ASSURED GUARANTY LTD

Organizational Structure

The Board oversees the risk management process. The Board employs an enterprise-wide approach to risk management that supports the Company’s business plans within an acceptable level of risk. Risk assessment and risk management encompass not only understanding the risks the Company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for the Company. The Board annually approves the Company’s business plan, taking risk management into account. It also approves the Company’s risk appetite statement, which articulates the Company’s tolerance for risk and describes the general types of risk that the Company accepts or attempts to avoid. The involvement of the Board in setting the Company’s business strategy is a key part of its assessment of management’s risk tolerance and a determinant of what constitutes an appropriate level of risk for the Company.

While the Board has the ultimate oversight responsibility for the risk management process, various committees of the Board also have responsibility for risk assessment and risk management. The Risk Oversight Committee of the Board oversees the standards, controls, limits, underwriting guidelines and policies that the Company establishes and implements in respect of credit underwriting and risk management. It focuses on management of credit risks as well as other risks, including, but not limited to, market, financial, legal, operational risks (including information technology, cybersecurity and data privacy risks), and risks relating to the Company's reputation and ethical standards. In addition, the Audit Committee of the Board is responsible for, among other matters, reviewing policies and processes related to risk assessment and risk management, including the Company’s major financial risk exposures and the steps management has taken to monitor and control such exposures, in coordination with the Risk Oversight Committee. It also oversees information technology, cybersecurity and data privacy as related to financial systems and controls, and reviews compliance with related legal and regulatory requirements. The Compensation Committee of the Board reviews risks to the Company arising from its compensation program. The Finance Committee of the Board oversees the Company’s investment portfolio (including alternative investments) and the Company’s capital structure, liquidity, financing arrangements, rating agency matters, and any corporate development activities in support of the Company’s financial plan. The Nominating and Governance Committee of the Board oversees risk at the Company by developing appropriate corporate governance guidelines, identifying qualified individuals to become Board members and, in coordination with the Compensation Committee, making plans for senior management succession. The Environmental and Social Responsibility Committee oversees the Company’s risk and opportunities related to environmental issues, such as climate-related financial risk, as well as aspects of human capital management, including its strategies, policies and initiatives.

The board of directors of each of the Company’s insurance subsidiaries has overall responsibility for the system of governance, oversight of the business and affairs and establishment of the key strategic direction and key financial objectives, including risk management, of its respective company.

The Company has established several management committees to develop enterprise level risk management guidelines, and policies and procedures for the Company’s insurance subsidiaries that are tailored to their respective businesses, providing multiple levels of review, analysis and control.

The Company’s management committees responsible for risk management include:

•Portfolio Risk Management Committee—The portfolio risk management committee is responsible for enterprise risk management for the Company’s insurance business and focuses on measuring and managing credit, market and liquidity risk for the Company’s insurance business. This committee establishes company-wide credit policy for the Company’s direct and assumed insured business. It implements specific underwriting procedures and limits for the Company and allocates underwriting capacity among the Company’s subsidiaries. All transactions in new asset classes or new jurisdictions, or otherwise outside the Company’s Board-approved risk appetite statement or its risk limits, must be approved by this committee.

•Risk Management—Each financial guaranty insurance subsidiary has a committee responsible for conducting an in-depth review of the insured portfolios of the relevant subsidiary, focusing on varying portions of the portfolio at each meeting. These committees review and may revise internal ratings assigned to the insured transactions and review sector reports, monthly product line surveillance reports and compliance reports, and are responsible for assisting in the management of risk and oversight of their respective company’s risk management framework and processes. This includes monitoring their respective company’s compliance with risk strategy, risk appetite, risk limits, as well as overseeing and challenging their respective company’s risk management and compliance functions. In carrying out its responsibilities, each of the risk management committees considers numerous factors that could impact their insured portfolios, including macroeconomic factors, long term trends and climate-related financial risk.

