BAC, §1A diff (2020 → 2021)

Item 1A. Risk Factors

The discussion below addresses the Corporation’s material risk factors of which we are aware. Any risk factor, either by itself or together with other risk factors, could materially and adversely affect our businesses, results of operations, cash flows and/or financial condition. The considerations and risks that follow are organized within relevant headings but may be relevant to other headings as well. Other factors not currently known to us or that we currently deem immaterial could also adversely affect our businesses, results of operations, cash flows and/or financial condition. Therefore, the risk factors below should not be considered all of the potential risks that we may face. For more information on how we manage risks, see Managing Risk in the MD&A on page 46. For more information about the risks contained in the Risk Factors section, see Item 1. Business on page 2, MD&A on page 26 and Notes to Consolidated Financial Statements on page 94.

Summary of Risk Factors

Coronavirus Disease

● The impacts of the pandemic have adversely affected, and may continue to adversely affect us, and the pandemic’s duration and future impacts remain uncertain.

Market

● Our business and results of operations may be adversely affected by the financial markets, fiscal, monetary, and regulatory policies, and economic conditions generally.

● Increased market volatility and adverse changes in financial or capital market conditions may increase our market risk.

● We may incur losses if asset values decline, including due to changes in interest rates and prepayment speeds.

Liquidity

● If we are unable to access the capital markets or continue to maintain deposits, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.

● Reduction in our credit ratings could significantly limit our access to funding or the capital markets, increase borrowing costs or trigger additional collateral or funding requirements.

● Bank of America Corporation is a holding company, is dependent on its subsidiaries for liquidity and may be restricted from transferring funds from subsidiaries.

● Our liquidity and financial condition, and the ability to pay dividends to shareholders and to pay obligations could be materially adversely affected in the event of a resolution.

Credit

● Economic or market disruptions and insufficient credit loss reserves may result in a higher provision for credit losses.

● Our concentrations of credit risk could adversely affect our credit losses, results of operations and financial condition.

● We may be adversely affected if the U.S. housing market weakens or home prices decline.

● Our derivatives businesses may expose us to unexpected risks and potential losses.

Geopolitical

● We are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate.

Business Operations

● A failure in or breach of our operational or security systems or infrastructure or business continuity plans, or those of third parties or the financial services industry, could disrupt our critical business operations and customer services, result in additional risk exposures, and adversely impact our results of operations and financial condition, and cause legal or reputational harm.

● A cyberattack, information or security breach, or a technology failure of ours or of a third party could adversely affect our ability to conduct our business, manage our exposure to risk, result in the disclosure and/or misuse of information and/or fraudulent activity, and increase our operational and security systems and critical infrastructure costs.

● Failure to satisfy our obligations as servicer for residential mortgage securitizations, loans owned by other entities and other losses we could incur as servicer, could adversely impact our reputation, servicing costs or results of operations.

● Changes in the structure of and relationship among the government-sponsored enterprises (GSEs) could adversely impact our business.

● Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.

Regulatory, Compliance and Legal

● We are subject to comprehensive government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.

● We are subject to significant financial and reputational risks from potential liability arising from lawsuits and regulatory and government action.

● U.S. federal banking agencies may require us to increase our regulatory capital, total loss-absorbing capacity (TLAC), long-term debt or liquidity requirements.

● Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.

● We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.

Reputation

● Damage to our reputation could harm our businesses, including our competitive position and business prospects.

Other

● Reforms to and replacement of Interbank Offered Rates (IBORs) and certain other rates or indices may adversely affect our reputation, business, financial condition and results of operations.

● We face significant and increasing competition in the financial services industry.

● Our inability to adapt our business strategies, products and services could harm our business.

● We could suffer operational, reputational and financial harm if our models and strategies fail to properly anticipate and

7 Bank of America

manage risk.

● Failure to properly manage data may result in our inability to manage risk and business needs, errors in our day-to-day operations, critical reporting and strategic decision-making, inaccurate reporting and non-compliance with laws, rules and regulations.

● Our operations, businesses and customers could be materially adversely affected by the impacts related to climate change.

● Our ability to attract and retain qualified employees is critical to our success, business prospects and competitive position.

The above summary is qualified in its entirety to the more detailed discussion of the Corporation’s material risk factors set forth below.

Coronavirus DiseaseThe impacts of the pandemic have adversely affected, and may continue to adversely affect us, and the pandemic’s duration and future impacts remain uncertain.

Since the onset of the pandemic, the negative economic conditions and disruptions arising from it have adversely impacted our financial results to varying degrees and in various respects, including as a result of periods of increased allowance for credit losses followed by subsequent declines, and continued elevated noninterest expense. The pandemic’s impact on economic conditions and activity remains uncertain and will continue to evolve by region, country and state, and it is possible that new or evolving variants of COVID-19 could result in increased business disruptions and contribute to a potential economic downturn. In recent months, the U.S. and other regions of the world have experienced supply chain disruptions and labor shortages, and the global economy and supply chains remain vulnerable. Pandemic developments and certain responses have also resulted in inflationary pressure and ultimately may contribute to the development of a prolonged, disruptive period of high inflation in the U.S. and globally.

The economic impact of the pandemic may continue to adversely affect certain of our businesses and our results of operations, including decreased demand for and use of our products and services; lower fees, including asset management fees; lower sales and trading revenue due to decreased market liquidity resulting from heightened volatility; higher levels of uncollectible reversed charges in our merchant services business; increased noninterest expense, including operational losses; and increased credit losses due to a deterioration in the financial condition of our consumer and commercial borrowers, which could result in their inability to fulfill contractual obligations, may vary by region, sector or industry and could be exacerbated by the expiration of government assistance. Additionally, our liquidity and/or regulatory capital could be adversely impacted by customers’ withdrawal of deposits, inability to repay loans and reduced usage of banking products, volatility and disruptions in the capital and credit markets, changes in the value of securities, derivatives and other financial instruments resulting in increased margin requirements, volatility in foreign exchange rates and customer draws on lines of credit. Adverse macroeconomic conditions could also result in potential downgrades to our credit ratings, negative impacts to regulatory capital and liquidity and reinstated restrictions on dividends and/or common stock repurchases.

We continue to execute business continuity plans in connection with the pandemic. If we become unable to operate

our businesses from remote locations including, for example, because of an internal or external failure of our information technology infrastructure, we experience increased rates of employee illness or unavailability, or governmental restrictions are placed on our employees or operations, our business continuity plans could be adversely affected and result in disruption to our businesses. Additionally, we continue to rely on third parties who could experience business interruptions as a result of the pandemic, which could increase our risks and adversely impact our businesses.

In connection with the pandemic, various governmental fiscal and monetary relief programs were implemented in an effort to stimulate the global economy and avert negative economic or market conditions. Our participation in such programs could result in reputational harm and government actions and proceedings, and has resulted in, and may continue to result in, litigation, including class actions. Such actions may result in judgments, orders, settlements, penalties, and fines. Our participation in such programs has also resulted and will continue to result in losses, including from the Paycheck Protection Program (PPP) and the processing of unemployment benefits for California and certain other states.

We continue to closely monitor the pandemic and related risks as they evolve globally and in the U.S. The magnitude and duration of the pandemic and its future direct and indirect effects on global health, the global economy and our businesses, results of operations and financial condition are uncertain and depend on future developments that cannot be predicted, including the likelihood of future surges of COVID-19 cases and the spread of more easily communicable and/or dangerous variants of COVID-19, the availability, usage and acceptance of effective medical treatments and vaccines (including additional doses of vaccines) in the U.S. and globally and future public response and government actions, including travel bans and restrictions, limitations on business activity, vaccine mandates and additional stimulus legislation. The pandemic may cause setbacks to the global or national economic recovery or longer lasting effects on economic conditions than are currently anticipated, changes in financial markets, changes in fiscal, monetary and tax regulatory environments, and changes in client preferences and behavior, which could have a material adverse effect on our businesses, results of operations and financial condition.

Market

Our business and results of operations may be adversely affected by the financial markets, fiscal, monetary, and regulatory policies, and economic conditions generally.

General economic, political, social and health conditions in the U.S. and in one or more countries abroad affect markets in the U.S. and abroad and our business. In particular, markets in the U.S. or abroad may be affected by the level and volatility of interest rates, availability and market conditions of financing, unexpected changes in gross domestic product (GDP), economic growth or its sustainability, inflation, supply chain disruptions, consumer spending, employment levels, labor shortages, wage stagnation, federal government shutdowns, developments related to the U.S. federal debt ceiling, energy prices, home prices, commercial property values, bankruptcies, a default by a significant market participant or class of counterparties, fluctuations or other significant changes in both debt and equity capital markets and currencies, liquidity of the global financial markets, the growth of global trade and commerce, trade policies, the availability and cost of capital and credit, disruption of communication, transportation or energy infrastructure and

Bank of America 8

investor sentiment and confidence. Additionally, global markets, including energy and commodity markets, may be adversely affected by the current or anticipated impact of climate change, extreme weather events or natural disasters, the emergence or continuation of widespread health emergencies or pandemics, cyberattacks or campaigns, military conflict, including escalating military tension between Russia and Ukraine, terrorism or other geopolitical events. Market fluctuations may impact our margin requirements and affect our business liquidity. Also, any sudden or prolonged market downturn in the U.S. or abroad, as a result of the above factors or otherwise, could result in a decline in net interest income and noninterest income and adversely affect our results of operations and financial condition, including capital and liquidity levels. For example, global developments in connection with the ongoing pandemic, including supply chain disruptions, high inflation, changes to industries such as commercial real estate, the emergence of new variants and significant restrictions on households and businesses in certain countries, have adversely impacted and may continue to adversely impact financial markets and macroeconomic conditions and could result in additional market volatility and disruptions globally.

Actions taken by the Federal Reserve, including changes in its target funds rate, balance sheet management, and lending facilities, and other central banks are beyond our control and difficult to predict. These actions can affect interest rates and the value of financial instruments and other assets and liabilities and can impact our borrowers. Sudden changes in monetary policy, for example in response to high inflation, could lead to financial market volatility, increases in market interest rates, and a flattening or inversion of the yield curve. The continued protracted period of lower interest rates has resulted in lower revenue through lower net interest income, which has adversely affected our results of operations. Continued low U.S. interest rates, potentially resulting from a further extended period of accommodative monetary policy and/or an economic downturn could have a further adverse impact on us, including our net interest income and results of operations.

