Corebridge Financial, Inc. (CRBG) Risk Analysis

Our operations generally, and certain of our subsidiaries in particular, are subject to extensive and potentially conflicting laws, regulations, and regulatory guidance in the jurisdictions in which we operate. For example, our products are subject to a complex and extensive array of domestic and foreign tax, securities, insurance and employee benefit plan laws and regulations, which are administered and enforced by a number of different governmental and self-regulatory authorities, including state insurance and securities regulators, federal banking authorities, securities administrators, the DOL and the IRS. The laws and regulations that apply to our business and operations generally grant regulatory agencies and/or self-regulatory organizations broad rule-making and enforcement powers, including the power to regulate: (i) the issuance, sale and distribution of our products, (ii) the manner in which we underwrite our policies, (iii) our operations and the delivery of our services, including information security and privacy (iv) the nature or extent of disclosures required to be given to our customers, (v) the compensation of our distribution partners, (vi) the manner and methods by which we handle claims on our policies and the administration of our policies and contracts, (vii) the activities related to our investments and management of our investment portfolios, (viii) arrangements between our reinsurance partners and our insurance company subsidiaries, and (ix) certain agreements and arrangements between our insurance company subsidiaries and other affiliates. Such agencies and organizations are also generally granted the power to limit or restrict the conduct of business for failure to comply with applicable laws and regulations. We and our distributors are also subject to laws and regulations governing the standard of conduct applicable to sales of our products, the provision of advice to our customers and the manner in which certain conflicts of interest arising from or related to such sales or giving of advice are to be addressed. Such laws and regulations, including the DOL's amendment to the fiduciary rule which is stayed pending litigation, continue to evolve. Changes in standard of conduct requirements or new standards issued by governmental authorities, such as the DOL, the SEC, the NAIC or state regulators and/or legislators, have impacted, and may impact our businesses, results of operations and financial condition and may increase regulatory and litigation risk. In addition, federal and state securities laws and regulations apply to certain of our insurance products that are considered "securities" under such laws, including our registered index-linked annuities, variable annuity contracts, variable life insurance policies and the separate accounts related to such products, as well as our broker-dealer, investment advisor, trustee and mutual fund operations. The application of and compliance with the laws, regulations, and regulatory guidance applicable to our business, products, reinsurance transactions, operations and legal entities may be subject to interpretation, revisions, evolving industry practices and regulatory expectations that could result in increased compliance or operational costs. The relevant authorities may not agree with our interpretation of these current laws, regulations and guidance, and any subsequent changes, including, for example, our implementation of new or revised requirements related to capital, accounting treatment or reserving such as those governing PBR, or with our policies and procedures adopted to address evolving industry practices or meet regulatory expectations. Such authorities' interpretations and views may also change from time to time. It is also possible that the laws, regulations and interpretations across various jurisdictions in which we do business may conflict with one another and affect how we do business in the United States and globally. If we are found not to have complied with applicable legal or regulatory requirements due to our interpretation of such requirements, these authorities could preclude or temporarily suspend us from carrying on some or all of our activities, impose substantial administrative penalties such as fines or require corrective actions to be taken, which individually or in the aggregate could interrupt our operations and materially and adversely affect our reputation, business, results of operations, financial condition and liquidity. Additionally, if such authorities' existing, new or modified interpretation of requirements related to capital, accounting treatment and/or valuation or reserving (such as PBR) materially differs from ours, we may incur higher operating costs, our capital and surplus may be adversely impacted, and future sales of products subject to such requirement or treatment may be affected. Regulators in the jurisdictions in which we do business, domestically and internationally, have adopted capital and liquidity standards, such as the RBC ratio formula used in the United States, and the Enhanced Capital Requirement used in Bermuda, applicable to insurers and reinsurers operating in their jurisdiction. Failure to comply with such capital and liquidity standards and similar requirements set forth in law or regulation, or as otherwise may be agreed by us or one of our insurance company subsidiaries with an insurance regulator, would generally permit the insurance regulator to take certain regulatory actions that could materially impact the affected company's operations. Those actions range from requiring an insurer to submit a plan describing how it would in the future comply with such capital and liquidity standard to a mandatory regulatory takeover of the company. Furthermore, as a company with certain operations outside of the U.S. and with certain