1

Risk Policy and Capital Committee Charter

1. Members. The Risk Policy and Capital Committee (the “Committee”) shall consist

of at least three members of the Board of Directors (the “Board”) of Fannie Mae (the 

“Company”), including an independent chair, appointed by the Board upon

recommendation by the Nominating and Corporate Governance Committee of the 

Board and may be removed by the Board in its discretion. 

Further, in accordance with the requirements of 12 C.F.R. 1239.11(b) and the status 

of the Company in Conservatorship the Committee shall: 

i. Be chaired by a Board member not serving in a management capacity

at the Company;

ii. Have at least one member with risk management experience that is 

commensurate with the Company’s inherent risks, capital structure, 

risk appetite, complexity, activities, size, and other appropriate riskrelated factors; and

iii. Have Committee members that have, or that will acquire within a 

reasonable time after being elected to the committee, a practical 

understanding of risk management principles and practices relevant 

to the Company.

2. Purpose of the Committee. The purpose of the Committee shall be to assist the 

Board in overseeing the Company’s Enterprise Risk Management Program (as 

defined below in Section 4.i.) and the alignment of the Enterprise Risk Management 

Program with the Company’s mission and safety and soundness objectives.

The Committee’s role is one of oversight. The Company’s management is 

responsible for designing, implementing, and maintaining an effective and 

appropriate enterprise-wide risk management program, which is overseen by the 

Committee in accordance with its responsibilities set forth in this charter.

The Committee shall also oversee senior management in setting the “tone from the 

top” in a manner that fosters an effective risk culture.

3. Duties to the Conservator. The Board members of the Company serve on behalf of

the Federal Housing Finance Agency (“FHFA”), as Conservator of the Company, 

and shall exercise authority as directed by the Conservator. The Committee shall 

consult with and obtain approval of the Conservator before retaining outside legal 

counsel to advise the Committee, as specified in Section 7 below.

4. Duties and Responsibilities of the Committee. The Committee shall carry out its risk

and capital management oversight by:

i. Recommending for Board approval the enterprise risk management 

program establishing the Company’s risk policies, risk appetite, aligning 

the risk appetite with the Company’s strategies and objectives, 

addressing the Company’s exposure to credit risk (including mortgage 

default and counterparty risks), market risk (including interest rate, 
2

currency, and prepayment risks), funding and liquidity risk (including the 

risk associated with the inability to access funding sources or manage 

fluctuations in funding levels), operational risk (including 

cyber/information security risk, third-party risk, and model risk), strategic, 

reputational and compliance risk, transverse risks (including climate risk),

and any other emerging risks, establishing appropriate policies and limits 

for Board approval to address these risks, in each case, consistent with 

any applicable Conservator directives, 12 CFR sec 1239.11(b)(2) and the 

Company’s capital structure, complexity, activities and size (the 

“Enterprise Risk Management Program”);

ii. Overseeing and periodically reviewing the Board-approved Enterprise 

Risk Management Program and making recommendations to the Board 

for approval of changes to the Enterprise Risk Management Program as 

appropriate, including any recommended changes to enterprise risk 

policies, the enterprise risk appetite, or the Board-level risk limits;

iii. Overseeing a periodic review of the aggregated risks of the Company to 

provide the Committee with a view of credit, market and operational risk 

and strategic, reputational, compliance, and climate risks as addressed 

by the Enterprise Risk Management Program. A number of these risks 

are primarily overseen by either the Board (strategic and reputational 

risk) and other Committees of the Board (e.g., compliance) so, where 

another Committee of the Board has primary oversight of an area of risk, 

the Committee will at least annually review with such other Committee 

the scope of that Committee’s risk oversight to confirm ongoing 

appropriateness and adequacy;

iv. Overseeing development of capital management policies which may be 

directed by the Conservator and may address current and projected 

capital levels and capital allocation, and which shall comply with any 

applicable Conservator requirements regarding capital;

v. Overseeing the Chief Risk Officer (“CRO”), the CRO shall report directly

to the Chief Executive Officer and independently to the Committee, and 

the Committee shall approve all decisions regarding the appointment or 

removal of the CRO, and shall consult with the Compensation and 

Human Capital Committee of the Board regarding the compensation of 

the CRO;