Changes to existing U.S. laws and regulatory policies and evolving priorities, including those related to financial regulation, taxation, international trade, fiscal policy, climate change (including required reduction of greenhouse gas emissions) and healthcare, may adversely impact U.S. or global economic activity and our customers', our counterparties' and our earnings and operations. For example, the expiration of pandemic-related government assistance in the U.S. could result in a reduction in economic activity and lead to a deterioration in households’ finances, particularly if consumers also continue to face high inflation. A slowdown in consumer demand could limit the ability of firms to pass on fast-rising costs for labor and other inputs, weighing on earnings and potentially leading to an equity market downturn. Significant fiscal policy changes and/or initiatives may also raise the federal debt, affect businesses and household after-tax incomes and increase uncertainty surrounding the formulation and direction of U.S. monetary policy and volatility of interest rates. A rise in U.S. interest rates could increase the likelihood of a more volatile and appreciating U.S. dollar. Changes, or proposed changes, to certain U.S. trade and international investment policies, particularly with important trading partners (including China and the EU) have in recent years negatively impacted financial markets. An escalation of tensions could lead to further measures that adversely affect financial markets, disrupt world trade and commerce and lead to trade retaliation, including through the use of tariffs, foreign exchange measures

or the large-scale sale of U.S. Treasury Bonds. Actions taken by other countries, particularly China, to restrict the activities of businesses, could also negatively affect financial markets.

Any of these developments could adversely affect our consumer and commercial businesses, our customers, our securities and derivatives portfolios, including the risk of lower re-investment rates within those portfolios, our level of charge-offs and provision for credit losses, the carrying value of our deferred tax assets, our capital levels, our liquidity and our results of operations. Additionally, the transition from IBORs and other benchmark rates to alternative reference rates (ARRs) could negatively impact markets globally and our business, and/or magnify any negative impact of the above referenced factors on our business, customers and results of operations.

Increased market volatility and adverse changes in financial or capital market conditions may increase our market risk.

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, fluctuations (significant or otherwise) in equity and futures prices, lower trading volumes and prices of securitized products, the implied volatility of interest rates and credit spreads and other economic and business factors. These market risks may adversely affect, among other things, the value of our securities, trading assets and other financial instruments, the cost of debt capital and our access to credit markets, the value of assets under management (AUM), fee income relating to AUM, customer allocation of capital among investment alternatives, the volume of client activity in our trading operations, investment banking fees, the general profitability and risk level of the transactions in which we engage and our competitiveness with respect to deposit pricing. For example, the value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates or credit spreads could be affected, which could adversely impact the value of such assets. Changes to fiscal policy, including expansion of U.S. federal deficit spending and resultant debt issuance, could also affect market interest rates. In addition, although some interest rates have begun to rise and elevated inflation could lead to further increases, the continued low interest rate environment has had and could continue to have a negative impact on our results of operations, including on future revenue and earnings growth. A flattening or inversion of the yield curve could also negatively impact our results of operations, including revenue and earnings.

We use various models and strategies to assess and control our market risk exposures, but those are subject to inherent limitations. In times of market stress or other unforeseen circumstances, previously uncorrelated indicators may become correlated and vice versa. These types of market movements may limit the effectiveness of our hedging strategies and cause us to incur significant losses. These changes in correlation can be exacerbated where other market participants are using risk or trading models with assumptions or algorithms similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists for certain assets. To the extent that we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, we may not be able to reduce our positions and therefore reduce our risk associated with such positions.

9 Bank of America

We may incur losses if asset values decline, including due to changes in interest rates and prepayment speeds.

We have a large portfolio of financial instruments, including loans and loan commitments, securities financing agreements, asset-backed secured financings, derivative assets and liabilities, debt securities, marketable equity securities and certain other assets and liabilities that we measure at fair value that are subject to valuation and impairment assessments. We determine these values based on applicable accounting guidance, which, for financial instruments measured at fair value, requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate.

Gains or losses on these instruments can have a direct impact on our results of operations, unless we have effectively hedged our exposures. Increases in interest rates may result in a decrease in residential mortgage loan originations and could impact the origination of corporate debt. In addition, increases in interest rates or changes in spreads may adversely impact the fair value of debt securities and, accordingly, for debt securities classified as available for sale, may adversely affect accumulated other comprehensive income and, thus, capital levels. These market moves also may adversely impact the value of debt securities we hold to meet regulatory liquidity requirements. Decreases in interest rates may increase prepayment speeds of certain assets, and, therefore, may adversely affect net interest income.

Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions or indices. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions, and the difficulty in valuing assets may increase our risk-weighted assets (RWA), which requires us to maintain additional capital and increases our funding costs. Values of AUM also impact revenues in our wealth management and related advisory businesses for asset-based management and performance fees. Declines in values of AUM can result in lower fees earned for managing such assets.

Liquidity

If we are unable to access the capital markets or continue to maintain deposits, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.

Liquidity is essential to our businesses. We fund our assets primarily with globally sourced deposits in our bank entities, as well as secured and unsecured liabilities transacted in the capital markets. We rely on certain secured funding sources, such as repo markets, which are typically short-term and credit-sensitive. We also engage in asset securitization transactions, including with the GSEs, to fund consumer lending activities. Our liquidity could be adversely affected by any inability to access the capital markets, illiquidity or volatility in the capital markets, the decrease in value of eligible collateral or increased collateral requirements (including as a result of credit concerns for short-term borrowing), changes to our relationships with our funding providers based on real or perceived changes in our risk

profile, prolonged federal government shutdowns, or changes in regulations, guidance or GSE status that impact our funding avenues or ability to access certain funding sources. Additionally, our liquidity may be negatively impacted by the unwillingness or inability of the Federal Reserve to act as lender of last resort, unexpected simultaneous draws on lines of credit, slower customer payment rates, restricted access to the assets of prime brokerage clients, the withdrawal of or failure to attract customer deposits or invested funds (which could result from customer attrition for higher yields, the desire for more conservative alternatives, changes in customer behavior or our customers’ increased need for cash), increased regulatory liquidity, capital and margin requirements for our U.S. or international banks and their nonbank subsidiaries, which could result in the inability to transfer liquidity internally and inefficient funding, changes in patterns of intraday liquidity usage resulting from a counterparty or technology failure or other idiosyncratic event or failure or default by a significant market participant or third party (including clearing agents, custodians, central banks or central counterparties (CCPs)). These factors also have the potential to increase our borrowing costs and negatively impact our liquidity.

Several of these factors may arise due to circumstances beyond our control, such as general market volatility, disruption, shock or stress, the emergence or continuation of widespread health emergencies or pandemics, Federal Reserve policy decisions (including fluctuations in interest rates or Federal Reserve balance sheet composition), negative views or loss of confidence about the Corporation (including short- and long-term business prospects) or the financial services industry generally or due to a specific news event, changes in the regulatory environment or governmental fiscal or monetary policies, actions by credit rating agencies or an operational problem that affects third parties or us. The impact of these events, whether within our control or not, could include an inability to sell assets or redeem investments, unforeseen outflows of cash, the need to draw on liquidity facilities, the reduction of financing balances and the loss of equity secured funding, debt repurchases to support the secondary market or meet client requests, the need for additional funding for commitments and contingencies and unexpected collateral calls, among other things, the result of which could be increased costs, a liquidity shortfall and/or impact on our liquidity coverage ratio.

Our liquidity and cost of obtaining funding is directly related to prevailing market conditions, including changes in interest and currency exchange rates, significant fluctuations in equity and futures prices, lower trading volumes and prices of securitized products and our credit spreads. Credit spreads reflect the published credit ratings, or other assessments of credit risk and relative value by market participants, of the Corporation and represent the risk premiums that our funding providers demand in excess of a benchmark interest rate, for example, U.S. Treasury securities rates. Increases in interest rates and our credit spreads can increase the cost of our funding and result in mark-to-market or credit valuation adjustment exposures. Changes in our credit spreads are market-driven and may be influenced by market perceptions of our creditworthiness, including changes in our credit ratings. Changes to interest rates and our credit spreads occur continuously and may be unpredictable and highly volatile. We may also experience spread compression as a result of offering higher than expected deposit rates in order to attract and maintain deposits due to increased marketplace rate competition. Additionally, concentrations within our funding

Bank of America 10

profile, such as maturities, currencies or counterparties, can reduce our funding efficiency.

Reduction in our credit ratings could significantly limit our access to funding or the capital markets, increase borrowing costs or trigger additional collateral or funding requirements.

Our borrowing costs and ability to raise funds are directly impacted by our credit ratings. In addition, credit ratings may be important to customers or counterparties when we compete in certain markets and seek to engage in certain transactions, including OTC derivatives. Credit ratings and outlooks are opinions expressed by rating agencies on our creditworthiness and that of our obligations or securities, including long-term debt, short-term borrowings, preferred stock and asset securitizations. Our credit ratings are subject to ongoing review by rating agencies, which consider a number of factors, including our financial strength, performance, prospects and operations and factors not under our control, such as the macroeconomic and geopolitical environment, including any continued macroeconomic stress caused by the pandemic, or changes the rating agencies may make to the methodologies they use to determine our ratings.

Rating agencies could make adjustments to our credit ratings at any time, and there can be no assurance as to whether or when any downgrades could occur. A reduction in certain of our credit ratings could result in a wider credit spread and negatively affect our liquidity, access to credit markets, the related cost of funds, our businesses and certain trading revenues, particularly in those businesses where counterparty creditworthiness is critical. If the short-term credit ratings of our parent company, or bank or broker-dealer subsidiaries, were downgraded by one or more levels, we may experience loss of access to short-term funding sources such as repo financing, and/or incur increased cost of funds and increased collateral requirements. Under the terms of certain OTC derivative contracts and other trading agreements, if our or our subsidiaries’ credit ratings are downgraded, the counterparties may require additional collateral or terminate these contracts or agreements.

While certain potential impacts are contractual and quantifiable, the full consequences of a credit rating downgrade to a financial institution are inherently uncertain, as they depend upon numerous dynamic, complex and inter-related factors and assumptions, including whether any downgrade of a firm’s long-term credit ratings precipitates downgrades to its short-term credit ratings, and assumptions about the potential behaviors of various customers, investors and counterparties.

Bank of America Corporation is a holding company, is dependent on its subsidiaries for liquidity and may be restricted from transferring funds from subsidiaries.

