BlackRock (UU2) Risk Analysis

Policymaking workstreams focused on the financial services sector led by global standard setters, such as the Financial Stability Board ("FSB") and International Organization of Securities Commissions ("IOSCO"), may lead to or inform new regulations in multiple jurisdictions in which BlackRock operates. Such workstreams have focused on areas such as money market funds ("MMFs"), open-ended funds ("OEFs") and sustainability regulations. BlackRock is, and may become, subject to increasing regulation in these areas, see Item 1, Business - Regulation, including: - Macroprudential Policies for Asset Managers: Concerns about liquidity and leverage risks in the asset management industry and wider market-based finance sector have prompted a broad review of existing regulations globally, including an assessment of the adequacy of certain structural market components in mitigating risks, by the FSB, IOSCO, the US Securities and Exchange Commission ("SEC") and the Financial Stability Oversight Council ("FSOC"). The EU launched a consultation on macroprudential policies in 2024, including enhanced requirements for liquidity management tools, which may lead to increased oversight or new requirements for the management of OEFs. If these regulatory or policy actions result in broad application of macroprudential tools to OEFs or require changes to structural features of certain OEFs, it could limit BlackRock's ability to offer products to certain clients and/or result in clients altering their investment strategies or allocations in a manner that is adverse to BlackRock. - Global MMF Reforms: Following the market events of March 2020, US, UK and EU authorities initiated a review of existing regulatory frameworks with the aim of improving the resilience of MMFs in market downturns. The UK released a consultation in December 2023 indicating their intent to change regulatory requirements for MMFs domiciled in the UK and non-UK MMFs sold into the UK, including material increases in required liquidity levels. The EU is considering similar and further changes to the regulations of EU-domiciled MMFs and non-EU MMFs sold into the EU. In the US, the SEC adopted changes to Rule 2a-7, the primary rule under the Investment Company Act of 1940 governing MMFs, including changes to required liquidity levels and requiring mandatory liquidity fees under certain circumstances. New regulations or changes to existing regulations in the UK and EU may adversely impact BlackRock's MMFs. - Sustainability: Sustainability has been the subject of regulatory focus across jurisdictions. The International Sustainability Standards Board's ("ISSB") disclosure standards have been adopted by several national regulators, including in Hong Kong, Mexico, Singapore and Australia, while others, including the UK, Canada and Japan, are expected to issue ISSB-aligned standards. In 2023, California passed several laws requiring certain companies doing business in California to publish certain types of climate-related disclosures. In November 2025, the Ninth Circuit granted an injunction pending appeal staying the enforcement of one such law, California Senate Bill 261. Other states have proposed and may adopt similar laws. The EU has enacted numerous sustainability regulations which continue to evolve. In December 2025, the European Parliament and Council approved proposals to simplify and reduce the scope of the Corporate Sustainability Due Diligence Directive ("CSDDD") and the Corporate Sustainability Reporting Directive ("CSRD"). Furthermore, in November 2025, the European Commission ("EC") published its proposal ("SFDR 2.0") to revise the Sustainable Finance Disclosure Regulation, which requires sustainability-related disclosures by financial market participants. SFDR 2.0 proposes significant changes, including reducing sustainability disclosures by EU firms and simplifying product-level disclosures as well as introducing three new categories of sustainable and transition products. The EU and the UK are developing rules for ESG ratings providers to improve quality, transparency, consistency and independence of ESG ratings in the market. Japan, Singapore and India have published codes of conduct or regulatory frameworks for ESG data and rating providers, while Hong Kong is considering a similar approach. As jurisdictions continue to develop and implement sustainability regulations and litigation challenging such regulations increases, BlackRock faces greater fragmentation risk related to local application of regulations, resulting in complex and conflicting compliance obligations and legal and regulatory uncertainty. Global regulatory reforms could require BlackRock to alter its future business or operating activities, which could be time-consuming and increase costs, including costs related to regulatory compliance, result in litigation, impede the Company's growth and cause its AUM, revenue and earnings to decline. Regulatory reform may also impact BlackRock's clients, which could cause them to change their investment strategies or allocations in manners that may be adverse to BlackRock.

