BANK OF AMERICA CORP /DE/ (BAC) Business

Item 1. Business

Bank of America Corporation is a Delaware corporation, a bank holding company (BHC) and a financial holding company. When used in this report, “Bank of America,” “the Corporation,” “we,” “us” and “our” may refer to Bank of America Corporation individually, Bank of America Corporation and its subsidiaries, or certain of Bank of America Corporation’s subsidiaries or affiliates. As part of our efforts to streamline the Corporation’s organizational structure and reduce complexity and costs, the Corporation has reduced and intends to continue to reduce the number of its corporate subsidiaries, including through intercompany mergers.

Bank of America is one of the world’s largest financial institutions, serving individual consumers, small- and middle-market businesses, institutional investors, large corporations and governments with a full range of banking, investing, asset management and other financial and risk management products and services. Our principal executive offices are located in the Bank of America Corporate Center, 100 North Tryon Street, Charlotte, North Carolina 28255.

Bank of America’s website is www.bankofamerica.com, and the Investor Relations portion of our website is https://investor.bankofamerica.com. We use our website to distribute company information, including as a means of disclosing material, non-public information and for complying with our disclosure obligations under Regulation FD. We routinely post and make accessible financial and other information regarding the Corporation on our website. Investors should monitor our website, including the Investor Relations portion of our website, in addition to our press releases, U.S. Securities and Exchange Commission (SEC) filings, public conference calls and webcasts. Our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (Exchange Act) are available on the Investor Relations portion of our website as soon as reasonably practicable after we electronically file such reports with, or furnish them to, the SEC and at the SEC’s website, www.sec.gov. Notwithstanding the foregoing, the information contained on our website as referenced in this paragraph, or otherwise in this Annual Report on Form 10-K, is not incorporated by reference into this Annual Report on Form 10-K. Also, we make available on the Investor Relations portion of our website: (i) our Code of Conduct; (ii) our Corporate Governance Guidelines; and (iii) the charter of each active committee of our Board of Directors (the Board). Our Code of Conduct constitutes a “code of ethics” and a “code of business conduct and ethics” that applies to the required individuals associated with the Corporation for purposes of the respective rules of the SEC and the New York Stock Exchange. We also intend to disclose any amendments to our Code of Conduct and waivers of our Code of Conduct required to be disclosed by the rules of the SEC and the New York Stock Exchange on the Investor Relations portion of our website. All of these corporate governance materials are also available free of charge in print to shareholders who request them in writing to: Bank of America Corporation, Attention: Office of the Corporate Secretary, Bank of America Corporate Center, 100 North Tryon Street, NC1-007-56-06, Charlotte, North Carolina 28255.

Segments

Through our various bank and nonbank subsidiaries throughout the U.S. and in international markets, we provide a diversified range of banking and nonbank financial services and products through four business segments: Consumer Banking, Global Wealth & Investment Management (GWIM), Global Banking and Global Markets, with the remaining operations recorded in All Other. Additional information related to our business segments and the products and services they provide is included in the information set forth on pages 36 through 44 of Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations (MD&A) and Note 23 – Business Segment Information to the Consolidated Financial Statements.

Competition

We operate in a highly competitive environment. Our competitors include banks, thrifts, credit unions, investment banking firms, investment advisory firms, brokerage firms, investment companies, insurance companies, mortgage banking companies, credit card issuers, mutual fund companies, hedge funds, private equity firms, and e-commerce and other internet-based companies, including merchant banks and companies providing nonbank financial services. We compete with some of these competitors globally and with others on a regional or product-specific basis. We are increasingly competing with firms offering products solely over the internet and with nonfinancial companies, including firms utilizing emerging technologies, such as digital assets, rather than, or in addition to, traditional banking products.

Competition is based on a number of factors including, among others, customer service and convenience, the pricing, quality and range of products and services offered, lending limits, the quality and delivery of our technology and our reputation, experience and relationships in relevant markets. Our ability to continue to compete effectively also depends in large part on our ability to attract new employees and develop, retain and motivate our existing employees, while managing compensation and other costs.

