and could result in further litigation and/or government investigations and enforcement actions, and cause significant reputational harm.The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and are likely to continue to affect operational and compliance costs and risks, including the adaptation of business strategies, the limitation or cessation of our ability or feasibility to continue providing certain products and services and our employment practices. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us, in amounts that may be significant or unpredictable, and in some cases, exceed the amount of reserves established. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.U.S. federal banking agencies may require increased capital and liquidity levels, which could adversely impact the Corporation.We are subject to U.S. capital and liquidity regulations. These rules, among other things, establish minimum ratios relating to capital for different categories of assets and exposures to qualify as a well-capitalized institution. As a G-SIB, we are also required to hold additional capital buffers, including a G-SIB surcharge, a SCB and a countercyclical buffer, which are reassessed at least annually. Also, we are subject to regulatory liquidity requirements, including the Liquidity Coverage Ratio and the Net Stable Funding Ratio. If any of our subsidiary insured depository institutions fail to maintain “well capitalized” status under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status, which may include restrictions on our activities, such as our ability to pay dividends and/or repurchase our common stock. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities otherwise permitted. From time to time regulators may change regulatory capital requirements, including total loss-absorbing capacity (TLAC) and long-term debt requirements, change how regulatory capital or RWA is calculated, or increase liquidity requirements. These components of our capital and liquidity ratios could also be impacted by economic disruptions or other events that may cause an increase in our balance sheet, RWA or leverage exposures, which could increase the amounts of regulatory capital or liquidity we are required to hold.In 2023, U.S. banking regulators issued notices of proposed rulemaking to revise the measurement of RWA and the G-SIB surcharge calculation, both of which may be re-proposed. Also, in 2023, U.S. banking regulators issued proposed changes to the long-term debt requirements for TLAC, which may impact eligibility of certain debt instruments, and in 2024, the Federal Reserve separately confirmed it is considering changes to existing, as well as new, liquidity requirements. The timing and composition of any such proposals or re-proposals remain uncertain due to various factors, including changes of leadership positions in the U.S. bank regulatory agencies. Our ability to pay dividends or repurchase common stock depends, in part, on our ability to maintain regulatory capital levels above minimum requirements plus buffers. If increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our dividends and common stock repurchases, could decrease. For example, in 2024, our SCB increased by 70 bps to 3.2 percent and our G-SIB surcharge increased 50 bps to 3.0 percent. Our G-SIB surcharge is expected to increase to 3.5 percent from 3.0 percent in 2027, and could further increase in the future. The Federal Reserve could also limit or prohibit capital actions (e.g., impacts to dividends and common stock repurchases) as a result of economic disruptions or events. Extensive regulatory evaluation of our capital planning practices by the Federal Reserve includes stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level and require us to hold additional capital. In 2024, the Federal Reserve announced that it intends to propose potential changes to bank stress tests, which could impact our SCB. Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional securities, reduce common stock repurchases or dividends, limit compensation practices, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, adversely affecting our results of operations. our efforts to detect, prevent and address fraud perpetrated against our clients and/or the handling of fraud-related disputes, which could result in fines, judgments and/or settlements, and adversely affect our businesses and strategies due to the treatment of loss allocations between clients and us, all of which could also adversely impact other similar products and services. Further, in addition to the consent order referenced above regarding BSA/anti-money laundering and economic sanctions compliance programs, we have entered into orders or settlements with certain government agencies regarding the rates paid on uninvested cash in brokerage and investment advisory accounts that is swept into interest-paying bank deposits, credit card sales and marketing practices and representment fee practices and our participation in implementing COVID-19-related government relief measures and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states. We are subject to, or could become subject to, related litigation or investigations by other regulators with respect to the conduct that gave rise to these orders, or the orders or investigations we become subject to in the future, which may result in judgments and/or settlements. We and our regulators have an increased focus on information security. This includes cybersecurity incidents perpetrated against us, our clients, providers of products and services, counterparties and other third parties, the collection, use and sharing of data, and safeguarding of personally identifiable information and corporate data, as well as the development, implementation, use and management of emerging technologies, including AI, which have resulted in, and will likely continue to result in, related litigation or government enforcement, including with regard to compliance with U.S. and global LRRs, and could subject us to fines, judgments and/or settlements and involve reputational losses. We expect to also face increasing scrutiny regarding sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm. Misconduct, or the perception of misconduct, by our employees and representatives, including conflicts of interest, unethical, fraudulent, improper or illegal conduct, the failure to fulfill fiduciary obligations, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures or LRRs, including conduct that affects compliance with books and records requirements, have resulted and could result in further litigation and/or government investigations and enforcement actions, and cause significant reputational harm.The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and are likely to continue to affect operational and compliance costs and risks, including the adaptation of business strategies, the limitation or cessation of our ability or feasibility to continue providing certain products and services and our employment practices. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us, in amounts that may be significant or unpredictable, and in some cases, exceed the amount of reserves established. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.U.S. federal banking agencies may require increased capital and liquidity levels, which could adversely impact the Corporation. our efforts to detect, prevent and address fraud perpetrated against our clients and/or the handling of fraud-related disputes, which could result in fines, judgments and/or settlements, and adversely affect our businesses and strategies due to the treatment of loss allocations between clients and us, all of which could also adversely impact other similar products and services. Further, in addition to the consent order referenced above regarding BSA/anti-money laundering and economic sanctions compliance programs, we have entered into orders or settlements with certain government agencies regarding the rates paid on uninvested cash in brokerage and investment advisory accounts that is swept into interest-paying bank deposits, credit card sales and marketing practices and representment fee practices and our participation in implementing COVID-19-related government relief measures and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states. We are subject to, or could become subject to, related litigation or investigations by other regulators with respect to the conduct that gave rise to these orders, or the orders or investigations we become subject to in the future, which may result in judgments and/or settlements. We and our regulators have an increased focus on information security. This includes cybersecurity incidents perpetrated against us, our clients, providers of products and services, counterparties and other third parties, the collection, use and sharing of data, and safeguarding of personally identifiable information and corporate data, as well as the development, implementation, use and management of emerging technologies, including AI, which have resulted in, and will likely continue to result in, related litigation or government enforcement, including with regard to compliance with U.S. and global LRRs, and could subject us to fines, judgments and/or settlements and involve reputational losses. We expect to also face increasing scrutiny regarding sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm. Misconduct, or the perception of misconduct, by our employees and representatives, including conflicts of interest, unethical, fraudulent, improper or illegal conduct, the failure to fulfill fiduciary obligations, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures or LRRs, including conduct that affects compliance with books and records requirements, have resulted and could result in further litigation and/or government investigations and enforcement actions, and cause significant reputational harm. The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and are likely to continue to affect operational and compliance costs and risks, including the adaptation of business strategies, the limitation or cessation of our ability or feasibility to continue providing certain products and services and our employment practices. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us, in amounts that may be significant or unpredictable, and in some cases, exceed the amount of reserves established. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.

