Brighthouse Financial (BHF) Risk Analysis

Our operations are subject to a wide variety of insurance and other laws and regulations. Our insurance subsidiaries and BRCD are subject to regulation by their primary Delaware, Massachusetts and New York state regulators, as applicable, as well as other regulations in states in which they operate. Changes in these laws and regulations could adversely affect our business, financial condition and results of operations. See "Business - Regulation," as supplemented by discussions of regulatory developments in our subsequently filed Quarterly Reports on Form 10-Q under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations - Industry Trends and Uncertainties - Regulatory Developments." In addition, we cannot predict what proposals may be made, what legislation or regulations may be introduced or enacted, or what impact any future legislation or regulations could have on our business, financial condition and results of operations, including the cost of any such compliance. Furthermore, regulatory uncertainty could create confusion among our distribution partners and customers, which could negatively impact product sales. See "Business - Regulation - Standard of Conduct Regulation" for a more detailed discussion of particular regulatory efforts by various regulators. Changes to the laws and regulations that govern the standards of conduct that apply to the sale of our products, as well as the firms that distribute our products, could adversely affect our operations and profitability. Such changes could increase our regulatory and compliance burden, resulting in increased costs, or limit the type, amount or structure of compensation arrangements into which we may enter with certain of our employees, which could negatively impact our ability to compete with other companies, including with respect to recruiting and retaining key personnel. Additionally, our ability to react to rapidly changing economic conditions and the dynamic, competitive market for our products will depend on the continued efficacy of provisions we have incorporated into our product design allowing frequent and contemporaneous revisions of key pricing elements, as well as our ability to work collaboratively with regulators. Changes in regulatory approval processes, rules and other dynamics in the regulatory process could adversely impact our ability to react to such changing conditions. We cannot predict the impact that "best interest" or fiduciary standards may have on our business, financial condition or results of operations. Compliance with new or changed rules or legislation in this area may increase our regulatory burden and that of our distribution partners, require changes to our compensation practices and product offerings, and increase litigation risk, which could adversely affect our financial condition and results of operations. See "Business - Regulation - Standard of Conduct Regulation - State Law Standard of Conduct Rules and Regulations." In addition, we are subject to federal, state and other securities and state insurance laws and regulations which, among other things, require that we distribute certain of our products through a registered broker-dealer. The failure to comply with these laws or changes to these laws could have a material adverse effect on our operations and our profitability. Furthermore, changes in laws and regulations that affect our customers and distribution partners or their operations also may affect our business relationships with them and their ability to purchase or distribute our products. Such actions may negatively affect our business and results of operations. If our associates fail to adhere to regulatory requirements or our policies and procedures, we may be subject to penalties, restrictions or other sanctions by applicable regulators, and we may suffer reputational harm. See "Business - Regulation."

There is continued scrutiny and evolving expectations, as well as conflicting expectations, from investors, customers, regulators and other stakeholders on environmental, social and governance ("ESG") practices and disclosures, including those related to environmental stewardship, climate change, workplace conduct and other social and political mandates. Regulators have imposed and may continue to impose ESG-related rules and guidance, which may conflict with one another and impose additional costs on us or expose us to new or additional risks. In view of evolving regulatory expectations, investor scrutiny, and changing consumer preferences and social expectations, ESG issues can represent emerging or unforeseen risks to our long-term operating performance and financial condition. Moreover, certain organizations that provide information to investors have developed ratings for evaluating companies on their approach to different ESG matters, and unfavorable ratings of the Company or our industry may lead to negative investor sentiment and the diversion of investment to other companies or industries. Economic Environment and Capital Markets-Related Risks

As an insurance enterprise, we are in the business of accepting certain risks. The individuals who conduct our business include executive officers and other members of management, sales intermediaries, investment professionals, product managers, and other associates, as well as associates of our various third-party service providers. Each of these individuals makes decisions and choices that may expose us to risk. These include decisions such as setting underwriting guidelines and standards, product design and pricing, determining what assets to purchase for investment and when to sell them, which business opportunities to pursue, and other decisions. Such individuals may take excessive risks regardless of the structure of our risk management framework or our compensation programs and practices, which may not effectively deter excessive risk-taking or misconduct. Similarly, our controls and procedures designed to monitor associates' business decisions and prevent them from taking excessive risks, and to prevent employee misconduct, may not be effective. If our associates and those of our third-party service providers take excessive risks, the impact of those risks could harm our reputation and have a material adverse effect on our financial condition and results of operations.

