AMERICAN INTERNATIONAL GROUP INC

GENERAL

Our insurance subsidiaries are subject to extensive regulation and supervision in the jurisdictions in which our insurance businesses are located or operate. Insurance regulatory authorities in those jurisdictions are the primary regulators for those businesses; however, our operations are subject to regulation by many different types of regulatory authorities, including insurance, securities and derivatives regulators in the United States and abroad.

Insurance regulators, other regulatory authorities, law enforcement agencies, and other governmental authorities from time to time make inquiries and conduct examinations or investigations regarding our compliance, as well as compliance by other companies in our industry, with applicable laws. In addition, regulation, legislation and administrative policies that are not limited in application solely to the insurance market may significantly affect the insurance industry and certain of our operations, including regulation, legislation and administrative policies related to privacy, cybersecurity, government sanctions, anti-discrimination, financial services, securities, taxation and climate change. See Item 1A. Risk Factors – Regulation – "Our businesses are heavily regulated and changes in laws and regulations may affect our operations, increase our insurance subsidiary capital requirements or reduce our profitability".

We expect that the U.S. and international regulations applicable to us and our regulated entities will continue to evolve for the foreseeable future. See Item 1A. Risk Factors – Regulation – "New laws and regulations or new interpretations of current laws and regulations, both domestically and internationally, may affect our businesses, results of operations, financial condition and ability to compete effectively".

FINANCIAL, MARKET CONDUCT & CORPORATE GOVERNANCE OVERSIGHT

The method of insurance regulation of our insurance subsidiaries varies, but generally has its source in statutes that delegate regulatory and supervisory powers to a state insurance official (in the United States) or another governmental agency (outside the United States). The regulation and supervision relate primarily to the financial condition of the insurers, corporate conduct and market conduct activities. In general, such regulation is for the protection of policyholders rather than the creditors or equity owners of these companies. Financial, market conduct and corporate conduct oversight varies by jurisdiction, but can include activities such as:

(a)approval of policy language and rates;

(b)advertising practices;

(c)establishing minimum capital and liquidity requirements;

(d)licensing of insurers and their agents;

(e)requiring registration and periodic reporting by insurance companies that are licensed in the jurisdiction;

(f)evaluating and, in some cases, requiring regulatory approval of, certain transactions between insurance company subsidiaries and their affiliates;

(g)imposing restrictions and limitations on the amount of dividends or other distributions payable by an insurance company;

(h)enforcing rules related to outsourcing of material functions;

(i)requiring deposits of securities for the benefit of policyholders;

(j)establishing requirements for acceptability of reinsurers and credit for reinsurance;

(k)establishing requirements for reserves; and

(l)enterprise risk management (including technology risk management) and corporate governance requirements.

Our insurance subsidiaries are generally subject to laws and regulations that prescribe the type, quality and concentration of investments they can make and permissible investment practices, such as derivatives, securities lending and repurchase transactions. In non-U.S. jurisdictions, our insurance subsidiaries may also be subject to laws requiring certain amounts and types of local investment.

Insurance laws in many jurisdictions also provide that no person, corporation or other entity may acquire control of an insurance company, or a controlling interest in (or prescribed percentage of capital of) any direct or indirect parent company of an insurance company, without the prior approval of, or notice to, such insurance company’s domiciliary insurance regulator.

As a holding company with no significant business operations of its own, AIG Parent depends on dividends from our subsidiaries to meet our obligations. U.S. state insurance laws typically provide that dividends in excess of certain prescribed limits are considered to be extraordinary dividends and require prior approval or non- disapproval from the applicable insurance regulator. Outside the U.S., insurers, subject to certain exceptions, are permitted to pay dividends subject to maintaining prescribed capital and solvency requirements and ensuring that dividends are made out of profits/retained earnings.