Human Capital Resources

Bank of America has always been the bank of opportunity for our shareholders, our clients and customers, our communities and our teammates. We strive to make Bank of America a great place to work for our employees by providing access to a broad range of opportunities to achieve their professional goals and by maintaining a culture of caring for them and their families. We are a company of talented employees who represent a diverse range of experiences, skills, backgrounds and perspectives across many dimensions. We are deliberate about the many ways we seek to create an inclusive environment where everyone has the opportunity to achieve their career goals. This is core to our values, to our efforts to make the Corporation a great place to work and to delivering on Responsible Growth for our clients, customers and communities around the globe.

Our Board and its Compensation and Human Capital Committee provide oversight of our human capital management strategies, programs, initiatives and practices. The Corporation’s senior management provides regular briefings and reporting on human capital matters to the Board and its Committees to facilitate the Board’s oversight.

At both December 31, 2025 and 2024, the Corporation employed approximately 213,000 employees, of which 77 percent and 78 percent, respectively, were located in the U.S. None of our U.S. employees are subject to a collective bargaining agreement. Additionally, in 2025 and 2024, the Corporation’s compensation and benefits expense was $42.3 billion and $40.2 billion, or 61 percent and 60 percent, of total noninterest expense.

The following table provides our workforce data by gender (globally) and ethnicity (U.S. only).

Talent, Inclusion and Opportunity

The Corporation is focused on building a strong pipeline of talent, which means finding and hiring external candidates who are committed to our purpose and have a passion for serving our clients and communities. This spans programs from entry-level hiring through more senior-level recruiting. In 2025, the Corporation hired over 18,000 teammates reflecting a wide variety of backgrounds, experiences, skills and perspectives so that we understand and can respond to the needs of our clients and communities.

We provide a variety of resources to help employees grow in their current roles and build new skills, including resources to help employees find new opportunities, re-skill and seek leadership positions. We have 11 Employee Networks with over 330,000 voluntary memberships, which provide teammates opportunities to meet new people, have an impact across multiple business lines and grow personally and professionally. They are open to all employees and participation is voluntary. In 2025, more than 14,000 employees found new roles within the Corporation, and we delivered more than 7.6 million hours of training and development to our teammates through Bank of America Academy. Additionally, our Board oversees Chief Executive Officer and senior management succession planning, which is formally reviewed at least annually.

As part of our ongoing efforts to make the Corporation a great place to work, we conduct a confidential annual Employee Engagement Survey (Survey) and have done so for nearly two decades. The Survey results are reviewed by the Board and senior management and used to assist in reviewing the Corporation’s human capital strategies, programs, initiatives, and practices. In 2025, 86 percent of the Corporation’s employees participated in the Survey, and our Employee Engagement Index, an overall measure of employee satisfaction with the Corporation, was 86 percent. Our turnover among employees was stable at 8 percent in both 2025 and 2024.

Recognizing and Rewarding Performance

Our compensation philosophy is to pay for performance over the long term, as well as on an annual basis. Our performance considerations encompass both financial and nonfinancial measures, including the manner in which results are achieved. These considerations are designed to reinforce and promote Responsible Growth and align with our Risk Framework.

We strive to pay our employees based on market rates for their roles, experience and how they perform. We regularly benchmark against other companies both within and outside our industry to confirm our pay is competitive. In 2021, the Corporation announced it would increase its minimum hourly wage for U.S. employees to $25 per hour by 2025. In October 2025, the Corporation took its final step to reach this goal by raising its U.S. minimum hourly wage from $24 to $25 per hour. In addition, in January 2026, for the ninth year since 2017, we announced that we recognized our teammates with Sharing Success compensation awards for their efforts during 2025. Approximately 96 percent of employees globally will receive an award in the first quarter of 2026.

The Corporation is committed to equal pay for equal work. We maintain robust policies and practices that reinforce our commitment, including reviews conducted by a third-party consultant with oversight from our Board and senior management.

Physical, Emotional, and Financial Wellness

The Corporation is committed to providing employees with access to leading benefits and programs that help promote their physical, emotional and financial wellness. Investments we make in our teammates are designed to help them thrive, enabling them to better deliver for our clients, communities and each other.