A key part of our operating strategy is to leverage third parties to deliver certain services important to our business, including administrative, operational, technology, financial, investment and actuarial services. There can be no assurance that the services provided to us by third parties (or their suppliers, vendors or subcontractors) will be sufficient to meet our operational and business needs, that such third parties will continue to be able to perform their functions in a manner satisfactory to us, that the practices and procedures of such third parties will continue to enable them to adequately manage any processes they handle on our behalf, or that any remedies available under these third-party arrangements will be sufficient in the event of a dispute or nonperformance. In addition, we continue to leverage third-party service providers for certain administrative systems. There can be no assurance that in connection with any such services, including the transition to new third-party service providers in the future, or in connection with any of the services provided to us by existing third parties (or such third-party's supplier, vendor or subcontractor), we will not incur unanticipated expenses or experience other economic or reputational harm, service delays or interruptions, or be subject to litigation or regulatory investigations and actions, any of which could have a material adverse effect on our business and financial results. Furthermore, if a third-party provider (or such third-party's supplier, vendor or subcontractor) fails to meet contractual obligations or requirements (e.g., compliance with applicable laws and regulations or fails to provide material information on a timely basis) or fails to provide required services due to the result of a cyberattack or other security breach, the loss of key personnel or otherwise, then, in each case, we could suffer economic and reputational harm that could have a material adverse effect on our business and financial reporting. In addition, such failures could result in the loss of key distributors, impact the accuracy of our financial reporting, or subject us to litigation or regulatory investigations and actions, which could have a material adverse effect on our business, financial condition and results of operations. See "- Risks Related to Our Business - We may experience difficulty in marketing and distributing products through our distribution channels" and "- Operational Risks - Any failure in our cybersecurity risk management program, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning, could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively." Similarly, if any third-party provider (or such third-party's supplier, vendor or subcontractor) experiences any deficiency in internal controls, determines that its practices and procedures used in providing services to us (including administering any of our policies or managing any of our investments) require review, or otherwise fails to provide services to us in accordance with appropriate standards, we could incur expenses and experience other adverse effects as a result. In such situations, we may be unable to resolve any issues on our own without assistance from the third-party provider, and we could have limited ability to influence the speed and effectiveness of that resolution. In addition, from time to time, certain third parties have brought to our attention practices and procedures used to estimate our reserves with respect to certain products they administer on our behalf that require further review. While we do not believe, based on the information made available to us to date, that any of the matters brought to our attention will require material modifications to reserves or will have a material effect on our business and financial reporting, we are reliant on our third-party service providers to provide further information and assistance with respect to those products. There can also be no assurance that such matters will not require material modifications to reserves or have a material effect on our financial condition or results of operations in the future, or that our third-party service providers will provide further information and assistance. It may be difficult, disruptive and costly for us to replace some of our third-party providers in a timely manner if in the future they were unwilling or unable to provide us with the services we require (as a result of their financial or business conditions or otherwise), which could have a material adverse effect on our business and financial results. In addition, if a third-party provider raises the rates that it charges us for its services, we may not be able to pass the increased costs onto our customers and our profitability may be negatively impacted as a result.