Further, as part of their regulatory oversight processes, insurance regulators conduct periodic examinations of our insurance subsidiaries. Such examinations can cover a broad scope of the insurance subsidiary’s operations, including the financial strength of the insurance subsidiary; sales, marketing and claims handling practices; risk management; capital and liquidity management; and information technology operations (including emerging technology risks).

Insurance and securities regulators and other law enforcement agencies and attorneys general also, from time to time, make inquiries, issue data calls and conduct examinations or investigations regarding compliance with insurance and other laws or for informational purposes that can be company-specific or part of a broader industry-wide effort.

There can be no assurance that any noncompliance with such applicable laws, regulations or guidance would not have a material adverse effect on our business or results of operations.

REGULATORY REGIMES

United States

States

At the state-level, the National Association of Insurance Commissioners (NAIC) is a standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and five U.S. territories. The NAIC is not a regulator, but it assists state insurance regulators in establishing standards and best practices, conducting peer reviews and coordinating regulatory oversight. Model laws and regulations promulgated by the NAIC only become effective in a state once formally adopted by such state and are subject to revision by each state. Examples of NAIC models adopted in substantial part by all states include:

•The Risk-Based Capital (RBC) for Insurers Model Act, which incorporates an RBC formula calculated in accordance with instructions updated annually by the NAIC that is designed to measure the adequacy of an insurer’s total adjusted capital, as calculated pursuant to the RBC formula, in relation to certain risks inherent in its business, and authorizes certain regulatory actions regarding insurers whose RBC levels fall below specific thresholds. The NAIC has adopted certain changes, and is considering others, regarding how RBC is calculated, including initiatives aimed at a comprehensive review of the RBC investment framework. The RBC levels of each of our U.S. domiciled insurance companies exceeded each of these specific thresholds as of December 31, 2024. In addition to RBC requirements, the insurance laws of our domiciliary states prescribe certain minimum capital and surplus requirements for insurance companies. If any of our insurance entities fell below prescribed levels of statutory capital and surplus, it would be our intention to provide appropriate capital or other types of support to that entity. For additional information, see Part II, Item 7. MD&A – Liquidity and Capital Resources – Liquidity and Capital Resources of AIG Parent and Subsidiaries – Insurance Companies.

•The Insurance Holding Company System Regulatory Act and the Insurance Holding Company System Model Regulation (together, the Holding Company Models) include: provisions authorizing insurance commissioners to act as global group-wide supervisors for internationally active insurance groups and participate in supervisory colleges; standards for transactions between a domestic insurance company and its affiliates and regulatory approval requirements for certain of such transactions; requirements for obtaining regulatory approval for acquiring control of a domestic insurance company; and the requirement that the ultimate controlling person of a U.S. insurer file an annual enterprise risk report with its lead state regulator identifying risks likely to have a material adverse effect upon the financial condition or liquidity of its licensed insurers or the insurance holding company system as a whole, among other requirements. The New York State Department of Financial Services (NYDFS) is AIG’s lead U.S.-state regulator, and leads AIG’s Supervisory College meetings, which consist of AIG’s key global regulators.

•The Risk Management and Own Risk and Solvency Assessment Model Act, which requires that insurers maintain a risk management framework, conduct an internal own risk and solvency assessment of the insurer’s material risks in normal and stressed environments, and submit annual Own Risk and Solvency Assessment (ORSA) summary reports to the insurance group’s lead U.S.-state regulator.

•The Corporate Governance Annual Disclosure Model Act (CGAD), which requires insurers to submit an annual filing regarding their corporate governance structure, policies and practices.

The NAIC also provides standardized insurance industry accounting and reporting guidance through the NAIC Accounting Manual, which establishes statutory accounting principles applicable to insurance companies. Statutory accounting principles promulgated by the NAIC may be modified by individual state laws, regulations and permitted practices granted by our domiciliary insurance regulators.

The NAIC has undertaken a multi-pronged effort to determine whether additional standards, safeguards or disclosures are required in connection with certain investments by U.S. insurance companies, including related party investments, structured securities and other complex assets.

