ASSURED GUARANTY LTD

Organizational Structure

The Company’s Board of Directors (the Board or AGL’s Board) oversees the risk management process. The Board employs an enterprise-wide approach to risk management that supports the Company’s business plans within a reasonable level of risk. Risk assessment and risk management are not only understanding the risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for that company. The Board annually approves the Company’s business plan, taking risk management into account. It also approves the Company’s risk appetite statement, which articulates the Company’s tolerance for risk and describes the general types of risk that the Company accepts or attempts to avoid. The involvement of the Board in setting the Company’s business strategy is a key part of its assessment of management’s risk tolerance and a determinant of what constitutes an appropriate level of risk for the Company.

While the Board has the ultimate oversight responsibility for the risk management process, various committees of the Board also have responsibility for risk assessment and risk management. The Risk Oversight Committee of the Board oversees the standards, controls, limits, underwriting guidelines and policies that the Company establishes and implements in respect of credit underwriting and risk management. It focuses on management's assessment and management of credit risks as well as other risks, including, but not limited to, market, financial, legal, and operational risks (including cybersecurity and data privacy risks), and risks relating to the Company's reputation and ethical standards. In addition, the Audit Committee of the Board is responsible for, among other matters, reviewing policies and processes related to risk assessment and risk management, including the Company’s major financial risk exposures and the steps management has taken to monitor and control such exposures, in coordination with the Risk Oversight Committee, as appropriate. It also oversees cybersecurity and data privacy as related to financial systems and controls, and reviews compliance with related legal and regulatory requirements. The Compensation Committee of the Board reviews compensation-related risks to the Company. The Finance Committee of the Board oversees the Company’s investment portfolio (including alternative investments) and the Company’s capital structure, liquidity, financing arrangements, rating agency matters, and any corporate development activities in support of the Company’s financial plan. The Nominating and Governance Committee of the Board oversees risk at the Company by developing appropriate corporate governance guidelines and identifying qualified individuals to become board members. The Environmental and Social Responsibility Committee oversees the Company’s risk and opportunities related to environmental issues, such as climate change, as well as aspects of human capital management, including diversity and inclusion.

The board of directors of each of the Company’s insurance subsidiaries has overall responsibility for the system of governance, oversight of the business and affairs and establishment of the key strategic direction and key financial objectives, including risk management, of its respective company. The AGUK Board and the AGE Board have each delegated, pursuant to written terms of reference, responsibility for risk matters to their respective Risk Oversight Committees. The AGUK Board and the AGE Board have delegated the day-to-day management of their companies to their Chief Executive Officer and Managing Director respectively, who is in each case supported by a number of management committees.

The Company has established several management committees to develop enterprise level risk management guidelines, policies and procedures for the Company’s insurance and reinsurance subsidiaries that are tailored to their respective businesses, providing multiple levels of review, analysis and control.

The Company’s management committees responsible for risk management include:

•Portfolio Risk Management Committee—The Portfolio Risk Management Committee is responsible for enterprise risk management for the Company’s Insurance business and focuses on measuring and managing credit, market and liquidity risk for the Company’s Insurance business. This committee establishes company-wide credit policy for the Company’s direct and assumed insured business. It implements specific underwriting procedures and limits for the Company and allocates underwriting capacity among the Company’s subsidiaries. All transactions in new asset classes or new jurisdictions, or otherwise outside the Company’s Board-approved risk appetite statement or risk limits, must be approved by this committee.

•Risk Management Committees—The U.S., AG Re and AGRO risk management committees and the European Insurance Subsidiaries Surveillance Committees conduct an in-depth review of the insured portfolios of the relevant subsidiaries, focusing on varying portions of the portfolio at each meeting. They review and may revise internal ratings assigned to the insured transactions and review sector reports, monthly product line surveillance reports and compliance reports. The European Insurance Subsidiaries Executive Risk Committees are responsible for assisting the risk oversight committees of their respective board of directors in the management of risk and oversight of their respective company’s risk management framework and processes. This includes monitoring their respective company’s compliance with risk strategy, risk appetite, risk limits, as well as overseeing and challenging their respective company’s risk management and compliance functions. In carrying out its responsibilities, each of the risk management committees considers numerous factors that could impact their insured portfolios, including macroeconomic factors, long term trends and climate change.

•Workout Committee—This committee receives reports from surveillance and workout personnel on insurance transactions at AGM and/or AGC that might benefit from active loss mitigation or risk reduction and approves loss mitigation or risk reduction strategies for such transactions.