Federal and state legislatures and various government agencies have established laws and regulations protecting the privacy and security of personal information. See "Business - Regulation - Privacy and Cybersecurity Regulation." Our third-party service providers and our employees have access to, and routinely process, personal information through a variety of media, including information technology systems. It is possible that an employee or third-party service provider (or their suppliers, vendors or subcontractors) could, intentionally or unintentionally, disclose or misappropriate personal information, and there can be no assurance that our information security policies and systems in place can prevent unauthorized use or disclosure of confidential information, including personal information. Additionally, our data has been and could in the future be the subject of cyberattacks, and the misappropriation or intentional or unintentional inappropriate disclosure or misuse of employee or client information has occurred and could occur in the future, including as a result of us or our third-party service providers (or their suppliers, vendors or subcontractors) failing to maintain adequate internal controls or if our associates or any of our third-party service providers fail to comply with applicable policies and procedures. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to customers, employees, or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of sensitive information, which could include personal information or other user data, may result in governmental investigations, enforcement actions, regulatory fines, litigation and public statements against us by consumer advocacy groups or others, and could cause our customers, employees, or other third parties to lose trust in us, all of which could be costly and have a material adverse effect on our business, financial condition and results of operations. See "- Any failure in our cybersecurity risk management program, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning, could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively." In addition, compliance with complex variations in privacy and data security laws may require modifications to current business practices, including significant technological efforts that require long implementation timelines, increased costs and dedicated resources. Furthermore, there has been increased scrutiny as well as enacted and proposed additional laws and regulations, including from state regulators, regarding the use of personal information. These laws and regulations are increasing in complexity and number, change frequently, and may be subject to interpretation by different regulators and courts. We may analyze personal information or input such information into third-party analytics in order to better manage our business. Any inquiry in connection with our analytics business practices, as well as any misuse or alleged misuse of those analytics insights, including for alleged violation of third-party privacy and intellectual property rights, or other rights, or alleged breach of contractual obligations, such as limitations on the use of personal information, could cause reputational harm or result in regulatory enforcement actions or litigation, and any related limitations imposed on us could have a material impact on our business, financial condition and results of operations.

We heavily rely on communications, information systems (both internal and provided by third parties), and the internet to conduct our business. We rely on these systems throughout our business for a variety of functions, including processing new business, claims, and post-issue transactions, providing information to customers and distributors, performing actuarial analyses, managing our investments and maintaining financial records. A failure in the security of such systems or a failure to maintain the security of such systems, or the confidential information stored thereon, may result in regulatory enforcement action, harm our reputation or otherwise adversely affect our ability to conduct business, our financial condition or results of operations. In addition, our continuous technological evaluations and enhancements, including changes designed and intended to update our protective measures, may increase our risk of a breach or gap in our security, and there can be no assurance that any such efforts will be effective in preventing or limiting the impact of future cyberattacks. We and our vendors, like other commercial entities, have been, and will likely continue to be, subject to a variety of forms of cyberattacks with the objective of gaining unauthorized access to our systems and data, or disrupting our operations. Potential attacks may include, but are not limited to, cyberattacks, phishing attacks, account takeover attempts, the introduction of computer viruses or malicious code (commonly referred to as "malware"), ransomware or other extortion tactics, denial of service attacks, credential stuffing, and other computer-related penetrations, each of which may be facilitated by the use of AI. Hardware, software or applications developed by us or received from third parties may contain exploitable vulnerabilities, bugs, or defects in design, maintenance or manufacture or other issues that could compromise information and cybersecurity. The risk of cyberattacks has also increased and may continue to increase in connection with recent geopolitical conflicts, including in Europe and the Middle East, and other geopolitical events and dynamics that may adversely disrupt or degrade our operations and may compromise our data. Malicious actors may attempt to fraudulently induce employees, customers, or other users of our systems to disclose credentials or other similar sensitive information in order to gain access to our systems or data, or that of our customers, through social engineering, phishing, mobile phone malware, and other methods. Cybersecurity threats are rapidly evolving, and those threats and the means for obtaining access to our systems are becoming increasingly sophisticated. Cybersecurity threats can originate from a wide variety of sources including terrorists, nation states, financially or politically motivated actors, internal actors such as employees (through malicious or accidental acts), or third parties, such as external service providers, and the techniques used to effectuate such threats change frequently or are often not recognized until after they have been launched. The rapid evolution and increased adoption of AI technologies may intensify our cybersecurity or other information security system risks, including the deployment of AI technologies by malicious third parties and threat actors intent on finding and exploiting vulnerabilities, their use of "deep fakes," and long-term persistent attacks that may increase in sophistication and effectiveness in the future. There is no assurance that administrative, physical and technical controls and other preventive actions taken to reduce the risk of cyberattacks and protect our information technology will prevent physical and electronic break-ins, cyberattacks or other security breaches to such computer systems. In some cases, such physical and electronic break-ins, cyberattacks or other security breaches may not be immediately detected. If we or our vendors fail to prevent, detect, address and mitigate such incidents, this may impede or interrupt our business operations and information systems, result in data loss, destruction, modification, disclosure or misuse, or loss of assets which could adversely affect our business, financial condition and results of operations. A disaster such as a natural catastrophe, epidemic, pandemic, industrial accident, blackout, terrorist attack, cyberattack or war, unanticipated problems with our or our vendors' disaster recovery systems (and the disaster recovery systems of such vendors' suppliers, vendors or subcontractors), could cause our computer systems to be inaccessible to our employees, distributors, vendors or customers or may destroy valuable data. In addition, in the event that a significant number of our or our vendors' managers were unavailable following a disaster, our ability to effectively conduct business could be severely compromised. These interruptions also may interfere with our suppliers' ability to provide goods and services and our employees' ability to perform their job responsibilities. Unanticipated problems with, or failures of, our disaster recovery systems and business continuity plans could have a material impact on our ability to conduct business and on our financial condition and results of operations. A failure of our or relevant third-party (or such third-party's supplier's, vendor's or subcontractor's computer systems) computer systems could cause significant interruptions in our operations, result in a failure to maintain the security, confidentiality or privacy of sensitive data, harm our reputation, subject us to regulatory sanctions and legal claims, lead to a loss of customers and revenues, and otherwise adversely affect our business and financial results. Our cyber liability insurance may not be sufficient to protect us against all losses. See also "- Any failure to protect the confidentiality of customer, employee, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