In 2025, we continued our efforts to provide affordable access to healthcare. Teammates enrolled in one of our national medical plans were able to access virtual general medical and behavioral health care at no cost. For the 13th year in a row, U.S. health insurance premiums remained unchanged for teammates earning less than $50,000.

We also recognize the importance of emotional wellness. Globally, teammates and members of their households can utilize our Employee Assistance Programs for 12 in-person confidential counseling sessions, and unlimited phone consultations at no cost. The Corporation also offers comprehensive time-away policies and caregiving benefits. Globally, teammates celebrating at least 15 years of continuous service with the Corporation can participate in our paid Global Sabbatical Program.

We support teammates in reaching financial wellness with retirement savings plans and other programs, along with access to self-guided financial planning tools and expert advice.

For more information about our human capital management, see the Corporation’s website and 2025 Annual Report to shareholders that we expect to be available on the Investor Relations portion of our website in March 2026 (the content of which is not incorporated by reference into this Annual Report on Form 10-K).

Government Supervision and Regulation

The following discussion describes, among other things, elements of an extensive regulatory framework applicable to BHCs, financial holding companies, banks and broker-dealers, including specific information about Bank of America.

3 Bank of America

We are subject to an extensive regulatory framework applicable to BHCs, financial holding companies and banks and other financial services entities. U.S. federal regulation of banks, BHCs and financial holding companies is intended primarily for the protection of depositors and the Deposit Insurance Fund (DIF) rather than for the protection of shareholders and creditors. As a registered financial holding company and BHC, the Corporation is subject to the supervision of, and regular inspection by, the Board of Governors of the Federal Reserve System (Federal Reserve). Our U.S. bank subsidiaries (the Banks), organized as national banking associations, are subject to regulation, supervision and examination by the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and the Federal Reserve. In addition, the Federal Reserve and the OCC have adopted guidelines that establish minimum standards for the design, implementation and board oversight of BHCs’ and national banks’ risk governance frameworks. U.S. financial holding companies, and the companies under their control, are permitted to engage in activities considered “financial in nature” as defined by the Gramm-Leach-Bliley Act and related Federal Reserve interpretations. The Corporation's status as a financial holding company is conditioned upon maintaining certain eligibility requirements for both the Corporation and its U.S. depository institution subsidiaries, including minimum capital ratios, supervisory ratings and, in the case of the depository institutions, at least satisfactory Community Reinvestment Act ratings. Failure to be an eligible financial holding company could result in the Federal Reserve limiting Bank of America's activities, including potential acquisitions. Additionally, we are subject to a significant number of laws, rules and regulations (LRRs) that govern our businesses in the U.S. and in the other jurisdictions in which we operate, including permissible activities, minimum levels of capital and liquidity, compliance risk management, consumer products and sales practices, privacy, data protection, sustainability and executive compensation, among others. Additionally, we are subject to certain actions of the U.S. executive branch, including executive orders (Executive Branch Actions).

The scope of the LRRs and the intensity of the supervision to which we are subject is significant. In addition, the banking and financial services sector is subject to substantial regulatory enforcement and fines. We cannot assess whether or not there will be any major changes in the regulatory environment and expect that our business will remain subject to continuing and extensive regulation and supervision.

We are also subject to various other LRRs, as well as supervision and examination by other regulatory agencies, all of which directly or indirectly affect our entities, management and ability to make distributions to shareholders. For instance, our broker-dealer subsidiaries are subject to both U.S. and international regulation and supervision, including by the SEC, Financial Industry Regulatory Authority and New York Stock Exchange, among others; our futures commission merchant subsidiary supporting commodities and derivatives businesses in the U.S. is subject to regulation by and supervision of the U.S. Commodity Futures Trading Commission (CFTC), National Futures Association, the Chicago Mercantile Exchange, and in the case of the Banks, certain banking regulators; our insurance activities are subject to licensing and regulation by state insurance regulatory agencies; and our consumer financial products and services are regulated by the Consumer Financial Protection Bureau (CFPB). In addition, certain U.S. and foreign subsidiaries are also registered with the CFTC as swap dealers,

and conditionally registered with the SEC as security-based swap dealers.