•Reserve Committees—Oversight of reserving risk is vested in the U.S. Reserve Committee, the European Insurance Subsidiaries Executive Risk Committees, the AG Re Reserve Committee and the AGRO Reserve Committee. The committees review the reserve methodology and assumptions for each major asset class or significant below-investment-grade (BIG) transaction, as well as the loss projection scenarios used and the probability weights assigned to those scenarios. The reserve committees establish reserves for the relevant subsidiaries, taking into consideration supporting information provided by surveillance personnel, and are responsible for approving changes to assumptions that have a significant impact on expected losses.

•Assumptions Committee – The Assumptions Committee is responsible for setting the assumptions, other than assumptions related to BIG exposures that use transaction-specific models within the scope of the Reserve Committees, used to calculate the Company’s probability of default and loss in various portfolio loss scenario and economic capital models. When setting these assumptions, the committee considers relevant historical internal and external experience and any potential changes to market conditions that could affect these parameters going forward.

In addition, management and the boards of the Company’s subsidiaries evaluate alternative investments prior to committing any funds to such investments. In the case of the U.S. Insurance Subsidiaries, the boards have delegated the approval of alternative investments to investment committees consisting of directors who are the insurers’ Chief Investment Officer, Chief Executive Officer, Chief Operating Officer and Chief Financial Officer; the activities of the investment committees are further reviewed by the insurers’ full board of directors.

Enterprise Risk Management

The business units and functional areas are responsible for identifying, assessing, monitoring, reporting and managing their own risks. The Chief Risk Officer and other risk management personnel are separate from the business units and are responsible for developing the risk management framework, ensuring applicable risk management policies and procedures are followed consistently across business units, and for providing objective oversight and aggregated risk analysis.

The internal audit function (Internal Audit) provides independent assurance around effective risk management design and control execution. On a quarterly basis, or more frequently when required, Internal Audit reports its findings directly to the Audit Committee of the Board of Directors and informs the Chief Executive Officer and other senior management of any material issues.

The Company has established an enterprise level risk appetite statement, approved by the Board, and risk limits, that govern the Company’s risk-taking activities, with similar documents governing the activities of each operating subsidiary. Risk management personnel monitor a variety of key risk indicators on an ongoing basis and work with the business units to take the appropriate steps to manage the Company’s established risk appetites and tolerances. Risk management also uses an internally developed economic capital model to project potential ultimate losses in the insured portfolio as well as on alternative investments, and analyze the related capital implications for the Company, and performs stress and scenario testing to both validate model results and assess the potential financial impact of emerging risks and major strategic initiatives such as acquisitions or releases of capital.

Quarterly risk reporting keeps management and the Board and its Risk Oversight Committee, senior management, the business units and functional areas informed about material risk-related developments. At least once each year, risk management personnel prepare an Own Risk and Solvency Assessment for the Company as a whole and each of the operating companies (Commercial Insurer Solvency Self-Assessment for AG Re and AGRO) which reports the results of capital modeling, the status of key risk indicators and any emerging risks to the Risk Oversight Committee. In addition, the Company performs in-depth reviews annually of risk topics of interest to management and the Board. To the extent potentially significant business activities or operational initiatives are considered, the Chief Risk Officer analyzes the possible impact on the Company’s risk profile and capital adequacy.

Surveillance of Insured Transactions

The Company’s surveillance personnel are responsible for monitoring and reporting on the performance of each risk in its insured portfolio, including exposures in both the financial guaranty direct and assumed businesses, and tracking aggregation of risk. The primary objective of the surveillance process is to monitor trends and changes in transaction credit quality, detect any deterioration in credit quality, change or affirm ratings during reviews, and recommend remedial actions to management. The Company assigns internal credit ratings at closing to all transactions in the insured portfolio, and surveillance personnel recommend rating affirmations or adjustments to those ratings via the Risk Management Committees to reflect changes in transaction credit quality. The Company monitors its insured portfolio and refreshes its internal credit ratings on individual exposures in quarterly, semi-annual or annual review cycles based on the Company’s view of the exposure’s quality, loss potential, volatility and sector. Ratings on exposures in sectors identified as under the most stress or with the most potential volatility are reviewed every quarter, although the Company may also review a rating in response to developments impacting the credit when a ratings review is not scheduled.