Bank of America Corporation, as the parent company, is a separate and distinct legal entity from our bank and nonbank subsidiaries. We evaluate and manage liquidity on a legal entity basis. Legal entity liquidity is an important consideration as there are legal, regulatory, contractual and other limitations on our ability to utilize liquidity from one legal entity to satisfy the liquidity requirements of another, including the parent company, which could result in adverse liquidity events. The parent company depends on dividends, distributions, loans and other payments from our bank and nonbank subsidiaries to fund dividend payments on our common stock and preferred stock and to fund all payments on our other obligations, including debt obligations. Any inability of our subsidiaries to pay dividends or make payments to us may adversely affect our cash flow and financial condition.

Many of our subsidiaries, including our bank and broker-dealer subsidiaries, are subject to laws that restrict dividend payments, or authorize regulatory bodies to block or reduce the flow of funds from those subsidiaries to the parent company or other subsidiaries. Our bank and broker-dealer subsidiaries are subject to restrictions on their ability to lend or transact with affiliates, minimum regulatory capital and liquidity requirements and restrictions on their ability to use funds deposited with them in bank or brokerage accounts to fund their businesses. Intercompany arrangements we entered into in connection with our resolution planning submissions could restrict the amount of funding available to the parent company from our subsidiaries under certain adverse conditions.

Additional restrictions on related party transactions, increased capital and liquidity requirements and additional limitations on the use of funds on deposit in bank or brokerage accounts, as well as lower earnings, can reduce the amount of funds available to meet the obligations of the parent company and even require the parent company to provide additional funding to such subsidiaries. Also, regulatory action that requires additional liquidity at each of our subsidiaries could impede access to funds we need to pay our obligations or pay dividends. In addition, our right to participate in a distribution of assets upon a subsidiary’s liquidation or reorganization is subject to prior claims of the subsidiary’s creditors.

Our liquidity and financial condition, and the ability to pay dividends to shareholders and to pay obligations could be materially adversely affected in the event of a resolution.

Bank of America Corporation, our parent holding company, is required to periodically submit a plan to the FDIC and Federal Reserve describing its resolution strategy under the U.S. Bankruptcy Code in the event of material financial distress or failure. In the current plan, Bank of America Corporation’s preferred resolution strategy is a “single point of entry” strategy. This strategy provides that only the parent holding company would file for bankruptcy under the U.S. Bankruptcy Code and contemplates providing certain key operating subsidiaries with sufficient capital and liquidity to operate through severe stress and to enable such subsidiaries to continue operating or be wound down in a solvent manner following a bankruptcy of the parent holding company. Bank of America Corporation has entered into intercompany arrangements resulting in the contribution of most of its capital and liquidity to key subsidiaries. Pursuant to these arrangements, if Bank of America Corporation’s liquidity resources deteriorate so severely that resolution becomes imminent, Bank of America Corporation will no longer be able to draw liquidity from its key subsidiaries, and will be required to contribute its remaining financial assets to a wholly-owned holding company subsidiary, which could materially and adversely affect our liquidity and financial condition and the ability to return capital to shareholders, including through the payment of dividends and repurchase of the Corporation’s common stock, and meet our payment obligations.

If the FDIC and Federal Reserve jointly determine that Bank of America Corporation’s resolution plan is not credible, they could impose more stringent capital, leverage or liquidity requirements or restrictions on our growth, activities or operations. We could also be required to take certain actions that could impose operating costs and could potentially result in the divestiture of certain assets or restructuring of businesses and subsidiaries.

Additionally, under the Financial Reform Act, when a G-SIB such as Bank of America Corporation is in default or danger of default, the FDIC may be appointed receiver in order to conduct

11 Bank of America

an orderly liquidation of such institution. In the event of such appointment, the FDIC could, among other things, invoke the orderly liquidation authority, instead of the U.S. Bankruptcy Code, if the Secretary of the Treasury makes certain financial distress and systemic risk determinations. In 2013, the FDIC issued a notice describing its preferred “single point of entry” strategy for resolving a G-SIB. Under this approach, the FDIC could replace Bank of America Corporation with a bridge holding company, which could continue operations and result in an orderly resolution of the underlying bank, but whose equity would be held solely for the benefit of our creditors. The FDIC’s “single point of entry” strategy may result in our security holders suffering greater losses than would have been the case under a bankruptcy proceeding or a different resolution strategy.

To the extent that the Corporation is resolved under the U.S. Bankruptcy Code or the FDIC’s orderly liquidation authority, third-party creditors of the Corporation’s subsidiaries may receive significant or full recoveries on their claims while security holders of Bank of America Corporation could face significant or complete losses.

Credit

Economic or market disruptions and insufficient credit loss reserves may result in a higher provision for credit losses.

A number of our products expose us to credit risk, including loans, letters of credit, derivatives, debt securities, trading account assets and assets held-for-sale. Deterioration in the financial condition of our consumer and commercial borrowers, counterparties or underlying collateral could adversely affect our financial condition and results of operations.

Our credit portfolios may be impacted by global and U.S. macroeconomic and market conditions, events and disruptions, including declines in GDP, consumer spending or property values, asset price corrections, increasing consumer and corporate leverage, increases in corporate bond spreads, rising or elevated unemployment levels, rising or elevated inflation, fluctuations in foreign exchange or interest rates, as well as widespread health emergencies or pandemics, extreme weather events and the impacts of climate change and domestic and global efforts to transition to a low-carbon economy. Significant economic or market stresses and disruptions typically have a negative impact on the business environment and financial markets, which could impact the underlying credit quality of our borrowers, counterparties and assets. Property value declines or asset price corrections could increase the risk of borrowers or counterparties defaulting or becoming delinquent in their obligations to us, and could decrease the value of the collateral we hold, which could increase credit losses. Credit risk could also be magnified by lending to leveraged borrowers or declining asset prices, including property or collateral values, unrelated to macroeconomic stress. Simultaneous drawdowns on lines of credit and/or an increase in a borrower’s leverage in a weakening economic environment could result in deterioration in our credit portfolio, should borrowers be unable to fulfill competing financial obligations. Increased delinquency and default rates could adversely affect our credit portfolios, including consumer credit card, home equity and residential mortgage portfolios through increased charge-offs and provisions for credit losses.

Although macroeconomic conditions have improved during 2021 in comparison to 2020, the pandemic and the related impacts of inflationary conditions, high input costs and supply chain disruptions, unemployment or labor shortages and the expiration of pandemic-related government benefits and programs could negatively impact the ability of consumer and

commercial borrowers or counterparties to meet their financial obligations. Additionally, the pandemic continues to impact the economy and certain sectors remain at risk (e.g., travel and entertainment, as well as commercial real estate office exposure). To the extent the pandemic worsens, as a result of new variants or otherwise, resulting in restrictions on economic activity or other negative impacts on the macroeconomic environment, our credit portfolio and allowance for credit losses could be adversely impacted.

We establish an allowance for credit losses, which includes the allowance for loan and lease losses and the reserve for unfunded lending commitments, based on management's best estimate of lifetime expected credit losses inherent in our relevant financial assets. The process to determine the allowance for credit losses uses models and assumptions that require us to make difficult and complex judgments that are often interrelated. This includes forecasting how borrowers or counterparties will perform in changing and unprecedented economic conditions, such as predicting developments in public health and fiscal policy related to the pandemic. The ability of our borrowers or counterparties to repay their obligations will likely be impacted by changes in future economic conditions, which in turn could impact the accuracy of our loss forecasts and allowance estimates. There is also the possibility that we have failed or will fail to accurately identify the appropriate economic indicators or accurately estimate their impacts to our borrowers or counterparties, which similarly could impact the accuracy of our loss forecasts and allowance estimates.

If the models, estimates and assumptions we use to establish reserves or the judgments we make in extending credit to our borrowers or counterparties, which are more sensitive due to the current macroeconomic environment, including as a result of the uncertainty regarding the magnitude and duration of the pandemic, prove inaccurate in predicting future events, we may suffer unexpected losses. In addition, changes to external factors can negatively impact our recognition of credit losses in our portfolios and allowance for credit losses.

The allowance for credit losses is our best estimate of expected credit losses; however, there is no guarantee that it will be sufficient to address credit losses, particularly if the economic outlook deteriorates significantly and quickly. In such an event, we may increase our allowance which would reduce our earnings. Additionally, to the extent that economic conditions worsen as a result of COVID-19 or otherwise, impacting our consumer and commercial borrowers, counterparties or underlying collateral, and credit losses are worse than expected, we may increase our provision for credit losses, which could have an adverse effect on our results of operations and could negatively impact our financial condition.

Our concentrations of credit risk could adversely affect our credit losses, results of operations and financial condition.

In the ordinary course of our business, we may be subject to concentrations of credit risk because of a common characteristic or common sensitivity to economic, financial, public health or business developments. For example, concentrations of credit risk may reside in a particular industry, geography, product, asset class, counterparty or within any pool of exposures with a common risk characteristic. A deterioration in the financial condition or prospects of a particular industry, geographic location, product or asset class, or a failure or downgrade of, or default by, any particular entity or group of entities could negatively affect our businesses, and it is possible our limits and credit monitoring exposure controls will not function as anticipated.

Bank of America 12

While our activities expose us to many different industries and counterparties, we routinely execute a high volume of transactions with counterparties in the financial services industry, predominantly comprised of broker-dealers, commercial banks, investment banks, insurers, mutual funds, hedge funds, central clearing counterparties and other institutional clients, resulting in significant credit concentration with respect to these industries. Financial services institutions and other counterparties are inter-related because of trading, funding, clearing or other relationships. As a result, defaults by one or more counterparties, or market uncertainty about the financial stability of one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity disruptions, losses and defaults.

Many of these transactions expose us to credit risk and, in some cases, disputes and litigation in the event of default of a counterparty. In addition, our credit risk may be heightened by market risk when the collateral held by us cannot be liquidated or is liquidated at prices not sufficient to recover the full amount of the loan or derivatives exposure due to us, which may occur as a result of events that impact the value of the collateral, such as an asset price correction or fraud. Further, disputes with obligors as to the valuation of collateral could increase in times of significant market stress, volatility or illiquidity, and we could suffer losses during such periods if we are unable to realize the fair value of the collateral or manage declines in the value of collateral.