Our non-U.S. businesses are also subject to extensive regulation by various non-U.S. regulators, including governments, securities exchanges, prudential regulators, central banks and other regulatory bodies, in the jurisdictions in which those businesses operate. For example, our financial services entities are subject to regulation in the United Kingdom (U.K.) by the Prudential Regulatory Authority and Financial Conduct Authority, in Ireland by the European Central Bank (ECB) and the Central Bank of Ireland and in France by the ECB, Autorité de Contrôle Prudentiel et de Résolution and Autorité des Marchés Financiers.

The Corporation is also subject to extensive LRRs in the U.S. and in the other jurisdictions in which it operates regarding bribery and corruption, know-your-customer requirements, anti-money laundering, embargo programs and economic sanctions. For example, we are subject to the U.S. Bank Secrecy Act (BSA), which contains anti-money laundering and financial transparency laws designed to detect and deter money laundering and the financing of terrorism, as well as record-keeping, reporting, due diligence and customer verification requirements, various sanctions programs administered and enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and foreign jurisdictions, which target entities or individuals that are, or are located in countries that are, involved in activities, such as terrorism, hostilities, drug trafficking or human rights violations and the U.S. Foreign Corrupt Practices Act (FCPA) and the U.K. Bribery Act, relating to corrupt and illegal payments to government officials and others. In 2024, federal regulators, including the Federal Reserve and the OCC, proposed amendments to update the requirements for supervised institutions to establish, implement and maintain effective, risk-based and reasonably designed anti-money laundering programs, including the identification, evaluation and documentation of money laundering risks. The public comment period has concluded and the proposal remains pending.

Source of Strength

Under the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act (the Financial Reform Act) and Federal Reserve policy, BHCs are expected to act as a source of financial strength to each subsidiary bank and to commit resources to support each such subsidiary. Similarly, under the cross-guarantee provisions of the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA), in the event of a loss suffered or anticipated by the FDIC, either as a result of default of a bank subsidiary or related to FDIC assistance provided to such a subsidiary in danger of default, the affiliate banks of such a subsidiary may be assessed for the FDIC’s loss, subject to certain exceptions.

Transactions with Affiliates

Pursuant to Section 23A and 23B of the Federal Reserve Act, as implemented by the Federal Reserve’s Regulation W, the Banks are subject to restrictions that limit certain types of transactions between the Banks and their nonbank affiliates. In general, U.S. banks are subject to quantitative and qualitative limits on extensions of credit, purchases of assets and certain other transactions involving their nonbank affiliates. Additionally, transactions between U.S. banks and their nonbank affiliates are required to be on arm’s length terms and must be consistent with standards of safety and soundness.

Deposit Insurance

Deposits placed at U.S. domiciled banks are insured by the FDIC, subject to limits and conditions of applicable law and the FDIC’s regulations. Pursuant to the Financial Reform Act, FDIC insurance coverage limits are $250,000 per depositor, per insured bank for each account ownership category. All insured depository institutions are required to pay assessments to the FDIC in order to fund the DIF.

The FDIC is required to maintain a statutory minimum ratio of the DIF to insured deposits in the U.S. of at least 1.35 percent and has established a long-term goal of a two percent DIF ratio. As of the date of this report, the DIF satisfied the statutory minimum ratio, but it has not reached this long-term goal. Deposit insurance assessment rates are subject to change by the FDIC and will be impacted by the overall economy and the stability of the banking industry as a whole. The FDIC also has the authority to charge special assessments from time to time, including in connection with systemic risk events. For example, in 2023, the FDIC issued its final rule to impose a special assessment to recover the loss to the DIF resulting from the closure of Silicon Valley Bank and Signature Bank, the amount of which has been subsequently reduced. For more information on the impact to the Corporation of the FDIC special assessment, see Note 12 – Commitments and Contingencies to the Consolidated Financial Statements. For more information regarding deposit insurance, see Item 1A. Risk Factors – Regulatory, Compliance and Legal on page 17.