The review cycle and scope vary based upon transaction type and credit quality. In general, the review process includes the collection and analysis of information from various sources, including trustee and servicer reports, performance reports from Intex (a commercially available structured finance reporting system), financial statements, general industry or sector news and analyses, and rating agency reports. For public finance risks, the surveillance process includes monitoring general economic trends, developments with respect to state and municipal finances, regulatory changes, environmental trends, and the financial situation of the issuers. For structured finance transactions, the surveillance process can include monitoring transaction performance data and cash flows, compliance with transaction terms and conditions, and evaluation of servicer or collateral manager performance and their financial condition. Additionally, the Company uses various quantitative tools, scorecards and models to assess transaction performance and identify situations where there may have been a change in credit quality. Surveillance activities may include discussions with or site visits to issuers, servicers, collateral managers or other parties to a transaction. Surveillance may adopt augmented procedures in response to various events, as it has done in response to the COVID-19 pandemic, major hurricanes or floods, and the transition away from the London Interbank Offered Rate (LIBOR) as a reference rate.

For transactions that the Company has assumed, the ceding insurers are generally responsible for conducting ongoing surveillance of the exposures that have been ceded to the Company. The Company’s surveillance personnel monitor the ceding insurer’s surveillance activities on exposures ceded to the Company through a variety of means, including reviews of surveillance reports provided by the ceding insurers, and meetings and discussions with their analysts. For public finance risks, the Company’s surveillance personnel independently review assumed exposure utilizing the same procedures as applied to the Company’s direct exposures. The Company’s surveillance personnel also monitor transaction performance (for structured finance and infrastructure transactions), general news and information, industry trends and rating agency reports to help focus surveillance activities on sectors or exposures of particular concern. For certain assumed exposures, the Company provides surveillance and, in such cases, does so in a manner consistent with its own direct portfolio, including by undertaking an independent analysis and remodeling of the exposure. The Company’s surveillance personnel also take steps to ensure that the ceding insurer is managing the risk pursuant to the terms of the applicable reinsurance agreement.

Workouts

The Company has personnel drawn from its surveillance, risk management, legal and other functions who are responsible for managing workout, loss mitigation and risk reduction situations. They work to develop and implement strategies on transactions that are experiencing loss or could possibly experience loss. They, along with the Workout Committee, develop strategies designed to enhance the ability of the Company to enforce its contractual rights and remedies and mitigate potential losses. They also engage in negotiation discussions with transaction participants and, when necessary, manage (along with legal personnel) the Company’s litigation proceedings. They may also make open market or negotiated purchases of securities that the Company has insured, or negotiate or otherwise implement consensual terminations of insurance coverage prior to contractual maturity. In addition, the Company’s surveillance personnel work with servicers of RMBS transactions to enhance their performance.

Asset Management and Alternative Investments

Until July 1, 2023, the Company’s Asset Management segment personnel were responsible for quantifying, analyzing and reporting the risks of each asset management fund and ensuring adherence to agreed investor mandates. The Company retained certain former Asset Management personnel to work with other risk personnel (together the investment team) to monitor the Company's investment in Sound Point, Sound Point funds and other alternative investments. Investment team personnel are responsible for the evaluation and due diligence processes for proposed new investments, and submit recommended investment actions to management or the Investment Committee in accordance with the Company's investment procedures. Investment team members monitor existing investments and provide periodic reporting at least quarterly to senior management, the AGL Board and the AGL Board's Risk Oversight and Finance Committees.

Data Protection

The Company is subject to local, state, and national laws and regulations in the U.S., U.K., the European Union (EU), the other EEA countries that comply with data protection laws in the EU, and other non-U.S. jurisdictions that require financial institutions and other businesses to protect personal and other sensitive information and provide notice of their privacy and security practices relating to the collection, disclosure and other processing of personal information. The Company is also subject to local, state, and national laws and regulations in the U.S., U.K., EEA, and other non-U.S. jurisdictions that require notification to affected individuals and regulators regarding data security breaches. To address these requirements, the Company has established and implemented policies and procedures that are intended to protect the privacy and security of personal information that comes into the Company’s possession or control, and to comply with applicable laws and regulations. Company policies and procedures include, but are not limited to, specific technical, administrative, and physical safeguards for personal information, periodic risk assessments on privacy and security measures, monitoring and testing, an incident response plan that requires Company personnel to promptly report suspected and actual data breach incidents to designated management representatives, an enterprise-wide data governance program, and regularly maintained records that demonstrate the Company’s accountability for compliance with the core privacy principles, relating to the processing of personal information and applicable data protection laws. The Company has imposed similar requirements, as applicable, on third parties with whom it shares personal information including through a rigorous vendor selection and management process. The Company engages its personnel and strives to enhance data privacy and security awareness through Company training, which is mandatory for all employees globally on an annual basis.