In recent years, a number of regulatory reforms have been proposed or fully or partially implemented in the US, and the level of regulatory scrutiny to which BlackRock is subject has increased. BlackRock, as well as its clients, vendors and distributors, have expended resources and altered certain of their business or operating activities to prepare for, address and meet the requirements that such regulatory reforms impose. New or proposed changes to laws, regulations, policies, initiatives and other government actions may be difficult to anticipate, which provides additional uncertainty and may heighten the Company's risks related to such actions. While BlackRock is, and may become, subject to numerous reform initiatives in the US, see Item 1, Business - Regulation, key regulatory reforms that may impact the Company include: - Antitrust Rules and Guidance: In October 2024, the Federal Trade Commission ("FTC"), with concurrence from the Antitrust Division of the Department of Justice (the "DOJ") approved amendments to rules enacted under the Hart-Scott-Rodino Antitrust Improvements Act of 1976 ("HSR") that require parties in certain transactions to provide the FTC and DOJ prior notice and observe a waiting period before consummation of such transactions. The final amendments significantly expanded the information required to be reported and documents submitted in connection with an HSR filing, which generally increases any pre-merger notification expenses and may delay transactions. The continued applicability of the final amendments is uncertain as the FTC's adoption of these rules faces litigation challenges. In December 2023, the FTC and DOJ also jointly issued updated merger guidelines which could impact (1) the ability of the Company to expand its services through strategic investments or acquisitions and (2) funds that engage in transactions affecting US commerce. - Designation as a Systemically Important Financial Institution ("SIFI"): The FSOC has the authority to designate nonbank financial institutions as SIFIs in the US under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. In November 2023, the FSOC finalized amendments to its existing interpretive guidance to remove the prioritization of an activities-based approach over an entity-specific approach to designation in connection with addressing potential risks to financial stability, although the amendment clarified that the FSOC retained the ability to use an activities-based approach when appropriate. The FSOC has stated that it intends to review this guidance and the FSOC's analytic framework for financial stability risks, which could increase regulatory uncertainty. If BlackRock is designated as a SIFI, it could become subject to enhanced regulatory and capital requirements and direct supervision by the Federal Reserve. - Public Company Disclosure Requirements: The SEC has announced that it is considering recommending rule amendments to revise US public companies' reporting requirements. Potential amendments include giving companies the option to change their quarterly financial reports to a semi-annual reporting schedule and changes in executive compensation disclosure requirements, Rule 14a-8 on shareholder proposals and the shelf registration process. The SEC has also requested public comment on Regulation S-K in general. Depending on the form of any such final rules, they could impact BlackRock's reporting and compliance obligations. - SEC US Treasury Clearing Mandate: In December 2023, the SEC adopted rules mandating central clearing of US Treasury repurchases and certain other Treasury transactions. The rules require many market participants, including a large number of BlackRock funds and accounts, to clear Treasury repurchase transactions and potentially certain cash Treasury securities transactions through a clearing agency registered with the SEC, which could increase transaction costs for BlackRock's clients. - SEC Rules on Reporting of Short Positions and Securities Loans: In 2023, the SEC adopted a new rule requiring certain institutional managers to report short positions and activity to the SEC for publication on an aggregate basis, which could impact investment strategies and result in greater operational burdens and cost for BlackRock. The SEC also adopted a new rule requiring certain persons to report information on securities loan transactions to a registered national securities association which will then publish certain information. The rule may increase BlackRock's operational burdens and costs. The SEC has granted temporary exemptions from compliance with these rules until 2028 and indicated it may make changes to the rules prior to the compliance dates. - US Outbound Investment Regime: Beginning in January 2025, the US government has implemented an outbound investment screening program restricting certain investments in designated "countries of concern." The program: (1) prohibits US persons from engaging in specified transactions; and (2) requires notification to regulators of other transactions involving companies in those jurisdictions operating in sensitive technology sectors such as advanced semiconductors, AI and quantum computing. The Fiscal 2026 National Defense Authorization Act further authorizes the US Treasury to expand the scope of this regime, potentially adding more countries, technologies, or transaction types to the restrictions. These rules, especially if broadened, could limit BlackRock's ability to invest in certain companies or markets on behalf of clients and may increase the firm's compliance costs. - Beneficial Ownership Reporting: In 2025, the SEC clarified its guidance on when a 5% shareholder's engagement with an issuer could lead to the shareholder being considered to hold shares with the "purpose or effect of changing or influencing control of the issuer," and therefore cause the shareholder to lose eligibility to report its beneficial ownership on short-form Schedule 13G. The guidance explains that