CITIZENS FINANCIAL GROUP INCRI

We are committed to maintaining a strong, integrated and proactive approach to the management of all risks to which we are exposed in pursuit of our business objectives. A key aspect of our Board’s responsibility as the main decision-making body is setting our risk appetite to ensure that the levels of risk that we are willing to accept in the attainment of our strategic business and financial objectives are clearly understood.

To enable our Board to carry out its objectives, it has delegated authority for risk management activities, as well as governance and oversight of those activities, to a number of Board and executive management level risk committees. The Executive Risk Committee, chaired by the Chief Risk Officer, is responsible for oversight of risk across the enterprise and actively considers our inherent material risks, analyzes our overall risk profile and seeks confirmation that the risks are being appropriately identified, assessed and mitigated. Reporting to the Executive Risk Committee are the following committees covering specific areas of risk: Compliance and Operational Risk, Model Risk, Credit Policy, Asset Liability, Business Initiatives Review, and Conduct and Ethics.

Risk Framework

Our risk management framework is embedded in our business through a “Three Lines of Defense” model which defines responsibilities and accountabilities for risk management activities.

First Line of Defense

The business lines, including their associated support functions, are the first line of defense and are accountable for identifying, assessing, managing, and controlling the risks associated with the products and services they provide. The business lines are responsible for performing regular risk assessments to identify and assess the material risks that arise in their area of responsibility, complying with relevant risk policies, testing and certifying the adequacy and effectiveness of their operational and financial reporting controls on a regular basis, establishing and documenting operating procedures, and establishing a governance structure for identifying and managing risk.

Second Line of Defense

The second line of defense includes independent monitoring and control functions accountable for the development of risk and control frameworks and related policies, and their associated implementation. This centralized risk function is independent from the business and is accountable for overseeing and challenging our business lines on the effective management of their risks including, but not limited to, credit, market, operational, regulatory, reputational, interest rate, liquidity, legal and strategic risks.

Third Line of Defense

Our Internal Audit function is the third line of defense providing independent assurance of the effectiveness of our internal controls and governance practices so that risk is managed appropriately for the size, complexity, and risk profile of the organization. Internal Audit has complete and unrestricted access to all of our records, physical properties and personnel. Internal Audit issues a report following each internal review and provides an audit opinion to the Board’s Audit Committee on a quarterly basis.

Credit Review reports to the Chief Audit Executive and provides the Board, senior management and other stakeholders with independent assurance on the quality of credit portfolios and adherence to agreed Credit Risk Appetite and Credit Policies and processes. In line with its procedures and regulatory expectations, the Credit Review function undertakes a program of portfolio testing, assessing and reporting through four Risk Pillars of Asset Quality, Rating and Data Integrity, Risk Management and Credit Risk Appetite.

Risk Appetite

Risk appetite is a strategic business and risk management tool. We define our risk appetite as the maximum limit of acceptable risk beyond which we could be unable to achieve our strategic objectives and capital adequacy obligations.

Citizens Financial Group, Inc. | 66

Our principal non-market risks include credit, operational, regulatory, reputational, liquidity and strategic risks. We are also subject to certain market risks which include potential losses arising from changes in interest rates, foreign exchange rates, equity prices, commodity prices and/or other relevant market rates or prices. Market risk in our business arises from trading activities that serve customer needs, including interest rate hedging, foreign exchange risk and non-trading activities within capital markets. We have established enterprise-wide policies and methodologies to identify, measure, monitor and report on market risk. We actively manage both trading and non-trading market risks. See “Market Risk” for further information. Our risk appetite is reviewed and approved annually by the Board Risk Committee.

Credit Risk Management

Credit risk represents the potential for loss arising from the failure of a customer, counterparty, or issuer to perform in accordance with the contractual terms of an obligation. While the majority of our credit risk is associated with lending activities, we do engage with other financial counterparties for a variety of purposes including investing, asset and liability management, and trading activities. Given the financial impact of credit risk on our earnings and balance sheet, the assessment, approval and management of credit risk represents a significant part of our overall risk-management responsibility.

Our independent Credit Risk Function is responsible for reviewing and approving the credit risk appetite across all lines of business and credit products, approving larger and higher-risk credit transactions, monitoring portfolio performance, identifying problem credit exposures, and ensuring remedial management. Credit Risk actively monitors and manages concentrations of loan limits, loan types, industries, and geographies to ensure that our risk appetite is well balanced to achieve our goals.

