Company: NLY-PF
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001043219-25-000012
Chunk: 212

Company: ANNALY CAPITAL MANAGEMENT INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 1
Chunk 212
---
 to cybersecurity and receive joint and individual presentations from management and external experts on cyber technology-related risks. Two members of our Board have completed the Carnegie Mellon/NACD Cyber-Risk Oversight Program and earned the CERT Certificate in Cybersecurity Oversight and one member of our Board has completed the NACD Master Class: Cyber-Risk Oversight Program.

To date, we have not detected any risks from cybersecurity threats that have materially affected us. However, even though we take steps to employ reasonable cybersecurity defenses, not every cybersecurity incident can be prevented or detected. We also may be held responsible for cybersecurity threats affecting our third party service providers, including servicers and sub-servicers, some of whom have reported breaches in the past. Therefore, while we are not aware of any cybersecurity threats or incidents that are reasonably likely to have a material effect on our business strategy, results of operations, the likelihood and severity of such risks are difficult to predict. For further discussion, please see the risk factors titled “We are highly dependent on information systems and networks, many of which are operated by third parties” and “Cyberattacks or other information security breaches of our Company’s, service providers’ or counterparties’ systems or network affect our business, reputation and financial condition” in Part I, Item 1A. “Risk Factors” of our most recent Annual Report on Form 10-K and in Part II, Item 1A. “Risk Factors” in this Quarterly Report on Form 10-Q.

70

ANNALY CAPITAL MANAGEMENT, INC. AND SUBSIDIARIESItem 2. Management’s Discussion and Analysis 

Compliance, Regulatory and Legal Risk Management

Our business is organized as a REIT, and we seek to continue to meet the requirements for taxation as a REIT. The determination that we are a REIT requires an analysis of various factual matters and circumstances. Accordingly, we closely monitor our REIT status within our risk management program. We also regularly assess our risk management in respect of our regulated and licensed subsidiaries, which include our registered broker-dealer subsidiary Arcola, our subsidiary that is registered with the SEC as an investment adviser under the Investment Advisers Act and our subsidiary that operates as a licensed mortgage aggregator and master servicer.

The financial services industry is highly regulated and receives significant attention from regulators, which may impact both our company and our business strategy. Our investments in residential whole loans and MSR require us to comply with applicable state and federal laws and regulations and maintain appropriate governmental licenses, approvals and exemptions. We proactively monitor the potential