Americas Region Reputational Risk Committee Policy

Americas Region Reputational Risk Committee Policy 6.7 Role of Chairman Deutsche Bank The Chairman of the ARRC is the General Counsel for the Americas. The Chairman chairs each meeting and sets the tone for the committee by clearly articulating the mission statement. Additionally, the Chairman: 1. Sources the agenda; 2. Proposes new members; 3. Casts deciding vote in a tie situation; 4. Reviews and final approves minutes: and 5. Reports ARRC activities and issues to the RGB. Section 7: Risk Appetite 7.1 Definition The concept of risk when applied to reputational risk is different than credit, market or operational risk in that reputational risk (or 'headline' risk) never really goes away — it is a risk that can never be fully mitigated. One reason is that headline risk can easily and erroneously accrue to DB, and yet be as damaging as a true market risk event. For example, DB was slandered in newspapers across the US for abandoning foreclosed properties when DB was not responsible for upkeep of the properties — a third party servicer was responsible. A risk appetite is defined, by DB Group, as the maximum level of risk that DB is prepared to accept, in the aggregate, relative to its financial capacity to assume losses, in order to deliver its business objectives. The DB Group's risk appetite statement defines the Group level risk tolerance that is translated into financial targets for business divisions and risk limits, targets or measures for major risk categories throughout the Group. The risk appetite is an aggregation of risk capacity, risk tolerances and risk limits. 7.2 Discussion of Risk Appetite Terms A legal entity's Risk Capacity is the absolute risk bearing capacity for that entity. The risk capacity represents financial capacity to assume losses and is generally equal to a measure of the market value of surplus. Losses at or near risk capacity would potentially result in insolvency. DB Group monitors risk capacity through capital supply on both a regulatory capital basis and on an Economic Capital (EC) basis, along with liquidity availability under stress scenarios. Risk capacity for a banking legal entity might be 100% of Tier 1 capital. A Risk Tolerance is a measure of risk that the entity has determined is within an acceptable level of risk to "live within". A banking legal entity might establish Risk Tolerances in terms of regulatory capital, economic capital, and liquidity. Risk Limits are clearly defined risk boundaries established for operating units to provide the basis upon which actual risk levels are managed within risk tolerances, and acting upon instances where risk levels approach or exceed established tolerances (escalation procedures for limit breaches). A banking legal entity might establish risk limits covering specific categories of risk (e.g. market risk, credit risk) along with specific business line risk limits. Key Risk indicators (KRIs): Additional metrics monitored on an ongoing basis to provide additional insight into DBTC's risk profile and serve as early warning indicators for risk limits and tolerances. A banking legal entity might identify KRIS around EC components, operational risk, and liquidity. Risk appetites, including reputational risk, will be developed at the legal entity level for the four Tier 1 entities. Setting a reputational risk appetite at the regional level however, where an acceptable risk 8 For internal use only CONFIDENTIAL - PURSUANT TO FED. R. CRIM. P. 6(e) DB-SDNY-0028806 CONFIDENTIAL SDNY_GM_00174990 EFTA01343868