•Workout Committee—This committee receives reports from surveillance and workout personnel on transactions insured by the Company that might benefit from active loss mitigation or risk reduction and approves loss mitigation or risk reduction strategies for such transactions.

•Reserve Committees—Each financial guaranty insurance subsidiary has a committee responsible for oversight of reserves for insured obligations. The reserve committees review the reserve methodology and assumptions for each major asset class or significant below-investment-grade (BIG) transaction, as well as the loss projection scenarios used and the probability weights assigned to those scenarios. The reserve committees establish reserves for their respective insurance subsidiaries, taking into consideration supporting information provided by surveillance and portfolio analytics personnel, and are responsible for approving changes to assumptions that have a significant impact on expected losses.

•Assumptions Committees—The financial guaranty insurance subsidiaries have committees responsible for setting the assumptions, other than assumptions related to BIG exposures that use transaction-specific models within the scope of the reserve committees, used to calculate the Company’s probability of default and loss in various portfolio loss scenario and economic capital models. When setting these assumptions, each committee considers relevant historical internal and external experience and any potential changes to market conditions that could affect these parameters going forward.

In addition, management and the boards of the Company’s subsidiaries evaluate alternative investments prior to committing any funds to such investments. In the case of AG, the board has delegated the approval of alternative investments to an investment committee consisting of directors who are the insurer’s Chief Investment Officer, Chief Executive Officer, Chief Operating Officer and Chief Financial Officer; the activities of the investment committee are further reviewed by the insurer’s full board of directors. See “Asset Management and Alternative Investments” below.

Enterprise Risk Management

The business units and functional areas are responsible for identifying, assessing, monitoring, reporting and managing their own risks. The Chief Risk Officer and other risk management personnel are separate from the business units and are responsible for developing the risk management framework, ensuring applicable risk management policies and procedures are followed consistently across business units, and for providing objective oversight and aggregated risk analysis.

The internal audit function (Internal Audit) provides independent assurance around effective risk management design and control execution. On a quarterly basis, or more frequently when required, Internal Audit reports its findings directly to the Audit Committee of the AGL Board and informs the Chief Executive Officer and other senior management of any material issues identified during their audits.

The Company has established an enterprise level risk appetite statement, approved by the Board, and risk limits, that govern the Company’s risk-taking activities, with similar documents governing the activities of each operating subsidiary. Risk management personnel monitor a variety of key risk indicators on an ongoing basis and work with the business units to take the appropriate steps to manage the Company’s established risk appetites and tolerances. Risk management also uses an internally developed economic capital model to project potential ultimate losses in the insured portfolio as well as on alternative investments, and analyze the related capital implications for the Company. Risk management also performs stress and scenario testing to both validate model results and assess the potential financial impact of emerging risks and major strategic initiatives such as acquisitions or releases of capital.

Quarterly risk reporting keeps the Board, its Risk Oversight Committee and senior management informed about material risk-related developments. At least once each year, risk management personnel prepare an Own Risk and Solvency Assessment for the Company as a whole and each of the operating companies (Commercial Insurer Solvency Self-Assessment for AG Re and AGRO) which reports the results of capital modeling, the status of key risk indicators and any emerging risks to the Risk Oversight Committee. In addition, the Company performs in-depth reviews annually of risk topics of interest to management and the Board. To the extent potentially significant business activities or operational initiatives are considered, the Chief Risk Officer analyzes the possible impact on the Company’s risk profile and capital adequacy.

Surveillance of Insured Transactions

The Company’s surveillance personnel are responsible for monitoring and reporting on the performance of each risk in its insured portfolio and tracking aggregation of risk. The primary objective of the surveillance process is to monitor trends and changes in transaction credit quality, detect any deterioration in credit quality, change or affirm ratings during reviews, and recommend remedial actions to management. The Company assigns internal credit ratings at closing to all transactions in the insured portfolio, and surveillance personnel recommend rating affirmations or adjustments to those ratings via the risk management committees to reflect changes in transaction credit quality. The Company monitors its insured portfolio and refreshes its internal credit ratings on individual exposures in quarterly, semi-annual or annual review cycles based on the Company’s view of the exposure’s quality, loss potential, volatility and sector. Ratings on exposures in sectors identified as under the most stress or with the most potential volatility are reviewed every quarter, although the Company may also review a rating in response to developments impacting the credit when a ratings review is not scheduled.