Our commercial portfolios include exposures to certain industries, including asset managers and funds, real estate, finance companies and capital goods. Economic weaknesses, sustained elevated inflation, adverse business conditions, market disruptions, rising interest or capitalization rates, the collapse of speculative bubbles, greater volatility in areas where we have concentrated credit risk or deterioration in real estate values or household incomes may cause us to experience a decrease in cash flow and higher credit losses in either our consumer or commercial portfolios or cause us to write down the value of certain assets. Additionally, we could experience continued and long-term negative impacts to our commercial credit exposure and an increase in credit losses within those industries that continue to be disproportionately impacted by COVID-19 or are permanently impacted by a change in consumer preferences resulting from COVID-19 (e.g., travel and entertainment, as well as commercial real estate office exposure) or other industry disruptions.

Furthermore, we have concentrations of credit risk with respect to our consumer real estate, auto, consumer credit card and commercial real estate portfolios, which represent a significant percentage of our overall credit portfolio. The U.S. has experienced a meaningful increase in property prices over the past year and a decrease in home price valuations or commercial real estate valuations in certain markets where we have large concentrations, as well as more broadly within the U.S. or globally, could result in increased servicing expenses, defaults, delinquencies or credit losses. In particular, the impact of climate change, such as rising average global temperatures and rising sea levels, and the increasing frequency and severity of extreme weather events and natural disasters such as droughts, floods, wildfires and hurricanes could negatively impact collateral, the valuations of home prices or commercial real estate or our customers’ ability and/or willingness to pay fees, outstanding loans or afford new products. This could also cause insurability risk and/or increased insurance costs to customers.

We also enter into transactions with sovereign nations, U.S. states and municipalities. Unfavorable economic or political conditions, disruptions to capital markets, currency fluctuations, changes in oil prices, social instability and changes in government or monetary policies could adversely impact the operating budgets or credit ratings of these government entities and expose us to credit and liquidity risk.

Liquidity disruptions in the financial markets may result in our inability to sell, syndicate or realize the value of our positions, leading to increased concentrations, which could increase the credit and market risk associated with our positions, as well as increase our RWA.

We may be adversely affected if the U.S. housing market weakens or home prices decline.

Although the U.S. has experienced a meaningful increase in home prices in 2021, we remain conscious of geographic markets where housing price growth has increased significantly that could be vulnerable to declines in future periods and may negatively impact the demand and underlying collateral for many of our products. Additionally, our mortgage loan production volume is generally influenced by the rate of growth in residential mortgage debt outstanding and the size of the residential mortgage market, both of which may be adversely affected by rising interest rates. Any downturn in the condition of the U.S. housing market, similar to the 2008 financial crisis or otherwise, could result in both significant write-downs of asset values in several asset classes, notably mortgage-backed securities, and exposure to monolines. If the U.S. housing market were to weaken, the value of real estate could decline, which could result in increased credit losses and delinquent servicing expenses, negatively affect our representations and warranties exposures, and adversely affect our financial condition and results of operations.

Our derivatives businesses may expose us to unexpected risks and potential losses.

We are party to a large number of derivatives transactions that may expose us to unexpected market, credit and operational risks that could cause us to suffer unexpected losses. Severe declines in asset values, unanticipated credit events or unforeseen circumstances that may cause previously uncorrelated factors to become correlated and vice versa, may create losses resulting from risks not appropriately taken into account or anticipated in the development, structuring or pricing of a derivative instrument. Certain OTC derivative contracts and other trading agreements provide that upon the occurrence of certain specified events, such as a change in the credit rating of the Corporation or one or more of its affiliates, we may be required to provide additional collateral or take other remedial actions and could experience increased difficulty obtaining funding or hedging risks. In some cases our counterparties may have the right to terminate or otherwise diminish our rights under these contracts or agreements.

We are also a member of various central counterparties (CCPs), in part due to regulatory requirements for mandatory clearing of derivative transactions, which potentially increases our credit risk exposures to CCPs. In the event that one or more members of the CCP defaults on its obligations, we may be required to pay a portion of any losses incurred by the CCP as a result of that default. A CCP may modify, in its discretion, the margin we are required to post, which could mean unexpected and increased exposure to the CCP. As a clearing member, we are exposed to the risk of non-performance by our clients for which we clear transactions, which may not be covered by

13 Bank of America

available collateral. Additionally, default by a significant market participant may result in further risk and potential losses.

Geopolitical

We are subject to numerous political, economic, market, reputational, operational, compliance, legal, regulatory and other risks in the jurisdictions in which we operate.

We do business throughout the world, including in emerging markets. Economic or geopolitical stress in one or more countries could have a negative impact regionally or globally, resulting in, among other things, market volatility, reduced market value and economic output. Our liquidity and credit risk could be adversely impacted by and our businesses and revenues derived from non-U.S. jurisdictions are subject to risk of loss from financial, social or judicial instability, changes in government leadership, including as a result of electoral outcomes or otherwise, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, high inflation, natural disasters, the emergence or continuation of widespread health emergencies or pandemics, capital controls, currency re-denomination risk from a country exiting the EU or otherwise, currency fluctuations, foreign exchange controls or movements (caused by devaluation or de-pegging), unfavorable political and diplomatic developments, oil price fluctuations and changes in legislation. These risks are especially elevated in emerging markets. Additionally, continued tensions between the U.S. and important trading partners, particularly China, may result in sanctions, further tariff increases or other restrictive actions on cross-border trade, investment, and transfer of information technology that weigh on trade volumes, raise costs for producers, and adversely affect our businesses and revenues, as well as our customers and counterparties.

A number of non-U.S. jurisdictions in which we do business have been or may be negatively impacted by slowing growth or recessionary conditions, market volatility and/or political or civil unrest. The ongoing pandemic had a severe negative impact on global GDP, and despite significant progress in 2021, it appears that the global economy faces an uncertain and uneven recovery ahead. While the U.S. and numerous other countries have recovered to pre-pandemic levels of output, many countries and areas within countries are recovering more slowly. Economic weakness may prove persistent in many countries and regions, including certain regions of Europe, Japan and numerous emerging markets. Moreover, economic activity remains vulnerable to ongoing public health uncertainties with respect to the pandemic, and a number of countries are still imposing significant restrictions on residents and businesses. Global supply chain disruptions, labor shortages, wage pressures and elevated inflation in many countries pose further challenges, especially in the form of volatility in financial markets. Additionally, foreign exchange rates against the U.S. dollar are at risk of significant depreciation as the Federal Reserve raises interest rates.

We also invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less liquid and more volatile than U.S. trading markets. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions of all types

may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors. Any such unfavorable conditions or developments could adversely impact us.

As a result of the pandemic and fiscal policy responses to it, including the increased purchase of government bonds and other financial assets by central banks, government debt levels have increased significantly raising the risk of volatility, significant valuation changes, political tensions among EU members regarding fiscal policy or defaults on or devaluation of sovereign debt, which could expose us to substantial losses.

Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges and regulators, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are uncertain and evolving, and it may be difficult for us to determine the exact requirements of local laws in every market or manage our relationships with multiple regulators in various jurisdictions. Our potential inability to remain in compliance with local laws in a particular market and manage our relationships with regulators could result in increased expenses and changes to our organizational structure and adversely affect our businesses and results of operations in that market, as well as our reputation in general.

In connection with the U.K.’s exit from the EU, we are now subject to different laws and regulations, which are expected to diverge further over time, and are subject to the oversight of additional regulatory authorities. As political and regulatory environments evolve, further changes to the legal and regulatory framework under which our subsidiaries provide products and services in the U.K. and in the EU may result in additional compliance costs and have negative tax consequences or an adverse impact on our results of operations.

In addition to non-U.S. legislation, our international operations are also subject to U.S. legal requirements, which subjects us to operational and compliance costs and risks. For example, our operations are subject to U.S. and non-U.S. laws and regulations relating to bribery and corruption, anti-money laundering, and economic sanctions, which can vary by jurisdiction. The increasing speed and novel ways in which funds circulate could make it more challenging to track the movement of funds and heighten financial crimes risk. Our ability to comply with these legal requirements depends on our ability to continually improve surveillance, detection and reporting and analytic capabilities.

In the U.S., debt ceiling and budget deficit concerns, which have increased the possibility of U.S. government defaults on its debt and/or downgrades to its credit ratings, and prolonged government shutdowns could weaken the U.S. dollar, cause market volatility, negatively impact the global economy and banking system and adversely affect our financial condition, including our liquidity. Additionally, changes in fiscal, monetary or regulatory policy, including as a result of labor shortages, wage pressures, supply chain disruptions and higher inflation, could increase our compliance costs and adversely affect our business operations, organizational structure and results of operations. We are also subject to geopolitical risks, including economic sanctions, acts or threats of international or domestic terrorism, actions taken by the U.S. or other governments in response thereto, state-sponsored cyberattacks or campaigns, civil unrest and/or military conflicts, which could adversely affect business and economic conditions abroad and in the U.S. For example, escalating military tensions between Russia and Ukraine could result in regional instability and adversely impact

Bank of America 14

commodity and other financial markets as well as economic conditions, especially in Europe. Additionally, this could magnify inflationary pressure resulting from the pandemic and extend any prolonged period of higher inflation.

Business Operations

A failure in or breach of our operational or security systems or infrastructure or business continuity plans, or those of third parties or the financial services industry, could disrupt our critical business operations and customer services, result in additional risk exposures, and adversely impact our results of operations and financial condition, and cause legal or reputational harm.

The potential for operational risk exposure exists throughout our organization and as a result of our interactions with, and reliance on, third parties (including their downstream service providers) and the financial services industry infrastructure. Our operational and security systems infrastructure, including our computer systems, emerging technologies, data management and internal processes, as well as those of third parties, are integral to our performance. We also rely on our employees and third parties (including downstream service providers) in our day-to-day and ongoing operations, who may, as a result of human error, misconduct (including errors in judgment, malice, fraudulent activity and/or engaging in violations of applicable policies, laws, rules or procedures), malfeasance or a failure or breach of systems or infrastructure cause disruptions to our organization and expose us to operational losses, regulatory risk and reputational harm. The Corporation’s and third parties’ inability to properly introduce, deploy and manage changes to internal financial and governance processes, existing products, services and technology, as well as new product innovations and technology could also result in additional operational and regulatory risk.

