Northern Trust

2025 ANNUAL REPORT | NORTHERN TRUST CORPORATION 31

Our reputation and business prospects may also be damaged if we do not, or are perceived not to, effectively prepare for the potential business and operational opportunities and risks associated with climate change. This includes the development and marketing of effective and competitive new products, objectively understanding how climate changes might impact the financial performance of direct and indirect client investments, and other services designed to address our clients’ climate related needs. We also face regulatory and liability risk associated with not meeting regulatory expectations on climate risks, greenwashing claims, a failure to execute on our public climate-related commitments, or through association with individuals, entities, industries or products connected to climate change issues. At the same time, financial institutions have also been subject to external scrutiny from stakeholders, including some regulatory agencies, government officials, and clients in relation to areas our business decisions, public commitments and affiliations associated with climate change. Due to the divergent views of stakeholders, there is an increased risk that any action, or lack thereof, by us concerning our response to climate change will be perceived negatively by some stakeholders. If we do not identify, quantify, and mitigate such risks successfully, we may experience financial losses, litigation, reputational harm, and losses of investor and stakeholder confidence.

Methodologies and data used to conduct more robust climate-related risk analyses are being developed. Modeling capabilities across the industry to analyze climate-related risks and interconnections are improving but remain imperfect, for example, third-party exposures, emissions and other data are limited in availability and variable in quality. However, legislative and regulatory uncertainties along with inconsistencies and conflicts of policy across jurisdictions could result in higher costs and regulatory, compliance, credit, and reputational risks.

A March 2026 revised Basel III proposal would replace standardized/advanced approaches with a new expanded risk-based approach; a preliminary assessment estimates a modest decrease in Risk-Weighted Assets, but final-rule impacts and timing remain uncertain.

A global security operations center aggregates threat information and alerts the organization under Northern Trust's Cybersecurity Incident Response Plan.

A significant portion of Northern Trust Corporation's business involves providing services to large, complex clients requiring understanding of the market and legal, regulatory and accounting standards across jurisdictions.

A significant portion of our business involves providing certain services to large, complex clients which requires an understanding of the market and legal, regulatory and accounting standards in various jurisdictions. Any failure to understand, address or comply with those standards appropriately could affect our growth prospects or affect our reputation negatively. We identify and manage risk through our business strategies and plans and our risk management practices and controls. If we fail to identify and manage significant risks successfully, we could incur financial loss, suffer damage to our reputation that could restrict our ability to grow or conduct business profitably, or become subject to regulatory penalties or constraints that could limit some of our activities or make them significantly more expensive. In addition, our businesses and the markets in which we operate are continuously evolving. We may fail to understand fully the implications of changes in legal or regulatory requirements, our businesses or the financial markets or fail to enhance our risk framework to address those changes in a timely fashion. If our risk framework is ineffective, either because it fails to keep pace with changes in the financial markets, legal and regulatory requirements, our businesses, our counterparties, clients or service providers or for other reasons, we could incur losses, suffer reputational damage or find ourselves out of compliance with applicable regulatory or contractual mandates or expectations. These risks are magnified as client requirements become more complex and as our increasingly global business requires end-to-end management of operational and other processes across multiple time zones and many inter-related products and services.