Goldman Sachs Group

During the second quarter of 2026, the operating environment was generally characterized by resilient economic activity, particularly in the U.S., geopolitical concerns, a focus on investments related to artificial intelligence (AI) and uncertainty in the outlook for inflation and international trade policies (including tariffs). The conflict in the Middle East persisted over the course of the quarter, contributing to periods of market volatility. However, shifts in investor sentiment led to generally higher global equity markets following a decline in the prior quarter. Although the Federal Reserve held rates steady during the quarter, concerns about the economic outlook, including inflationary pressures, continued to weigh on the actions taken by central banks globally with respect to policy interest rates.

•Firmwide Artificial Intelligence Risk Committee. The Firmwide Artificial Intelligence Risk Committee is responsible for overseeing both the risks associated with the use of AI and firmwide risks impacted by AI developments internally and externally. This committee is co-chaired by our chief information officer and our chief risk officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact on us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2025 Form 10-K for further information about information and cybersecurity risk.

During the six months ended June 2026, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

During the first quarter of 2026, global economic activity was generally impacted by geopolitical concerns, the outlook for inflation, a focus on investments in artificial intelligence (AI) and uncertainty in international trade policies (including tariffs). In the latter part of the quarter, the conflict in the Middle East generated heightened uncertainty, quickly resulting in market volatility, increased energy prices, lower equity markets and elevated concerns about the outlook for economic growth. These factors also weighed on the actions taken by central banks globally towards policy interest rates, including the Federal Reserve holding rates steady during the quarter.

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact on us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2025 Form 10-K for further information about information and cybersecurity risk.

During the three months ended March 2026, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

The E.U. Digital Operational Resilience Act (DORA) applies from January 2025. DORA requires E.U. financial entities, such as GSBE, to have a comprehensive governance and control framework for the management of information and communications technology risk. In addition, in 2024, the E.U. Artificial Intelligence Act (E.U. AI Act) became effective. Certain provisions of the E.U. AI Act apply from February 2025, with other provisions applying between August 2025 and August 2027. The E.U. AI Act establishes rules for placing on the market, putting into service, and using artificial intelligence systems in the E.U. In July 2025, the European Commission published the voluntary General-Purpose AI (GPAI) Code of Practice, which provides guidelines for compliance with the E.U. AI Act. In parallel, the Directive (EU) 2022/2555 (NIS 2) expands cybersecurity obligations for all “essential” and “important” entities across critical sectors, including banking.

•The development and use of AI present risks and challenges that may adversely impact our business.

•The growth of electronic trading and the introduction of new products and technologies, including trading and distributed ledger technologies, such as cryptocurrencies, and AI technologies, has increased competition.

In the ordinary course of business, we are at times subject to a concentration of credit risk to a particular counterparty, borrower, issuer (including sovereign issuers) or geographic area or group of related countries, such as the E.U., and a failure or downgrade of, or default by, such entity could negatively impact our businesses, perhaps materially, and the systems by which we set limits and monitor the level of our credit exposure to individual entities, industries, countries and regions may not function as we have anticipated. Regulatory reform, including the Dodd-Frank Act, has led to increased centralization of trading activity through particular clearinghouses, agent banks or exchanges, which has significantly increased our concentration of risk with respect to these entities. Our activities expose us to many different counterparties and countries, as well as different industries, including new and emerging industries, such as those related to AI. In particular, we routinely execute a high volume of transactions with counterparties or extend credit to borrowers engaged in financial services activities, including brokers and dealers, commercial banks, clearinghouses, exchanges, alternative asset managers and investment funds. This has resulted in significant credit concentration with respect to these counterparties.

The development and use of AI present risks and challenges that may adversely impact our business.

We or our third-party vendors, clients or counterparties have in the past developed or incorporated and may in the future develop or incorporate AI technology in certain business processes, services or products. The development and use of AI present a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulation targeted specifically at AI, as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations have in the past required and may in the future require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential or proprietary information, that reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we rely on AI models developed by third parties, and, to that extent, are dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Additionally, we are exposed to risks related to the use of AI technologies by third-party vendors, clients, counterparties, clearinghouses and other financial intermediaries. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures, and, as we expand the development and incorporation of AI technologies in our business processes, services or products, including in connection with our OneGS 3.0 initiative, these risks may be heightened.

Similar wording appears in 22 other banks' reports.