We face significant legal risks in our business, with a high volume of claims against us and other financial institutions. The amount of damages, penalties and fines that litigants and regulators seek from us and other financial institutions continues to be significant. This includes disputes with consumers, customers and other counterparties. Financial institutions, including us, continue to be the subject of claims alleging anti-competitive conduct with respect to various products and markets, including U.S. antitrust class actions claiming joint and several liability for treble damages. As disclosed in Note 12 – Commitments and Contingencies to the Consolidated Financial Statements, we also face contractual indemnification and loan-repurchase claims arising from alleged breaches of representations and warranties in the sale of residential mortgages by legacy companies, which may result in a requirement that we repurchase the mortgage loans, or make whole or provide other remedies to counterparties.U.S. regulators and government agencies regularly pursue enforcement claims against financial institutions, including us, for alleged violations of law and customer harm, including under the Financial Institutions Reform, Recovery, and Enforcement Act, the federal securities laws, the False Claims Act, fair lending laws and regulations (including the Equal Credit Opportunity Act and the Fair Housing Act), the FCPA, the BSA, regulations issued by OFAC, Home Mortgage Disclosure Act, antitrust laws, and consumer protection laws and regulations related to products and services such as overdraft and sales practices, including prohibitions on unfair, deceptive, and/or abusive acts and practices (UDAAP) under the Consumer Financial Protection Act and the Federal Trade Commission Act, and EFTA, as well as other enforcement action taken by prudential regulators with respect to safety, soundness and appropriateness of our business practices. Such claims may carry significant penalties, restitution and, in certain cases, treble damages, and the ultimate resolution of regulatory inquiries, investigations and other proceedings which we are subject to from time-to-time is difficult to predict.There is also an increased focus on information security. This includes cybersecurity incidents perpetrated against us, our customers, providers of products and services, counterparties and other third parties, the collection, use and sharing of data, and safeguarding of personally identifiable information and corporate data, as well as the development, implementation, use and management of emerging technologies, including AI and machine learning. Related litigation or government enforcement, including with regard to compliance with U.S. and global laws, rules and regulations, could subject us to fines, judgments and/or settlements and involve reputational losses. Additionally, misconduct by our employees and representatives, including unethical, fraudulent, improper or illegal conduct, the failure to fulfill fiduciary obligations, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures, laws, rules or regulations, including conduct that affects compliance with books and records requirements, have resulted and could result in further litigation and/or government investigations and enforcement actions, and cause significant reputational harm. In particular, we are the subject of litigation and regulatory and government inquiries regarding our processing of electronic payments, our efforts to detect, prevent and address fraud perpetrated against our customers and/or the handling of fraud-related disputes, which could result in fines, judgments, and/or settlements, as well as adversely affect our businesses and strategies due to the treatment of loss allocations between customers and us, all of which could also have an adverse impact on other similar products and services. We are also subject to increasing scrutiny of sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm.The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and Financial institutions, including us, continue to be the subject of claims alleging anti-competitive conduct with respect to various products and markets, including U.S. antitrust class actions claiming joint and several liability for treble damages. As disclosed in Note 12 – Commitments and Contingencies to the Consolidated Financial Statements, we also face contractual indemnification and loan-repurchase claims arising from alleged breaches of representations and warranties in the sale of residential mortgages by legacy companies, which may result in a requirement that we repurchase the mortgage loans, or make whole or provide other remedies to counterparties. U.S. regulators and government agencies regularly pursue enforcement claims against financial institutions, including us, for alleged violations of law and customer harm, including under the Financial Institutions Reform, Recovery, and Enforcement Act, the federal securities laws, the False Claims Act, fair lending laws and regulations (including the Equal Credit Opportunity Act and the Fair Housing Act), the FCPA, the BSA, regulations issued by OFAC, Home Mortgage Disclosure Act, antitrust laws, and consumer protection laws and regulations related to products and services such as overdraft and sales practices, including prohibitions on unfair, deceptive, and/or abusive acts and practices (UDAAP) under the Consumer Financial Protection Act and the Federal Trade Commission Act, and EFTA, as well as other enforcement action taken by prudential regulators with respect to safety, soundness and appropriateness of our business practices. Such claims may carry significant penalties, restitution and, in certain cases, treble damages, and the ultimate resolution of regulatory inquiries, investigations and other proceedings which we are subject to from time-to-time is difficult to predict. There is also an increased focus on information security. This includes cybersecurity incidents perpetrated against us, our customers, providers of products and services, counterparties and other third parties, the collection, use and sharing of data, and safeguarding of personally identifiable information and corporate data, as well as the development, implementation, use and management of emerging technologies, including AI and machine learning. Related litigation or government enforcement, including with regard to compliance with U.S. and global laws, rules and regulations, could subject us to fines, judgments and/or settlements and involve reputational losses. Additionally, misconduct by our employees and representatives, including unethical, fraudulent, improper or illegal conduct, the failure to fulfill fiduciary obligations, unfair, deceptive, abusive or discriminatory business practices, or violations of policies, procedures, laws, rules or regulations, including conduct that affects compliance with books and records requirements, have resulted and could result in further litigation and/or government investigations and enforcement actions, and cause significant reputational harm. In particular, we are the subject of litigation and regulatory and government inquiries regarding our processing of electronic payments, our efforts to detect, prevent and address fraud perpetrated against our customers and/or the handling of fraud-related disputes, which could result in fines, judgments, and/or settlements, as well as adversely affect our businesses and strategies due to the treatment of loss allocations between customers and us, all of which could also have an adverse impact on other similar products and services. We are also subject to increasing scrutiny of sustainability-related policies, goals, targets and disclosure, which could result in litigation, regulatory investigations and actions and reputational harm. The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and Bank of America 18 Bank of America 18 Bank of America 18 Bank of America 18 regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the adaptation of business strategies and/or limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our participation in implementing government relief measures related to the COVID-19 pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation that may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.U.S. federal banking agencies may require us to increase our regulatory capital, total loss-absorbing capacity (TLAC), long-term debt or liquidity requirements.We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956.Capital and liquidity requirements are frequently introduced and amended. Regulators may increase regulatory capital requirements, including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. In 2023, U.S. banking regulators issued proposals to revise the calculation of the G-SIB surcharge and TLAC and long-term debt requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge increased by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events.As part of its annual CCAR, we are subject to extensive regulatory evaluation of capital planning practices by the Federal Reserve, including stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level, requiring us to hold additional capital or causing changes in required capital buffers.A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure. In July 2023, U.S. banking regulators issued a notice of proposed rulemaking to revise several key methodologies for measuring RWA, including a standardized approach for operational risk, revised market risk and credit risk requirements and removal of the use of certain internal models, which would increase our regulatory capital requirements, if adopted as proposed. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts.Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, which may adversely affect our results of operations.Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments are erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in revisions to prior-period financial statements.We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.Governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the adaptation of business strategies and/or limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our participation in implementing government relief measures related to the COVID-19 pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation that may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.U.S. federal banking agencies may require us to increase our regulatory capital, total loss-absorbing capacity (TLAC), long-term debt or liquidity requirements.We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956.Capital and liquidity requirements are frequently introduced and amended. Regulators may increase regulatory capital requirements, including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. In 2023, U.S. banking regulators issued proposals to revise the calculation of the G-SIB surcharge and TLAC and long-term debt requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge increased by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events.As part of its annual CCAR, we are subject to extensive regulatory evaluation of capital planning practices by the Federal Reserve, including stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level, requiring us to hold additional capital or causing changes in required capital buffers.A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure. In July 2023, U.S. banking regulators issued a notice of proposed rulemaking to revise several key methodologies for measuring RWA, regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the adaptation of business strategies and/or limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders, settlements, penalties and fines adverse to us. Further, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our participation in implementing government relief measures related to the COVID-19 pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation that may result in judgments and/or settlements. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could adversely affect our businesses, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm.