Capital, Liquidity and Operational Requirements

As a financial holding company, we and our bank subsidiaries are subject to the regulatory capital and liquidity rules issued by the Federal Reserve and other U.S. banking regulators, including the OCC and the FDIC. These rules are complex and continue to evolve as U.S. and international regulatory authorities propose and enact amendments to these rules. The Corporation seeks to manage its capital position to maintain sufficient capital to satisfy these regulatory rules and to support our business activities. These continually evolving rules are likely to influence our planning processes and may result in changes to regulatory capital and liquidity, as well as impose additional operational and compliance costs on the Corporation.

For more information on regulatory capital rules and capital composition, see Capital Management on page 48, Note 16 – Regulatory Requirements and Restrictions to the Consolidated Financial Statements, which are incorporated by reference in this Item 1, and Item 1A. Risk Factors – Regulatory, Compliance and Legal on page 17.

Distributions

We are subject to various regulatory policies and requirements relating to capital actions, including payment of dividends and common stock repurchases. For instance, Federal Reserve regulations require major U.S. BHCs to submit a capital plan as part of an annual Comprehensive Capital Analysis and Review (CCAR).

Our ability to pay dividends and make common stock repurchases depends in part on our ability to maintain regulatory capital levels above minimum requirements plus buffers and non-capital standards established under the FDICIA. To the extent that the Federal Reserve increases our stress

capital buffer (SCB), global systemically important bank (G-SIB) surcharge or countercyclical capital buffer, our returns of capital to shareholders, including dividends and common stock repurchases, could decrease. As part of its CCAR, the Federal Reserve conducts stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may impact the level of our SCB. For example, based on the results of our 2025 CCAR stress test, the Corporation’s SCB decreased to 2.5 percent. Additionally, the Corporation’s G-SIB surcharge is 3.0 percent. The Federal Reserve could also impose limitations or prohibitions on taking capital actions such as paying or increasing dividends or repurchasing common stock, including as a result of economic disruptions or events.

If the Federal Reserve finds that a bank is not “well-capitalized” or “well-managed,” the bank’s BHC would be required to enter into an agreement with the Federal Reserve to comply with all applicable capital and management requirements, which may contain additional limitations or conditions relating to its activities. Additionally, the applicable federal regulatory authority is authorized to determine, under certain circumstances relating to the financial condition of a bank or BHC, if the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof.

Many of our subsidiaries, including our bank and broker-dealer subsidiaries, are subject to laws that restrict dividend payments, or authorize regulatory bodies to block or reduce the flow of funds from those subsidiaries to the parent company or other subsidiaries. The rights of the Corporation, our shareholders and our creditors to participate in any distribution of the assets or earnings of our subsidiaries are further subject to the prior claims of creditors of the respective subsidiaries.

For more information regarding distributions, including the minimum capital requirements, see Note 13 – Shareholders’ Equity and Note 16 – Regulatory Requirements and Restrictions to the Consolidated Financial Statements.

Resolution Planning

As a BHC with greater than $250 billion of assets, every two years the Corporation is required by the Federal Reserve and the FDIC to submit a plan for a rapid and orderly resolution in the event of material financial distress or failure.

Such resolution plan is intended to be a detailed roadmap for the orderly resolution of the BHC, including the continued operations or solvent wind down of its material entities, pursuant to the U.S. Bankruptcy Code under one or more hypothetical scenarios assuming no extraordinary government assistance.

If both the Federal Reserve and the FDIC determine that the BHC’s plan is not credible, the Federal Reserve and the FDIC may jointly impose more stringent capital, leverage or liquidity requirements or restrictions on growth, activities or operations. A summary of our plan is available on the Federal Reserve and FDIC websites.

The FDIC also requires the submission of a resolution plan for Bank of America, National Association (BANA), which must describe how the insured depository institution would be resolved under the bank resolution provisions of the Federal Deposit Insurance Act. A description of this plan is available on the FDIC’s website.