We have developed policies, procedures and processes to enable and support the ongoing review of the actual and potential risks facing the Company. Nonetheless, our policies, procedures and processes may not be fully effective in identifying and assessing such risks, leaving us exposed to unidentified or unanticipated risks. In addition, we rely on third-party providers to administer and service many of our products, and our policies, procedures and processes may not enable us to identify and assess every risk with respect to those products, especially to the extent we rely on those providers for relevant information, including detailed information regarding the holders of our products. We use models to manage our business and evaluate the associated risk exposures. The models may not operate properly and could contain errors related to model inputs, data, assumptions, calculations, or output that may adversely impact our results of operations. In addition, these models may not fully predict future exposures, which may be significantly greater than our historical measures indicate. For example, we use actuarial models to assist us in establishing reserves for liabilities arising from our insurance policies and annuity contracts. We periodically review the effectiveness of these models, their underlying logic, and, from time to time, implement refinements to our models based on these reviews. We implement refinements after rigorous testing and validation; even after such validation and testing, our models remain subject to inherent limitations. Accordingly, no assurances can be given as to whether or when we will implement refinements to our actuarial models, and, if implemented, whether such refinements will be sufficient. Furthermore, if implemented, any such refinements could cause us to increase the reserves we hold for our insurance policy and annuity contract liabilities. If models are misused or fail to serve their intended purposes, they could produce incorrect or inappropriate results. Business decisions based on incorrect or misused model outputs or reports could have a material adverse impact on our results of operations. Other risk management models depend upon the evaluation of information regarding markets, clients, catastrophe occurrence, or other matters that are publicly available or otherwise accessible to us. This information may not always be accurate, complete, up-to-date, or properly evaluated. Furthermore, there can be no assurance that we can effectively review and monitor all risks or that all of our employees will follow our policies, procedures and processes, nor can there be any assurance that our policies, procedures and processes, or the policies, procedures and processes of third parties that administer or service our products, will enable us to accurately identify all risks and limit our exposures based on our assessments. In addition, if our business changes or the markets in which we operate evolve and new risks emerge, we may have to implement more extensive and perhaps different policies, procedures or processes and our risk management framework may not evolve at the same pace as those changes. See "- Risks Related to Our Business - Our hedging strategy may not be effective, which may result in significant volatility in our profitability measures or may negatively affect our statutory capital."