In December 2020, the NAIC amended the Holding Company Models to incorporate a Group Capital Calculation (GCC) requirement, which requires the ultimate controlling person of every U.S. insurer to submit GCC reports to the insurance group’s lead state insurance regulator on an annual basis unless an exemption applies. These GCC provisions were incorporated in New York State laws in August 2023, making AIG formally subject to the GCC beginning in 2024. The GCC is intended to serve as an analytical tool for evaluating a firm’s capital position at the group level and is not intended as a prescribed group capital requirement.

U.S. states have state insurance guaranty associations in which insurers admitted in the state are required by law to be members. Member insurers may be assessed by the associations for certain obligations of insolvent insurance companies to policyholders and claimants. The aggregate assessments levied against us have not been material to our financial condition in any of the past three years.

Federal

At the U.S. federal level, AIG is impacted by the activities of policymakers and by the laws and regulations enforced by various federal agencies.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), signed into law in 2010, brought about extensive changes to financial regulation in the United States and established the Federal Insurance Office (FIO) to serve as the central insurance authority in the federal government. While not serving a regulatory function, FIO performs certain duties related to the business of insurance and has authority to collect information on the insurance industry and recommend prudential standards. In addition, FIO monitors market access issues, represents the United States in international insurance forums and has authority to determine if certain regulations are preempted by covered agreements. FIO’s approval is required to subject a financial company whose largest U.S. subsidiary is an insurer to the special orderly liquidation process outside the federal bankruptcy code, administered by the FDIC pursuant to Dodd-Frank. U.S. insurance subsidiaries of any such financial company, however, would remain subject to rehabilitation and liquidation proceedings under state insurance laws.

FIO also assists the Secretary of the Treasury in administering the U.S. Terrorism Risk Insurance Act (TRIA), enacted in 2002 to support insurance coverage for certain terrorist acts in the U.S. The program was continued under the Terrorism Risk Insurance Program Reauthorization Act of 2019 (TRIPRA) through December 31, 2027 and is intended to provide reinsurance coverage from the federal government in limited circumstances for certified acts of terrorism that exceed a certain threshold of industry losses.

Title I of Dodd-Frank established the Financial Stability Oversight Council (Council), which is authorized to determine that certain nonbank financial companies be designated as nonbank systemically important financial institutions (SIFIs) subject to supervision by the Board of Governors of the Federal Reserve System and enhanced prudential standards. Designation by the Council of any nonbank SIFI is subject to certain statutory and regulatory standards and to the Council’s guidance. The Council may also recommend that state insurance regulators or other regulators apply new or heightened standards and safeguards for activities or practices that insurers or other nonbank financial services companies engage in.

Title V of Dodd-Frank authorizes the United States to enter into covered agreements with foreign governments or regulatory entities regarding the business of insurance and reinsurance. On September 22, 2017, the U.S. and the European Union (EU) entered into such an agreement, and on December 18, 2018, the U.S. signed a covered agreement with the United Kingdom (UK), which is similar to the agreement with the EU. Under the agreements, AIG is subject to consolidated group supervision by its relevant U.S. insurance supervisors only, and generally does not have to satisfy EU Solvency II capital, reporting and governance requirements at the consolidated group level. The covered agreements also required various U.S. reinsurance collateral reforms, which were adopted by all U.S. states.

Title VII of Dodd-Frank provides for significantly increased regulation of, and restrictions on, derivatives markets and transactions that have affected various activities of insurance and other financial services companies, including (i) regulatory reporting for swaps, including security-based swaps, (ii) mandated clearing through central counterparties and execution through regulated swap execution facilities for certain swaps (other than security-based swaps) and (iii) margin and collateral requirements.