Management and oversight of credit risk is the responsibility of each respective business line and the second line of defense. Our second line of defense, the independent Credit Risk Function, is led by the Chief Credit Officer who oversees all credit risk and reports to the Chief Risk Officer. The Chief Credit Officer, acting in a manner consistent with Board policies, has responsibility for, among other things, the governance process around policies, procedures, risk acceptance criteria, credit risk appetite, limits and authority delegation. The Chief Credit Officer and team also have responsibility for credit approvals for larger and higher-risk transactions and oversight of line of business credit risk activities. Reporting to the Chief Credit Officer are the heads of the second line of defense credit functions specializing in: Consumer Banking, Commercial Banking, Private Banking, Citizens Restructuring Management, Portfolio and Corporate Reporting, ACL Analytics, Current Expected Credit Loss, and Credit Policy and Administration. Each team under these leaders is composed of experienced credit professionals.

The primary mechanisms that govern our risk management include, but are not limited to, credit assessments, models, scorecards, credit limits, exposure management, concentration limits, balance sheet diversification, portfolio management, collateral requirements and individual credit policies tailored for Consumer and Commercial lending. Our policies outline the minimum acceptable lending standards and their alignment with our desired risk appetite. Material changes in our business model and strategies that identify a need to change our risk appetite or highlight a risk not previously contemplated are identified by the individual committees and presented to the Credit Policy Committee, Executive Risk Committee and the Board Risk Committee for approval, as appropriate.

We employ a comprehensive and integrated risk control program to proactively identify, measure, monitor, and mitigate existing and emerging credit risks across the credit life cycle including origination, account/portfolio management, and loss mitigation and recovery.

Consumer

We utilize several distinct business processes and channels to originate consumer credit, including traditional branch lending and mobile and online banking. Each distinct underwriting and origination activity includes unique credit risk characteristics, with loan pricing commensurate with the differing risk profiles. Consumer credit approvals are typically based on the financial strength and payment history of the borrower, type of exposure, and transaction structure, among other factors.

Citizens Financial Group, Inc. | 67

Lending authority is granted to each first line approver by the second line of defense credit risk function to ensure proper oversight of the underwriting teams. We periodically evaluate the performance of each first line approver and annually reauthorize their delegated authority. Only senior members of the second line of defense credit risk function are authorized to approve significant exceptions to credit policies, which are not uncommon when compensating factors are present. Established exception limits, when reached or exceeded, trigger a comprehensive analysis.

For Consumer Banking, our teams use models to evaluate consumer loans across their life cycle. Credit scoring models are used to forecast the probability of default of an applicant prior to origination. When approving customers for a new loan or extension of an existing credit line, credit scores are used in conjunction with other credit risk variables such as affordability, length of term, collateral value, collateral type, and lien subordination.

Our consumer banking portfolio is comprised of five categories of loans to consumers: residential mortgages, home equity, education, automobile, and other retail.

Residential Mortgages and Home Equity

Residential mortgages are loans to consumers to purchase or refinance 1-4 family residential properties and are generally structured with repayment terms ranging from 15 to 30 years. We originate both fixed- and adjustable-rate (traditional and interest-only) residential mortgages, with the properties securing such mortgages primarily located within our geographic footprint. We do not originate residential mortgages that allow negative amortization or multiple payment options. Residential mortgage applications are underwritten using consistent credit policies and processes, with a focus on higher-quality borrowers.

Residential mortgages are originated based on an appraisal completed during the credit underwriting process, with borrower performance tracked monthly by segmenting the mortgage portfolio into pools based on product type. The portfolio is also segmented based upon delinquency, nonperforming status, modification and bankruptcy status, FICO scores, LTV and geographic concentrations as part of our overall risk management analysis and monitoring.

Home equity loans primarily include lines of credit secured by a first- or second-lien on the borrower’s residence, which enable the customer to borrow against the equity in their home or refinance existing mortgage debt. The product is a variable-rate, interest-only line of credit that allows the borrower to draw against the available line with no required principal payments during an initial 10-year revolving period. At the end of the revolving period, the home equity line of credit converts into a 15-year amortizing structure.