The review cycle and scope vary based upon transaction type and credit quality. In general, the review process includes the collection and analysis of information from various sources, including trustee and servicer reports, performance reports from Intex (a commercially available structured finance reporting system), financial statements, general industry or sector news and analyses, and rating agency reports. Additionally, the Company uses various quantitative tools, scorecards and models to assess transaction performance and identify situations where there may have been a change in credit quality. Surveillance activities may include discussions with or site visits to issuers, servicers, collateral managers or other parties to a transaction. Surveillance may adopt augmented procedures in response to various events, as it has done in response to the COVID-19 pandemic, major natural disasters, and the transition away from the London Interbank Offered Rate as a reference rate.

For transactions that the Company has assumed, the ceding insurers are generally responsible for conducting ongoing surveillance of the exposures that have been ceded to the Company. The Company’s surveillance personnel monitor the ceding insurer’s surveillance activities on exposures ceded to the Company through a variety of means, including reviews of surveillance reports provided by the ceding insurers, meetings and discussions with their analysts and, in certain cases, independently review assumed transactions.

Workouts

The Company has personnel drawn from its surveillance, risk management, legal and other functions who are responsible for managing workout, loss mitigation and risk reduction situations. They work to develop and implement strategies on transactions that are experiencing loss or could possibly experience loss. They, along with the workout committee, develop strategies designed to enhance the ability of the Company to enforce its contractual rights and remedies and mitigate potential losses. They also engage in negotiation discussions with transaction participants and, when necessary, manage (along with legal personnel) the Company’s litigation proceedings. They may also recommend and facilitate open market or negotiated purchases of securities that the Company has insured, negotiate or otherwise implement consensual terminations of insurance coverage prior to contractual maturity, or engage in other loss mitigation strategies. In addition, the Company’s surveillance personnel work with servicers of RMBS transactions to enhance their performance.

Asset Management and Alternative Investments

The Company’s investment management personnel and other risk personnel (together, the Investment Team) monitor the Company's ownership interest in Sound Point, and investments in Sound Point funds and other alternative investments. Investment Team personnel are responsible for the evaluation and due diligence processes for proposed new investments, and submit recommended investment actions to management, the boards of directors of the insurance subsidiaries, or AG’s investment committee in accordance with the Company's investment guidelines and procedures. Investment team members monitor existing investments and provide periodic reporting at least quarterly to senior management, AGL’s Board and the Board's Risk Oversight and Finance Committees.

Data Protection

The Company is subject to local, state, and national laws and regulations in the U.S., U.K., the European Union (EU), the other EEA countries that comply with data protection laws in the EU, and other non-U.S. jurisdictions that require financial institutions and other businesses to protect personal and other sensitive information and provide notice of their privacy and security practices relating to the collection, disclosure and other processing of personal information. The Company is also subject to local, state, and national laws and regulations in various jurisdictions in which it does business that require notification to affected individuals and regulators regarding data security breaches. To address these requirements, the Company has established and implemented policies and procedures that are intended to protect the privacy and security of personal information that comes into the Company’s possession or control, and to comply with applicable laws and regulations. Company policies and procedures include, but are not limited to, specific technical, administrative, and physical safeguards for personal information, periodic risk assessments on privacy and security measures, monitoring and testing, an incident response plan that requires Company personnel to promptly report suspected and actual data breach incidents to designated management representatives, an enterprise-wide data governance program, and regularly maintained records that demonstrate the Company’s accountability for compliance with the core privacy principles relating to the processing of personal information and applicable data protection laws. The Company has imposed similar requirements, as applicable, on third parties with whom it shares personal information including through a rigorous vendor selection and management process. The Company engages its personnel and strives to enhance data privacy and security awareness through Company training, which is mandatory for all employees globally on an annual basis. See Item 1C. Cybersecurity.