Climate Change Risk

The Company has long considered environmental impacts as part of its underwriting process, in particular with regard to U.S. public finance transactions. Global awareness of climate change has drawn greater attention to the financial implications and long-term consequences of frequent or severe natural disaster perils (e.g., storms and wildfires). As a financial guarantor of municipal and structured finance transactions, the Company does not have direct insurance exposure to natural perils but does face the risk that its obligors’ ability to pay debt service may be impacted as a result of such perils and the exacerbating effect climate change may have on them.

The Company continues to enhance its approach to the consideration of climate risk in the origination, underwriting, credit approval, and surveillance of its insured exposures and has integrated climate risk into its risk management and control functions. Credit underwriting submissions are required to include an assessment of environmental and/or transitional risk factors as part of the underwriting analysis. Specifically, the vulnerability of obligors is evaluated with respect to climatic changes (e.g., sea level rise, droughts), extreme weather events (e.g., hurricanes, tornadoes, floods) or geological events (e.g., earthquakes, volcanic activity) as well as resilience factors (e.g., mitigation capabilities, adaptation capacity) to determine if such environmental issues could materially impact an obligor’s expected performance.

The Company’s assessment of how climate change-driven risks may impact a prospective obligor’s ability to pay debt service is informed by its extensive experience in municipal finance coupled with proprietary analytics and third-party data and insights. To improve the Company’s understanding of climate change and to develop the analytical tools needed to measure and manage the related financial risks, the Company has been investing in both talent and technology. The Company’s risk management resources include climate science expertise. In addition, a dedicated internal team works with a geospatial data analytics company specializing in climate change/risk analysis and its effect on cities, counties, and states, to develop analytical capabilities to evaluate climate risk and assess potential negative impacts that climate change could have on the proposed obligor’s ability to pay debt service.

The Company is also exposed indirectly to climate change trends and events that might impair the performance of securities in its investment portfolio. The portfolio consists predominantly of fixed-maturity securities. Nevertheless, environmental issues, including regulatory changes, changes in supply or demand characteristics of fuels, and extreme weather events, may impact the value of certain securities. In 2016, the Company determined not to make any new investments in thermal coal enterprises. In fourth quarter of 2019, the Company revised its investment guidelines to incorporate material environmental factors into its investment analysis to enhance the quality of investment decisions. On an annual basis, the

Company requests and reviews reports from its primary investment managers on any material non-financial risks (including vulnerability to climate change risks or exposure to extreme weather events) that may adversely impact returns.

The Company believes that the physical effects of climate change on the Company’s business operations are not likely to be material and the Company does not anticipate capital expenditures for climate related projects.

Regulatory Reporting. As the global community moves to address and mitigate the effects of climate change, regulators across jurisdictions have taken steps to require climate change risk management and related reporting. Several of the Company’s subsidiaries are subject to regulatory reporting with respect to managing and disclosing the impact of climate change and the related financial risks. The Company continues to monitor regulatory developments and meet requirements applicable to its subsidiaries. To date, the costs associated with complying with regulatory reporting obligations have not had a material impact on the Company’s business, financial condition, and results of operations.

Governance. The Environmental and Social Responsibility Committee and the Risk Oversight Committee of AGL’s Board of Directors, each consisting solely of independent directors, provide oversight of the Company's approach to addressing climate change risk in accordance with their respective charters. The Environmental and Social Responsibility Committee reviews updates on the consideration of environmental risks in the Company’s insurance risk management and its investment portfolio, as well as legislative and regulatory developments of significance to the Company’s environmental initiatives and related oversight. The Risk Oversight Committee reviews the establishment and implementation of enterprise risk management policies and practices.

At the operating company level, the AGM, AGC, AG Re and AGRO boards of directors review environmental risk reports at each of their quarterly meetings. The Chief Risk Officer is designated as the AGM, AGC, AG Re and AGRO board member and member of senior management responsible for overseeing the management of climate risks. In addition, the boards of AGUK and AGE have responsibility for overseeing the management of climate risks and compliance with environmental laws and regulations in those jurisdictions. The Company has also formed an environmental risk working group composed of senior members of the Company’s credit, underwriting, surveillance, and risk management departments, to review the impact of environmental risk on the Company, including the development of objective risk measures, metrics and methodologies needed to evaluate the financial impact of climate change on obligors in its insured portfolio on both aggregate and individual risk levels.