vendors, service providers and customers in non-U.S. jurisdictions, we are subject to myriad regulations that govern items such as sanctions, bribery, anti-money laundering and data transfers, for which failure to comply could expose us to significant penalties. The USA PATRIOT Act of 2001 requires companies to know certain information about their clients and to monitor their transactions for suspicious activities. The Foreign Corrupt Practices Act makes it unlawful for certain classes of persons and entities to make payments to foreign government officials to assist in obtaining or retaining business. Also, the Department of the Treasury's Office of Foreign Assets Control administers regulations that restrict or prohibit dealings by U.S. companies and their branches and affiliates involving certain organizations, individuals and countries. The UK, the EU and other jurisdictions maintain similar laws and regulations, some of which may be in conflict with each other and may change rapidly, as demonstrated by the significant sanctions imposed against Russia resulting from the ongoing armed conflict in Ukraine. Such laws and regulations may pose compliance challenges and adversely impact our business, our investments and the business of our customers. We are also subject to various extraterritorial laws and regulations, the laws and regulations of which may sometimes conflict with those of the United States. We may not always be able to prevent our employees or third parties acting on our behalf from violating these laws. As a result, we could be subject to criminal and civil penalties as well as disgorgement. We could be required to make changes or enhancements to our compliance measures that could increase our costs, and we could be subject to other remedial actions. Violations of these laws or allegations of such violations could disrupt our operations, cause reputational harm, cause management distraction and result in a material adverse effect on our competitive position, results of operations, financial condition or liquidity. See "Business-Regulation-U.S. Regulation" and "Business-Regulation-International Regulation."

Certain of our annuity and life insurance products include features that guarantee a certain level of benefits, including GMDB, guaranteed living benefits, including GMIB, and products with guaranteed interest crediting rates, including crediting rate guarantees tied to the performance of various market indices. Many of these features are accounted for at fair value as either MRBs or embedded derivatives under GAAP, and they have significant exposure to capital markets and insurance risks. An increase in valuation of liabilities associated with the guaranteed features results in a decrease in our profitability and depending on the magnitude of any such increase, could materially and adversely affect our financial condition, including our capitalization, as well as our financial strength ratings. We employ a capital markets hedging strategy to partially offset the economic impacts of movements in equity, interest rate and credit markets; however, our hedging strategy may not effectively offset movements in our GAAP equity or our statutory surplus and capital requirements and may otherwise be insufficient in relation to our obligations. Furthermore, we are subject to the risk that changes in policyholder behavior or actual levels of mortality/longevity as compared to assumptions in pricing and reserving, combined with adverse market events, could produce losses not addressed by the risk management techniques employed. These factors, individually or collectively, may have a material adverse effect on our business, results of operations, financial condition and liquidity including our ability to receive dividends from our operating companies. Changes in interest rates result in changes to the fair value liability. All else being equal, higher interest rates generally decrease the fair value of our liabilities, which increases our earnings, while low interest rates generally increase the fair value of our liabilities, which decreases our earnings. A prolonged low interest rate environment or a prolonged period of widening credit spreads may also subject us to increased hedging costs or an increase in the amount of statutory reserves that our insurance company subsidiaries are required to hold for our liabilities, lowering their statutory surplus, which would adversely affect their ability to pay dividends. In addition, it may also increase the perceived value of our benefits to our policyholders, which in turn may lead to a higher than expected benefit utilization and lower than expected surrender rates of those products over time as compared to pricing assumptions. Differences between the change in fair value of the direct and ceded MRBs, which may not fully offset each other due to differences in measurement assumptions, and embedded derivatives, as well as associated statutory and tax liabilities, and the value of the related hedging portfolio may occur and can be caused by movements in the level of equity, interest rate and credit markets, market volatility, policyholder behavior, and mortality/longevity rates that differ from our assumptions and our inability to purchase hedging instruments at prices consistent with the desired risk and return trade-off. In addition, we may sometimes choose not to hedge or fully mitigate these risks, based on economic considerations and other factors. The occurrence of one or more of these events has in the past resulted in, and could in the future result in, an increase in the fair value of liabilities associated with the guaranteed benefits without an offsetting increase in the value of our hedges, or a decline in the value of our hedges without an offsetting decline in our liabilities, thus reducing our results of operations and shareholders' equity.