shareholder engagement that "exerts pressure on management to implement specific measures or changes to a policy" may be considered "influencing" control of the issuer. - Proxy Voting Reform: Reform of the proxy voting system is an area of increased interest among US policymakers. In 2025, the SEC indicated that they are considering regulatory changes related to proxy voting. As an asset manager that exercises voting rights on behalf of certain clients, such reforms could increase regulatory scrutiny and uncertainty for BlackRock and affect its business or operating activities. - Financial Crimes Enforcement Network ("FinCEN") Rule for Registered Investment Advisers: In 2024, FinCEN issued a final rule requiring registered investment advisers to adopt new anti-money laundering requirements. Under the rule, registered investment advisers will be required to establish written risk-based anti-money laundering programs and report suspicious activity to FinCEN under the Bank Secrecy Act of 1970 (the "Bank Secrecy Act"), as well as comply with Bank Secrecy Act reporting and recordkeeping requirements, which may increase BlackRock's compliance burdens and costs. In 2025, the effective date of the rule was pushed back to January 2028. - SEC Rules on Form PF: In 2024, the SEC adopted new rules and amendments to Form PF for registered investment advisers requiring new disclosures, filing obligations and enhanced reporting. In September 2025, the SEC extended the compliance deadline until October 2026. Implementing these rules and amendments may significantly increase BlackRock's reporting, disclosure and compliance obligations and create operational complexity for BlackRock's alternatives products. - Regulation of US Registered Funds and Investment Advisers: Regulation of US registered funds and investment advisers may change over time as a result of rulemaking, exemptive and no-action relief and interpretative positions by the SEC, any of which could impact the Company's US registered investment advisers and the registered funds they manage. Regulatory reforms in the US could require BlackRock to alter its future business or operating activities, which could be time-consuming and costly, increase regulatory compliance costs, result in litigation, impede the Company's growth and cause its AUM, revenue and earnings to decline. Regulatory reform may also impact BlackRock's clients, which could cause them to change their investment strategies or allocations in manners that may be adverse to BlackRock.

BlackRock's business and operating activities are subject to increasing regulatory oversight outside of the US and the Company may be affected by several proposed or implemented reform initiatives in the EMEA and the Asia-Pacific regions, as well as volatility associated with international regulatory uncertainty. While BlackRock is, and may become, subject to numerous reform initiatives internationally, see Item 1, Business - Regulation, key reforms in these regions include: European Union - Enhanced Regulatory Scrutiny of Technology Service Providers to Financial Services Firms: The EU's Digital Operational Resilience Act ("DORA"), which focuses on direct regulation of providers and users of technology and data services, became applicable in 2025. DORA, among other things: (1) introduced additional governance, risk management, incident reporting, resilience testing and information sharing requirements to several of BlackRock's European entities and certain Aladdin clients; and (2) may potentially subject Aladdin to additional oversight. The European Supervisory Authorities are using data collected under DORA to assess which third party suppliers should be designated as critical to the EU financial system and become subject to further regulatory oversight. - Retail Investment Strategy: The EU continues to consider a proposed Retail Investment Strategy package of amendments intended to improve retail investor access to financial markets while ensuring investor protections. When enacted, these changes could impact clients' product preferences and may increase costs for BlackRock in European markets due to additional requirements on distributors and product providers. - EMIR 3.0: The EU legislative package known as "EMIR 3.0" introduces key changes to derivatives clearing, margining and reporting requirements in the European Market Infrastructure Regulation (EMIR), including: (1) a requirement to hold an "active account" with an EU central counterparty for clearing certain euro-denominated instruments; (2) new reporting requirements for cleared trades; (3) revised clearing thresholds for financial and non-financial counterparties; and (4) amendments related to clearing to the UCITS directive. EMIR 3.0 was adopted in December 2024 and is being implemented in phases, with initial compliance obligations effective from June 2025 and further reporting obligations expected through 2026. EMIR 3.0 is expected to impact EU counterparties as well as UK and non-EU entities trading with EU firms, and the collective impact of the package may increase operational complexity, necessitate a reassessment of clearing and trading strategies, and lead to higher transaction costs for BlackRock and its clients. - Digital Omnibus: In November 2025, the EC proposed a Digital Omnibus package intended to take a holistic view across digital legislation at the EU level, including the EU AI Act, GDPR, Data Act, ePrivacy Directive and cybersecurity laws to reduce complexity and duplication. The package proposes a delay to the introduction of rules relating to high-risk AI uses pending development of compliance guidance, targeted changes to data protection rules under GDPR to facilitate data use in the development and operation of AI models and systems, and streamlining of incident reporting obligations. - T+1 Settlement: Regulators in the EU, UK, and Switzerland have announced plans to transition to a T+1 settlement cycle for securities transactions with implementation in