a. The CRO shall report regularly to the Committee on significant risk 

exposures and related controls, proposed changes to the risk 

appetite or Board-level risk limits, risk management strategies, 

results of risk management reviews, and emerging risks; and 

b. The CRO shall also report regularly on the Company’s compliance 

with, and the adequacy of, its current risk management policies, 

and shall recommend to the Committee any adjustments to such 

policies that he or she considers necessary or appropriate;
3

vi. Reviewing periodically the capabilities for, and adequacy of resources 

allocated to, Enterprise-wide risk management; 

vii. Overseeing and periodically reviewing the Company’s cyber and 

information security program; and

viii. Overseeing and periodically reviewing the Company’s climate risk

exposure, and discussing with management risks related to climate 

change. 

For the avoidance of doubt, notwithstanding anything in this charter, each other 

Committee of the Board shall continue to have the responsibilities and duties as 

provided in its respective charter.

5. Reports from Management. The Committee shall participate in discussions and 

receive periodic reports or analysis covering emerging risks as well as standard risk 

reports from management on matters relating to risk and capital pursuant to a

reporting schedule that the Committee Chair develops in consultation with the CRO 

and management, which may include the following:

i. Emerging risk issues as identified by management or the Committee; 

ii. Enterprise-wide Risk Management Program;

iii. Enterprise risk exposure and appetite, including risk levels relative to

limits;

iv. Risk assessments with respect to emerging, evolving and ongoing risks;

v. Enterprise capital position and internal economic capital assessment, as

appropriate given status in Conservatorship;

vi. Stress-testing of cash flows, capital and earnings to risk and

macroeconomic scenarios;

vii. Compliance with applicable FHFA regulations regarding risk

management, capital management and enterprise-wide risk

management policies;

viii. Aggregated view of enterprise risks, including credit, market, funding and 

liquidity, and operational risks as well as other risks such as strategic, 

reputational, compliance, and climate;

ix. Enterprise risk environment and culture;

x. Independent benchmarking of the Company’s practices in the area of risk

management; and

xi. The Company’s cyber and information security program.

6. Annual Review. The Committee will annually evaluate the performance of the

Committee and the adequacy of its charter.
4

7. Outside advisors. Subject to the Conservator’s approval, the Committee shall have

the authority to retain and terminate such outside legal counsel as it determines

appropriate to assist it in the full performance of its functions. The Committee shall

also have sole authority to retain and terminate such other experts and advisors as

it determines appropriate to assist it in the full performance of its functions, and

approve any such experts’ or advisors’ fees and other retention terms. The 

Company shall provide for appropriate funding, as determined by the Committee,

for payment of compensation to any advisor retained by the Committee.

8. Meetings. The Committee shall develop a calendar for its meetings and devote such 

time as it deems necessary to fulfill its duties, and shall meet as often as may be

deemed necessary or appropriate in its judgment, either in person or by means of a 

conference call or similar communications equipment providing a means by which 

all persons participating in the meeting can hear each other, and at such times and

places as the Committee shall determine. The Committee may elect to meet from

time to time in executive session with the Chief Executive Officer, Chief Risk Officer,

Chief Financial Officer, Chief Compliance Officer, Chief Audit Executive, or any 

other officer, as it deems appropriate. At least once per year, the Committee shall 

meet in joint session with the Audit Committee to discuss policies with respect to 

risk assessment and risk management. The Committee shall fully document and 

maintain records of its meetings. The Committee may meet in joint session with 

another Committee of the Board or with the Board in fulfilling its oversight duties and 

responsibilities. In addition, where another Committee of the Board has primary 

oversight of an area of risk, the Committee at least annually shall review with such 

other Committee the scope of that Committee’s risk oversight to confirm ongoing 

appropriateness and adequacy. The Committee shall report directly to the Board, 

and shall make regular reports to the Board on its activities, making

recommendations for Board action as appropriate. These reports shall generally

occur at the Board meetings, after each Committee meeting, or at such other times

as the Committee deems appropriate.

9. Subcommittees. In its discretion, the Committee may establish and delegate

responsibilities to subcommittees consisting of one or more members, who shall

report on their activities to the Committee.

Charter Last Approved: September 6, 2023.