Large Bank Examination Workshop February 2026

Model Risk Management Committee •

A forum for the reporting and aggregation of model risk issues • Provides oversight of the Bank’s framework for model risk management • Acts as the Risk Committee of the Board’s delegate (through approval of this policy) to have the final decision-making authority of the model inventory • Approves new models for use • Reviews and approves model performance thresholds • Reviews model changes including a determination of whether the change is significant • Reviews the model validation schedule, results of model validations, and the status of outstanding model validation recommendations • Resolves model validation recommendation impasses (for models not owned by the CRO) Provides information to the Risk Committee on model risk issues, model performance metrics and an aggregate view of the level and direction of model risk • Provides oversight of the Model Risk Management Group • Chairs the Model Risk Management Committee Model Risk Management Group • Operates independently of the business lines that manage specific models or use model results • Oversees the model validation program, including those conducted internally and by third parties • Tracks and reports on the status of outstanding recommendations and confirms their completion • Recommends enhancements to the model risk management framework • Identifies and measures model risk and provides an independent review of model performance metrics • No less than annually, reviews and assesses the model risk classifications and outstanding findings of all models in inventory • Initiates, as warranted, additional targeted validation work and recommends enhancements or modifications to risk controls • Engage various stakeholders to capture model information from a variety of sources • Manages the model inventory and periodically provides it to the Risk Committee of the Board of Directors and the Model Risk Management Committee for review • Participates, as it deems appropriate, in model working groups Model Owners • In conjunction with Model Users, act as the first line of defense in managing model risk • Inform the Model Risk Management Group of changes to or the intent to develop or acquire models • Establish and monitor model performance metrics Chief Risk Officer (CRO) •

3

Model Risk Management Policy

March 15, 20XX

Classification: Confidential

Page 29 of 39