Risk Management

Annaly Risk Management Framework

Our risk management framework is intended to facilitate a holistic, enterprise wide view of risk that supports a strong and collaborative risk management culture across the firm. We maintain a risk appetite statement that defines both the level and types of risk that we are willing to manage in order to achieve our business objectives. Our risk culture seeks to ensure that key risks are highlighted, understood and managed appropriately.

We are subject to a variety of risks due to the nature of the businesses that we operate. The objective of our risk management framework is to identify, measure and monitor these risks. Risk categories include: Capital, Liquidity & Funding, Investment & Market, Counterparty, Operational, Compliance, Regulatory & Legal and Credit. Additionally, we also consider changing adverse weather patterns and events in our analysis of risk across the portfolio.

Risk management at Annaly begins with our Board and continues with executive oversight through the on-going formulation of risk-management practices executed through Annaly’s in-house risk personnel. The Board, at the forefront of this risk control framework, exercises its oversight of risk management primarily through the Board Risk Committee and Board Audit Committee with support from the other Board Committees.

Daily assessment and management of risk is also the responsibility of our management. A series of management committees have oversight or decision-making responsibilities for Annaly’s overall risk-management activities. Membership of these committees is reviewed regularly to ensure the appropriate personnel are engaged in the risk-management process. Three primary management committees have been established to provide a comprehensive framework for risk management: the Enterprise Risk Committee, Asset and Liability Committee and the Financial Reporting and Disclosure Committee. Each of these committees reports to our Operating Committee, which is responsible for oversight and management of our operations, including approval authority over all aspects of our enterprise risk management.

Operational Risk Management

Our Operational Risk Management practices include emergency preparedness planning and testing to maintain business continuity during events such as natural disasters and system outages. Our well-established Business Continuity Plan (“BCP”) was designed to ensure continued, effective operations through a variety of scenarios including natural disasters and pandemics. It identifies critical systems, processes, roles, and third parties, and can be adjusted on a real-time basis to address situations as they arise.

The BCP is regularly reviewed, tested, and updated. Annual testing includes extensive, remote Disaster Recovery testing and tabletop exercise scenarios with management. The BCP is part of three overlapping plans to address emergency events and ensures the firm’s crisis management planning is in place. It overlaps with the Cyber Security Incident Response Plan and the Corporate Event Protocol. Key tenets of the planning include active communication between our Crisis Response Team, made up of senior leaders across a number of functions, and our internal and external stakeholders to afford efficient, thoughtful, effective responses to evolving emergency situations.