CITIZENS FINANCIAL GROUP INCRI

We are committed to maintaining a strong, integrated and proactive approach to the management of all risks to which we are exposed in pursuit of our business objectives. A key aspect of our Board’s responsibility as the main decision-making body is setting our risk appetite to ensure that the levels of risk that we are willing to accept in the attainment of our strategic business and financial objectives are clearly understood.

To enable our Board to carry out its objectives, it has delegated authority for risk management activities, as well as governance and oversight of those activities, to a number of Board and executive management level risk committees. The Executive Risk Committee, chaired by the Chief Risk Officer, is responsible for oversight of risk across the enterprise and actively considers our inherent material risks, analyzes our overall risk profile and seeks confirmation that the risks are being appropriately identified, assessed and mitigated. Reporting to the Executive Risk Committee are the following committees covering specific areas of risk: Compliance and Operational Risk, Model Risk, Credit Policy, Asset Liability, Business Initiatives Review, and Conduct and Ethics.

Risk Framework

Our risk management framework is embedded in our business through a “Three Lines of Defense” model which defines responsibilities and accountabilities for risk management activities.

First Line of Defense

The business lines, including their associated support functions, are the first line of defense and are accountable for identifying, assessing, managing, and controlling the risks associated with the products and services they provide. The business lines are responsible for performing regular risk assessments to identify and assess the material risks that arise in their area of responsibility, complying with relevant risk policies, testing and certifying the adequacy and effectiveness of their operational and financial reporting controls on a regular basis, establishing and documenting operating procedures, and establishing a governance structure for identifying and managing risk.

Second Line of Defense

The second line of defense includes independent monitoring and control functions accountable for the development of risk and control frameworks and related policies, and their associated implementation. This centralized risk function is independent from the business and is accountable for overseeing and challenging our business lines on the effective management of their risks, including, but not limited to, credit, market, operational, regulatory, reputational, interest rate, liquidity, legal and strategic risks.

Third Line of Defense

Our Internal Audit function is the third line of defense providing independent assurance of the effectiveness of our internal controls, governance practices, and culture so that risk is managed appropriately for the size, complexity, and risk profile of the organization. Internal Audit has complete and unrestricted access to all of our records, physical properties and personnel. Internal Audit issues a report following each internal review and provides an audit opinion to the Board’s Audit Committee on a quarterly basis.

Credit Review reports to the Chief Audit Executive and provides the Board, senior management and other stakeholders with independent assurance on the quality of credit portfolios and adherence to agreed Credit Risk Appetite and Credit Policies and processes. In line with its procedures and regulatory expectations, the Credit Review function undertakes a program of portfolio testing, assessing and reporting through four Risk Pillars of Asset Quality, Rating and Data Integrity, Risk Management and Credit Risk Appetite.

Risk Appetite

Risk appetite is a strategic business and risk management tool. We define our risk appetite as the maximum limit of acceptable risk beyond which we could be unable to achieve our strategic objectives and capital adequacy obligations.

Citizens Financial Group, Inc. | 64

Our principal non-market risks include credit, operational, regulatory, reputational, liquidity and strategic risks. We are also subject to certain market risks which include potential losses arising from changes in interest rates, foreign exchange rates, equity prices, commodity prices and/or other relevant market rates or prices. Market risk in our business arises from trading activities that serve customer needs, including hedging of interest rates, foreign exchange risk and non-trading activities within capital markets. We have established enterprise-wide policies and methodologies to identify, measure, monitor and report on market risk. We actively manage both trading and non-trading market risks. See “Market Risk” for further information. Our risk appetite is reviewed and approved annually by the Board Risk Committee.

Credit Risk

Overview

Credit risk represents the potential for loss arising from a customer, counterparty, or issuer failing to perform in accordance with the contractual terms of the obligation. While the majority of our credit risk is associated with lending activities, we do engage with other financial counterparties for a variety of purposes including investing, asset and liability management, and trading activities. Given the financial impact of credit risk on our earnings and balance sheet, the assessment, approval and management of credit risk represents a major part of our overall risk-management responsibility.

Objective

The independent Credit Risk Function is responsible for reviewing and approving credit risk appetite across all lines of business and credit products, approving larger and higher-risk credit transactions, monitoring portfolio performance, identifying problem credit exposures, and ensuring remedial management.