Additionally, our financial, accounting, data processing and transmission, storage, backup or other operating or security systems and infrastructure, or those of third parties with whom we interact or upon whom we rely, may be ineffective or fail to operate properly or become disabled or damaged as a result of a number of factors including events that are wholly or partially beyond our or such third party’s control, which could adversely affect our ability to process transactions or provide services. We could also experience prolonged computer and network outages resulting in disruptions to our critical business operations and customer services, including abuse or failure of our electronic trading and algorithmic platforms. We may experience sudden increases in customer transaction volume or electrical, telecommunications or other major physical infrastructure outages, newly identified vulnerabilities in key hardware or software, failure of aging infrastructure and technology project implementation challenges, which could result in prolonged operational outages. Climate change is increasing the frequency and severity of natural disasters, such as earthquakes, wildfires, tornadoes, hurricanes and floods, which could result in increased exposure to operational risks, including outages. Additionally, events arising from local or larger scale political or social matters, including civil unrest and terrorist acts, could result in operational disruptions and prolonged operational outages.

We continue to execute our business continuity plans due to the pandemic and will likely continue to be subject to heightened operational risks to the extent that the pandemic persists. We also continue to have greater reliance on remote access tools and technology and employees’ personal systems and increased data utilization and be increasingly dependent upon our information technology infrastructure to operate our

businesses remotely due to the increased number of employees who work from home and evolving customer preferences, including increased reliance on digital banking and other digital

services provided by our businesses. Effective management of our business continuity depends on the security, reliability and adequacy of such systems. We also continue to be at risk of business disruptions due to illness and unavailability as the pandemic persists, including from the emergence of new variants, particularly if they are more transmissible and/or severe.

Regardless of the measures we have taken to implement training, procedures, backup systems and other safeguards to support our operations and bolster our operational resilience, our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties (including their downstream service providers) with whom we interact or upon whom we rely, including systemic cyber events that result in system outages and unavailability of part or all of the internet, cloud services and/or the financial services industry infrastructure (including critical banking activities). Our ability to implement backup systems and other safeguards with respect to third-party systems and the financial services industry infrastructure is more limited than with respect to our own systems.

Furthermore, to the extent that backup systems are available and utilized, they may not process data as quickly as our primary systems and some data might not have been backed up. We regularly update the systems on which we rely to support our operations and growth and to remain compliant with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions.

A failure or breach of our operational or security systems or infrastructure or business continuity plans resulting in disruption to our critical business operations and customer services and/or failure to identify and effectively respond to operational risks in a timely manner could expose us to market abuse, regulatory, market, privacy and liquidity risk, and adversely impact our results of operations and financial condition, as well as cause legal or reputational harm.

A cyberattack, information or security breach, or a technology failure of ours or of a third party could adversely affect our ability to conduct our business, manage our exposure to risk, result in the disclosure and/or misuse of information and/or fraudulent activity and increase our operational and security systems and critical infrastructure costs.

Our business is highly dependent on the security, controls and efficacy of our infrastructure, computer and data management systems, as well as those of our customers, suppliers, counterparties and other third parties (including their downstream service providers) the financial services industry and financial data aggregators, with whom we interact, on whom we rely or who have access to our customers' personal or account information. Our business relies on effective access management and the secure collection, processing, transmission, storage and retrieval of confidential, proprietary, personally identifiable and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to remotely access our network, products and services, our employees, customers, suppliers, counterparties and other third parties increasingly use personal mobile devices or computing devices that are outside of our

15 Bank of America

network and control environments and are subject to their own cybersecurity risks.

We, our employees, customers, regulators and third parties (including providers of products and services) are regularly the target of an increasing number of cyber threats and attacks and will continue to be. Cyber threats and techniques used in cyberattacks are pervasive, sophisticated, rapidly evolving, difficult to prevent and include computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or other security breach tactics that could result in disruptions to our businesses and operations, the loss of funds of the Corporation and/or its clients and the unauthorized release, gathering, monitoring, misuse, loss or destruction or theft of confidential, proprietary and other information, including intellectual property, of ours, our employees, our customers or of third parties. Cybersecurity risks have also significantly increased in recent years in part due to the growing number and increasingly sophisticated activities of malicious cyber actors, including organized crime groups, hackers, terrorist organizations, extremist parties, hostile foreign governments and state-sponsored actors, in some instances acting to promote political ends responding to policies and/or actions of the U.S. government. We are also subject to cyberattacks by disgruntled employees, activists and other third parties, including those involved in corporate espionage.

Our cybersecurity risk and exposure remains heightened because of, among other things, the evolving nature and pervasiveness of cyber threats, our prominent size and scale, our high-profile brand, our geographic footprint and international presence and our role in the financial services industry and the broader economy. The financial services industry, including the Corporation, is particularly at risk because of the use of and reliance on digital banking and other digital services, including mobile banking products, such as mobile payments, and other web- and cloud-based products and applications and the development of additional remote connectivity solutions, which increase cybersecurity risks and exposure. Acceptance and use of such digital banking products and services has substantially increased since the onset of the pandemic. Additionally, the proliferation of third-party financial data aggregators and emerging technologies, including our use of automation, artificial intelligence (AI) and robotics, increase our cybersecurity risks and exposure.

We continue to execute our business continuity plans due to the pandemic. Accordingly, our risk and exposure to cyberattacks and security breaches remain magnified due to our continued reliance on remote access tools and technology, resulting in increased reliance on virtual/digital interactions and a larger number of access points to our networks that must be secured. This increased risk of unauthorized access to our networks results in greater amounts of information being available for access, including from employees’ personal devices over which we do not have the same controls as we do when a larger employee population is working from our offices. Greater demand on our information technology infrastructure and security tools and processes will likely continue as the pandemic persists and may be experienced permanently.

We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties (including their downstream service providers) and the financial services industry with whom we do business, upon whom we rely to facilitate or enable our business activities or upon whom our customers rely. Other indirect risks relate to providers of products and/or services, financial counterparties,

financial data aggregators, financial intermediaries, such as clearing agents, exchanges and clearing houses, regulators, providers of critical infrastructure, such as internet access and electrical power, and retailers for whom we process transactions. We are also at additional risk resulting from critical third-party information security and open-source software vulnerabilities.

Additionally, we have exposure to cyber threats as a result of our continuous transmission of sensitive information to, and storage of such information by, third parties, including providers of products and/or services, and regulators, the outsourcing of some of our business operations, and system and customer account updates and conversions. Further, any such event may not be disclosed to us in a timely manner. Similarly, any failure, cyberattack or other information or security breach that significantly degrades, deletes or compromises our systems or data could adversely impact third parties, counterparties and the critical infrastructure of the financial services industry.

As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyberattack or other information or security vulnerability, failure or breach that significantly exposes, degrades, deletes or compromises the systems or data of one or more financial entities or third parties (or their downstream service providers) could have a material impact on us, our counterparties or other market participants and ultimately have an adverse impact on financial stability in the U.S. and/or globally. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis.

Cyber threats and the techniques used in cyberattacks change rapidly. Despite substantial efforts to protect the integrity and resilience of our systems and implement controls, processes, policies and other protective measures, we may not be able to anticipate or detect cyberattacks or information or security breaches and implement effective preventive or defensive measures to address or mitigate such attacks or breaches. Even the most advanced internal control environment is vulnerable to compromise. Internal access management failures could result in the compromise or unauthorized exposure of confidential data.

Cyberattacks or security breaches could persist for an extended period of time before being detected. It could take considerable additional time for us to determine the scope, extent, amount, and type of information compromised, at which time the impact on the Corporation and measures to recover and restore to a business-as-usual state may be difficult to assess. As cyber threats continue to evolve, we may be required to expend significant additional money and resources to modify or enhance our protective measures, investigate and remediate any information security, software or network vulnerabilities or incidents whether specific to us, a third party, the industry or businesses in general, and develop our capabilities to respond and recover. As a result, increasing resources to develop and enhance our controls, processes and practices designed to protect our systems, workstations, intellectual property and proprietary information, software, data and networks from attack, damage or unauthorized access, remains a critical priority.

Although to date we have not experienced any material losses or other material consequences relating to technology failure, cyberattacks or other information or security breaches, whether directed at us or third parties, there can be no assurance that our controls and procedures in place to monitor

Bank of America 16

and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Successful penetration or circumvention of system security could result in negative consequences, including loss of customers and business opportunities, the withdrawal of customer deposits, misappropriation or destruction of our intellectual property, proprietary information or confidential information and/or the confidential, proprietary or personally identifiable information of certain parties, such as our employees, customers, providers of products and services, counterparties and other third parties, or damage to their computers or systems. Also, any technology failure, cyberattack, successful penetration or circumvention of our networks and systems or other information or security breach, termination or constraint of any third party (including their downstream service providers), the financial services industry infrastructure or financial data aggregators, could, among other things, adversely affect our ability to conduct day-to-day business activities, effect transactions, service our clients, manage our exposure to risk or expand our businesses, result in fraudulent or unauthorized transactions or cause prolonged computer and network outages resulting in material disruptions to our or our customers’ or other third parties’ network access or critical business operations and customer services, in the U.S. and/or globally.

Cyberattacks or other information or security breaches, whether directed at us or third parties, may result in significant lost revenue, give rise to losses and claims brought by third parties, litigation exposure, government fines, penalties or intervention and other negative consequences. Furthermore, the public perception that a cyberattack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom we do business and/or result in the loss of confidence in our security measures. Additionally, our failure to communicate cyber incidents appropriately to relevant parties could result in regulatory, privacy, operational and reputational risk. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate. Cyberattacks or other information or security breaches could also result in a violation of applicable privacy and other laws in the U.S. and abroad, reimbursement or other compensatory costs, additional compliance costs, and our internal controls or disclosure controls being rendered ineffective. The occurrence of any of these events could adversely impact our results of operations, liquidity and financial condition.

Failure to satisfy our obligations as servicer for residential mortgage securitizations, loans owned by other entities and other losses we could incur as servicer, could adversely impact our reputation, servicing costs or results of operations.

We and our legacy companies service mortgage loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. In addition, we may have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach was found to have occurred, it may harm our reputation, increase our servicing costs, result in litigation or regulatory action or adversely impact our results of

operations. Additionally, with respect to foreclosures, we may incur costs or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.

Changes in the structure of and relationship among the GSEs could adversely impact our business.

