Morgan Stanley

The economic environment exhibited strength in the second quarter of 2026, characterized by active capital markets supported by the adoption of AI and improved investor sentiment. Geopolitical risk, inflation, rising asset prices, the rate of economic growth and the future path of monetary policy represent ongoing uncertainties which could continue to impact the capital markets and our businesses.

AI Artificial intelligence

We also continue to experience price competition in our Institutional Securities business segment’s products. In particular, the ability to execute securities, derivatives and other financial instrument trades electronically on exchanges, swap execution facilities and other automated trading platforms, and the introduction and application of new technologies, including generative artificial intelligence and tokenization, will likely continue the pressure on our revenues. The trend toward direct access to automated, electronic markets will likely continue as additional markets move to automated trading platforms.

our competitors across different channels (i.e., advisor led, workplace and digital direct) is affected by multiple factors including our brand and reputation, the breadth, depth and pricing of our product offerings and our technology supporting evolving client needs, including generative artificial intelligence and tokenization.

infrastructure that supports our businesses and the communities where we are located. This may include a disruption involving physical site access; software flaws and vulnerabilities; cybersecurity incidents; terrorist activities; political unrest; disease pandemics; catastrophic events; climate-related incidents and natural disasters (such as earthquakes, tornadoes, floods, hurricanes and wildfires); electrical outages; environmental hazards; computer servers; internet outages; client access to our digital platforms and mobile applications; communication platforms or other services we use; new technologies (such as generative artificial intelligence); and our employees or third parties with whom we conduct business. Although we and the third parties with whom we conduct business employ backup systems for data, those backup systems may be unavailable following a disruption, the affected data may not have been backed up or may not be recoverable from the backup, the backup systems may not process data as accurately or efficiently as the primary systems or the backup data may be costly to recover, any of which could adversely affect our business.

Cybersecurity risks for financial institutions have significantly increased in recent years, in part because of the proliferation of new technologies; the use of the internet, mobile telecommunications and cloud technologies to conduct financial transactions; the use of artificial intelligence and the emergence of quantum computing; and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, state-sponsored actors and other parties. Any of these parties may also attempt to fraudulently induce employees, customers, clients, vendors or other third parties or users of our systems to disclose sensitive information in order to gain access to our networks, systems or data or those of our employees or clients, and such parties may see their effectiveness enhanced by the use of advanced systems, such as artificial intelligence. Global events and geopolitical instability have also led to increased nation-state targeting of financial institutions in the U.S. and abroad.

Information security risks may also derive from human error, fraud or malice on the part of our employees or third parties, software bugs, server malfunctions, software or hardware failure or other technological failure. For example, human error has led to the loss of the Firm's physical data-bearing devices in the past. These risks may be heightened by several factors, including remote work, reliance on new technologies (such as generative artificial intelligence) or as a result of the integration of acquisitions and other strategic initiatives that may subject us to new technology, customers or third-party providers. In addition, third parties with whom we do business or share information, and each of their service providers, our regulators and the third parties with whom our customers and clients share information used for authentication, may also be sources of cybersecurity and information security risks, particularly where these activities are beyond our security and control systems. There is no guarantee that the measures we take will provide absolute security or recoverability given that the techniques used in cyberattacks are complex, frequently change and are difficult to anticipate.

As our businesses change and grow, including through acquisitions and the introduction and application of new technologies, such as artificial intelligence and tokenization, and the markets in which we operate evolve, our risk management strategies, models and processes may not always adapt with those changes. Some of our methods of managing risk are based upon our use of observed historical market behavior and management’s judgment. As a result, these methods may not predict future risk exposures, which could be significantly greater than the historical measures indicate. Many models we use are based on assumptions or inputs regarding correlations among prices of various asset classes or other market indicators and, therefore, may not anticipate future market conditions, such as the impact of a pandemic or a geopolitical conflict, which could cause us to incur losses.

The Firm and its employees are subject to wide-ranging regulation and supervision, which, among other things, subject us to intensive scrutiny of our businesses and any plans for expansion of those businesses through acquisitions or otherwise, limitations on activities, a systemic risk regime that imposes heightened capital and liquidity and funding requirements, including the global implementation of capital standards established by the Basel Committee, and other enhanced prudential standards, resolution regimes and resolution planning requirements, requirements for maintaining minimum amounts of TLAC and external long-term debt, restrictions on activities and investments imposed by the Volcker Rule, comprehensive derivatives regulation, commodities regulation, market structure regulation, consumer protection regulation, AML, terrorist financing and anti-corruption rules and regulations, tax regulations and interpretations, antitrust laws, trade and transaction reporting obligations, requirements related to preventing the misuse of confidential information, including material non-public information, record-keeping requirements, broadened fiduciary obligations and disclosure requirements and laws and regulations related to new technologies, including artificial intelligence and tokenization.

We continue to experience price competition in some of our businesses. In particular, the ability to execute securities, derivatives and other financial instrument trades electronically on exchanges, swap execution facilities and other automated trading platforms, and the introduction and application of new technologies, including generative artificial intelligence and tokenization, will likely continue the pressure on revenues. The trend toward direct access to automated, electronic markets will likely continue as additional markets move to more automated trading platforms. We have experienced, and will likely continue to experience, competitive pressures in these and other areas in the future.

