BNY MELLON ENTERPRISE ESG 73 GLOBAL CITIZENSHIP Transition Risk. This refers to risks associated with the transition to a low-carbon economy. These risks will include changes to fiscal and environmental policy, regulation, legislation and technology, as well as investor and consumer sentiment changes that may impact the financial, legal, strategic and reputational risks of our organization. As a result, climate change risk management within BNY Mellon begins by assessing how climate change-driven risk may impact either our organization or our clients. The risk management framework in place requires and supports the identification, reporting, escalation and mitigation of all material risk drivers, including climate change risk. THREE LINES OF DEFENSE Management of climate change-driven risk is implemented in line with our organizational structure and follows the Three Lines of Defense model of our Risk Management Framework. The first line of defense is the business. Each of our businesses takes and owns the risk associated with its activities, and manages the risks and related control processes and procedures. The Risk Management and Compliance functions are the second line of defense, and the third line of defense is Internal Audit. The first line of defense is responsible for identifying and mitigating all risks, including climate risks. As the second line of defense, the Risk and Compliance function is responsible for supporting, reviewing and challenging the first line and has responsibility for the design and implementation of the global risk framework. The third line of defense, our Audit function, provides independent review of any aspect of implementation. NEW IN 2021 CLIMATE RISK TRAINING To support the implementation of the Climate Risk Framework and embed governance oversight responsibilities, we conducted training sessions and provided materials to boards, relevant committees and select teams across all three lines of defense with specific climate risk management obligations. The program outlined the risk management requirements and explained the importance of climate risk within business-as-usual activities. Participants were introduced to risk management tools available for identifying, assessing and managing climate risks. The training encourages participants to lead by example and set the tone to support a culture that institutionalizes appropriate risk management behavior with respect to climate risk. Risk Taxonomy. To ensure risks are consistently identified and categorized across the company, BNY Mellon uses an enterprise-wide risk taxonomy that considers risk across our six enterprise risk categories: Strategic, Credit, Market, Liquidity, Operational and Model risks. This Risk Management Framework enables consistent risk identification across the company. Through this existing framework, climate change-driven financial, physical and transition risks are assessed as risk drivers impacting across all risk types. Risk Appetite. Our Corporate Risk Appetite Statement expresses the aggregate level of risk we are willing to assume, within risk capacity constraints, in order to meet strategic and business objectives. We determine risk appetite by balancing risk and return, considering regulatory, capital and liquidity needs and maintaining a balance sheet that remains resilient throughout market cycles. Our Risk Appetite Statement currently allows for the monitoring and measurement of the potential impact of climate change as a risk driver across all six enterprise risk categories. The Corporate Risk Appetite Statement includes requirements that reinforce the need to ensure climate risk is incorporated into risk assessments and risk-based decision-making. These requirements are cascaded to all lines of business, including Investment Management, Market and Wealth Services, and Securities Services business segments, and all material legal entities. The Board approves the Corporate Risk Appetite Statement, including risk appetite limits for major risk categories. Although limits are not set with specific consideration of climate change (or other risk drivers), the limits in place do provide constraints on any buildup of climate risk. Risk Materiality. The Risk Management Framework employs a risk materiality matrix, which is a corporate- wide, risk-specific benchmark that provides a consistent measurement mechanism for assessing risk likelihood, significance and impact. Risks associated with climate change are assessed using this common benchmark along with all other risk drivers.