Organizational Structure

Management and oversight of credit risk is the responsibility of both the business line and the second line of defense. The second line of defense, the independent Credit Risk Function, is led by the Chief Credit Officer who oversees all credit risk and reports to the Chief Risk Officer. The Chief Credit Officer, acting in a manner consistent with Board policies, has responsibility for, among other things, the governance process around policies, procedures, risk acceptance criteria, credit risk appetite, limits and authority delegation. The Chief Credit Officer and team also have responsibility for credit approvals for larger and higher-risk transactions and oversight of line of business credit risk activities. Reporting to the Chief Credit Officer are the heads of the second line of defense credit functions specializing in: Consumer Banking, Commercial Banking, Citizens Restructuring Management, Portfolio and Corporate Reporting, ALLL Analytics, Current Expected Credit Loss, and Credit Policy and Administration. Each team under these leaders is composed of experienced credit professionals.

Governance

The primary mechanisms used to govern our credit risk function are our consumer and commercial credit policies. These policies outline the minimum acceptable lending standards that align with our desired risk appetite. Material changes in our business model and strategies that identify a need to change our risk appetite or highlight a risk not previously contemplated are identified by the individual committees and presented to the Credit Policy Committee, Executive Risk Committee and the Board Risk Committee for approval, as appropriate.

Key Management Processes

We employ a comprehensive and integrated risk control program to proactively identify, measure, monitor, and mitigate existing and emerging credit risks across the credit life cycle including origination, account/portfolio management, and loss mitigation and recovery.

Consumer

On the Consumer Banking side of credit risk, our teams use models to evaluate consumer loans across the life cycle of the loan. Credit scoring models are used to forecast the probability of default of an applicant at origination. When approving customers for a new loan or extension of an existing credit line, credit scores are used in conjunction with other credit risk variables such as affordability, length of term, collateral value, collateral type, and lien subordination.

Citizens Financial Group, Inc. | 65

Lending authority is granted by the second line of defense credit risk function to each underwriter to ensure proper oversight of the underwriting teams. The amount of delegated authority depends on the experience of the individual. We periodically evaluate the performance of each underwriter and annually reauthorize their delegated authority. Only senior members of the second line of defense credit risk team are authorized to approve significant exceptions to credit policies. It is not uncommon to make exceptions to established policies when compensating factors are present. There are exception limits which, when reached, trigger a comprehensive analysis.

Credit scores and collateral values are refreshed at regular intervals once an account is established to allow for proactive identification of increasing or decreasing levels of credit risk. Our approach to managing credit risk is highly analytical and, where appropriate, is automated to ensure consistency and efficiency.

Commercial

On the Commercial Banking side of credit risk, risk management begins with defined credit products and policies and is separated into commercial and industrial loans, CRE and leases. Within commercial and industrial loans and leases there are separate verticals established for certain specialty products (e.g., asset-based lending, leasing, franchise finance, health care, technology and mid-corporate). A “specialty vertical” is a stand-alone team of industry or product specialists. Substantially all activity that falls under the ambit of the defined industry or product is managed through a specialty vertical when one exists. CRE also operates as a specialty vertical.

Commercial transactions are subject to individual analysis and approval at origination and, with few exceptions, are subject to a formal annual review requirement. The underwriting process includes the establishment and approval of credit grades that establish the PD and LGD. All material transactions require the approval of both a business line approver and an independent credit approver with the requisite level of delegated authority. The approval level of a particular credit facility is determined by the size of the credit relationship as well as the PD. The checks and balances in the credit process and the independence of the credit approver function are designed to appropriately assess and sanction the level of credit risk being accepted, facilitate the early recognition of credit problems when they occur, and to provide for effective problem asset management and resolution. All authority to grant credit is delegated through the independent Credit Risk function and is closely monitored and updated annually at a minimum.

The primary factors considered in commercial credit approvals are the financial strength of the borrower, assessment of the borrower’s management capabilities, cash flows from operations, industry sector trends, type and sufficiency of collateral, type of exposure, transaction structure, and the general economic outlook. While these are the primary factors considered, there are a number of other factors that may be considered in the decision process. In addition to the credit analysis conducted during the approval process at origination and annual review, our Credit Review group performs testing to provide an independent review and assessment of the quality of the portfolio and new originations. This group conducts portfolio reviews on a risk-based cycle to evaluate individual loans and validate risk ratings, as well as test the consistency of the credit processes and the effectiveness of credit risk management.

The maximum level of credit exposure to individual credit borrowers is limited by policy guidelines based on the perceived risk of each borrower or related group of borrowers. Concentration risk is managed through limits on industry asset class and loan quality factors. We focus predominantly on extending credit to commercial customers with existing or expandable relationships within our primary markets, although we do engage in lending opportunities outside our primary markets if we believe that the associated risks are acceptable and aligned with strategic initiatives.

Substantially all loans categorized as Classified are managed by a specialized group of credit professionals.