International

In the UK, the Prudential Regulation Authority (PRA) is the lead prudential supervisor for our UK insurance operations and the Financial Conduct Authority has oversight of AIG’s insurance operations for consumer protection and competition matters. The Society of Lloyd’s also provides regulatory oversight of AIG’s Lloyd’s Managing Agent, Talbot Underwriting Limited.

In the EU, various Directives and Regulations affect our international insurance operations. The Luxembourg insurance regulator, the Commissariat aux Assurances, is the insurance regulator for AIG Europe SA, which serves our European Economic Area (EEA) and Swiss policyholders. In addition, financial companies that operate in the EU are subject to a range of regulations enforced by the national regulators in each member state in which that firm operates. Solvency II governs the insurance industry’s solvency framework for the EU, including minimum capital and solvency requirements, governance requirements, risk management and public reporting standards applicable to AIG’s subsidiaries operating in the EU.

AIG’s operating insurance subsidiaries in Bermuda are regulated by the Bermuda Monetary Authority (BMA). Bermuda’s Insurance Act 1978, the applicable Codes of Conduct and related regulations impose solvency and liquidity standards and auditing and reporting requirements on Bermuda insurance companies and grant the BMA powers to supervise, investigate and intervene in the affairs of insurance companies. A variety of requirements and restrictions are imposed on our Bermuda operating insurance subsidiaries including: periodic financial reporting; corporate governance framework; solvency and financial performance; compliance with minimum enhanced capital requirements; minimum solvency margins and liquidity ratios; and limitations on dividends and distributions.

The Monetary Authority of Singapore (MAS) supervises AIG’s insurance subsidiary in Singapore. It has broad authority under the Insurance Act 1966 to regulate insurance business in Singapore as well as insurers, insurance intermediaries and related institutions. Our Singapore insurance operations are subject to minimum capital and solvency requirements as well as financial reporting, corporate governance and conduct of business requirements. The MAS has authority to conduct inspections and investigations on insurers and to administer sanctions for regulatory non-compliance. Our Singapore insurance subsidiary holds insurance entities in the Asia Pacific region. The MAS holds the Chief Executive Officer of the Singapore insurance subsidiary principally responsible for the management and conduct of the business of the subsidiary, including the business of its subsidiaries and overseas branches.

The Japan Financial Services Agency (JFSA) regulates AIG’s operating insurance subsidiaries and insurance holding company in Japan. The JFSA has extensive authority under the Insurance Business Act and related regulations to oversee licensing, sales practices, business conduct, investments, reserves and solvency, amongst other matters. Our Japanese insurance operations are required to maintain a minimum solvency margin ratio (SMR), which is a measure of capital adequacy. The failure to maintain an appropriate SMR, or comply with other similar indicators of financial health, could result in the JFSA imposing corrective actions on our operations.

FSB and IAIS

The Financial Stability Board (FSB) consists of representatives of national financial authorities of the G20 countries. The FSB is not a regulator but is focused primarily on promoting international financial stability. The FSB has issued a series of frameworks and recommendations to address such issues as systemic financial risk, financial group supervision, capital and solvency standards, effective recovery and resolution regimes, corporate governance including compensation, and a number of related issues associated with responses to the financial crisis.

The International Association of Insurance Supervisors (IAIS) represents insurance regulators and supervisors of more than 200 jurisdictions (including regions and states) in nearly 140 countries and seeks to promote globally consistent insurance industry supervision. The IAIS is not a regulator, but one of its activities is to develop insurance regulatory standards for use by local authorities across the globe. For example, the IAIS has adopted a Common Framework (ComFrame) for the Supervision of Internationally Active Insurance Groups (IAIGs). ComFrame assists regulators in addressing an IAIG’s risks by providing supervisory standards for areas such as group supervision, governance and internal controls, enterprise risk management, and recovery and resolution planning. We currently meet the criteria set forth to identify an IAIG, and the NYDFS, as our group-wide supervisor, has publicly disclosed us as an IAIG on the IAIS’ register of IAIGs.