We are no longer included in the U.S. federal income tax group of which AIG is the common parent (the "AIG Consolidated Tax Group") as AIG's ownership of Corebridge Parent shares is below 80%. In addition, the AGC Group is not permitted to join in the filing of a U.S. consolidated federal income tax return with our other subsidiaries (collectively, the "Non-Life Group") for the period of five full taxable years following our deconsolidation from AIG Inc. (the "five-year waiting period"). Instead, the AGC Group will file separately as members of the AGC consolidated U.S. federal income tax return during the five-year waiting period. Our ability to utilize tax deductions for interest expense may be diminished by our inability to file a single consolidated tax return for all of our subsidiaries during the five-year waiting period. As a result of the foregoing, the AGC Group and the Non-Life Group may pay more cash taxes than each would have paid if a single consolidated federal income tax return were permitted. Following the five-year waiting period, the AGC Group is expected to join the U.S. consolidated tax return with the Non-Life Group in 2028. Any net operating losses incurred by our non-insurance companies during the five-year waiting period generally will be unavailable to reduce the taxable income of our insurance companies following the five-year waiting period. Similar principles may apply to state and local income tax liabilities in jurisdictions that conform to the federal rules.

There is increasing scrutiny and evolving expectations from investors, customers, regulators, and other stakeholders on ESG and sustainability practices and disclosures, including those related to environmental stewardship, climate change, workplace conduct, and other social and political mandates. In 2023, California adopted climate disclosure and financial reporting legislation which will require the reporting of greenhouse gas emissions and biennial climate-related financial risk reports. Although litigation challenging the California climate laws is pending, Corebridge expects to report under the Climate Corporate Data Accountability Act and the Climate Related Financial Risk Act. Other states, including New York and Illinois, have proposed but not yet passed climate disclosure laws similar to those adopted by California. Federal and state laws, regulations, executive orders and actions governing corporate environmental, social and governance activity may conflict with one another, and may impose additional costs on us, block or impede our business opportunities, including by restricting contracting with state governmental authorities or by imposing divestment requirements, or expose us to new or additional risks. See "Business-Regulation-U.S. Regulation" and "Business-Regulation-International Regulation." Moreover, certain organizations that provide information to investors have developed ratings for evaluating companies on their approach to different ESG matters. A lack of ratings or unfavorable ratings of our company or our industry may lead to negative investor sentiment and the diversion of investment to other companies or industries.

Our success depends, in large part, on our ability to attract and retain talent, which may be difficult due to the intense competition in our industry for key employees with demonstrated ability. In addition, we may experience higher than expected employee turnover and difficulty attracting new employees as a result of uncertainty from strategic actions and organizational and operational changes. Losing any of our key people, including key sales or business personnel, could also have a material adverse effect on our operations given their skills, knowledge of our business, years of industry experience and the potential difficulty of promptly finding qualified replacement employees. Additionally, we may face increased costs if, as a result of the competitive market and recent inflationary pressures, we must offer and pay a greater level of remuneration to attract or replace certain critical employees or hire contractors to fill highly skilled roles while vacant. Our business, consolidated results of operations, financial condition and liquidity could be materially adversely affected if we are unsuccessful in attracting and retaining key employees. We could also be adversely affected if we fail to adequately plan for the succession of our senior management and other key employees. While we have succession plans and long-term compensation plans designed to retain our employees, our succession plans may not operate effectively and our compensation plans cannot guarantee that the services of these employees will continue to be available to us.

