Federal Agricultural (AGM) Risk Analysis

In addition to the general risks posed by adverse weather conditions, our exposure to credit risk and the market value of loan collateral is potentially subject to risks associated with farmers and ranchers facing increasing, (in both frequency and severity), weather incidents. The U.S. experienced 23 separate billion-dollar weather disasters in 2025, surpassed only by the 27 billion-dollar weather disasters in 2024 and the 28 billion-dollar weather disasters in 2023, both of which significantly exceeded the previous high set in 2020 (which had 22 billion-dollar weather disasters) as the highest level in the more than 40 years tracked by the National Oceanic and Atmospheric Administration. Many climatologists predict increases in average temperatures, more extreme temperatures, and increases in volatile weather over time. These physical changes may prompt changes in regulations or consumer preferences, which in turn could have negative consequences for the business models of borrowers, such as increasing costs, reducing the value of assets, and increasing operating expenses. The effects of severe weather events could make some agricultural properties less suitable for farming or for other alternative uses. Extended periods of drought and dryness can reduce agricultural productivity, cause lasting damage to permanent crops like fruit and tree nuts, and result in producers leaving some fields fallow due to lack of water. These and other effects of severe weather could have an adverse impact on farming operations and the value of loan collateral, which could have a material adverse effect on our business, operating results, or financial condition.

Our ability to operate our business, meet our obligations, generate asset volume growth, and fulfill our statutory mission depends on our continued access to the U.S. financial markets at favorable rates and terms to remain adequately capitalized through the issuance of equity and with adequate access to liquidity through the issuance of debt securities. The issuance of debt securities is our primary source for repaying or refinancing existing debt and to fund contingent liabilities, as needed. Our ability to access the debt and equity markets to raise capital, fund our assets, repay debt, and earn net interest income depends on market perception of Farmer Mac. If we are unable to access the U.S. financial markets to issue equity or debt securities at favorable rates and terms, our business, operating results, liquidity, or financial condition could be adversely affected.

As the needs of our customer base and rural America evolve, we seek to respond by offering new products and services to meet these needs. We invest significant time and resources in developing and marketing new products and services. Initial timetables for the introduction and development of new products or services may not be achieved, and profitability targets may not prove feasible. External factors, such as compliance with laws and regulations, competitive alternatives, and shifting consumer preferences, may also impact the successful implementation of a new product or service. Further, as we expand our product offerings and services, we are exposed to operational risk in implementing these new products and services. New products and services may require new operational processes, which often require new internal controls to manage new risks that these new processes present. If these controls are insufficient or ineffective to manage the risks inherent in these new processes, or if there is human error in executing these new controls either due to their novelty or otherwise, we could face financial loss, reputational damage, or regulatory enforcement, which could materially and adversely affect our business, operating results, or financial condition.