During 2021, we sold approximately $3.2 billion of loans to GSEs, primarily Freddie Mac (FHLMC). FHLMC and Fannie Mae (FNMA) are currently in conservatorship with their primary regulator, the Federal Housing Finance Agency (FHFA) acting as conservator. In September 2019, the Treasury Department published a proposal to recapitalize FHLMC and FNMA and remove them from conservatorship as well as reduce their role in the marketplace. Consistent with this proposal, in January 2021, the Treasury Department further amended the agreement that governs the conservatorship of FHLMC and FNMA and delineated the continued objective to remove the GSEs from conservatorship. However, we cannot predict the future prospects of the GSEs, timing of the recapitalization or release from conservatorship, or content of legislative or rulemaking proposals regarding the future status of the GSEs in the housing market. Additionally, if the GSEs were to take a reduced role in the marketplace, including by limiting the mortgage products they offer, we could be required to seek alternative funding sources, retain additional loans on our balance sheet, secure funding through the Federal Home Loan Bank system, or securitize the loans through Private Label Securitization. Accordingly, uncertainty regarding their future and the mortgage-backed securities they guarantee continues to exist for the foreseeable future.

Any of these developments could adversely affect the value of our securities portfolios, capital levels, liquidity and results of operations.

Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.

Our risk management framework is designed to minimize risk and loss to us. We seek to effectively and consistently identify, measure, monitor, report and control the types of risk to which we are subject, including strategic, credit, legal, climate, market, liquidity, compliance, operational and reputational risks. While we employ a broad and diversified set of controls and risk mitigation techniques, including modeling and forecasting, hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, our ability to control and mitigate risks that result in losses is inherently limited by our ability to identify all risks, including emerging and unknown risks, anticipate the timing of risks, apply effective hedging strategies, make correct assumptions, manage and aggregate data correctly and efficiently, and develop risk management models to assess and control risk.

Our ability to manage risk is dependent on our ability to consistently execute all elements of our risk management program and develop and maintain a culture of managing risk well throughout the Corporation and manage risks associated with third parties (including their downstream service providers), including providers of products and/or services, to enable effective risk management and ensure that risks are appropriately considered, evaluated and responded to in a timely manner. Uncertain economic conditions, heightened

17 Bank of America

legislative and regulatory scrutiny of and change within the financial services industry, the pace of technological changes, accounting and market developments, the failure of employees to comply with our policies and Risk Framework and the overall complexity of our operations, among other developments, may result in a heightened level of risk for us. We have experienced increased operational, reputational and compliance risk as a result of the need to rapidly implement multiple and varying pandemic relief programs, such as PPP and the processing of unemployment benefits for California and certain other states, which have resulted and will continue to result in losses, in addition to the continued execution of our business continuity plans due to the pandemic. Our failure to manage evolving risks or properly anticipate, manage, control or mitigate risks could result in additional losses.

Regulatory, Compliance and Legal

We are subject to comprehensive government legislation and regulations and certain settlements, orders and agreements with government authorities from time to time.

We are subject to comprehensive regulation under federal and state laws in the U.S. and the laws of the various jurisdictions in which we operate, including increasing and complex economic sanctions regimes. These laws and regulations significantly affect and have the potential to restrict the scope of our existing businesses, limit our ability to pursue certain business opportunities, including the products and services we offer, reduce certain fees and rates or make our products and services more expensive for our clients. Additionally, we are required to file various financial and non-financial regulatory reports to comply with laws and rules in the jurisdictions in which we operate.

We continue to adjust our business and operations, legal entity structure and our policies, processes, procedures and controls, including with regard to capital and liquidity management, risk management and data management, to comply with currently effective laws and regulations, as well as final rulemaking, guidance and interpretation by regulatory authorities, including the Department of Treasury (including the Internal Revenue Service (IRS)), Federal Reserve, OCC, CFPB, Financial Stability Oversight Council, FDIC, Department of Labor, SEC and CFTC in the U.S. and foreign regulators and other government authorities. Further, we could become subject to future legislation and regulatory requirements beyond those currently proposed, adopted or contemplated in the U.S. or abroad, including policies and rulemaking related to the Financial Reform Act, the pandemic, emerging technologies and climate change. The cumulative effect of all of the legislation and regulations on our business, operations and profitability remains uncertain. This uncertainty necessitates that in our business planning we make certain assumptions with respect to the scope and requirements of prospective and proposed rules. If these assumptions prove incorrect, we could be subject to increased regulatory and compliance risks and costs as well as potential reputational harm. In addition, U.S. and international regulatory initiatives may overlap, and non-U.S. regulations and initiatives may be inconsistent or may conflict with current or proposed U.S. regulations, which could lead to compliance risks and increased costs.

Our regulators’ prudential and supervisory authority gives them broad power and discretion to direct our actions, and they have assumed an active oversight, inspection and investigatory role across the financial services industry. Regulatory focus is not limited to laws and regulations applicable to the financial services industry, but extends to other significant laws and

regulations that apply across industries and jurisdictions, including those related to data management and privacy, anti-money laundering, anti-corruption and economic sanctions.

We are also subject to laws, rules and regulations in the U.S. and abroad, including GDPR, CCPA and CPRA, and a number of additional jurisdictions enacting or considering similar laws, regarding compliance with our privacy policies and the disclosure, collection, use, sharing and safeguarding of personally identifiable information of certain parties, such as our employees, customers, suppliers, counterparties and other third parties, the violation of which could result in litigation, regulatory fines and enforcement actions. The complexity and risk of compliance has been magnified by the collection of employee health information in response to the pandemic. Additionally, we will likely be subject to new and evolving data privacy laws in the U.S. and abroad, which could result in additional costs of compliance, litigation, regulatory fines and enforcement actions. In particular, there is increased complexity and uncertainty, including potential suspension or prohibition, regarding the standards used by the Corporation for cross-border flows and transfers of personal data from the European Economic Area (EEA) to the U.S. and other jurisdictions outside of the EEA resulting from a decision of the Court of Justice of the EU and guidance from the European Data Protection Board. Additionally, the European Commission has published new standards of personal data transfer, and China and the U.K. have commenced consultation efforts to establish standards for personal data transfers. If cross-border personal data transfers are suspended or restricted or we are required to implement distinct processes for each jurisdiction’s standards, this could result in operational disruptions to our businesses, additional costs, increased enforcement activity, new contract negotiations with third parties, and/or modification of our cross-border data management.

As part of their enforcement authority, our regulators and other government authorities have the authority to, among other things, conduct investigations and assess significant civil or criminal monetary penalties or restitution and issue cease and desist orders and initiate injunctive actions. The amounts paid by us and other financial institutions to settle proceedings or investigations have, in some instances, been substantial and may increase. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of such resolutions, which could have significant consequences, including reputational harm, loss of customers, restrictions on the ability to access capital markets, and the inability to operate certain businesses or offer certain products for a period of time.

The Corporation and the conduct of its employees and representatives, including conduct that could harm clients, customers, employees or the integrity of the markets, are subject to regulatory scrutiny across jurisdictions. The complexity of the federal and state regulatory and enforcement regimes in the U.S., coupled with the global scope of our operations and the regulatory environment worldwide, also means that a single event or practice or a series of related events or practices may give rise to a significant number of overlapping investigations and regulatory proceedings, either by multiple federal and state agencies in the U.S. or by multiple regulators and other governmental entities in different jurisdictions. Additionally, actions by other members of the financial services industry related to business activities in which we participate may result in investigations by regulators or other government authorities. Responding to inquiries, investigations, lawsuits and proceedings is time-consuming and expensive and can divert senior management attention from our business. The

Bank of America 18

outcome of such proceedings, which may last a number of years, may be difficult to predict or estimate.

We are and may become subject to the terms of settlements, orders and agreements that we have entered into with government entities and regulatory authorities, which impose, or could impose, significant operational and compliance costs on us as they typically require us to enhance our procedures and controls, expand our risk and control functions within our lines of business, invest in technology and hire significant numbers of additional risk, control and compliance personnel. Moreover, if we fail to meet the requirements of the regulatory settlements, orders or agreements to which we are subject, or, more generally, fail to maintain risk and control procedures and processes that meet the heightened standards established by our regulators and other government authorities, we could be required to enter into further settlements, orders or agreements and pay additional fines, penalties or judgments, or accept material regulatory restrictions on our businesses.

While we believe that we have adopted appropriate risk management and compliance programs to identify, assess, monitor and report on employees conduct, applicable laws, policies and procedures, compliance risks will continue to exist, particularly as we adapt to new and evolving laws, rules and regulations. Additionally, changing U.S. fiscal, monetary and regulatory policies, and evolving priorities, may result in ongoing regulatory uncertainties. There is no guarantee that our risk management and compliance programs will be consistently executed to successfully manage compliance risk. We also rely upon third parties who may expose us to compliance and legal risk. Future legislative or regulatory actions, and any required changes to our business or operations, or those of third parties (including their downstream providers) upon whom we rely, resulting from such developments and actions could result in a significant loss of revenue, impose additional compliance and other costs or otherwise reduce our profitability, limit the products and services that we offer or our ability to pursue certain business opportunities, require us to dispose of or curtail certain businesses, affect the value of assets that we hold, require us to increase our prices and therefore reduce demand for our products, or otherwise adversely affect our businesses. In addition, investigations, legal and regulatory proceedings and other contingencies will arise from time to time that may result in fines, regulatory sanctions, penalties, equitable relief and changes to our business practices. As a result, we are and will continue to be subject to heightened compliance and operating costs that could adversely affect our results of operations.

We are subject to significant financial and reputational risks from potential liability arising from lawsuits and regulatory and government action.

We continue to face significant legal risks in our business, with a high volume of claims against us and other financial institutions. The amount of damages, penalties and fines that litigants and regulators seek from us and other financial institutions continues to be high. This includes disputes with consumers, customers and other counterparties.

Financial institutions, including us, continue to be the subject of claims alleging anti-competitive conduct with respect to various products and markets, including U.S. antitrust class actions claiming joint and several liability for treble damages. As disclosed in Note 12 — Commitments and Contingencies to the Consolidated Financial Statements, we also face contractual indemnification and loan-repurchase claims arising from alleged breaches of representations and warranties in the sale of

residential mortgages by legacy companies, which may result in a requirement that we repurchase the mortgage loans, or otherwise make whole or provide other remedies to counterparties.