We believe competition among insurance companies is based on a number of factors, including service, product features, scale, price, actual or perceived financial strength, claims-paying ratings, credit ratings, e-business capabilities and name recognition. We face intense competition from a large number of other insurance companies, as well as non-insurance financial services companies (e.g., banks, private equity firms, broker-dealers and asset managers). In addition, certain of our distributors also currently offer their own competing products or may offer competing products in the future. Some of our competitors offer a broader array of products, have more competitive pricing or, with respect to other insurance companies, have higher claims-paying ability and financial strength ratings. Some may also have greater financial resources with which to compete. In some circumstances, national banks that sell annuity products of life insurers may also have a pre-existing customer base for financial services products. These competitive pressures may adversely affect the persistency of our products, as well as our ability or decision to sell certain products in the future. In addition, new and disruptive technologies may present competitive risks. If, as a result of competitive factors, our ability to generate profitability consistent with our strategic goals or otherwise, we are unable to generate a sufficient return on products we sell in the future, we may stop selling such products, which could result in adverse rating agency actions and have a material adverse effect on our financial condition and results of operations. See "Business - Competition." We have limited control over many of our costs. For example, we have limited control over the cost of unaffiliated third-party reinsurance, the cost of meeting changing regulatory requirements, and our cost to access capital or financing. There can be no assurance that we will be able to achieve or maintain a cost advantage over our competitors. If our cost structure increases and we are not able to achieve or maintain a cost advantage over our competitors, it could have a material adverse effect on our ability to execute our strategy, as well as on our financial condition and results of operations. If we hold substantially more capital than is needed to support credit ratings that are commensurate with our business strategy, over time, our competitive position could be adversely affected. In addition, the highly regulated nature of our business, as well as the legislative or other changes affecting the regulatory environment for our business, may, over time, affect our competitive position within the annuities and life insurance industry, and within the broader financial services industry. See "- Regulatory and Legal Risks" and "Business - Regulation."

We distribute our products through a variety of third-party distribution channels. Our agreements with our third-party distributors may be terminated by either party with or without cause. We may periodically renegotiate the terms of these agreements, and there can be no assurance that such terms will remain acceptable to us or such third parties. If we are unable to maintain our relationships, our sales of individual insurance, annuities and investment products could decline, and our financial condition and results of operations could be materially adversely affected. Our distributors may elect to suspend, alter, reduce or terminate their distribution relationships with us for various reasons, including changes in our distribution strategy, adverse developments in our business, adverse rating agency actions, changes in the products we offer, or concerns about market-related risks. We are also at risk that key distribution partners may merge, consolidate, change their business models in ways that affect how our products are sold, or terminate their distribution contracts with us, or that new distribution channels could emerge in the marketplace, any of which could adversely impact the effectiveness of our distribution efforts. Also, if we are unsuccessful in attracting and retaining key internal associates who conduct our business, including wholesalers, our sales could decline. An interruption or significant change in certain key relationships could materially affect our ability to market our products and could have a material adverse effect on our financial condition and results of operations. In addition, we rely on a core number of our distributors to produce the majority of our sales. If one or more such distributors were to terminate its relationship with us or reduce the amount of sales which it produces for us, our results of operations could be adversely affected. An increase in bank and broker-dealer consolidation activity could increase competition for access to distributors, resulting in greater distribution expenses and an impaired ability to market our products through these channels. Consolidation of distributors or other industry changes may also increase the likelihood that distributors will try to renegotiate the terms of any existing selling agreements to terms less favorable to us. Because our products are distributed through unaffiliated firms, we may not be able to monitor or control the manner of their distribution despite our training and compliance programs. If our products are distributed by such firms in an inappropriate manner, or to customers for whom such products are not in their best interest, we may suffer reputational and other harm to our business. We compete with major, well-established stock and mutual life insurance companies and non-insurance financial services companies (e.g., banks, private equity firms, broker-dealers and asset managers) in all of our product offerings, and our distributors sell such competitors' products along with our products. In addition, certain of our distributors currently offer their own competing products or may offer competing products in the future. If our distributors concentrate their efforts on selling their firm's own products or our other competitors' products instead of ours, our sales could be adversely impacted.