Home equity applications are underwritten using full income and credit standards with underwriting criteria based on minimum credit scores, debt-to-income ratios, and combined LTV ratios utilizing current collateral valuations. The underwriting for variable-rate lines of credit also incorporates a stress analysis for rising interest rates. We actively manage lines of credit and adjust their lending limit when we believe it is necessary based on a borrower’s FICO score and any associated credit deterioration.

Borrower performance of the home equity portfolio is tracked on a monthly basis for internal reporting and risk management purposes by segmenting the portfolio into pools, which are typically based on origination vintage tranches. The performance of any related mortgage loans is also tracked regardless of whether we hold a lien on such loans. A third-party service provider is utilized to obtain updated loan information, including lien and collateral data that is aggregated from both public and private sources.

LTV information on our outstanding residential mortgages and home equity portfolios is updated quarterly based on a combination of automated valuation model updates and relevant home price indices. LTV is the ratio of the loan’s outstanding principal balance to the current property value estimate. For home equity and second mortgages, CLTV is the ratio of the first mortgage original principal balance and the second lien outstanding principal balance combined to the current property value estimate.

Property values for both residential mortgages and home equity loans are refreshed quarterly after an account is established to allow for proactive identification of changing levels of credit risk and to facilitate our portfolio management, including workout and loss mitigation functions. Our approach to managing credit risk is highly analytical and, where appropriate, is automated to ensure consistency and efficiency.

Citizens Financial Group, Inc. | 68

Education

The education portfolio is primarily comprised of two products, in-school loans and education refinance loans. An in-school loan is generally financed over a 5, 10, or 15-year term and provides for fixed or variable rate financing to students while enrolled in school, with the option to pay while in school or to defer payment until after graduation. An education refinance loan provides a refinancing option on an existing education loan for students and parents, with 5 to 20-year terms and fixed or variable rates.

The performance of the education portfolio is measured monthly, including updated FICO, or equivalent, scores. We analyze the portfolio by product channel and type, and regularly evaluate default and delinquency experience for internal reporting and risk management purposes.

Automobile

The automobile portfolio consists of loans originated primarily through independent franchised dealers, including some located in select states outside of our primary geographic footprint. This portfolio is in runoff as we discontinued the origination of automobile loans in 2023.

The performance of the automobile loan portfolio is measured monthly, including updated collateral values and FICO, or equivalent, scores. We analyze the portfolio by product channel and type and regularly evaluate default and delinquency experience for internal reporting and risk management purposes.

Other Retail

Other retail loans primarily consist of unsecured consumer lending products, including credit cards and point-of-sale loans originated through partnerships with third-party companies. These loans are underwritten in accordance with our established credit policies and guidelines. Certain point-of-sale loans originated with third-party companies include credit loss protection agreements provided by those companies, which mitigate our risk of loss. Given the variable nature of the credit card portfolio, we actively monitor interest rate impacts and portfolio performance to ensure alignment with our risk tolerance.

Commercial

Our commercial banking portfolio consists of traditional commercial and industrial loans, commercial leases, and commercial real estate loans.

For Commercial Banking, risk management includes defined credit products and policies and is separated into commercial and industrial loans, CRE and leases. Separate verticals are established within commercial and industrial loans and leases for certain specialty products. Substantially all activity that falls under a defined industry or product is managed through a specialty vertical and a stand-alone team of industry, product, and credit risk specialists. CRE also operates as a specialty vertical.

Commercial transactions are subject to individual analysis and approval before origination and, with few exceptions, are subject to a formal annual review requirement. The underwriting process includes the establishment and approval of credit grades that establish the probability of default and loss given default. Material transactions require both a business line approver and an independent credit approver with the requisite level of delegated authority as determined by the size of the credit relationship as well as the probability of default. Checks and balances in the credit process and the independence of the credit approver function are designed to appropriately assess and sanction the level of credit risk being accepted, actively monitor the portfolio to facilitate the early recognition of credit problems, and provide for effective problem asset management and resolution. Authority to grant credit is delegated through the independent Credit Risk Function and is closely monitored and updated annually, at a minimum.