For our business, establishment and ongoing calculations of reserves for future policy benefits and related reinsurance assets, as well as embedded derivatives and MRBs, is a complex process, with significant judgmental inputs, assumptions and modeling techniques, each of which may yield corresponding results that are inaccurate or incorrect. We make assumptions, including regarding mortality, morbidity, discount rates, persistency and policyholder behavior at various points, including at the time of issuance and in subsequent reporting periods. An increase in the valuation of the liability could result to the extent emerging and actual experience deviates from these assumptions. The inputs and assumptions used in connection with calculations of reserves for future policy benefits are inherently uncertain. Experience may develop adversely such that additional reserves must be established or the value of MRBs or embedded derivatives may increase. Adverse experience could arise out of a number of factors, including, but not limited to, a severe short-term event, such as a pandemic or unexpected changes to policyholder behavior during stressed economic periods, or due to mis-estimation of long-term assumptions such as mortality, interest rates, credit spreads, equity market levels and volatility and persistency assumptions. Certain variables, such as policyholder behavior, are difficult to estimate and can have a significant impact on future policy benefits, MRBs and embedded derivatives. We review and update actuarial assumptions at least annually, typically in the third quarter for reserves, MRBs and embedded derivatives. Additionally, we regularly carry out asset adequacy testing for statutory reporting. If actual experience or revised future expectations result in projected future losses, we may be required to record additional liabilities through a charge to policyholder benefit expense, Net realized gains or losses, or changes in MRBs in the then-current period, which could negatively affect our business, results of operations, financial condition and liquidity. For a further discussion of our loss reserves for future policy benefits and market risk benefits, see Notes 12 and 14 to the Consolidated Financial Statements.

We use information technology systems, infrastructure and networks, other operational systems and third-party systems and services to store, retrieve, transmit, evaluate, use and delete customer, employee, and company data and information. Our business is highly dependent on our ability to access these systems to perform necessary business functions. In the event of a natural disaster, unauthorized access, a terrorist attack, malware, cyber-attacks or other disruptions, our systems and networks may be inaccessible to our employees, customers or business partners for an extended period of time, and we may be unable to meet our business obligations for an extended period of time if our data or systems are disabled, manipulated, destroyed or otherwise compromised. Additionally, some of our systems and networks are older, legacy-type systems that are less efficient, more susceptible to cybersecurity risks and require an ongoing commitment of significant resources to maintain or upgrade. System and network failures, outages, degraded performance and other disruptions have in the past compromised and in the future may compromise our ability to perform business functions in a timely manner, which could adversely impact our ability to conduct business and our relationships with our business partners and customers, and expose us to legal claims as well as regulatory investigations and sanctions, any of which could have a material adverse effect on our business, results of operations, financial condition and liquidity. See "Cybersecurity-Cybersecurity Risk Management" below. The systems and networks we maintain and third-party systems and networks we use have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, including physical or electronic break-ins or unauthorized tampering, and cybersecurity threats, such as "denial of service" attacks, phishing, untargeted but sophisticated and automated attacks, ransomware and other disruptive software. Also, like other companies, we face an increasing challenge of attracting and retaining highly qualified security personnel to assist us in combating these security threats. Cybersecurity threats and attacks can originate from a broad range of sources including terrorists, nation states, state-sponsored actors, financially motivated actors, internal actors, or third-parties (including third-party providers), and the techniques used in these threats and attacks may change, develop and evolve rapidly, including the use of emerging technologies, such as broader forms of artificial intelligence, and are frequently or are often not recognized until after they have been launched. The frequency and sophistication of such threats and attacks continue to increase and often become further heightened in connection with geopolitical tensions. In light of these geopolitical events and dynamics, state-sponsored parties or their supporters have in the past and may in the future, launch cyberattacks, and attempt to cause supply chain disruptions, or carry out other geopolitically motivated actions that may adversely disrupt or degrade our operations and may result in data compromise. If we or our vendors fail to prevent, detect, address and mitigate such incidents, we may suffer significant financial and reputational harm. There is no assurance that our security measures or those of our vendors, including information security policies, administrative, technical and physical controls and other actions designed as preventative, will provide fully effective protection from such events. We maintain insurance to cover operational risks, such as cyber risk and technology outages, but this insurance may not cover all costs associated with the consequences of information systems or personal, confidential or proprietary information being compromised. We cannot be certain that insurance coverage will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage of a future claim. In the case of a successful ransomware or extortion attack in which our data and information systems are compromised and applicable restore