Large Bank Examination Workshop February 2026

VII. Related Policies; Procedures:

The following Bank policies and procedures cover subject matter that is related to this policy:

• • •

Model Validation Policy Model Validation Procedures Application Control Policy

• End User Developed Application Control Policy • Model Lifecycle Management Procedures • Data Control Policy • Vendor Policy • Records Management Policy • Risk Management Policy

VIII. Glossary/Definitions:

The following defined terms are used in this policy:

Application: means a model or a designated calculation.

Designated Calculation: means an application that is not a model and that conducts a calculation that has been designated by the CRO to require validation. It includes applications that perform complex calculations not readily transparent to the user or the materiality of the calculation is simply large enough to warrant additional scrutiny. Model: means an application that a) is not a designated calculation and b) is used to calculate the value of unknown behavior and that value is used in the Bank’s decision making or in statements of financial condition or performance. This definition includes present value measurement of 1) default likelihood used in market price cash flow discounting and in the calculation of potential credit losses and 2) future market movements and their effect on optionality value. The definition also includes the generation of future cash flow streams used in fee amortization or income simulation and the generation of market movement scenarios to predict possible future valuation changes. Projections or calculations of operational expenses for budgeting purposes are excluded from the definition of a model. In cases where it is unclear whether a specific procedure or algorithm constitutes a model, the Chief Risk Officer (CRO) makes the final determination.

Model Owner: means the individual ultimately responsible and accountable for a model.

Modeling Process: the aggregate set of activities, inclusive of applications and tools used, that directly or indirectly support derivation of model output.

Significant Change: a “significant change” is one that materially alters the theoretical or mathematical basis of a model, the data inputs, assumptions, operational complexity, or technological infrastructure. Additionally, any change resulting in material differences in

9

Model Risk Management Policy

March 15, 20XX

Classification: Confidential

Page 35 of 39