Company: KMX
Filing Date: 2025-05-08
Form Type: DEF 14A
Source: 0001170010-25-000073
Chunk: 12

Company: CARMAX INC
Filing Date: 2025-05-08
Form: DEF 14A
Chunk 12
---
                                                                                                                           |     | Nominating and Governance Committee: oversees risks related to government affairs, CarMax’s reputation, social responsibility, and environmental and sustainability matters. |
|                               |     | §                                                                                                                                                                                                                                                                                                                                                                                           |     | Technology and Innovation Committee: oversees risks related to information technology, cybersecurity, artificial intelligence, and business continuity.                      |
|                               |     | §                                                                                                                                                                                                                                                                                                                                                                                           |     | Board: oversees risks related to the economy, competition, shareholder relations, finance and strategy.                                                                      |
| Enterprise Risk Management    |     | Risk Committee: We have a management-level Risk Committee, which is chaired by Enrique Mayor-Mora, our Executive Vice President and Chief Financial Officer (“CFO”), and includes as members other leaders from across CarMax. The Risk Committee meets periodically to identify and discuss the risks facing CarMax.                                                                       |     |                                                                                                                                                                              |
|                               |     | Board Reporting: The Risk Committee delivers biannual reports to the Board identifying the most significant risks facing the Company.                                                                                                                                                                                                                                                       |     |                                                                                                                                                                              |
|                               |     | Board Oversight: On an annual basis, Mr. Mayor-Mora, on behalf of the Risk Committee, discusses our procedures for identifying significant risks with the Audit Committee.                                                                                                                                                                                                                  |     |                                                                                                                                                                              |
| Other Processes that Support  
 Risk Oversight and Management |     | The Board oversees other processes that are not intended primarily to support enterprise risk management, but that assist the Company in identifying and controlling risk. These processes include our compliance and ethics program, our internal audit function, pre-filing review of SEC filings by our management-level disclosure committee, and the work of our independent auditors. |     |                                                                                                                                                                              |

We believe that our Board leadership structure supports the Board’s risk oversight function. Our chair, lead independent director and committee chairs set agendas and lead meetings to ensure strong risk oversight, while our CEO and his management team are charged with managing risk.

#### Related Person Transactions
Our Board has adopted a written Related Person Transactions Policy that applies to any transaction in which:

• CarMax or one of its affiliates is a participant;

• the amount involved exceeds $120,000; and

• the related person involved in the transaction (whether a director, executive officer, owner of more than 5% of our common stock, or an immediate family member of any such person) has a direct or indirect material interest.

| We did not have any related person transactions in fiscal 2025. |     | A copy of our policy is available under the “Governance