In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyber attacks. Generative AI, if used to perpetrate fraud or launch cyber attacks, could result in losses, liquidity outflows or other adverse effects for us and our clients.

We are regularly the target of attempted cyber attacks, including denial-of-service attacks, and must continuously monitor and develop our systems to protect the integrity and functionality of our technology infrastructure and access to and the security of our data. We have faced a high volume of cyber attacks as we expand our mobile- and other internet-based products and services, as well as our usage of mobile and cloud technologies, and as we provide these services to individual consumers. Further, the use of AI by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our third-party vendors and clients. The use of employee-owned devices presents additional risks of cyber attacks, as do hybrid work arrangements. In addition, due to our interconnectivity with third-party vendors (and their respective service providers), agent banks, exchanges, clearinghouses and other financial institutions, we have been, and could in the future be, adversely impacted if any of them is subject to a successful cyber attack or other information security event. These impacts could include the loss of access to information or services from the third party subject to the cyber attack or other information security event or could result in unauthorized access to or disclosure of client, customer or other confidential information, which could, in turn, interrupt certain of our businesses or adversely affect our results of operations and reputation.

The growth of electronic trading and the introduction of new products and technologies, including trading and distributed ledger technologies, such as cryptocurrencies, and AI technologies, has increased competition.

In addition, the emergence, adoption and evolution of new technologies, including distributed ledgers, such as digital assets and blockchain, and AI technologies, have required us to invest resources to adapt our existing products and services, and we expect to continue to make such investments, which could be material. The adoption and evolution of such new technologies may also increase our compliance and regulatory costs. Further, new products, platforms and technologies, including stablecoins, digital assets and others based on distributed ledgers, may not require intermediation and could significantly disrupt payments processing and other financial services. Regulatory limitations on our involvement in products and platforms involving digital assets and distributed ledger technologies may not apply equally or, in some cases, at all to certain of our competitors. We may not be as timely or successful in developing or integrating, or even able to develop or integrate, new products and technologies, such as those built on distributed ledgers or AI technologies, into our existing products and services, adapting to changes in client preferences or achieving market acceptance of our products and services. For example, our competitors may be more timely or successful in developing or integrating AI technologies to increase their productivity and reduce their costs or to provide better transaction execution or improved products and services to clients. Any of the foregoing could affect our ability to attract or retain clients, cause us to lose market share or result in service disruptions and in turn reduce our revenues or otherwise adversely affect us.

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of this Form 10-K for further information about information and cybersecurity risk.

During 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

0.53.95 110.147.190 32.101.124 106.165.191 63.174.191 32.152.193 0.129.198 81.112.181 35.199.186 122.104.172 4 Multiplier effect from increased M&A drives activity and growth across our businesses Strategic Activity Focused on Scale Supportive Capital Markets Innovation and Artificial Intelligence Accelerating Sponsor-Led Transactions More Balanced Regulatory Backdrop #1 for 23 years Advisory net revenue share11 Trusted advisor for >13,000 clients L E A D I N G I N V E S T M E N T B A N K $21.9 $17.0 Advisory net revenues for 2021-2025 ($bn) ~$5bn $1.62 $1.36>$250bn Driving our highest backlog6 in 4 years GS GS#2 bank #2 bank 2025 announced M&A volumes7 ($tn) F O R W A R D C ATA LY S T S

One GS 3.0 A new operating model propelled by artificial intelligence One Goldman Sachs 3.0: A new operating model 13 0.53.95 110.147.190 32.101.124 106.165.191 63.174.191 32.152.193 0.129.198 81.112.181 35.199.186 122.104.172 Enhancing the client experienceDriving productivity and efficiency Improving profitability Strengthening resilience & capacity to scale Bolstering risk management Elevating the employee experience Goals One GS 1.0 Client coverage program; Delivering the Firm One GS 2.0 Breaking down silos; Enhancing synergies Rationalize expenses Reinvest savings into strategic growth areas Optimize headcount Enable process simplification and automation Improve cross-business collaboration Accelerate AI adoption across employee base Modernize foundational architecture for scalability Automate error-prone workflows Enhance data capture, storage and retrieval Reduce friction in onboarding and servicing Enhance user interface across platforms Deliver faster turnaround times Invest to improve client insights Streamline processes Minimize toil Enhance operational risk capabilities Improve data lineage and auditability Improve timeliness of risk insights Initial Workstreams Client Onboarding / KYC Enterprise Risk ManagementVendor Management LendingRegulatory Reporting Sales Enablement

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of artificial intelligence (AI), reports to the Firmwide Technology Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2024 Form 10-K for further information about information and cybersecurity risk.