The primary factors considered in commercial credit approvals are the financial strength of the borrower, assessment of the borrower’s management capabilities, cash flows from operations, industry sector trends, type and sufficiency of collateral, type of exposure, geography, transaction structure including loan covenants, and the general economic outlook. While these are the primary factors considered, there are a number of other factors that may be considered in the decision process. In addition to the credit analysis conducted during the approval process before origination and during an annual review, our Credit Review group performs testing to provide an independent review and assessment of the quality of the portfolio and new originations. This group conducts portfolio reviews on a risk-based cycle to evaluate individual loans and validate risk ratings, as well as tests the consistency of the credit processes and the effectiveness of credit risk management.

Citizens Financial Group, Inc. | 69

Credit exposure to individual borrowers is managed by policy guidelines based on the perceived risk of each borrower, or related group of borrowers, with concentration risk managed through limits on industry sectors, asset classes and loan quality factors.

Our standardized loan grading system considers many components that directly correlate to loan quality and likelihood of repayment. Substantially all loans categorized as Classified are managed by Citizens Restructuring Management, a specialized group of credit professionals that handle the day-to-day management of loan workouts, commercial recoveries, and problem loan sales to reduce losses and maximize recoveries. Their responsibilities include developing and implementing action plans, assessing risk ratings, and determining the adequacy of the ACL, accrual status, and ultimate collectability of the Classified loan portfolio.

Commercial and Industrial

The commercial and industrial portfolio includes both loans and leases made to commercial customers for use in normal business operations to finance working capital needs, equipment purchases, capital call facilities, or other projects/acquisitions. The loans and leases are generally underwritten individually to assess the quality of multiple sources of repayment including cash flow for debt service, collateral, and any guarantees from the business owner. Although real estate exists as collateral for these loans, the operation, sale, rental, or refinancing of the real estate is not considered the primary repayment source.

The risks inherent in the commercial and industrial portfolio are managed through origination policies, a defined loan concentration policy with established limits, ongoing loan- and portfolio-level reviews, recourse requirements, and continuous portfolio risk management activities. Our origination policies for the commercial and industrial portfolio include policies specific to loan product type, such as LTV and debt service coverage ratios, as applicable.

Commercial Real Estate

The CRE portfolio consists of both commercial property and construction loans that support a wide range of property development and investment activities including, but not limited to, multi-family, office spaces, industrial facilities, and retail shopping centers. These loans are typically repaid through cash flows generated from the operation, sale, or refinance of the property. Risk on these loans is mitigated by requiring collateral values that exceed the loan amount and underwriting the loan with projected cash flow in excess of the debt service requirement.

Our CRE construction portfolio primarily consists of multi-family, warehouse, office and data center property types. Loans in this portfolio are generally for construction projects that have been pre-sold or pre-leased, have secured permanent financing, or are made to real estate companies with significant equity invested in the project. A specialized real estate lending group is responsible for this portfolio and actively monitors the construction phase and manages the loan disbursements according to the predetermined construction schedule. Construction loans, which are generally short term in nature, are utilized to fund the development or renovation of real estate, with repayment often tied to the successful completion and stabilization of the property.

Risks inherent in this portfolio are managed by focusing on the financial strength and experience of the developer, market conditions and other specific attributes associated with each project. We limit our loan amounts based on appraised values, minimum equity investments by our borrowers, and adequate cash flows to support the debt.

Both macro- and loan-level stress-test scenarios based on existing and forecasted market conditions are part of the ongoing portfolio management process for the CRE portfolio. Ongoing portfolio-level reviews are performed that generate action plans based on occupancy levels or leasing revenues associated with the projects being reviewed. This highly individualized process requires working closely with all of our borrowers, as well as an in-depth knowledge of CRE project lending and the current market environment.

Property-type concentrations and both geographic and property-type performance metrics are actively monitored for all CRE loan types, with a focus on loans identified as higher risk based on our risk rating methodology. The portfolio is diversified by property type and loan size, representing a significant portion of the credit risk management strategies employed for this portfolio. Subsequent to the origination, the Credit Review group provides an independent review and assessment of the quality of the underwriting and risk from new loan originations.

Citizens Financial Group, Inc. | 70

Appraisal values are obtained in conjunction with all originations and renewals, and on an as-needed basis, to both comply with regulatory requirements and to ensure appropriate decisions regarding the ongoing management of the portfolio with respect to changing market conditions. Appraisals are obtained from approved vendors and are reviewed by an internal appraisal review group, which is composed of certified appraisers to ensure the quality of the valuation used in the underwriting process.