As part of the ERM framework, we have implemented and maintain a program that is designed to identify and manage risks arising from the cybersecurity threats confronting the Firm (“Cybersecurity Program”). Our Cybersecurity Program helps protect our clients, customers, employees, property, products, services and reputation by seeking to preserve the confidentiality, integrity and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems. We continually review our Cybersecurity Program, and make adjustments where appropriate, to address the evolving cybersecurity threat landscape, including threats arising from new technologies, such as generative artificial intelligence, and comply with extensive legal and regulatory expectations.

vulnerabilities; cybersecurity incidents; terrorist activities; political unrest; disease pandemics; catastrophic events; climate-related incidents and natural disasters (such as earthquakes, tornadoes, floods, hurricanes and wildfires); electrical outages; environmental hazards; computer servers; internet outages; client access to our digital platforms and mobile applications; communication platforms or other services we use; new technologies (such as generative artificial intelligence); and our employees or third parties with whom we conduct business. Although we and the third parties with whom we conduct business employ backup systems for data, those backup systems may be unavailable following a disruption, the affected data may not have been backed up or may not be recoverable from the backup, the backup systems may not process data as accurately or efficiently as the primary systems or the backup data may be costly to recover, any of which could adversely affect our business.

Cybersecurity risks for financial institutions have significantly increased in recent years, in part because of the proliferation of new technologies; the use of the internet, mobile telecommunications and cloud technologies to conduct financial transactions; and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, state-sponsored actors and other parties. Any of these parties may also attempt to fraudulently induce employees, customers, clients, vendors or other third parties or users of our systems to disclose sensitive information in order to gain access to our networks, systems or data or those of our employees or clients, and such parties may see their effectiveness enhanced by the use of artificial intelligence. Global events and geopolitical instability have also led to increased nation-state targeting of financial institutions in the U.S. and abroad.

Information security risks may also derive from human error, fraud or malice on the part of our employees or third parties, software bugs, server malfunctions, software or hardware failure or other technological failure. For example, human error has led to the loss of the Firm's physical data-bearing devices in the past. These risks may be heightened by several factors, including remote work, reliance on new technologies (such as generative artificial intelligence) or as a result of the integration of acquisitions and other strategic initiatives that may subject us to new technology, customers or third-party providers. In addition, third parties with whom we do business or share information, and each of their service providers, our regulators and the third parties with whom our customers and clients share information used for authentication, may also be sources of cybersecurity and information security risks, particularly where these activities are beyond our security and control systems. There is no guarantee that the measures we take will provide absolute security or recoverability given that the techniques used in cyberattacks are complex, frequently change and are difficult to anticipate.

As our businesses change and grow, including through acquisitions and the introduction and application of new technologies, such as artificial intelligence, and the markets in which we operate evolve, our risk management strategies, models and processes may not always adapt with those changes. Some of our methods of managing risk are based upon our use of observed historical market behavior and management’s judgment. As a result, these methods may not predict future risk exposures, which could be significantly greater than the historical measures indicate.

We continue to experience price competition in some of our businesses. In particular, the ability to execute securities, derivatives and other financial instrument trades electronically on exchanges, swap execution facilities and other automated trading platforms, and the introduction and application of new technologies, including generative artificial intelligence, will likely continue the pressure on revenues. The trend toward direct access to automated, electronic markets will likely continue as additional markets move to more automated trading platforms. We have experienced, and will likely continue to experience, competitive pressures in these and other areas in the future.

There can be no assurance that our business contingency and security response plans fully mitigate all potential risks to us. Our ability to conduct business may be adversely affected by a disruption in the infrastructure that supports our businesses and the communities where we are located. This may include a disruption involving physical site access; software flaws and vulnerabilities; cybersecurity incidents; terrorist activities; political unrest; disease pandemics; catastrophic events; climate-related incidents and natural disasters (such as earthquakes, tornadoes, floods, hurricanes and wildfires); electrical outages; environmental hazards; computer servers; communication platforms or other services we use; new technologies (such as generative artificial intelligence); and our employees or third parties with whom we conduct business. Although we employ backup systems for our data, those backup systems may be unavailable following a disruption, the affected data may not have been backed up or may not be recoverable from the backup, or the backup data may be costly to recover, which could adversely affect our business.

Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies; the use of the internet, mobile telecommunications and cloud technologies to conduct financial transactions; and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, state-sponsored actors and other parties. Any of these parties may also attempt to fraudulently induce employees, customers, clients, vendors or other third parties or users of our systems to disclose sensitive information in order to gain access to our networks, systems or data or those of our employees or clients, and such parties may see their effectiveness enhanced by the use of artificial intelligence. Global events and geopolitical instability have also led to

Information security risks may also derive from human error, fraud or malice on the part of our employees or third parties, software bugs, server malfunctions, software or hardware failure or other technological failure. For example, human error has led to the loss of the Firm's physical data-bearing devices in the past. These risks may be heightened by several factors, including remote work, reliance on new technologies (such as generative artificial intelligence) or as a result of the integration of acquisitions and other strategic initiatives that may subject us to new technology, customers or third-party providers. In addition, third parties with whom we do business or share information, and each of their service providers, our regulators and the third parties with whom our customers and clients share information used for authentication, may also be sources of cybersecurity and information security risks, particularly where activities of customers are beyond our security and control systems. There is no guarantee that the measures we take will provide absolute security or recoverability given that the techniques used in cyberattacks are complex, frequently change and are difficult to anticipate.

As our businesses change and grow, including through acquisitions and the introduction and application of new technologies, such as artificial intelligence, and the markets in which we operate evolve, our risk management strategies, models and processes may not always adapt with those changes. Some of our methods of managing risk are based upon our use of observed historical market behavior and management’s judgment. As a result, these methods may not predict future risk exposures, which could be significantly greater than the historical measures indicate.

We continue to experience price competition in some of our businesses. In particular, the ability to execute securities, derivatives and other financial instrument trades electronically on exchanges, swap execution facilities and other automated trading platforms, and the introduction and application of new technologies, including generative artificial intelligence, will likely continue the pressure on revenues. The trend toward direct access to automated, electronic markets will likely continue as additional markets move to more automated trading platforms. We have experienced and will likely continue to experience competitive pressures in these and other areas in the future.