During the nine months ended September 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

Results Snapshot “This quarter's results reflect the strength of our client franchise and focus on executing our strategic priorities in an improved market environment. Across our business, clients continue to turn to us for their most complex and consequential matters. We know that conditions can change quickly and so we remain focused on strong risk management. Longer term, we are prioritizing the need to operate more efficiently to seamlessly deliver the firm to our clients helped by new AI technologies.” — David Solomon, Chairman and Chief Executive Officer Net Revenues Net Earnings EPS 3Q25 $15.18 billion 3Q25 $ 4.10 billion 3Q25 $12.25 $12.56 billion $44.83 billion $37.33 3Q25 YTD 3Q25 YTD 3Q25 YTD 1 1 Annualized ROE Annualized ROTE Book Value Per Share 15.2% 3Q25 14.2% 3Q25 3Q25 $353.79 14.6% 15.6% 5.1% 3Q25 YTD 3Q25 YTD YTD Growth 4 Quarterly Highlights Selected Items rd $ in millions, except per share amounts 3 highest quarterly net revenues 3Q25 3Q25 YTD Pre-tax earnings: 2 #1 in announced and completed M&A; #2 in high-yield debt and leveraged loan offerings ; 5 $ 38 $ (158) AWM historical principal investments Strong Investment banking fees and Equities net revenues, incl. record Equities financing GM Card / Seller financing (27) (62) 3 Record AUS of $3.45 trillion; st 31 consecutive quarter of long-term fee-based net inflows 11 (220) Total impact to pre-tax earnings $ $ Impact to net earnings $ 8 $ (172) Record Management and other fees; Record Private banking and lending net revenues 0.02 (0.54) Impact to EPS $ $ 0.0pp (0.3)pp Impact to ROE Completed the sale of the General Motors (GM) credit card program in 3Q25 1

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of artificial intelligence (AI), reports to the Firmwide Technology Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2024 Form 10-K for further information about information and cybersecurity risk.

During the six months ended June 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of artificial intelligence (AI), reports to the Firmwide Technology Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2024 Form 10-K for further information about information and cybersecurity risk.

During the three months ended March 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

In 2023, the E.U. Digital Operational Resilience Act (DORA) became effective and applies from January 2025. DORA requires E.U. financial entities, such as GSBE, to have a comprehensive governance and control framework for the management of information and communications technology risk. In addition, in 2024, the E.U. Artificial Intelligence Act (E.U. AI Act) became effective. Certain provisions of the E.U. AI Act apply from February 2025, with other provisions applying between August 2025 and August 2027. The E.U. AI Act establishes rules for placing on the market, putting into service, and using artificial intelligence systems in the E.U.

•The development and use of AI present risks and challenges that may adversely impact our business.

•The growth of electronic trading and the introduction of new products and technologies, including trading and distributed ledger technologies, such as cryptocurrencies, and AI technologies, has increased competition.

The development and use of AI present risks and challenges that may adversely impact our business.

We or our third-party vendors, clients or counterparties have in the past developed or incorporated, and may in the future develop or incorporate, AI technology in certain business processes, services or products. The development and use of AI present a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulation targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential or proprietary information, that reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Additionally, we are exposed to risks related to the use of AI technologies by third-party vendors, clients, counterparties, clearinghouses and other financial intermediaries. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Similar wording appears in 32 other banks' reports.

In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks. Generative AI, if used to perpetrate fraud or launch cyberattacks, could result in losses, liquidity outflows or other adverse effects at a particular financial institution or exchange.

We are regularly the target of attempted cyber attacks, including denial-of-service attacks, and must continuously monitor and develop our systems to protect the integrity and functionality of our technology infrastructure and access to and the security of our data. We have faced a high volume of cyber attacks as we expand our mobile- and other internet-based products and services, as well as our usage of mobile and cloud technologies, and as we provide these services to individual consumers. Further, the use of AI by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our third-party vendors and clients. The use of employee-owned devices presents additional risks of cyber attacks, as do hybrid work arrangements. In addition, due to our interconnectivity with third-party vendors (and their respective service providers), agent banks, exchanges, clearinghouses and other financial institutions, we could be adversely impacted if any of them is subject to a successful cyber attack or other information security event. These impacts could include the loss of access to information or services from the third party subject to the cyber attack or other information security event or could result in unauthorized access to or disclosure of client, customer or other confidential information, which could, in turn, interrupt certain of our businesses or adversely affect our results of operations and reputation.