October 2027. The change shortens the standard settlement period from two business days (T+2) to one business day (T+1), requiring significant operational and technological adjustments across the investment lifecycle. The multi-jurisdictional nature of the transition may result in a lack of consistency between regulators, increasing the complexity of implementation. The transition could increase BlackRock's operational complexity, settlement risk, and costs, particularly in cross-border transactions, FX settlement, and coordination with third-party providers. - EU Supervisory Reform: In December 2025, the EC published a proposal for wide-ranging reforms to EU capital markets rules, including changes to the supervisory regime for asset managers. Depending on the terms of the final reforms, such changes could add additional layers of supervisory oversight to asset managers at the EU level and slow supervisory outcomes and authorisations. United Kingdom - UK Operational Resilience: The UK's policies regulating services provided by certain third parties designated by HMT as "critical" to the financial sector became effective in January 2025. Entities designated as "critical" will be required to provide additional information to financial regulators, engage in resilience testing and report major incidents like cyber-attacks, natural disasters and power outages. If BlackRock is designated as critical, its operational costs and regulatory oversight may increase. The FCA will also introduce further rules on supply chain oversight and incident reporting, potentially increasing regulatory compliance costs. - Conduct Regulation: The FCA continues to focus on conduct regulation, including the effectiveness of implementation of the Consumer Duty by all asset management firms, including BlackRock's UK subsidiaries and across a range of product types sold to retail investors including those related to digital assets. The Consumer Duty rules require firms to act to deliver good outcomes for retail customers in their manufacture and distribution of products and services, in respect of price and value, consumer understanding and consumer support. Any failure to meet the FCA's regulatory expectations could expose BlackRock to regulatory sanctions and increased reputational risk. - Consumer Composite Investments: The FCA has finalized product information requirements for consumer composite investments (CCIs) replacing the current PRIIPs regime, which was derived from EU law and was assimilated into UK law after Brexit. The transition to the CCI regime may increase operational complexity and regulatory compliance costs for BlackRock. Asia-Pacific - Regulatory Environment in China: The Company's operations in China are subject to a number of regulatory risks, including an evolving regulatory environment, frequent policy changes and complex data security and data transfer regulations. These factors may increase compliance risk and costs, limit the Company's ability to source and execute new investment opportunities and potentially lead to impairment losses on its investments. Restrictions on transfers of certain types of onshore data of the Company's Chinese entities to offshore entities also may limit BlackRock's ability to aggregate, report and monitor such data on its global platform. In addition, multiple regulators in China have jurisdiction over BlackRock's business operations, increasing operational and regulatory engagement complexity. These risks may be further heightened by additional scrutiny by Chinese regulators of certain sectors, such as technology and other industries that might be deemed to be of national importance. International regulatory reforms could require BlackRock to alter its future business or operating activities, which could be time-consuming and costly, increase regulatory compliance costs, result in litigation, impede the Company's growth and cause its AUM, revenue and earnings to decline. Regulatory reform may also impact BlackRock's clients, which could cause them to change their investment strategies or allocations in manners that may be adverse to BlackRock.

BlackRock has a number of key strategic partnerships, including with Microsoft. For instance, the Aladdin infrastructure and environment for BlackRock and its external Aladdin clients are hosted on Microsoft Azure and Amazon Web Services. BlackRock has also migrated certain systems that support its corporate functions to cloud-based platforms. The benefits of cloud-based platforms are significant and BlackRock has adopted a robust risk-based approach to its migration strategies. However, these partnerships also introduce risks, including: (1) risks associated with relying on third-parties for aspects of infrastructure reliability and stability; (2) software and information security risks arising from the use of cloud technology; (3) operational and execution risks; and (4) risks related to increased regulatory oversight and new compliance obligations, which may be further exacerbated as BlackRock and the Aladdin platform continue to grow. A prolonged global failure of cloud services could also impact BlackRock's other systems. Failures by BlackRock to manage these risks, and/or risks associated with future technology partnerships, may result in escalating costs, financial loss, client dissatisfaction or attrition, regulatory fines and/or sanctions, reputational harm or legal liability, which, in turn, may cause BlackRock's AUM, revenue and earnings to decline.

BlackRock's trust bank subsidiary, which is a national banking association chartered by the OCC, is subject to OCC regulation, including requirements regarding capital and liquidity, that may limit its business activities. The OCC has broad supervisory and enforcement authority over BlackRock's trust bank. Having a subsidiary subject to banking regulation may put BlackRock at a competitive disadvantage because certain of its competitors are not subject to the limitations imposed by such regulation.