Our ability to attract and retain clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, clients and third parties, including counterparties, such as fraud, misconduct and unethical behavior, adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our clients, and the handling of related disputes regarding the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our clients, including overdraft and non-sufficient funds fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the services offered to our clients, the reliability of our research and models and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products, standards of service and quality expected by our clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our clients and/or recognize and address client complaints, compliance failures, technology changes, the implementation, management and use of emerging technologies, including AI, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our employees, clients and third parties, which have occurred and which we expect to continue to occur with increased frequency and severity, prolonged or repeated system outages, our privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of our fiduciary obligations, employment practices and the handling of widespread health emergencies or pandemics. Our reputation may also be harmed by litigation and/or regulatory matters and their outcomes, and/or criticism or challenges by third parties, relating to the topics discussed above or otherwise. Challenges and criticisms to our environmental and social practices and disclosures, and those of our clients and third parties, including from third parties, who may have diverging views regarding those practices and disclosures, may also harm our reputation.Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may trigger a loss of trust or confidence on the part of clients, counterparties, shareholders, investors, debt holders, market analysts, other relevant parties or regulators, adversely impacting our business prospects and results of operations.We are subject to complex and evolving LRRs and interpretations, including regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy (including the GDPR and the CCPA), cross-border data movement and data localization, cybersecurity, the use and development of AI, data and technology and other matters, as well as evolving and expansive interpretations of these LRRs. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably across jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy and data protection remains fluid. These laws may be interpreted and applied by various jurisdictions inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of clients in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations. and services, including electronic payments, effectiveness of our internal controls, the fees charged to our clients, including overdraft and non-sufficient funds fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the services offered to our clients, the reliability of our research and models and prohibiting clients from engaging in certain transactions. Our reputation may also be harmed by actual or perceived failure to deliver the products, standards of service and quality expected by our clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our clients and/or recognize and address client complaints, compliance failures, technology changes, the implementation, management and use of emerging technologies, including AI, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our employees, clients and third parties, which have occurred and which we expect to continue to occur with increased frequency and severity, prolonged or repeated system outages, our privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of our fiduciary obligations, employment practices and the handling of widespread health emergencies or pandemics. Our reputation may also be harmed by litigation and/or regulatory matters and their outcomes, and/or criticism or challenges by third parties, relating to the topics discussed above or otherwise. Challenges and criticisms to our environmental and social practices and disclosures, and those of our clients and third parties, including from third parties, who may have diverging views regarding those practices and disclosures, may also harm our reputation. Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may trigger a loss of trust or confidence on the part of clients, counterparties, shareholders, investors, debt holders, market analysts, other relevant parties or regulators, adversely impacting our business prospects and results of operations. We are subject to complex and evolving LRRs and interpretations, including regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy (including the GDPR and the CCPA), cross-border data movement and data localization, cybersecurity, the use and development of AI, data and technology and other matters, as well as evolving and expansive interpretations of these LRRs. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably across jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy and data protection remains fluid. These laws may be interpreted and applied by various jurisdictions inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of clients in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations. Bank of America 20 Bank of America 20 Bank of America 20 Bank of America 20 We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest, the management of which has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business. Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of clients and employees, and give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses.OtherWe face significant and increasing competition in the financial services industry.We operate in a highly competitive environment and experience intense competition from local and global bank and nonbank financial institutions and new entrants in domestic and foreign markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees, lower cost investment strategies and higher interest rates on deposits, which may impact our ability to effectively compete. Also, we may be disadvantaged from more stringent regulatory requirements applicable to us than to nonbank financial institutions or other actual or perceived competitors. The growth of and mergers among traditional financial services companies have increased competition. Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an alternative to traditional products. Increased competition may reduce our market share, net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing, requiring additional investment to improve the quality and delivery of our technology and/or affecting our clients’ willingness to do business with us.Our inability to adapt our business strategies, products and services could harm our business.We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ ability to timely change or adapt our business strategies, products and services and their respective features, including available payment processing services and technology, such as AI and machine learning, to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, widespread health emergencies or pandemics, cyberattacks, and military conflicts or other significant geopolitical events.Widespread adoption and rapid evolution of, as well as developments in the regulatory landscape relating to emerging technologies, including analytic capabilities, AI (including machine learning and generative AI), automated decision-making, self-service digital trading platforms and automated trading markets, internet services, and digital assets, such as central bank digital currencies, cryptocurrencies (including stablecoins), tokens and other cryptoassets that utilize distributed ledger technology (DLT), as well as payment, clearing and settlement processes that use DLT, create additional strategic risks, could negatively impact our ability to compete and require substantial expenditures to the extent we were to modify or adapt our existing products and services. As new technologies evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of new competitors to the payments and trading ecosystems and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in assessing the competitive landscape and developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining clients. Further, our businesses may be negatively impacted if we, or our third-party providers, do not timely development and apply emerging technologies, like AI and quantum computing, or if our initiatives in these areas are deficient or fail. Our or our third-party providers’ inability or resistance to timely innovate or adapt operations, products and services to evolving regulatory and market environments, industry standards and consumer preferences could result in service disruptions, harm our business and adversely affect our results of operations and reputation.We could suffer operational, reputational and financial harm if our models fail to properly anticipate and manage risk.We use models enterprise-wide, including to forecast losses, project revenue and expenses, assess and control our operations and financial condition, assist in capital planning, manage liquidity and measure, forecast and assess capital and liquidity requirements for credit, market, operational and strategic risks. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform end-to-end model oversight, including independent validation before initial use, implementation monitoring, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. However, models are subject to inherent limitations from simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks, including from applications that rely on AI.Our models may not be sufficiently predictive of future results, such as due to limited historical patterns, extreme or unanticipated market movements or clients’ behavior and liquidity, especially during severe market downturns or stress events (e.g., geopolitical or pandemic events), which could limit their effectiveness and require timely recalibration. The models that we use to assess and control our market risk exposures also reflect assumptions about the degree of correlation among prices of various asset classes or other market indicators, which may not be representative of the next downturn and would magnify the limitations inherent in using historical data to We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest, the management of which has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business. Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of clients and employees, and give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses.OtherWe face significant and increasing competition in the financial services industry.We operate in a highly competitive environment and experience intense competition from local and global bank and nonbank financial institutions and new entrants in domestic and foreign markets. There is increasing pressure to provide products and services on more attractive terms, including lower fees, lower cost investment strategies and higher interest rates on deposits, which may impact our ability to effectively compete. Also, we may be disadvantaged from more stringent regulatory requirements applicable to us than to nonbank financial institutions or other actual or perceived competitors. The growth of and mergers among traditional financial services companies have increased competition. Emerging technologies and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer traditional banking products and services and allowed non-traditional financial service providers and technology companies to compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing services, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky as an alternative to traditional products. Increased competition may reduce our market share, net interest margin and revenues from our fee-based products and services and negatively affect our earnings, including by pressuring us to lower pricing, requiring additional investment to improve the quality and delivery of our technology and/or affecting our clients’ willingness to do business with us.Our inability to adapt our business strategies, products and services could harm our business.We rely on a diversified mix of businesses that deliver a broad range of financial products and services through multiple distribution channels. Our success depends on our and our third-party providers’ ability to timely change or adapt our business strategies, products and services and their respective features, including available payment processing services and technology, such as AI and machine learning, to rapidly evolving industry standards and consumer preferences. Our strategies could be further impacted by macroeconomic stress, We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest, the management of which has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business. Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of clients and employees, and give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses. Other

Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, customers and third parties, including counterparties, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our customers, and the handling of related disputes with regard to the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our customers, including overdraft and non-sufficient fund fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the reliability of our research and models and prohibiting clients from engaging in certain transactions. Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our customers and/or recognize and address customer complaints, compliance failures, technology changes, the implementation, management and/or use of emerging technologies, including quantum computing, AI and machine learning, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our third parties, which have occurred and we expect to continue to experience with increased frequency and severity due to the evolving threat environment, prolonged or repeated system outages, the Corporation’s privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of the Corporation’s fiduciary obligations and handling of the emergence or continuation of health emergencies and pandemics. Our reputation may be also be harmed by litigation and/or regulatory matters and their outcomes, relating to the topics discussed above or otherwise. For example, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Challenges to our ESG practices and disclosures, and those of our customers and third parties, including from diverging views regarding ESG-related practices and disclosures may also harm our reputation. Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects and results of operations. We are subject to complex and evolving laws, regulations and interpretations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR and the CCPA as modified by the CPRA, cross-border data movement, cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations.We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business.Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of customers and employees. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses.OtherReforms to benchmarks may adversely affect our reputation, business, financial condition and results of operations.Risks and challenges associated with reference rate reform, including the potential replacement of benchmark rates with ARRs (e.g., the expected cessation of BSBY), could expose us to various financial, operational, supervisory, conduct and legal risk.Usage of ARRs for impacted benchmarks may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs may have compositions and characteristics that differ from replaced benchmarks, including limited liquidity and less predictable performance over time. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, resulting in unanticipated market exposures. Transition to ARRs may adversely affect the yield on loans or securities held by us, amounts paid on our securities and received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our effective use of hedging instruments to manage risk. There is no assurance that impacted benchmarks will transition to ARRs without delay or potential disputes.The transition of any products using impacted benchmarks (Impacted Products) that do not include fallback provisions or adequate fallback mechanisms may require additional efforts to modify their terms, and may be more challenging to modify if all cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations. We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business. Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of customers and employees. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses. Other

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, client allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees and the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates and/or spreads. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth. Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.If asset values decline, we may incur losses and negative impacts, including to capital and liquidity requirements.We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value and are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate.Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively mitigated the risk of our exposures. Increases in interest rates may cause decreases in residential mortgage loan originations and could impact the origination of corporate debt. In addition, increases in interest rates or changes in spreads may continue to adversely impact the fair value of our debt securities and, accordingly, for debt securities classified as available-for-sale (AFS), adversely affect accumulated other comprehensive income and, thus, our capital levels. Increases in interest rates or changes in spreads could also adversely impact our regulatory liquidity position and requirements, which include eligible AFS debt securities and held-to-maturity (HTM) debt securities. As our liquidity is dependent on the fair value of these assets, increases in market interest rates and/or wider spreads, have adversely impacted and may continue to adversely impact the fair value of debt securities, adversely affecting liquidity levels.Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets.LiquidityIf we are unable to access the capital markets, have prolonged net deposits outflows, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.Liquidity is essential to our businesses. We fund our assets primarily with globally sourced deposits in our bank entities, as well as secured and unsecured liabilities transacted in the capital markets. We rely on certain secured funding sources, where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations in equity, commodity and futures prices, trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and business factors. These market risks may adversely affect, among other things, the value of our securities, including our on- and off-balance sheet securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking, underwriting and other capital market fees, which have already been negatively impacted, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. The value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. If interest rates decrease, our results of operations could be negatively impacted, including future revenue and earnings growth. Our models and strategies to assess and control our market risk exposures are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated. Such changes to the relationship between market parameters may limit the effectiveness of our hedging strategies and cause us to incur significant losses. Changes in correlation can be exacerbated where market participants use risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists. Where we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, or where the degree of accessible liquidity declines significantly, we may not be able to reduce our positions and risks associated with such holdings, so we may suffer larger than expected losses when adverse price movements take place. This risk can be exacerbated where we hold a position that is large relative to the available liquidity.

