CME GROUP INC.
CHICAGO MERCANTILE EXCHANGE INC.
BOARD OF TRADE OF THE CITY OF CHICAGO, INC.
NEW YORK MERCANTILE EXCHANGE, INC.
COMMODITY EXCHANGE, INC.
RISK COMMITTEE OF THE BOARD OF DIRECTORSCHARTERI.

PurposeThe Risk Committee (the “Committee”) is a committee of the Board of Directors (the “Board”) of
CME Group Inc. (“CME Group”), Chicago Mercantile Exchange Inc. (“CME”), Board of Trade of the City ofChicago, Inc. (“CBOT”), New York Mercantile Exchange, Inc. (“NYMEX”) and Commodity Exchange, Inc.
(“COMEX”), (collectively, referred to as, the “Company”). The primary purpose of the Committee is toreview, assess and provide oversight of the Company’s risk management practices and to assist theBoard in its oversight of the effectiveness of the Company’s programs, policies and processes to identify,
manage and plan for its clearing house, compliance, financial, operational, reputational, and strategic andcommercial risks.
Certain specialized risk categories that fall within the remit of other Board established committees
will continue to be overseen by those committees (as set forth in Appendix E of the Enterprise Risk
Management Framework (“ERMF”)). The Risk Committee is responsible for overseeing the coordinationof the risk oversight with these other committees to satisfy the Board’s responsibility to ensure thecomprehensive and holistic oversight of the organization’s risk management processes.
II.

III.

Membership & Organization•The members of the Committee and its Chairperson shall be appointed in accordance withthe provisions of CME Group’s Corporate Governance Principles.

•The Committee shall consist of no fewer than three (3) directors. Members of the Committee
should be suitably knowledgeable in matters pertaining to the responsibilities of theCommittee. At least one member shall have appropriate skills, background and knowledge
relating to current technology and information security issues. Members of the Committee
shall participate in ongoing education pertaining to the risk areas the Committee oversees,
including information technology and information security, as necessary to maintain theireffectiveness and performance of their responsibilities under this Charter.

•The Chairperson shall schedule all meetings of the Committee and provide the Committeewith a written agenda, as appropriate. A quorum of the Committee shall be a majority of theappointed members of the Committee. The Committee may ask members of management orothers to attend the meeting and provide information or recommendations, as necessary.

Engagement of Outside Advisors•The Committee shall have the resources and authority appropriate to discharge its duties andresponsibilities, including the authority to engage independent professional advisors, as it
deems appropriate, and may direct the proper officers of the Company to pay the reasonable
fees and expenses of any such advisor.

IV.

Committee Meetings, Tasks and Authority
General•The Committee shall meet as often as it determines necessary to carry out its duties andresponsibilities, but no less frequently than four (4) times annually and keep minutes of its
proceedings.

•As appropriate, and in any event no less than annually, the Committee will meet in separate
executive sessions with senior management, including the leaders of programs under its
purview, to discuss any matters that the Committee or senior management believe should bediscussed privately, including the adequacy and appropriateness of resources and staff
supporting these programs.

•The Committee shall perform its responsibilities in accordance with this Charter.

Responsibilities
Enterprise Risk Management (“ERM”) Program•

The Committee shall receive and review regular quarterly reports on the operation andeffectiveness of the Company’s ERM Program (not duplicating the efforts of other establishedcommittees as identified in Appendix E of the ERMF), which will include among other things
significant changes to the Company’s risk profile and the quarterly report on the Company’s
enterprise risks.

•The Committee shall review and approve substantive changes to the ERM Framework andERM’s Risk Universe and shall annually review and recommend to the Board the Statementof Risk Appetite and various levels of acceptable key risks underlying the Company’sbusiness and strategy.

•The Committee shall review the structure and staffing of the Company’s ERM Program for
purposes of ensuring the adequacy and appropriateness of resources and staff supporting
the program.

•The Committee shall receive and review quarterly reports on the operation of the Company’s
Third Party Risk Management (“TPRM”) Program.

Global Information Security (“GIS”) Program•The Committee shall receive and review regular quarterly reports on the operation andeffectiveness of the Company’s GIS Program, which will include among other things thestatus of significant information security risk projects, key metrics for assessing theeffectiveness and maturity of the program (as determined by senior management) and anychanges in the Company’s information security risk profile.

•

The Committee shall review the structure and staffing of the Company’s GIS Program for
purposes of ensuring the adequacy and appropriateness of resources and staff supporting
the program.

•Annually, the Committee shall review and approve any substantive amendments to the GIS
Program Charter.

•The Committee shall review the annual performance evaluation and compensation
determinations and approve any termination decisions made by senior management of theCompany with respect to the Chief Information Security Officer with the goal that suchdeterminations or decisions are not designed to influence improperly the independent
exercise of his or her duties.