To conduct and manage our business operations, we rely heavily on technology and information systems, including from third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information in our information systems (and those of third parties). These technology and information systems encompass an integrated set of hardware, software, infrastructure, and personnel organized to facilitate our planning, control, coordination, operations, and decision-making processes. Risks to our information systems and data as a result of cybersecurity attacks has increased as the importance and complexity of our technology and information systems has increased, and as new technologies are developed that are used by us, our customers, and our service providers to support our business and operations. Like many other financial institutions, we and our third-party service providers, vendors, and suppliers face regular attacks by threat actors attempting to gain unauthorized access to, or disrupt, information systems and access or acquire data, including from organized criminal groups, hackers, nation states, activists, insiders, and others. These threats come from a variety of different sources, including cyber-attacks, computer viruses, malware, exploits of system and network vulnerabilities, human error, phishing, ransomware, and distributed denial of service attacks. The threats we and our third-party service providers face and the methods used to gain unauthorized access to or disrupt information systems and data are evolving. We are not always able to prevent or recognize attacks, our existing cybersecurity defenses may not be sufficient to detect attacks in a timely manner or to fully investigate an attack, and we may be unable to implement effective preventive measures or proactively address these threats until after a cybersecurity incident has been discovered. We require third parties who collect, process, or store confidential, proprietary, or personal data to adhere to security policies, processes, and controls. We also may have limited or no control over our service providers' handling of cybersecurity incidents, including their recognition and prevention practices. Any of our employees or agents (or our third-party customers or vendors) who have authorized access to confidential, proprietary, or personal information could also intentionally, inadvertently, or erroneously disseminate the information to unauthorized third parties. Our current information security program with cybersecurity procedures, policies, training, practices, and controls, may not be sufficient to prevent unauthorized access to our information technology assets or data, which could lead to a significant disruption to business operations; unauthorized access to or acquisition, destruction, alteration, release, theft, or loss of confidential, proprietary, or personal data; fraud (on us and/or our customers); extortion; financial and economic loss or costs; errors in our financial statements; impairment of liquidity; harm to employees, customers, or vendors; liability or service interruptions to our customers; loss of customers or vendors; violation of data protection laws and other litigation and legal risk; increased regulatory or legislative scrutiny; or reputational damage. Even when an attempted cybersecurity attack or other security breach is successfully avoided or thwarted, we may need to expend substantial resources in doing so, may be required to take actions that could adversely affect customer satisfaction or behavior, or may be exposed to reputational damage. We also could be subject to litigation and government enforcement actions as a result of any failure in our procedures, policies, practices, and controls. Any such claim or proceeding could cause us to incur significant unplanned expenses in excess of our insurance coverage, which could adversely affect our financial condition and results of operations. The amount and scope of insurance we maintain may not cover all expenses related to those claims. Also, the risk of unauthorized access to confidential, proprietary, or personal information through information system breaches or inadvertent dissemination may be heightened in a remote-working environment, which is currently more prevalent at Farmer Mac.

We are exposed to operational risk due to the complex nature of our business operations and the processes and systems used to undertake our business activities and comply with regulatory requirements. Operational risk includes the risk of loss resulting from: - inadequate or failed internal processes, systems, cybersecurity program, or infrastructure;- inability to successfully implement enhancements to any of these or migrate to new systems or infrastructure;- any cybersecurity incident or compromise of our information systems or security measures (including of our third parties), or the unauthorized access and/or acquisition of data;- failed execution of system implementations and upgrades;- human error, malfeasance, or other misconduct;- undetected or unknown errors, defects, or vulnerabilities in third party software or cybersecurity incidents related to third party software;- inadequate or failed internal controls or processes to detect or prevent fraud or other violations of law or regulations; or - external events, including a disruption involving physical site access, catastrophic events, natural disasters, terrorist activities, or disease pandemics. We rely on business processes that largely depend on people, technology, and the use of complex systems and models to manage our business, process a high volume of daily transactions, and generate the records on which our financial statements are based. Inadequacies or failures in our internal processes, personnel, systems, cybersecurity program, or infrastructure could lead to a significant disruption to business operations; unauthorized access to, or acquisition, destruction, alteration, release, theft, or loss of, confidential, proprietary, or personal data; fraud on our business and customers; extortion; financial and economic loss or costs; errors in our financial statements; impairment of our liquidity; harm to our employees, customers, or vendors; liability or service interruptions to our customers; loss of customers or vendors; violation of data protection laws and other litigation and legal risk; increased regulatory or legislative scrutiny; or reputational damage. The potential for operational risk exposure also exists as a result of our interactions with, and reliance on, third parties and we are aware of cybersecurity incidents involving third parties in the past. Our business relies on our ability to process, evaluate, and interpret significant amounts of information, much of which third parties provide or process. Yet our ability to implement safeguards preventing disruption or unauthorized access to third-party systems or infrastructure is more limited than for our own systems or infrastructure. Although we have not experienced a material loss due to a breach of third party systems, unauthorized access to a third party service provider's information technology assets or data may significantly impact our operations in the same manner as incidents on our own systems. If the financial, accounting, data processing, backup, information technology, or other operating systems and infrastructure of third parties with whom we interact or upon whom we rely fail to operate properly, are subject to unauthorized access or improper use, or are disrupted, then we may be impacted in the same manner as we would be due to inadequacies or failures in our own internal processes, personnel, systems, cybersecurity program, or infrastructure.