We are subject to U.S. capital and liquidity regulations. These rules, among other things, establish minimum ratios relating to capital for different categories of assets and exposures to qualify as a well-capitalized institution. As a G-SIB, we are also required to hold additional capital buffers, including a G-SIB surcharge, a SCB and a countercyclical buffer, which are reassessed at least annually. Also, we are subject to regulatory liquidity requirements, including the Liquidity Coverage Ratio and the Net Stable Funding Ratio. If any of our subsidiary insured depository institutions fail to maintain “well capitalized” status under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status, which may include restrictions on our activities, such as our ability to pay dividends and/or repurchase our common stock. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities otherwise permitted. From time to time regulators may change regulatory capital requirements, including total loss-absorbing capacity (TLAC) and long-term debt requirements, change how regulatory capital or RWA is calculated, or increase liquidity requirements. These components of our capital and liquidity ratios could also be impacted by economic disruptions or other events that may cause an increase in our balance sheet, RWA or leverage exposures, which could increase the amounts of regulatory capital or liquidity we are required to hold.In 2023, U.S. banking regulators issued notices of proposed rulemaking to revise the measurement of RWA and the G-SIB surcharge calculation, both of which may be re-proposed. Also, in 2023, U.S. banking regulators issued proposed changes to the long-term debt requirements for TLAC, which may impact eligibility of certain debt instruments, and in 2024, the Federal Reserve separately confirmed it is considering changes to existing, as well as new, liquidity requirements. The timing and composition of any such proposals or re-proposals remain uncertain due to various factors, including changes of leadership positions in the U.S. bank regulatory agencies. Our ability to pay dividends or repurchase common stock depends, in part, on our ability to maintain regulatory capital levels above minimum requirements plus buffers. If increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our dividends and common stock repurchases, could decrease. For example, in 2024, our SCB increased by 70 bps to 3.2 percent and our G-SIB surcharge increased 50 bps to 3.0 percent. Our G-SIB surcharge is expected to increase to 3.5 percent from 3.0 percent in 2027, and could further increase in the future. The Federal Reserve could also limit or prohibit capital actions (e.g., impacts to dividends and common stock repurchases) as a result of economic disruptions or events. Extensive regulatory evaluation of our capital planning practices by the Federal Reserve includes stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level and require us to hold additional capital. In 2024, the Federal Reserve announced that it intends to propose potential changes to bank stress tests, which could impact our SCB. Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional securities, reduce common stock repurchases or dividends, limit compensation practices, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, adversely affecting our results of operations. We are subject to U.S. capital and liquidity regulations. These rules, among other things, establish minimum ratios relating to capital for different categories of assets and exposures to qualify as a well-capitalized institution. As a G-SIB, we are also required to hold additional capital buffers, including a G-SIB surcharge, a SCB and a countercyclical buffer, which are reassessed at least annually. Also, we are subject to regulatory liquidity requirements, including the Liquidity Coverage Ratio and the Net Stable Funding Ratio. If any of our subsidiary insured depository institutions fail to maintain “well capitalized” status under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status, which may include restrictions on our activities, such as our ability to pay dividends and/or repurchase our common stock. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities otherwise permitted. From time to time regulators may change regulatory capital requirements, including total loss-absorbing capacity (TLAC) and long-term debt requirements, change how regulatory capital or RWA is calculated, or increase liquidity requirements. These components of our capital and liquidity ratios could also be impacted by economic disruptions or other events that may cause an increase in our balance sheet, RWA or leverage exposures, which could increase the amounts of regulatory capital or liquidity we are required to hold. In 2023, U.S. banking regulators issued notices of proposed rulemaking to revise the measurement of RWA and the G-SIB surcharge calculation, both of which may be re-proposed. Also, in 2023, U.S. banking regulators issued proposed changes to the long-term debt requirements for TLAC, which may impact eligibility of certain debt instruments, and in 2024, the Federal Reserve separately confirmed it is considering changes to existing, as well as new, liquidity requirements. The timing and composition of any such proposals or re-proposals remain uncertain due to various factors, including changes of leadership positions in the U.S. bank regulatory agencies. Our ability to pay dividends or repurchase common stock depends, in part, on our ability to maintain regulatory capital levels above minimum requirements plus buffers. If increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our dividends and common stock repurchases, could decrease. For example, in 2024, our SCB increased by 70 bps to 3.2 percent and our G-SIB surcharge increased 50 bps to 3.0 percent. Our G-SIB surcharge is expected to increase to 3.5 percent from 3.0 percent in 2027, and could further increase in the future. The Federal Reserve could also limit or prohibit capital actions (e.g., impacts to dividends and common stock repurchases) as a result of economic disruptions or events. Extensive regulatory evaluation of our capital planning practices by the Federal Reserve includes stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level and require us to hold additional capital. In 2024, the Federal Reserve announced that it intends to propose potential changes to bank stress tests, which could impact our SCB. Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional securities, reduce common stock repurchases or dividends, limit compensation practices, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, adversely affecting our results of operations. 19 Bank of America 19 Bank of America 19 Bank of America 19 Bank of America Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments are erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in unexpected losses, revisions to prior-period financial statements and other adverse impacts to us, including legal and regulatory risk.We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.We could be adversely affected if U.S. and foreign governmental authorities further change tax laws, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in U.S. and foreign tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Also, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized in a U.K. subsidiary over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of international capital markets or changes in the ability of our U.K. subsidiary to conduct business in the markets outside the U.K., could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA.ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, clients and third parties, including counterparties, such as fraud, misconduct and unethical behavior, adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our clients, and the handling of related disputes regarding the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our clients, including overdraft and non-sufficient funds fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the services offered to our clients, the reliability of our research and models and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products, standards of service and quality expected by our clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our clients and/or recognize and address client complaints, compliance failures, technology changes, the implementation, management and use of emerging technologies, including AI, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our employees, clients and third parties, which have occurred and which we expect to continue to occur with increased frequency and severity, prolonged or repeated system outages, our privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of our fiduciary obligations, employment practices and the handling of widespread health emergencies or pandemics. Our reputation may also be harmed by litigation and/or regulatory matters and their outcomes, and/or criticism or challenges by third parties, relating to the topics discussed above or otherwise. Challenges and criticisms to our environmental and social practices and disclosures, and those of our clients and third parties, including from third parties, who may have diverging views regarding those practices and disclosures, may also harm our reputation.Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may trigger a loss of trust or confidence on the part of clients, counterparties, shareholders, investors, debt holders, market analysts, other relevant parties or regulators, adversely impacting our business prospects and results of operations.We are subject to complex and evolving LRRs and interpretations, including regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy (including the GDPR and the CCPA), cross-border data movement and data localization, cybersecurity, the use and development of AI, data and technology and other matters, as well as evolving and expansive interpretations of these LRRs. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably across jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy and data protection remains fluid. These laws may be interpreted and applied by various jurisdictions inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of clients in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations. Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments are erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in unexpected losses, revisions to prior-period financial statements and other adverse impacts to us, including legal and regulatory risk.We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.We could be adversely affected if U.S. and foreign governmental authorities further change tax laws, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in U.S. and foreign tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Also, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized in a U.K. subsidiary over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of international capital markets or changes in the ability of our U.K. subsidiary to conduct business in the markets outside the U.K., could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA.ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, clients and third parties, including counterparties, such as fraud, misconduct and unethical behavior, adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our clients, and the handling of related disputes regarding the use of our products

We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fail to maintain their status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956. Capital and liquidity requirements are frequently introduced and amended. Regulators may increase regulatory capital requirements, including TLAC and long-term debt requirements, change how regulatory capital or RWA is calculated or increase liquidity requirements. In 2023, U.S. banking regulators issued proposals to revise the calculation of the G-SIB surcharge and TLAC and long-term debt requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders, including common stock dividends and common stock repurchases, could decrease. For example, our G-SIB surcharge increased by 50 bps to 3.0 percent on January 1, 2024. The Federal Reserve could also limit or prohibit capital actions, such as paying or increasing dividends or repurchasing common stock, as a result of economic disruptions or events. As part of its annual CCAR, we are subject to extensive regulatory evaluation of capital planning practices by the Federal Reserve, including stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact our SCB level, requiring us to hold additional capital or causing changes in required capital buffers. A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure. In July 2023, U.S. banking regulators issued a notice of proposed rulemaking to revise several key methodologies for measuring RWA, including a standardized approach for operational risk, revised market risk and credit risk requirements and removal of the use of certain internal models, which would increase our regulatory capital requirements, if adopted as proposed. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts.Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, which may adversely affect our results of operations.Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.Accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require the use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If assumptions, estimates or judgments are erroneously applied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact the preparation and reporting of our financial statements, including the application of new or revised standards retrospectively, resulting in revisions to prior-period financial statements.We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.Governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. including a standardized approach for operational risk, revised market risk and credit risk requirements and removal of the use of certain internal models, which would increase our regulatory capital requirements, if adopted as proposed. Economic disruptions or events may also cause an increase in our balance sheet, RWA or leverage exposures, increasing required regulatory capital and liquidity amounts. Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, reduce the amount of common stock repurchases or dividends, cease or alter certain operations, pricing strategies and business activities or hold highly liquid assets, which may adversely affect our results of operations.