The growth of electronic trading and the introduction of new products and technologies, including trading and distributed ledger technologies, such as cryptocurrencies, and AI technologies, has increased competition.

In addition, the emergence, adoption and evolution of new technologies, including distributed ledgers, such as digital assets and blockchain, and AI technologies, have required us to invest resources to adapt our existing products and services, and we expect to continue to make such investments, which could be material. The adoption and evolution of such new technologies may also increase our compliance and regulatory costs. Further, technologies, such as those based on distributed ledgers, that do not require intermediation could also significantly disrupt payments processing and other financial services. Regulatory limitations on our involvement in products and platforms involving digital assets and distributed ledger technologies may not apply equally or, in some cases, at all to certain of our competitors. We may not be as timely or successful in developing or integrating, or even able to develop or integrate, new products and technologies, such as those built on distributed ledgers or AI technologies, into our existing products and services, adapting to changes in client preferences or achieving market acceptance of our products and services., For example, our competitors may be more timely or successful in developing or integrating AI technologies to increase their productivity and reduce their costs or to provide better transaction execution or improved products and services to clients. Any of the foregoing could affect our ability to attract or retain clients, cause us to lose market share or result in service disruptions and in turn reduce our revenues or otherwise adversely affect us.

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of this Form 10-K for further information about information and cybersecurity risk.

During 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Technology Risk monitors cybersecurity threats and risks from information security and cybersecurity matters on an ongoing basis, and allocates resources and directs operations in a manner designed to mitigate those risks. For example, in response to the proliferation of AI-enabled fraud and ransomware attacks that continue to be reported globally, we have emphasized phishing and cybersecurity training for our employees and allocated additional resources for business continuity. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurances that we have not had occurrences of undetected cybersecurity incidents.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee. See “Overview and Structure of Risk Management” for further information about this committee.

Investing to operate at scale with resilience and enhanced productivity O P E RATI NG E FFI CI E NCI E S 1 2 3 Organizational Spend Automation Structure Management n Expand presence in key n Optimize transaction based n Simplify and modernize strategic locations expenses technology stack n Optimize pyramid footprintn Drive efficient management n Productivity enhancements of consultants and vendors n Streamline functions and n Leverage AI solutions to processesn Reduction of expenses accelerate and transform associated with business technology consolidated investment entity (CIE) dispositions 9

•Firmwide Technology Risk Committee. The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of artificial intelligence (AI), reports to the Firmwide Technology Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2023 Form 10-K for further information about information and cybersecurity risk.

The Firmwide Technology Risk Committee is responsible for reviewing matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is co-chaired by our CISO and our chief technology officer, and reports to the Firmwide Enterprise Risk Committee. To assist the Firmwide Technology Risk Committee in carrying out its mandate, the Firmwide Artificial Intelligence Risk and Controls Committee, which oversees risks associated with the use of AI, reports to the Firmwide Technology Risk Committee. See “Overview and Structure of Risk Management” for further information about this committee.

•Firmwide Operational Risk and Resilience Committee. The Firmwide Operational Risk and Resilience Committee is responsible for overseeing operational risk, and seeks to ensure our business and operational resilience. To assist the Firmwide Operational Risk and Resilience Committee in carrying out its mandate, other risk committees with dedicated oversight for technology-related risks, including cybersecurity matters and artificial intelligence (AI), report into the Firmwide Operational Risk and Resilience Committee. This committee is co-chaired by our chief administrative officer for EMEA and our head of Operational Risk, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2023 Form 10-K for further information about information and cybersecurity risk.

•Firmwide Operational Risk and Resilience Committee. The Firmwide Operational Risk and Resilience Committee is responsible for overseeing operational risk, and seeks to ensure our business and operational resilience. To assist the Firmwide Operational Risk and Resilience Committee in carrying out its mandate, other risk committees with dedicated oversight for technology-related risks, including cybersecurity matters and artificial intelligence (AI), report into the Firmwide Operational Risk and Resilience Committee. This committee is co-chaired by our chief administrative officer for EMEA and our head of Operational Risk, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of the 2023 Form 10-K for further information about information and cybersecurity risk.

