Company: NLY-PF
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001043219-25-000012
Chunk: 210

Company: ANNALY CAPITAL MANAGEMENT INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 1
Chunk 210
---
 Rate Swaps at Fair ValueExposure (2)Geography(dollars in thousands)North America21 $58,667,332 $(16,217)$3,885,242 Europe10 13,002,589 (4,935)948,449 Asia (non-Japan)1 488,886 — 15,377 Japan4 3,985,156 — 871,114 Total36 $76,143,963 $(21,152)$5,720,182 (1) Includes repurchase agreements and other secured financing.(2) Represents the amount of cash and/or securities pledged as collateral to each counterparty less the aggregate of repurchase agreement and other secured financing and derivatives for each counterparty.

Operational Risk Management

We are subject to operational risk in each of our business and support functions. Operational risk may arise from internal or external sources including human error, fraud, systems issues, process change, vendors, business interruptions and other external events. We manage operational risk through a variety of tools including processes, policies and procedures that cover topics such as business continuity, personal conduct, cybersecurity and vendor management. Other tools include Risk and Control Self Assessment (“RCSA”) testing, including disaster recovery/testing; systems controls, including access controls; training, including phishing exercises and cybersecurity awareness training; and monitoring, which includes the use of key risk 

69

ANNALY CAPITAL MANAGEMENT, INC. AND SUBSIDIARIESItem 2. Management’s Discussion and Analysis 

indicators. Our Operational Risk Management team conducts a disaster recovery exercise on an annual basis and periodically conducts other operational risk tabletop exercises. Employee-level lines of defense against operational risk include proper segregation of incompatible duties, activity-level internal controls over financial reporting, the empowerment of business units to identify and mitigate operational risk sources, testing by our internal audit staff, and our overall governance framework.

Operational Risk Management responsibilities are overseen by the ERC. The ERC is responsible for supporting the Operating Committee in the implementation, ongoing monitoring, and evaluation of the effectiveness of the enterprise-wide risk management framework. This oversight authority includes review of the strategies, processes, policies, and practices established by management to identify, assess, measure, and manage enterprise-wide risk.

Cybersecurity is part of our enterprise-wide risk management framework. Processes for assessing, identifying and managing cybersecurity risks include cybersecurity risk assessments, use of key risk indicators, vendor cybersecurity risk management, employee training, including phishing exercises and cybersecurity awareness training, penetration