We rely on the GSEs to guarantee or purchase certain mortgage loans that meet their conforming loan requirements. During 2024, we sold approximately $1.5 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae are currently in conservatorship, with the Federal Housing Finance Agency acting as conservator. While there have been Bank of America 16 Bank of America 16 Bank of America 16 Bank of America 16 periodic proposals to remove or exit the GSEs from conservatorship and eliminate the perceived “implicit guarantee” associated with the GSEs, none have been successful. We cannot predict the future prospects of the GSEs, including the timing of any recapitalization or release from conservatorship, or any legislative or rulemaking proposals regarding the GSEs’ status in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.Our risk management framework is designed to minimize our risk and loss. We seek to effectively and consistently identify, measure, monitor, report and control the risk types to which we are subject, including the seven key risk types we face. Risks also may span across multiple key risk types, including cybersecurity risk, climate risk, legal risk and concentration risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques seeking to balance our ability to profit from trading positions with our exposure to potential losses, we are inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not historically reflected and develop risk management models and forecasts to assess and control risk.Our risk management depends on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage third-party risks, including providers of products and services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to timely. Uncertain economic and geopolitical conditions, widespread health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, including AI (such as machine learning and generative AI) and quantum computing, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future, result in a heightened level of risk, including operational, reputational and compliance risk. Failure to manage evolving risks or properly anticipate, escalate, manage, control or mitigate risks could result in additional legal, regulatory and reputational risk, losses and adversely affect our results of operations.Regulatory, Compliance and LegalWe are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.We are highly regulated and subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various foreign jurisdictions in which we operate. These laws and regulations significantly affect and have the potential to increase our compliance costs, restrict the scope of our existing businesses, require changes to our employment practices, business strategies and controls and procedures, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates and/or make our products and services more expensive for our clients. We are also required to file various financial and nonfinancial regulatory reports to comply with LRRs in the jurisdictions in which we operate, which results in additional compliance and operational risk.We continue to adjust our business and operations, legal entity structure, systems, disclosure, policies, procedures, processes, controls and governance, including with regard to capital and liquidity management, risk management and data management, in an effort to comply with LRRs, and evolving expectations, guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS) and OFAC), Financial Crimes Enforcement Network, Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S., foreign regulators, other government authorities and self-regulatory organizations. Further, we expect to become subject to future LRRs, including beyond those currently proposed, adopted or contemplated in the U.S. or abroad, and evolving interpretations of existing and future LRRs, which may include policies and rulemaking related to FDIC assessments, loss allocations between financial institutions and clients regarding the use of our products and services, including electronic payments, emerging technologies, such as the development and use of AI (including machine learning and generative AI), cybersecurity and data, employment practices and further climate and environmental risk management and sustainability reporting and disclosure, including emissions.The cumulative effect of all of the current and possible future legislation and regulations, as well as related interpretations, on our litigation and regulatory exposure, businesses, operations, including our ability to compete, and profitability remains uncertain and necessitates that we make certain assumptions with respect to the scope and requirements of existing, prospective and proposed LRRs in our business planning and strategies. If these assumptions prove incorrect, we could be subject to increased regulatory, legal and compliance risks and costs, and potential reputational harm. Also, regulatory initiatives in the U.S. and abroad may overlap, and non-U.S. regulations and initiatives may be inconsistent or conflict with current or proposed U.S. regulations or with each other, which could lead to compliance risks and higher costs.Our regulators’ prudential and supervisory authority gives them broad power and discretion to direct our actions, and they have assumed an active oversight, inspection and investigatory role across the financial services industry. Regulatory focus is not limited to LRRs applicable to the financial services industry, but includes other significant LRRs that apply across industries and jurisdictions, including those related to anti-money laundering, anti-bribery, anti-corruption know-your-customer requirements, embargo programs and economic sanctions.We are also subject to LRRs in the U.S. and abroad, including the GDPR and CCPA, and a number of additional jurisdictions enacting or considering similar laws or amendments to existing laws, regarding privacy and the disclosure, collection, use, sharing and safeguarding of personally identifiable information, including our employees, clients, suppliers, counterparties and other third parties, the violation of which could result in litigation, regulatory fines, periodic proposals to remove or exit the GSEs from conservatorship and eliminate the perceived “implicit guarantee” associated with the GSEs, none have been successful. We cannot predict the future prospects of the GSEs, including the timing of any recapitalization or release from conservatorship, or any legislative or rulemaking proposals regarding the GSEs’ status in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.Our risk management framework is designed to minimize our risk and loss. We seek to effectively and consistently identify, measure, monitor, report and control the risk types to which we are subject, including the seven key risk types we face. Risks also may span across multiple key risk types, including cybersecurity risk, climate risk, legal risk and concentration risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques seeking to balance our ability to profit from trading positions with our exposure to potential losses, we are inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not historically reflected and develop risk management models and forecasts to assess and control risk.Our risk management depends on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage third-party risks, including providers of products and services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to timely. Uncertain economic and geopolitical conditions, widespread health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, including AI (such as machine learning and generative AI) and quantum computing, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future, result in a heightened level of risk, including operational, reputational and compliance risk. Failure to manage evolving risks or properly anticipate, escalate, manage, control or mitigate risks could result in additional legal, regulatory and reputational risk, losses and adversely affect our results of operations.Regulatory, Compliance and LegalWe are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.We are highly regulated and subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various foreign jurisdictions in which we periodic proposals to remove or exit the GSEs from conservatorship and eliminate the perceived “implicit guarantee” associated with the GSEs, none have been successful. We cannot predict the future prospects of the GSEs, including the timing of any recapitalization or release from conservatorship, or any legislative or rulemaking proposals regarding the GSEs’ status in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.

Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Risks also may span across multiple key risk types, including cybersecurity risk, climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk. Bank of America 16 Bank of America 16 Bank of America 16 Bank of America 16 Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk, including operational, reputational and compliance risk. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses and adversely affect our results of operations.Regulatory, Compliance and LegalWe are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.Our businesses are highly regulated and we are subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various foreign jurisdictions in which we operate, including increasing and complex economic sanctions regimes. These laws and regulations significantly affect and have the potential to restrict the scope of our existing businesses, require changes to our business strategies, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates and/or make our products and services more expensive for our clients. We are also required to file various financial and nonfinancial regulatory reports to comply with laws, rules and regulations in the jurisdictions in which we operate, which results in additional compliance risk.We continue to adjust our business and operations, legal entity structure, disclosure and policies, processes, procedures and controls, including with regard to capital and liquidity management, risk management and data management, in an effort to comply with laws, rules and regulations, as well as evolving expectations, guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS) and OFAC), Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S., foreign regulators, other government authorities and self-regulatory organizations. Further, we expect to become subject to future laws, rules and regulations beyond those currently proposed, adopted or contemplated in the U.S. or abroad, as well as evolving interpretations of existing and future laws, rules and regulations, which may include policies and rulemaking related to FDIC assessments, loss allocations between financial institutions and customers with regard to the use of our products and services, including electronic payments, emerging technologies, such as the development and use of AI and machine learning, cybersecurity and data, and further climate risk management and ESG reporting, including emissions and sustainability disclosure. The cumulative effect of all of the current and possible future legislation and regulations, as well as related interpretations, on our litigation and regulatory exposure, businesses, operations and profitability remains uncertain and necessitates that we make certain assumptions with respect to the scope and requirements of existing, prospective and proposed laws, rules and regulations in our business planning and strategies. If these assumptions prove incorrect, we could be subject to increased regulatory, legal and compliance risks and costs, as well as potential reputational harm. Also, U.S. and regulatory initiatives abroad may overlap, and non-U.S. regulation and initiatives may be inconsistent or may conflict with current or proposed U.S. regulations, which could lead to compliance risks and increased costs.Our regulators’ prudential and supervisory authority gives them broad power and discretion to direct our actions, and they have assumed an active oversight, inspection and investigatory role across the financial services industry. Regulatory focus is not limited to laws, rules and regulations applicable to the financial services industry, but includes other significant laws, rules and regulations that apply across industries and jurisdictions, including those related to anti-money laundering, anti-bribery, anti-corruption know-your-customer requirements, embargo programs and economic sanctions.We are also subject to laws, rules and regulations in the U.S. and abroad, including the GDPR and CCPA as modified by the CPRA, and a number of additional jurisdictions enacting or considering similar laws or amendments to existing laws, regarding privacy and the disclosure, collection, use, sharing and safeguarding of personally identifiable information, including our employees, customers, suppliers, counterparties and other third parties, the violation of which could result in litigation, regulatory fines, enforcement actions and operational loss. Additionally, we are and will continue to be subject to new and evolving data privacy laws in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines and enforcement actions. There remains complexity and uncertainty, including potential suspension or prohibition, regarding data transfer because of concerns over compliance with laws, rules and regulations for cross-border flows and transfers of personal data from the European Economic Area (EEA) to the U.S. and other jurisdictions outside of the EEA, resulting from judicial and regulatory guidance. To the extent that a new EU-U.S. Data Privacy Framework leads to a relaxation of applicable legislation and regulations, regardless of transfer mechanism, challenges are expected from consumer advocacy groups. Other jurisdictions, including China and India, have commenced consultation efforts or enacted new legislation or regulations to establish standards for personal data transfers. If cross-border personal data transfers are suspended or restricted or we are required to implement distinct processes for each jurisdiction’s standards, this could result in operational disruptions to our businesses, additional costs, increased enforcement activity, new contract negotiations with third parties, and/or modification of such data management.As part of their enforcement authority, our regulators and other government authorities have the authority to, among other things, conduct investigations and assess significant civil or criminal monetary fines, penalties or restitution, issue cease and desist orders, suspend or withdraw licenses and authorizations, initiate injunctive action, apply regulatory sanctions or cause us to enter into consent orders. The amounts paid by us and other financial institutions to settle proceedings or investigations have, in some instances, been substantial and may increase. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of such resolutions, which could have significant consequences, including reputational harm, loss of customers, restrictions on the ability to access capital markets, and the inability to operate certain businesses or offer certain products. Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk, including operational, reputational and compliance risk. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses and adversely affect our results of operations.Regulatory, Compliance and LegalWe are highly regulated and subject to evolving government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.Our businesses are highly regulated and we are subject to evolving and comprehensive regulation under federal and state laws in the U.S. and the laws of the various foreign jurisdictions in which we operate, including increasing and complex economic sanctions regimes. These laws and regulations significantly affect and have the potential to restrict the scope of our existing businesses, require changes to our business strategies, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates and/or make our products and services more expensive for our clients. We are also required to file various financial and nonfinancial regulatory reports to comply with laws, rules and regulations in the jurisdictions in which we operate, which results in additional compliance risk.We continue to adjust our business and operations, legal entity structure, disclosure and policies, processes, procedures and controls, including with regard to capital and liquidity management, risk management and data management, in an effort to comply with laws, rules and regulations, as well as evolving expectations, guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS) and OFAC), Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S., foreign regulators, other government authorities and self-regulatory organizations. Further, we expect to become subject to future laws, rules and regulations beyond those currently proposed, adopted or contemplated in the U.S. or abroad, as well as evolving interpretations of existing and future laws, rules and regulations, which may include policies and rulemaking related to FDIC assessments, loss allocations between financial institutions and customers with regard to the use of our products and services, including electronic payments, emerging technologies, such as the development and use of AI and machine learning, cybersecurity and data, and further climate risk management and ESG reporting, including emissions and sustainability disclosure. The cumulative effect of all of the current and possible future legislation and regulations, as well as related interpretations, on our litigation and regulatory exposure, businesses, operations and profitability remains uncertain and necessitates that we make certain assumptions Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program, develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties, including providers of products and/or services, to allow for effective risk management and help confirm that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic and geopolitical conditions, health emergencies and pandemics, heightened legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting, tax and market developments, the failure of employees, representatives and third parties to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, have in the past and may in the future result in a heightened level of risk, including operational, reputational and compliance risk. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses and adversely affect our results of operations.

We rely on our ability to manage and process data accurately, timely and completely, including capturing, transporting, aggregating, using, transmitting data externally, and retaining and protecting data appropriately. While we continually update our policies, programs, processes and practices and take steps to leverage emerging technologies, such as automation, AI and robotics, our data management processes may not be effective and are subject to weaknesses and failures, including human error, data limitations, process delays, system failure or failed controls. Failure to effectively manage data accurately, timely and completely may adversely impact its quality and reliability and our ability to manage current and emerging risks, produce accurate financial, nonfinancial, regulatory, operational, environmental and social reporting, detect or surveil potential misconduct or non-compliance with LRRs, and to manage our business needs, strategic decision-making, resolution strategy and operations. The failure to establish and maintain effective, efficient and controlled data management could adversely impact our development of products and client relationships and increase operational losses and regulatory and reputational risk.

We rely on our ability to manage and process data in an accurate, timely and complete manner, including capturing, transporting, aggregating, using, transmitting data externally, and retaining and protecting data appropriately. While we continually update our policies, programs, processes and practices and implement emerging technologies, such as automation, AI, machine learning and robotics, our data management processes may not be effective and are subject to weaknesses and failures, including human error, data limitations, process delays, system failure or failed controls. Failure to properly manage data effectively in an accurate, timely and complete manner may adversely impact its quality and reliability and our ability to manage current and emerging risk, produce accurate financial and/or nonfinancial, regulatory, operational and ESG reporting, detect or surveil potential misconduct or non-compliance with laws, rules and regulations, and to manage changing business needs, strategic decision-making, resolution strategy and operations. The failure to establish and maintain effective, efficient and controlled data management could adversely impact our ability to develop our products and relationships with customers, increase regulatory risk and operational losses, and damage our reputation.