•The development and use of artificial intelligence (AI) present risks and challenges that may adversely impact our business.

The development and use of artificial intelligence (AI) present risks and challenges that may adversely impact our business.

We or our third-party vendors, clients or counterparties may develop or incorporate AI technology in certain business processes, services or products. The development and use of AI present a number of risks and challenges to our business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, both in the U.S. and internationally, and includes regulation targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that result in the release of private, confidential or proprietary information, that reflect biases included in the data on which they are trained, infringe on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, we may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models, and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which we may have limited visibility. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

In addition to our use of AI technologies, we are exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyberattacks. Generative AI, if used to perpetrate fraud or launch cyberattacks, could result in losses, liquidity outflows or other adverse effects at a particular financial institution or exchange.

We are regularly the target of attempted cyber attacks, including denial-of-service attacks, and must continuously monitor and develop our systems to protect the integrity and functionality of our technology infrastructure and access to and the security of our data. We have faced a high volume of cyber attacks as we expand our mobile- and other internet-based products and services, as well as our usage of mobile and cloud technologies, and as we provide these services to individual consumers. Further, the use of AI by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our third-party vendors and clients. The migration of our communication from devices we provide to employee-owned devices presents additional risks of cyber attacks, as do hybrid work arrangements. In addition, due to our interconnectivity with third-party vendors (and their respective service providers), central agents, exchanges, clearinghouses and other financial institutions, we could be adversely impacted if any of them is subject to a successful cyber attack or other information security event. These impacts could include the loss of access to information or services from the third party subject to the cyber attack or other information security event or could result in unauthorized access to or disclosure of client, customer or other confidential information, which could, in turn, interrupt certain of our businesses or adversely affect our results of operations and reputation.

In addition, the emergence, adoption and evolution of new technologies, including distributed ledgers, such as digital assets and blockchain, and AI, have required us to invest resources to adapt our existing products and services, and we expect to continue to make such investments, which could be material. The adoption and evolution of such new technologies may also increase our compliance and regulatory costs. Further, technologies, such as those based on distributed ledgers, that do not require intermediation could also significantly disrupt payments processing and other financial services. Regulatory limitations on our involvement in products and platforms involving digital assets and distributed ledger technologies may not apply equally or in some cases at all to certain of our competitors. We may not be as timely or successful in developing or integrating, or even able to develop or integrate, new products and technologies, such as those built on distributed ledgers or AI technologies, into our existing products and services, adapting to changes in client preferences or achieving market acceptance of our products and services, any of which could affect our ability to attract or retain clients, cause us to lose market share or result in service disruptions and in turn reduce our revenues or otherwise adversely affect us.

•Firmwide Operational Risk and Resilience Committee. The Firmwide Operational Risk and Resilience Committee is responsible for overseeing operational risk, and seeks to ensure our business and operational resilience. To assist the Firmwide Operational Risk and Resilience Committee in carrying out its mandate, other risk committees with dedicated oversight for technology-related risks, including cybersecurity matters and artificial intelligence (AI), report into the Firmwide Operational Risk and Resilience Committee. This committee is co-chaired by our chief administrative officer for EMEA and our head of Operational Risk, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.

Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system. We seek to minimize the occurrence and impact of unauthorized access, disruption or use of information and/or information systems. We deploy and operate preventive and detective controls and processes to mitigate emerging and evolving information security and cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. There is increased information risk through diversification of our data across external service providers, including use of a variety of cloud-provided or -hosted services and applications. In addition, new AI technologies may increase the frequency and severity of cybersecurity attacks. See “Risk Factors” in Part I, Item 1A of this Form 10-K for further information about information and cybersecurity risk.

•Firmwide Operational Risk and Resilience Committee. The Firmwide Operational Risk and Resilience Committee is responsible for overseeing operational risk, and for ensuring our business and operational resilience. To assist the Firmwide Operational Risk and Resilience Committee in carrying out its mandate, other risk committees with dedicated oversight for technology-related risks, including cybersecurity matters and artificial intelligence, report into the Firmwide Operational Risk and Resilience Committee. This committee is co-chaired by our chief administrative officer for EMEA and our head of Operational Risk, who are appointed as chairs by the chairs of the Firmwide Enterprise Risk Committee.