In addition, regulatory authorities have had a supervisory focus on enforcement, including in connection with customer complaints, alleged violations of law and customer harm. For example, U.S. regulators and government agencies have pursued claims against financial institutions under the Financial Institutions Reform, Recovery, and Enforcement Act, the False Claims Act, fair lending laws and regulations (including the Equal Credit Opportunity Act and the Fair Housing Act), antitrust laws, and consumer protection laws and regulations, including prohibitions on unfair, deceptive, and/or abusive acts and practices under the Consumer Financial Protection Act and the Federal Trade Commission Act. Such claims may carry significant and, in certain cases, treble damages. There is also an increased focus on compliance with global laws, rules and regulations related to the collection, use, sharing and safeguarding of personally identifiable information and corporate data. Additionally, misconduct by the Corporation’s employees and representatives, including unethical, fraudulent, improper or illegal conduct, or other unfair, deceptive, abusive or discriminatory business practices, can result in litigation and/or government investigations and enforcement actions, and cause significant reputational harm. There is also increased scrutiny of climate change-related policies, goals and disclosure, which could result in litigation and regulatory investigations and actions.

The global environment of extensive investigations, regulation, regulatory compliance burdens, litigation and regulatory enforcement, combined with uncertainty related to the continually evolving regulatory environment, have affected and will likely continue to affect operational and compliance costs and risks, including the limitation or cessation of our ability or feasibility to continue providing certain products and services. Lawsuits and regulatory actions have resulted in and will likely continue to result in judgments, orders settlements, penalties and fines adverse to us. Further, the Corporation's participation in implementing government relief measures related to the pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, may lead to additional such judgments, orders, settlements, penalties and fines. Litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could have material adverse effects on our business, financial condition, including liquidity, and results of operations, and/or cause significant reputational harm to us.

U.S. federal banking agencies may require us to increase our regulatory capital, total loss-absorbing capacity (TLAC), long-term debt or liquidity requirements.

We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a well-capitalized institution. If any of our subsidiary insured depository institutions fails to maintain its status as well capitalized under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to well-capitalized status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, or fail to comply with the terms of such agreement, the Federal Reserve may impose more severe restrictions on our activities, including

19 Bank of America

requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956.

Capital and liquidity requirements are frequently introduced and amended. It is possible that regulators may increase regulatory capital requirements including TLAC and long-term debt requirements, change how regulatory capital is calculated or increase liquidity requirements. Our ability to return capital to our shareholders depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers. To the extent that increases occur in our SCB, G-SIB surcharge or countercyclical capital buffer, our returns of capital to shareholders could decrease. For example, our G-SIB surcharge is expected to increase by 50 basis points to 3.0 percent on January 1, 2024.

As part of its CCAR, the Federal Reserve conducts stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact the level of our SCB requiring us to hold additional capital. Additionally, the Federal Reserve could reinstitute limitations or prohibitions on taking capital actions, such as paying or increasing dividends or repurchasing common stock as a result of the economic impact of the ongoing pandemic or otherwise impose such limitations in connection with other economic disruptions or events.

A significant component of regulatory capital ratios is calculating our RWA and our leverage exposure, which may increase. The Basel Committee on Banking Supervision has also revised several key methodologies for measuring RWA that have not yet been implemented in the U.S., including a standardized approach for operational risk, revised market risk requirements and constraints on the use of internal models, as well as a capital floor based on the revised standardized approaches. U.S. banking regulators may update the U.S. Basel 3 rules to incorporate the Basel Committee revisions. Banks have experienced an increase in balance sheets, increasing leverage exposures and causing leverage-based ratios to overtake risk-based capital ratios.

Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, cease or alter certain operations or hold highly liquid assets, which may adversely affect our results of operations.

Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.

Our accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If those assumptions, estimates or judgments were misapplied, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards, including the SEC, banking regulators and our independent registered public accounting firm may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact how we prepare and report our financial statements. In some cases, we could be required to apply a new or revised

standard retrospectively, resulting in us revising prior-period financial statements.

We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.

It is possible that governmental authorities in the U.S. and/or other countries could further amend or repeal tax laws in a way that would materially adversely affect us, including the possibility that aspects of the 2017 Tax Cuts and Jobs Act could be amended in the future. Any future change in tax laws and regulations or interpretations of current or future tax laws and regulations could materially adversely affect our results of operations. Additionally, U.S. and foreign tax laws are complex and our judgments, interpretations or applications of such tax laws could differ from that of the relevant governmental authority. This could result in additional tax liabilities and interest, penalties, the reduction of certain tax benefits and/or the requirement to make adjustments to amounts recorded, which could be material.

In addition, we have U.K. net deferred tax assets (DTA) which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe’s capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net DTA.

Reputation

Damage to our reputation could harm our businesses, including our competitive position and business prospects.

Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation. Harm to our reputation can arise from various sources, including officer, director and/or employee activities, such as fraud, misconduct and unethical behavior (such as employees’ sales practices), security breaches, litigation or regulatory matters and their outcomes, compensation practices, lending practices, the suitability or reasonableness of recommending particular trading or investment strategies, including the reliability of our research and models and prohibiting clients from engaging in certain transactions.

Additionally, our reputation may be harmed by failing to deliver the products and standards of service and quality expected by our customers, clients and the community, the failure to recognize and address customer complaints, compliance failures, the inability to manage technology change or maintain effective data management, cyber incidents, prolonged or repeated system outages, internal and external fraud, inadequacy of responsiveness to internal controls, unintended disclosure of personal, proprietary or confidential information, conflicts of interest and breach of fiduciary obligations, the handling of health emergencies or pandemics, and the activities of our clients, customers, counterparties and third parties, including providers of products and/or services. For example, our reputation may be harmed in connection with our implementation of government programs to provide relief to address the economic impact of the pandemic and other federal and state government assistance programs, including the processing of unemployment benefits for California and certain other states, as well as how we handle employee matters related to the pandemic. Our reputation may also be negatively impacted by our ESG practices and disclosures, our businesses

Bank of America 20

and our customers, including practices and disclosures related to climate change.

Actions by the financial services industry generally or by certain members or individuals in the industry also can adversely affect our reputation. Also, adverse publicity or negative information posted on social media by employees, the media or otherwise, whether or not factually correct, may adversely impact our business prospects or financial results.

We are subject to complex and evolving laws and regulations regarding privacy, fair lending activity, UDAAP, electronic funds transfers, know-your-customer requirements, data protection, including the GDPR, CCPA and CPRA, cross-border data movement and other matters. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. It is possible that these laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or that is inconsistent with one another. If personal, confidential or proprietary information of customers or clients in our possession, or in the possession of third parties (including their downstream service providers) or financial data aggregators, is mishandled, misused or mismanaged, or if we do not timely or adequately address such information, we may face regulatory, reputational and operational risks which could adversely affect our financial condition and results of operations.

We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interest has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The failure to adequately address, or the perceived failure to adequately address, conflicts of interest could affect the willingness of clients to use our products and services, or give rise to litigation or enforcement actions, which could adversely affect our business.

Our actual or perceived failure to address these and other issues, such as operational risks, gives rise to reputational risk that could harm us and our business prospects. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties, and cause us to incur related costs and expenses.

Other

Reforms to and replacement of IBORs and certain other rates or indices may adversely affect our reputation, business, financial condition and results of operations.

There continues to be a major transition in progress in the global financial markets with respect to the replacement of IBORs, including the London Interbank Offered Rate (LIBOR), and certain other rates or indices that serve as “benchmarks.” Such benchmarks have been used extensively across the global financial markets and in our business. In particular, LIBOR has historically been used in many of our products and contracts, including derivatives, consumer and commercial loans, mortgages, floating-rate notes and other adjustable-rate products and financial instruments. The aggregate notional amount of these products and contracts referencing LIBOR or other IBORs remains material to our business. At the end of 2021, the global financial markets generally transitioned away

from the use of all LIBOR settings (except for certain U.S. dollar (USD) LIBOR settings). However, there continue to be risks and challenges associated with the transition from IBORs that may result in consequences that cannot be fully anticipated, which expose us to various financial, operational, supervisory, conduct and legal risks, which we continue to monitor closely.

Through a multi-year effort by the industry and regulators, ARRs have been identified and/or developed and are being used to replace LIBOR and other IBORs. However, market and client adoption of ARRs, may vary across or within categories of contracts, products and services, resulting in market fragmentation, decreased trading volumes and liquidity, increased complexity and modeling and operational risks. ARRs have compositions and characteristics that differ from the benchmarks they replace, in some cases have limited history, and may demonstrate less predictable performance over time than the benchmarks they replace. For example, certain ARRs are calculated on a compounded or weighted-average basis and, unlike IBORs, do not reflect bank credit risk and therefore typically require a spread adjustment. There are important differences between the fallbacks, triggers and calculation methodologies being implemented in cash and derivatives markets (including within cash markets). Any mismatch between the adoption of ARRs in loans, securities and derivatives markets may impact hedging or other financial arrangements we have implemented, and as a result we may experience unanticipated market exposures. Changes resulting from transition to successor or alternative rates may adversely affect the yield on loans or securities held by us, amounts paid on securities we have issued, amounts received and paid on derivatives we have entered into, the value of such loans, securities or derivative instruments, the trading market for such products and contracts, and our ability to effectively use hedging instruments to manage risk. There can be no assurance that existing assets and liabilities based on or linked to IBORs that have not already transitioned to ARRs will successfully transition.

Given the continuation of certain USD LIBOR settings until June 30, 2023, IBOR-based products and contracts (IBOR Products) linked to these LIBOR settings will still have to be transitioned by such time. Although a significant majority of the aggregate notional amount of our IBOR-based products maturing after 2021 include or have been updated to include fallbacks to ARRs, the transitioning of certain IBOR Products that do not include fallback provisions or adequate fallback mechanisms will require additional efforts to modify their terms. Some outstanding IBOR Products are particularly challenging to modify due to the requirement that all impacted parties consent to such modification. To address such challenges in IBOR Products, legislation has been adopted in various jurisdictions, including the EU, U.K. and New York State, and federal legislation is pending in the U.S. Congress. Litigation, disputes or other action may occur as a result of the interpretation or application of legislation, in particular, if there is an overlap between laws in different jurisdictions.

Some of our IBOR Products, in particular LIBOR-based products and contracts, may contain language giving the calculation agent (which may be us) discretion to determine the successor rate (including the ARR and/or the applicable spread adjustment) to the existing benchmark. We may face a risk of litigation, disputes or other actions from clients, counterparties, customers, investors or others based on various claims, for example that the Corporation incorrectly interpreted or enforced IBOR-based contract provisions, failed to appropriately communicate the effect that the transition to ARRs will have on

21 Bank of America

existing and future products, treated affected parties unfairly or made inappropriate product recommendations to or investments on behalf of its clients, or engaged in anti-competitive behavior or unlawfully manipulated markets or benchmarks.