While the FSB no longer identifies global systemically important insurers (G-SIIs); in its place the IAIS has adopted an enhanced set of supervisory policy measures for the assessment and mitigation of systemic risk in the insurance sector (Holistic Framework). The Holistic Framework recognizes that systemic risk can emanate from specific activities and exposures arising from either sector-wide trends or concentrations in individual insurers. The FSB has also been engaging with member jurisdictions in order to encourage greater adherence to its “Key Attributes for Effective Resolution Regimes for the Insurance Sector” to ensure that large, internationally active insurers can exit the market in an orderly fashion and avoid the need for taxpayer bailouts. Starting in December 2024 the FSB began publishing an annual list of insurers, including AIG, that are subject to resolution planning requirements.

As part of ComFrame, the IAIS also developed a risk-based global Insurance Capital Standard (ICS) applicable to IAIGs. The IAIS formally adopted the ICS at its annual general meeting in December 2024. The ICS is intended to be applied as a group-wide prescribed capital requirement, defined as a solvency control level above which the supervisor does not intervene on capital adequacy grounds. In parallel, the United States developed the Aggregation Method (AM) as an alternative approach to the consolidated ICS group-capital calculation. Following a comparability assessment, the IAIS determined in November 2024 that the AM delivers comparable outcomes to the ICS and therefore provides the basis for implementation of the ICS. The AM will be implemented in the United States through the GCC.

The standards issued by the FSB and/or the IAIS are not binding on the United States or other jurisdictions around the world unless and until the appropriate local governmental bodies or regulators adopt laws or regulations implementing such standards.

PRIVACY, DATA PROTECTION, CYBERSECURITY AND ARTIFICIAL INTELLIGENCE REQUIREMENTS

We are subject to various laws and regulations that require financial institutions and other businesses to protect and safeguard personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information. We also are subject to U.S. federal and state laws and regulations requiring notification to affected individuals and regulators of a data breach. Below we highlight a few key applicable privacy, data protection, cybersecurity and artificial intelligence (AI) laws and regulations.

In the European Union, the EU Digital Operational Resilience Act (DORA) will require covered entities, including insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries to comply with a wide range of organizational and technical requirements to identify, manage and mitigate operational risk arising from use of network and information systems and, in particular, the use of third party information and communication technology service providers. Covered entities were required to comply with DORA by January 17, 2025.

In October 2017, the NAIC adopted the Insurance Data Security Model Law (NAIC Data Security Model Law), which, among other things, requires insurers, insurance producers and other entities required to be licensed under state insurance laws to develop and maintain a written information security program, conduct risk assessments, and oversee the data security practices of third-party service providers. As of December 31, 2024, more than 20 jurisdictions had adopted the NAIC Data Security Model Law. In addition, on March 1, 2019, the NYDFS’s cybersecurity regulation became fully effective, requiring covered financial institutions, including insurance entities licensed in New York, to, among other things, implement a cybersecurity program designed to protect information systems. On November 1, 2023, the NYDFS published amendments to this cybersecurity regulation, which include additional obligations for large insurers including enhanced and updated governance, risk assessment, and technology requirements, new notification obligations, and clarifying changes regarding enforcement.

The State of California enacted the California Consumer Privacy Act of 2018 (CCPA), which went into effect as of January 1, 2020, and imposes significant privacy obligations on businesses handling data related to California residents. The law has a number of exceptions; it does not apply to personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act (GLBA) and implementing regulations or the California Financial Information Privacy Act (FIPA). The California Privacy Rights Act (CPRA) passed in November 2020 became effective January 1, 2023 and amends the CCPA to create additional privacy rights and obligations in California. A number of other states, including Colorado, Connecticut, Texas and Virginia also enacted comprehensive consumer data privacy laws and many other states have proposed similar laws, albeit with similar exemptions for entities and/or data governed by the GLBA.