We service mortgage loans on behalf of third-party securitization vehicles and other investors. If a material breach of our obligations as servicer or master servicer is committed, we may be subject to termination if the breach is not cured timely following notice, which could cause us to lose servicing income. We may also have liability for any failure by us or a third party, as a servicer or master servicer to adhere to or perform the required servicing obligation in accordance with the terms of the servicing agreements that result in impairment or loss to the loans’ owner. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Also, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.

We service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. We may also have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.Changes in the structure of and relationship among the GSEs could adversely impact our business.We rely on the GSEs to guarantee or purchase mortgage loans that meet their conforming loan requirements. During 2023, we sold approximately $3.1 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship, with the Federal Housing Finance Agency (FHFA) acting as conservator. In 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship and reduce their role in the marketplace. In January 2021, the Treasury Department further amended the agreement that governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. If the GSEs take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization, which could increase our cost of funds related to the origination of new mortgage loans, increase credit risk and/or impact our capacity to originate new mortgage loans. Uncertainty regarding their future and the MBS they guarantee continues to exist for the foreseeable future. These developments could adversely affect our securities portfolios, capital levels, liquidity and results of operations.Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the key types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. Risks also may span across multiple key risk types, including cybersecurity risk, climate risk and legal risk. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify and measure all risks, including emerging and unknown risks, anticipate the timing and impact of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, identify changes in markets or client behaviors not yet inherent in historical data and develop risk management models and forecasts to assess and control risk. any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs or losses due to potential indemnification obligations, result in litigation or regulatory action or adversely impact our results of operations. Additionally, foreclosures may result in costs, litigation or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.

We could be adversely affected if U.S. and foreign governmental authorities further change tax laws, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in U.S. and foreign tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material. Also, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized in a U.K. subsidiary over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of international capital markets or changes in the ability of our U.K. subsidiary to conduct business in the markets outside the U.K., could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. Reputation

Governmental authorities in the U.S. and/or other countries could further change tax laws in a way that would materially adversely affect us, including changes to the Tax Cuts and Jobs Act of 2017 and Inflation Reduction Act of 2022. Also, new guidelines issued by the Organization for Economic Cooperation and Development (OECD), which are currently being enacted into law in some OECD countries in which we operate, are expected to impose a 15 percent global minimum tax on a country-by-country basis. Any implementation of and/or change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our effective tax rate, tax liabilities and results of operations. U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material. Additionally, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA. 19 Bank of America 19 Bank of America 19 Bank of America 19 Bank of America ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, customers and third parties, including counterparties, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our customers, and the handling of related disputes with regard to the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our customers, including overdraft and non-sufficient fund fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the reliability of our research and models and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our customers and/or recognize and address customer complaints, compliance failures, technology changes, the implementation, management and/or use of emerging technologies, including quantum computing, AI and machine learning, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our third parties, which have occurred and we expect to continue to experience with increased frequency and severity due to the evolving threat environment, prolonged or repeated system outages, the Corporation’s privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of the Corporation’s fiduciary obligations and handling of the emergence or continuation of health emergencies and pandemics. Our reputation may be also be harmed by litigation and/or regulatory matters and their outcomes, relating to the topics discussed above or otherwise. For example, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Challenges to our ESG practices and disclosures, and those of our customers and third parties, including from diverging views regarding ESG-related practices and disclosures may also harm our reputation.Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects and results of operations.We are subject to complex and evolving laws, regulations and interpretations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR and the CCPA as modified by the CPRA, cross-border data movement, cybersecurity and other matters, as well as evolving and expansive interpretations of these laws and regulations. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. These laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or with one another. If personal, confidential or proprietary information of customers in our possession, or in the possession of third parties or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, legal and operational risks, which could adversely affect our reputation, financial condition and results of operations.We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The actual or perceived failure to adequately address conflicts of interest could affect the willingness of clients to use our products and services, or result in litigation or enforcement actions, which could adversely affect our business.Our actual or perceived failure to address these and other issues, such as operational risks, could give rise to reputational risk that could harm us and our business prospects, including the attraction and retention of customers and employees. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses.OtherReforms to benchmarks may adversely affect our reputation, business, financial condition and results of operations.Risks and challenges associated with reference rate reform, including the potential replacement of benchmark rates with ARRs (e.g., the expected cessation of BSBY), could expose us to various financial, operational, supervisory, conduct and legal risk.Usage of ARRs for impacted benchmarks may vary across or within categories of contracts, products and services, potentially resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs may have compositions and characteristics that differ from replaced benchmarks, including limited liquidity and less predictable performance over time. Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, resulting in unanticipated market exposures. Transition to ARRs may adversely affect the yield on loans or securities held by us, amounts paid on our securities and received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our effective use of hedging instruments to manage risk. There is no assurance that impacted benchmarks will transition to ARRs without delay or potential disputes.The transition of any products using impacted benchmarks (Impacted Products) that do not include fallback provisions or adequate fallback mechanisms may require additional efforts to modify their terms, and may be more challenging to modify if all ReputationDamage to our reputation could harm our businesses, including our competitive position and business prospects.Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including actual or perceived activities of our officers, directors, employees, other representatives, customers and third parties, including counterparties, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), adequacy of our ability to detect, prevent and/or respond to fraud perpetrated against our customers, and the handling of related disputes with regard to the use of our products and services, including electronic payments, effectiveness of our internal controls, the fees charged to our customers, including overdraft and non-sufficient fund fees, compensation practices, lending practices, suitability or reasonableness of particular trading or investment strategies, the reliability of our research and models and prohibiting clients from engaging in certain transactions.Our reputation may also be harmed by actual or perceived failure to deliver the products and standards of service and quality expected by our customers, clients and the community, including the overstatement or mislabeling of the environmental benefits of our products, services or transactions, the failure to protect our customers and/or recognize and address customer complaints, compliance failures, technology changes, the implementation, management and/or use of emerging technologies, including quantum computing, AI and machine learning, the failure to maintain effective data management, cybersecurity incidents and information and security breaches affecting us and our third parties, which have occurred and we expect to continue to experience with increased frequency and severity due to the evolving threat environment, prolonged or repeated system outages, the Corporation’s privacy policies, the unintended disclosure of or failure to safeguard personal, proprietary or confidential information, the breach of the Corporation’s fiduciary obligations and handling of the emergence or continuation of health emergencies and pandemics. Our reputation may be also be harmed by litigation and/or regulatory matters and their outcomes, relating to the topics discussed above or otherwise. For example, we entered into orders with certain government agencies regarding credit card sales and marketing practices and the representment of non-sufficient fund fees, as well as our processing of unemployment benefits for California and certain other states, and continue to be involved in related litigation, which may result in judgments and/or settlements. Challenges to our ESG practices and disclosures, and those of our customers and third parties, including from diverging views regarding ESG-related practices and disclosures may also harm our reputation.Increases in market interest rates have resulted in increased focus on asset and liability management, including HTM and AFS securities and related unrealized losses. Perceptions of our liquidity and financial condition, actions by the financial services industry generally, or by certain members or individuals in the industry may harm our reputation. Adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects and results of operations.We are subject to complex and evolving laws, regulations and interpretations regarding fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection and privacy, including the GDPR and the CCPA as modified by the CPRA, cross-border data movement, Reputation