control processes to restore access are not effective, our information or systems could be held hostage until a ransom, which may be significant, is paid and payment of a ransom does not guarantee that the affected information and system will be able to be restored. In some cases, such a compromise may not be immediately detected, which may make it difficult to restore critical services, mitigate damage to assets and maintain the integrity and security of data, including our policyholder, employee, agent and other confidential information processed through our systems and networks. Additionally, since we rely heavily on information technology and systems and on the integrity and timeliness of data to run our businesses and service our customers, any cybersecurity event resulting in a compromise of systems or data has in the past and may in the future impede or interrupt our ability to conduct business operations, offer products to and service our customers, and comply with applicable laws and regulations and otherwise may materially and adversely affect our business, results of operations, financial condition and liquidity. We routinely transmit, receive and store personal, confidential and proprietary information by email and other electronic means. Although we attempt to keep such information confidential and secure, we have experienced unintentional and intentional unauthorized access to and transmissions of such information and may be unable to prevent future occurrences of unintentional or intentional unauthorized access to and transmissions of such information, especially with customers, vendors, service providers, counterparties and other third parties who do not or may not have or use appropriate controls to protect personal, confidential or proprietary information. Failure by us or any of our third-party vendors to secure or appropriately handle personal, confidential or proprietary information has in the past and could in the future cause a loss of data or compromised data integrity, give rise to remediation or other expenses, expose us to liability under U.S. and international laws and regulations, and subject us to litigation, investigations, sanctions, and regulatory and law enforcement action, and result in reputational harm and loss of business, which could have a material adverse effect on our business, results of operations, financial condition and liquidity. Regulators' or others' scrutiny of cybersecurity and information privacy, including new laws or regulations and for evolving expectations, could increase our compliance costs and operational burdens, particularly as regulatory and legislative focus on cybersecurity and information privacy matters intensifies, which could lead to more enforcement actions. Regulators, customers, or others may act against us for any cybersecurity failures. New and currently unforeseen laws and regulatory issues could also arise from the increased use of emerging technologies, data analytics and digital services, including the use of AI. If we are found not to be in compliance with these laws and regulations, we could be subjected to significant civil and criminal liability and exposed to financial and reputational harm. For additional information on data protection and cybersecurity regulations and cybersecurity generally, see "Business-Regulation-U.S. Regulation-Privacy and Cybersecurity," "Business-Regulation-International Regulation-Privacy, Data Protection and Cybersecurity," and "Cybersecurity-Cybersecurity Risk Management."

Although we distribute our Individual Retirement and Life Insurance products through a wide variety of distribution channels, we maintain relationships with a number of key distributors, which results in certain distributor concentration. Distributors have in the past, and may in the future, elect to renegotiate the terms of existing relationships such that those terms may not remain attractive or acceptable to us, limit the products they sell, including the types of products offered by us, or otherwise reduce or terminate their distribution relationships with us. For example, an increase in bank, wirehouse and broker-dealer consolidation activity could increase competition for access to distributors, result in greater distribution expenses and impair our ability to market our Individual Retirement annuity products through these channels. Alternatively, renegotiated terms may not be attractive or acceptable to distributors, or we may terminate one or more distribution agreements. An interruption or reduction in key relationships could materially affect our ability to market our products and could materially and adversely affect our business, results of operations, financial condition and liquidity. Further, if we are unsuccessful in attracting, retaining and training key distribution partners, or are unable to maintain our distribution relationships, our sales could decline, which could have a material adverse effect on our business, results of operations, financial condition and liquidity. In addition, substantially all of our distributors are permitted to sell our competitors' products. If our competitors offer products that are more attractive than ours or pay higher commission rates to the distribution partners than we do, these distribution partners could concentrate their efforts on selling our competitors' products instead of ours. In addition, we can, in certain circumstances, be held responsible for the actions of our third-party distributors in connection with their marketing and sale of our products, including the security of their operations and their handling of confidential information and personal data, in a manner that is deemed not compliant with applicable laws and regulations. This risk is particularly acute because a majority of our distribution occurs through unaffiliated distributors, over whom we lack direct oversight or control of how our products are sold, notwithstanding our risk assessment, training, and compliance programs. Further, misconduct by employees, agents and representatives of our broker-dealer subsidiaries in the sale of our products could also result in regulatory investigations, sanctions or violations of laws by us or our subsidiaries. The precautions we take to prevent and detect the foregoing activities may not be effective.