We have launched, and expect to continue to develop, launch and support, ARR-based products and services. There is no guarantee that liquidity in ARR-based products will develop, and it is possible that ARR-based products, including products using credit sensitive rates, will perform differently to IBOR Products during times of economic stress, adverse or volatile market conditions and across the credit and economic cycle, which may impact the value, return on and profitability of our ARR-based assets. New financial products linked to ARRs may have additional legal, financial, tax, operational, market, compliance, reputational, competitive or other risks to us, our clients and other market participants. In particular, banking regulators in the U.S. and globally have increased regulatory scrutiny and intensified supervisory focus of financial institution LIBOR transition plans, preparations and readiness, including the Corporation’s use of credit-sensitive rates like the Bloomberg Short-Term Bank Yield Index, which could result in a regulatory action, litigation and/or the need to change the products offered by our businesses.

Failure to meet industry-wide IBOR transition milestones and to cease issuance of IBOR Products by relevant cessation dates may, subject to certain regulatory exceptions, result in supervisory enforcement by applicable regulators, increase our cost of, and access to, capital and other consequences.

The market transition may also alter our risk profile and risk management strategies, including derivatives and hedging strategies, modeling and analytics, valuation tools, product design and systems, controls, procedures and operational infrastructure. This may prove challenging given the limited history of many of the proposed ARRs and may increase the costs and risks related to potential regulatory compliance, requirements or inquiries. Among other risks, various IBOR Products transition to ARRs at different times or in different manners, with the result that we may face significant unexpected interest rate, pricing or other exposures across business or product lines. Continuing reforms to market transition and other factors may adversely affect our business, including the ability to serve customers and maintain market share, financial condition or results of operations and could result in reputational harm to us.

We face significant and increasing competition in the financial services industry.

We operate in a highly competitive environment and experience intense competition from local and global financial institutions as well as new entrants, in both domestic and foreign markets, in which we compete on the basis of a number of factors, including customer service, quality and range of products and services offered, technology, price, fees, reputation, interest rates on loans and deposits, lending limits, customer convenience and experience and relationships in relevant markets. Additionally, the changing regulatory environment may create competitive disadvantages for us given geography-driven capital and liquidity requirements.

In addition, emerging technologies and advances and the growth of e-commerce have lowered geographic and monetary barriers of other financial institutions, made it easier for non-depository institutions to offer products and services that traditionally were banking products and allowed non-traditional

financial service providers and technology companies to

compete with traditional financial service companies in providing electronic and internet-based financial solutions and services, including electronic securities trading with low or no fees and commissions, marketplace lending, financial data aggregation and payment processing, including real-time payment platforms. Further, clients may choose to conduct business with other market participants who engage in business or offer products in areas we deem speculative or risky. Increased competition may negatively affect our earnings by creating pressure to lower prices, fees, commissions or credit standards on our products and services, requiring additional investment to improve the quality and delivery of our technology and/or reducing our market share, or affecting the willingness of our clients to do business with us.

Our inability to adapt our business strategies, products and services could harm our business.

Our business model is based on a diversified mix of businesses that provide a broad range of financial products and services, delivered through multiple distribution channels. Our success depends on our, and our third-party providers of products and services’ ability to adapt and develop our business strategies, products, services and technology to rapidly evolving industry standards and consumer preferences. In particular, the emergence of the pandemic has resulted in increased reliance on digital banking and other digital services provided by the Corporation’s businesses. There is increasing pressure by competitors to provide products and services on more attractive terms, including lower fees and higher interest rates on deposits, and offer lower cost investment strategies, which may impact our ability to grow revenue and/or effectively compete. Additionally, legislative and regulatory developments may affect the competitive landscape and impact the products and services that we can offer. Further, we may be impacted by the growth of non-depository institutions that offer traditional banking products at higher rates or with low or no fees, or otherwise offer alternative products. This can reduce our net interest margin and revenues from our fee-based products and services, either from a decrease in the volume of transactions or through a compression of spreads.

The widespread adoption and rapid evolution of new technologies, including analytic capabilities, self-service digital trading platforms, internet services, distributed ledgers, such as the blockchain system, cryptocurrencies, Central Bank Digital Currencies (CBDCs) and payment systems, could require substantial expenditures to modify or adapt our existing products and services as we grow and develop our online and mobile banking channel strategies in addition to remote connectivity solutions. As CBDC initiatives evolve and mature, our businesses and results of operations could be adversely impacted, including as a result of the introduction of new competitors to the payment ecosystem and increased volatility in deposits and/or significant long-term reduction in deposits (i.e., financial disintermediation). Also, we may not be as timely or successful in developing or introducing new products and services, integrating new products or services into our existing offerings, responding, managing or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining loyal customers. The Corporation’s or its third-party providers of products and services’ inability or resistance to timely innovate or adapt its operations, products and services

Bank of America 22

to evolving industry standards and consumer preferences could result in service disruptions and harm our business and adversely affect our results of operations and reputation.

We could suffer operational, reputational and financial harm if our models and strategies fail to properly anticipate and manage risk.

We use models and strategies extensively to forecast losses, project revenue, measure and assess capital and liquidity requirements for credit, market, operational and strategic risks, assist in capital planning and assess and control our operations and financial condition. Model Risk Management is a dedicated and independent risk function that defines model risk governance, policy and guidelines for the Corporation based on laws, rules and regulations, as well as internal requirements. Under our Enterprise Model Risk Policy, Model Risk Management is required to perform model oversight, including independent validation before initial use, ongoing monitoring reviews through outcomes analysis and benchmarking, and periodic revalidation. Models are subject to inherent limitations due to the use of simplifying assumptions, uncertainty regarding economic and financial outcomes, and emerging risks from the use of applications that rely on AI.

Our models and strategies may not be sufficiently predictive of future results due to limited historical patterns, extreme or unanticipated market movements or customer behavior and liquidity, especially during severe market downturns or stress events, which could limit their effectiveness and require timely recalibration. The models that we use to assess and control our market risk exposures also reflect assumptions about the degree of correlation among prices of various asset classes or other market indicators, which may not be representative of the next downturn and would magnify the limitations inherent in using historical data to manage risk. Our models may be adversely impacted as a result of human error and may not be effective if we fail to properly oversee and review them at regular intervals and detect their flaws during our review and monitoring processes, they contain erroneous data, assumptions, valuations, formulas or algorithms or our applications running the models do not perform as expected. Regardless of the steps we take to ensure effective controls, governance, monitoring and testing, and implement new technology and automated processes, we could suffer operational, reputational and financial harm if models and strategies fail to properly anticipate and manage current and evolving risks.

Failure to properly manage data may result in our inability to manage risk and business needs, errors in our day-to-day operations, critical reporting and strategic decision-making, inaccurate reporting and non-compliance with laws, rules and regulations.

Our ability to obtain, create, report and maintain information, including the data associated with it, during our normal course of business is a foundational component of our business and of managing relationships with customers. Additionally, we rely on our ability to manage data in an accurate, timely and complete manner, including the capture, transport, aggregation, validation, processing, quality, interpretation, protection, maintenance, retention, external transmission and use. Our policies, programs, processes and practices govern how data risk is managed globally. While we continuously update our policies, programs, processes and practices and implement emerging technologies, such as automation, AI and robotics, our data management processes may not be effective and are subject to weaknesses and failures, including human error, data limitations, process delays, system failure or failed controls.

Failure to properly manage data effectively in an accurate, timely and complete manner may impact its quality and reliability and our ability to manage current and emerging risk, produce accurate financial, regulatory and operational reporting, detect or surveil potential misconduct or non-compliance with laws, rules and regulations, as well as to manage changing business needs, strategic decision-making and day-to-day operations. The failure to establish and maintain effective, efficient and controlled data management could adversely impact our ability to develop our products and relationships with our customers, increase regulatory risk and operational losses, and damage our reputation.

Our operations, businesses and customers could be materially adversely affected by the impacts related to climate change.

There is an increasing concern over the risks of climate change and related environmental sustainability matters, which present short-term and an increasing amount of long-term risks to us. The physical risks of climate change include rising average global temperatures, rising sea levels and an increase in the frequency and severity of extreme weather events and natural disasters, including floods, wildfires, hurricanes and tornados. Such disasters could disrupt our operations or the operations of customers or third parties on which we rely. Such disasters could result in market volatility or negatively impact our customers’ ability to repay outstanding loans, result in rapid deposit outflows, cause supply chain and/or distribution network disruptions, damage collateral or result in the deterioration of the value of collateral or insurance shortfalls.

Additionally, climate change concerns could result in transition risk. Changes in consumer preferences or technology and additional legislation, regulatory and legal requirements, including those associated with the transition to a low-carbon economy, could restrict the scope of our existing businesses, limit our ability to pursue certain business activities and offer certain products and services, amplify credit and market risks, negatively impact asset values, increase expenses, including as a result of strategic planning and technology and market changes, and/or otherwise adversely impact us, our businesses or our customers. Our response to climate change, our climate change strategies, policies, goals, commitments and disclosure, and/or our ability to achieve our climate-related goals and commitments (which are subject to risks and uncertainties, many of which are outside of our control) could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence.

Our ability to attract and retain qualified employees is critical to our success, business prospects and competitive position.

Our performance and competitive position is heavily dependent on the talents and efforts of highly skilled individuals. Competition for qualified personnel within the financial services industry and from businesses outside the financial services industry is intense.

Our competitors include global institutions and institutions subject to different compensation and hiring regulations than those imposed on U.S. institutions and financial institutions. Also, our ability to attract and retain employees could be impacted by the pandemic, including changing workforce concerns, expectations, practices and preferences (including remote work), and increasing labor shortages and competition for labor, which could increase labor costs.

In order to attract and retain qualified personnel, we must provide market-level compensation. As a large financial and banking institution, we are and may become subject to

23 Bank of America

additional limitations on compensation practices, which may or may not affect our competitors, by the Federal Reserve, the OCC, the FDIC and other regulators around the world. EU and U.K. rules limit and subject to clawback certain forms of variable compensation for senior employees. Furthermore, a substantial portion of our annual incentive compensation paid to our senior

employees, as well as certain periodic awards to both senior and broad-based groups of employees, consist of long-term equity-based awards, the value of which is based on the price of our common stock when the awards vest. Our business prospects and competitive position could be adversely affected if we cannot attract and retain qualified individuals.