2

Compliance and Ethics Program•The Committee shall receive and review regular quarterly reports from the Managing
Director, Chief ERM & Compliance Officer on the operation and effectiveness of theCompany’s Compliance and Ethics Program.

•The Committee shall oversee the Company’s compliance efforts with respect to theCompany’s Code of Conduct, relevant Company policies (including conflicts of interest andanti-financial crime), the Company’s data privacy program, and other relevant laws andregulations that are not otherwise overseen by another committee and shall monitor theCompany’s efforts to implement compliance programs, policies and procedures that aredesigned to be: responsive to the various compliance and regulatory risks facing theCompany; communicated in an effective manner to the Company’s employees, consultants
and certain third parties; and developed to support lawful and ethical business conduct by theCompany’s employees, consultants, and certain third parties.

•The Committee shall review the structure and staffing of the Company’s Compliance & Ethics
Program for purposes of ensuring the adequacy and appropriateness of resources and staff
supporting the program.

•The Committee shall approve any substantive amendments to the Charter of the Global
Compliance & Ethics Team.

•The Committee shall oversee the investigation of, and may also request the investigation of,any significant instances of noncompliance with laws or the Company’s compliance andethics programs, policies, or procedures, or potential compliance and ethical violations thatare reported to the Committee; provided, however that matters relating to members of theBoard shall be directed to the Nominating and Governance Committee.

•The Committee shall review the annual performance evaluation and compensation
determinations and approve any termination decisions made by senior management of theCompany with respect to the Managing Director, Chief ERM & Compliance Officer with thegoal that such determinations or decisions are not designed to influence improperly theindependent exercise of his or her duties.

Operational Resilience and Global Security•The Committee shall receive and review regular quarterly reports on the operation andeffectiveness of the Operational Resilience and Global Security Program, which will include
among other things the status of key activities relating to all of the program components andother matters impacting the Company’s ability to operate its markets, safeguard its assets
and employees, or meet its operational recovery obligations.

•The Committee shall review the structure and staffing of the Company’s Operational
Resilience and Global Security Program for purposes of ensuring the adequacy andappropriateness of resources and staff supporting the program.

•The Committee shall approve any substantive amendments to the Operational Resilienceand Global Security Program Charter.

General Risk Management Oversight•

The Committee shall receive and review periodic reports from other members ofmanagement as the Committee deems appropriate to fulfill its responsibilities under thisCharter.

•The Committee shall oversee the Operational Risk Management Framework ("ORMF") of theCME Clearing House, including annually reviewing and approving the ORMF and reviewing
and approving any substantive changes thereto. The Committee will annually submit arecommendation to the Board to approve the ORMF. The Committee will also submit a3

recommendation to the Board for approval for changes to the ORMF to the extent changes
would have a significant impact on the CME Clearing House's risk profile.

V.

VI.

•

Every two years, the Committee shall perform a gap analysis of the division of risk-related
responsibilities among the Board committees and functional committees to ensure the Board
has effective oversight of the Company’s key risks and make recommendations forenhancing such oversight to the Board as necessary.

•For matters relating to the risk areas the Committee oversees, the Committee shall receive areport regarding the substance of any recommendations from any regulatory examination orthird-party assessment report and of management’s responses and remediation efforts
pertaining to such recommendations, if any.

Reporting Activities•

The Committee Chairperson or his or her delegate, on behalf of the Committee, shall makeverbal reports to the Board on recent activities of the Committee. In connection therewith, theCommittee Chairperson should review with the Board any issues that arise with respect tothe effectiveness of the programs under the purview of the Committee.

•If risk management issues develop between meetings of the Committee that senior
management believes could have a material adverse impact on the Company, such matter
will be promptly reported to the Chairman of the Committee by the General Counsel or theManaging Director, Chief ERM & Compliance Officer.

•The Committee shall prepare and adopt a written annual report to the Board summarizing thekey activities, conclusions and recommendations of the Committee during the previous year.

•The Committee shall reassess the adequacy of this Charter no less frequently than annuallyand submit any recommended changes to the full Board for approval.

•The Committee shall evaluate its performance on an annual basis and establish criteria forsuch evaluation. The Committee shall report to the Board regarding the results of its
evaluation and provide copies of written evaluations, if any, to the full Board.

Limitation on the Role of the Risk Committee

The Committee’s role is one of oversight, recognizing that management is responsible for
executing CME Group’s risk management and corporate compliance and ethics policies, procedures, andprograms. While the Committee has the responsibilities set forth in this Charter, management isresponsible for designing, implementing, and maintaining effective risk management and corporate
compliance and ethics programs. Nothing contained in this Charter is intended to create, or should beconstrued as creating, any responsibility or liability of the members of the Committee, except to the extent
otherwise provided under the applicable laws of State of Delaware, which shall continue to set the legal
standard for the conduct of the members of the Committee.
Originally Adopted August 8, 2014
Approved by the Risk Committee: December 5, 2023
Approved by the Board of Directors: February 7, 20244