Changing Climate Risks

The Company has long considered environmental impacts as part of its underwriting process, in particular with regard to U.S. public finance transactions. Global awareness of changing climate conditions and weather patterns has drawn greater attention to the financial implications and long-term consequences of frequent or severe natural disaster perils (e.g., storms and wildfires). As a financial guarantor of municipal and structured finance transactions, the Company does not have direct insurance exposure to natural perils but does face the risk that its obligors’ ability to pay debt service may be impacted as a result of such perils and the exacerbating effect extreme weather or deteriorating climatic conditions may have on their operations and/or financial condition.

The Company continues to enhance its approach to the consideration of climate risk in the origination, underwriting, credit approval, and surveillance of its insured exposures and has integrated climate risk into its risk management and control functions. Credit underwriting submissions are required to include an assessment of environmental and/or transitional risk factors as part of the underwriting analysis. Specifically, the vulnerability of obligors is evaluated with respect to climatic changes (e.g., sea level rise, droughts), extreme weather events (e.g., hurricanes, tornadoes, floods) or geological events (e.g., earthquakes, volcanic activity) as well as resilience factors (e.g., mitigation capabilities, adaptation capacity) to determine if such environmental issues could materially impact an obligor’s expected performance.

The Company’s assessment of how climate risks may impact a prospective obligor’s ability to pay debt service is informed by its extensive experience in municipal finance coupled with proprietary analytics and third-party data and insights. To improve the Company’s understanding of changing climate conditions and to develop the analytical tools needed to measure and manage the related financial risks, the Company has been investing in both talent and technology. The Company’s risk management function, which includes climate science expertise, continues to develop and expand analytical capabilities to evaluate climate risk and assess any potential negative impacts on the proposed obligor’s ability to pay debt service.

The Company is also exposed indirectly to climate trends and extreme weather events that might impair the performance of securities in its investment portfolio, which consists predominantly of fixed-maturity securities. Nevertheless, environmental issues, including regulatory changes, changes in supply or demand characteristics of fuels, and extreme weather events, may impact the value of certain securities. The investment guidelines incorporate material environmental factors into the investment analysis to enhance the quality of investment decisions. On an annual basis, the Company requests and reviews reports from its primary investment managers on any material non-financial risks (including vulnerability to climate risks or exposure to extreme weather events) that may adversely impact returns.

The Company believes that the physical effects of evolving climate risks on the Company’s business operations are not likely to be material and the Company does not anticipate capital expenditures for climate related projects.

Regulatory Reporting. As the global community continues to address and mitigate the effects of changing climatic conditions, regulators across jurisdictions have imposed requirements or issued guidance regarding climate risk management and related reporting. Several of the Company’s subsidiaries are subject to regulatory reporting with respect to managing and disclosing the impact of changing climate conditions and the related financial risks. The Company continues to monitor regulatory developments and meet requirements applicable to its subsidiaries. To date, the costs associated with complying with regulatory reporting obligations have not had a material impact on the Company’s business, financial condition, and results of operations.

Governance. The Environmental and Social Responsibility Committee and the Risk Oversight Committee of AGL’s Board provide oversight of the Company's approach to addressing climate-related risk in accordance with their respective charters. The Environmental and Social Responsibility Committee reviews updates on the consideration of environmental risks in the Company’s insurance risk management and its investment portfolio, as well as legislative and regulatory developments of significance to the Company’s environmental initiatives and related oversight. The Risk Oversight Committee reviews the establishment and implementation of enterprise risk management policies and practices.

The Company also has an environmental risk working group composed of senior members of the Company’s credit, underwriting, surveillance, and risk management departments to review the impact of environmental risk on the Company, including the development of objective risk measures, metrics and methodologies needed to evaluate the financial impact of evolving climate conditions and extreme weather events on obligors in its insured portfolio on both aggregate and individual risk levels.