5 Bank of America

We continue to make progress to enhance our resolvability, which includes continued improvements to our preparedness and exercise capabilities to implement our resolution plan, both from a financial and operational standpoint.

Across international jurisdictions, resolution planning is the responsibility of national resolution authorities (RA) and central resolution authorities (CA). Among those, the jurisdictions with the greatest impact to the Corporation’s subsidiaries are the U.K., Ireland, France, Mexico, Hong Kong, Indonesia, the Philippines and Malaysia where rules have been issued requiring the submission of significant information about locally incorporated subsidiaries as well as the Corporation’s banking branches located in those jurisdictions that are deemed to be material for resolution planning purposes. As a result of the RA’s and CA's review of the submitted information, we could be required to take certain actions over the next several years that could increase operating costs and potentially result in the restructuring of certain businesses and subsidiaries.

For more information regarding our resolution plan, see Item 1A. Risk Factors – Liquidity on page 9.

Insolvency and the Orderly Liquidation Authority

Under the Federal Deposit Insurance Act, the FDIC may be appointed receiver of an insured depository institution if it is insolvent or in certain other circumstances. In addition, under the Financial Reform Act, when a systemically important financial institution (SIFI) such as the Corporation is in default or danger of default, the FDIC may be appointed receiver in order to conduct an orderly liquidation of such institution. In the event of such appointment, the FDIC could, among other things, invoke the orderly liquidation authority, instead of the U.S. Bankruptcy Code, if the Secretary of the Treasury makes certain financial distress and systemic risk determinations. The orderly liquidation authority is modeled in part on the Federal Deposit Insurance Act, but also adopts certain concepts from the U.S. Bankruptcy Code.

The orderly liquidation authority contains certain differences from the U.S. Bankruptcy Code. For example, in certain circumstances, the FDIC could permit payment of obligations it determines to be systemically significant (e.g., short-term creditors or operating creditors) in lieu of paying other obligations (e.g., long-term creditors) without the need to obtain creditors’ consent or prior court review. The insolvency and resolution process could also lead to a large reduction or total elimination of the value of a BHC’s outstanding equity, as well as impairment or elimination of certain debt.

Under the FDIC’s “single point of entry” strategy for resolving SIFIs, the FDIC could replace a distressed BHC with a bridge holding company, which could continue operations and result in an orderly resolution of the underlying bank, but whose equity is held solely for the benefit of creditors of the original BHC.

Furthermore, the Federal Reserve requires that BHCs maintain minimum levels of long-term debt required to provide adequate loss absorbing capacity in the event of a resolution.

For more information regarding our resolution, see Item 1A. Risk Factors – Liquidity on page 9.

Limitations on Acquisitions

The Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 permits a BHC to acquire banks located in states other than its home state without regard to state law, subject to certain conditions, including the condition that the BHC, after and as a result of the acquisition, controls no more than 10 percent of the total amount of deposits of insured depository institutions in the U.S. and no more than 30 percent or such

lesser or greater amount set by state law of such deposits in that state. At June 30, 2025, we held greater than 10 percent of the total amount of deposits of insured depository institutions in the U.S.

In addition, the Financial Reform Act restricts acquisitions by a financial institution if, as a result of the acquisition, the total liabilities of the financial institution would exceed 10 percent of the total liabilities of all financial institutions in the U.S. At June 30, 2025, our liabilities did not exceed 10 percent of the total liabilities of all financial institutions in the U.S.

The Volcker Rule

The Volcker Rule prohibits insured depository institutions and companies affiliated with insured depository institutions (collectively, banking entities) from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options for their own account. The Volcker Rule also imposes limits on banking entities’ investments in, and other relationships with, hedge funds and private equity funds. The Volcker Rule provides exemptions for certain activities, including market making, underwriting, hedging, trading in government obligations, insurance company activities and organizing and offering hedge funds and private equity funds. The Volcker Rule also clarifies that certain activities are not prohibited, including acting as agent, broker or custodian. A banking entity with significant trading operations, such as the Corporation, is required to maintain a detailed compliance program to comply with the restrictions of the Volcker Rule.