These privacy laws impose requirements on covered businesses that are similar to those imposed by the CCPA with respect to privacy notices, data subject rights and data security standards.

The Securities and Exchange Commission (SEC) requires that registrants disclose any material cybersecurity incident on Form 8-K within four business days of determining that the incident the registrant has experienced is material. Periodic disclosures of, among other things, (i) details on the company’s cybersecurity policies and procedures, and (ii) cybersecurity governance and oversight policies, including the board of directors’ oversight of any material incidents (individually or in the aggregate) are also required.

The EU General Data Protection Regulation (GDPR) scope extends to entities established within the EEA (i.e., EU member states plus Iceland, Liechtenstein and Norway) and to certain entities not established in the EEA (in certain instances, if they solicit or target individuals in the EU by offering goods or services to EEA data subjects or monitoring the personal behavior of EEA data subjects (e.g., in an online context)). The GDPR was also onshored in the UK through the European Union (Withdrawal) Act 2018, with adjustments as provided in the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. Sanctions for non-compliance with the GDPR are onerous, with the potential for fines of up to 4 percent of global revenue for the most serious infringements of the GDPR.

We have sought to address the GDPR’s requirements by demonstrating accountability for compliance with the GDPR’s principles relating to processing of personal data, maintaining records of processing and completing mandatory Data Protection Impact Assessments in connection with higher risk data processing activities.

The GDPR imposes requirements on the transfer of personal data outside of the EEA, including via standard contractual clauses supplemented by an assessment and due diligence of the legal and regulatory landscape of the jurisdiction of the data importer, the channels used to transmit personal data and the processors or subprocessors of personal data.

The NAIC and certain U.S. states have adopted or are considering regulations and guidance relating to the use of “big data,” AI, machine learning and other technology innovations in the insurance marketplace. For example, in December 2023, the NAIC adopted a model bulletin on the use of AI by insurers that sets forth governance, risk management and other requirements that insurers using AI are expected to establish. In addition, state insurance regulators in the United States have issued and will continue to consider regulations or proposed guidelines in the use of external data, algorithms and AI in insurance practices, including underwriting, marketing, and claims practices.

The EEA and the UK have also taken steps to regulate the use of data and algorithms used for the purpose of AI and automated decision-making. The European Union Artificial Intelligence Act, which entered into force on August 1, 2024, and will be effective from August 2, 2026, will broadly regulate the use of AI within the European Union. European countries, and supranational political organizations like the EU and the Council of Europe, are expected to continue taking an active role in regulating AI in ways that may impact the insurance industry.

We also are subject to other international laws and regulations that require financial institutions and other businesses to protect personal and other sensitive information and provide notice of their practices relating to the collection, disclosure and other processing of personal information and to obtain consent for specific processing activities. We are also subject to laws and regulations requiring notification to affected individuals and regulators of security breaches and laws and regulations regarding data localization and the cross-border transfer of information.

CLIMATE CHANGE

In recent years, federal- and state-level lawmakers and regulators in the United States and in other major countries in which we operate have increased their scrutiny on financial institutions’ and other companies’ governance, risk oversight, disclosures, plans, policies and practices in connection with climate change. There have been active and significant regulatory developments on these issues in the form of newly proposed, issued or implemented laws, rules, regulations, guidance and frameworks regarding climate change that impose, or will impose if and when effective, new requirements and expectations, including in connection with climate- related governance, risk management, disclosures, stress testing and scenario analysis. Regulators in several jurisdictions are considering the so-called protection gap as it relates to climate – instances in which populations are under-insured or there is insufficient coverage to protect policyholders against the risks associated with climate change. In March 2024, the SEC adopted final rules on climate-related disclosure, which have been stayed pending completion of judicial review in the U.S. Court of Appeals for the Eighth Circuit, and which may be reconsidered by the new U.S. administration. We continue to actively monitor the regulatory landscape surrounding these issues.