Derivatives

Our derivatives businesses are subject to extensive regulation globally, including under the Financial Reform Act, the European Union (EU) Markets in Financial Instruments Directive and Regulation, the European Market Infrastructure Regulation, analogous U.K. regulatory regimes and similar regulatory regimes in other jurisdictions. These regulations, among other things, require clearing and exchange trading of certain derivatives, establish capital, margin, reporting, registration and business conduct requirements for certain market participants, set position limits on certain derivatives and set out derivatives trading transparency requirements.

In addition, many G-20 jurisdictions, including the U.S., EU, U.K., and Japan, have adopted resolution stay regulations to address concerns that the close-out of derivatives and other financial contracts could impede orderly resolution of G-SIBs. Generally, these regulations require amendment of certain financial contracts to provide for contractual recognition of stays of termination rights under various statutory resolution regimes and a stay on the exercise of cross-default rights based on an affiliate’s entry into insolvency proceedings. Resolution regulations may also require contractual recognition by the counterparty that amounts owed to them may be written down or converted into equity as part of a bail in. As resolution stay regulations of a particular jurisdiction applicable to us go into effect, we amend impacted financial contracts in compliance with such regulations either as a regulated entity or as a counterparty facing a regulated entity in such jurisdiction.

Consumer Regulations

Our consumer businesses are subject to extensive federal regulation and oversight by federal and state authorities. We are subject to numerous federal consumer protection laws, including the Equal Credit Opportunity Act, Home Mortgage Disclosure Act, Fair Housing Act, Electronic Fund Transfer Act (EFTA), Fair Credit Reporting Act, Real Estate Settlement Procedures Act, prohibitions on unfair, deceptive, or abusive acts or practices, Truth in Lending Act, Truth in Savings Act and the Servicemembers Civil Relief Act.

Privacy and Information Security

We are subject to many U.S. federal, state and international laws and regulations governing requirements for maintaining policies and procedures regarding the collection, disclosure, use and protection of the personal information of our customers and employees. The Gramm-Leach-Bliley Act requires us to periodically disclose Bank of America’s privacy policies and practices relating to the disclosure of customer information and enables retail customers to opt out of our ability to share information with unaffiliated third parties, under certain circumstances. The Gramm-Leach-Bliley Act and other laws also require us to implement a comprehensive information security program that includes administrative, technical and physical safeguards to provide the security and confidentiality of customer records and information. Security and privacy policies and procedures for the protection of personal and confidential information are in effect across all businesses and geographic locations.

Other laws and regulations, at the international, federal and state level, impact our ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or contact customers with marketing offers and establish certain rights of consumers in connection with their

personal information. For example, California’s Consumer Privacy Act (CCPA) provides consumers with the right to know what personal data is being collected, know whether their personal data is sold, or disclosed for purposes of targeted marketing, and to whom, and opt out of the sale or disclosure of their personal data, among other rights. In addition, in the EU and other countries around the world, similar laws, such as the General Data Protection Regulation (GDPR), afford those countries’ residents with certain rights related to their information and may impose additional obligations on financial institutions. The impact of these laws on the Corporation is assessed and addressed through comprehensive compliance implementation programs. These existing and evolving legal requirements in the U.S. and abroad, as well as court proceedings and changing guidance from regulatory bodies, including the validity of cross-border data transfer mechanisms from the EU and other jurisdictions, continue to lend uncertainty to privacy compliance globally.

Additionally, the Corporation is subject to emerging and evolving information security (including cybersecurity) LRRs enacted by U.S. federal and state governments and non-U.S. jurisdictions, including requirements to develop cybersecurity and resilience programs, policies and frameworks, as well as provide disclosure and/or notifications of certain cybersecurity incidents and data breaches. Artificial intelligence-related (AI) LRRs are also rapidly evolving in the U.S. and non-U.S. jurisdictions imposing various obligations, including AI governance and risk management, transparency and consumer disclosures, documentation and reporting requirements, AI use restrictions and enhanced compliance obligations for AI systems, including those categorized as high risk. For more information on risks related to privacy and information security, see Item 1A. Risk Factors on beginning on page 8.

7 Bank of America