Our guarantee and purchase commitment obligations to third parties, including LTSPCs and securities that we guarantee, are solely our obligations and are not backed by the full faith and credit of the United States, FCA, or any other agency or instrumentality of the United States other than Farmer Mac. As of December 31, 2025, we had $5.4 billion of contingent liabilities related to LTSPCs and securities issued to third parties that we guarantee, which represents our exposure if all loans underlying these LTSPCs and guarantees defaulted and we recovered no value from the related collateral. If this were to occur, the funds available for payment on these guarantees and LTSPCs could be substantially less than the aggregate amount of the corresponding liabilities. As of December 31, 2025, we held cash, cash equivalents, and other investment securities with a fair value of $7.8 billion that could be used as a source of funds for payment on our obligations, including our guarantee and LTSPC obligations. Although we believe that we remain well-collateralized on the assets underlying our guarantee and LTSPC obligations to third parties and that the estimated probable losses for these obligations remain low relative to the amount available for payment of claims on these obligations, our total contingent liabilities for these obligations could exceed the amount we may have available for payment of our obligations, including claims on contingent obligations. See MD&A-Risk Management-Credit Risk – Loans and Guarantees for more information on our management of credit risk.

We rely on our employees' breadth and depth of knowledge of our company and related industries to run our business operations successfully. If we cannot retain and attract motivated and qualified employees or do not have adequate human capital to achieve our business objectives, our business performance, operations, financial condition, or reputation could be materially adversely affected. A significant disruption in the continuity of our employees or any significant executive leadership change could also result in a loss of productivity and affect our ability to successfully execute business strategies by creating uncertainty or instability or requiring us to divert or expend more resources to replace personnel. Loss of key leadership personnel could damage the public or market perception of our company or result in the departure of other executives or key employees. Any of these factors could materially adversely affect our business performance, operations, financial condition, or reputation. Any of the risks described in this section could materially and adversely affect our business, operating results, financial condition, reputation, capital levels, and future earnings. For more information about Farmer Mac's risk management, see "MD&A-Risk Management" in Item 7 of this report.

We rely on third parties, including loan servicers, information systems providers, software-as-a-service (SaaS) providers, cloud computing service providers, law firms, and other service providers, to perform various functions that support our business and operations. We depend on these third parties to collect, process, transmit, and store a variety of confidential, proprietary, or personal information, including sensitive financial information and customer information. Just as we are subject to numerous cyber-attacks from a variety of actors, so too are these third parties. We require third parties who collect, process, or store confidential, proprietary, or personal data to adhere to security policies, processes, and controls. However, the control systems, cybersecurity program, infrastructure, and personnel associated with third parties with which we do business or obtain services are beyond our control. We also may have limited or no control over third parties handling of cybersecurity incidents, including their recognition and prevention practices. We are aware of cybersecurity incidents involving our third party service providers in the past. Although we have not experienced a material loss of data or disruption of our operations due to a breach of third party systems, unauthorized access to a third party service provider's information technology assets or data may significantly impact our operations in the same manner as incidents on our own systems. We rely upon a variety of third-party applications, services, and tools that we do not develop, including artificial intelligence systems and cloud-based platforms and related data centers, to host data and support and operate certain aspects of our services and business operations. The effective adoption, integration, and leveraging of existing and emerging technologies, including artificial intelligence and machine learning systems into our operations, presents operational and business risks, including system failures, inaccuracies with artificial intelligence outputs, and the investment of time and resources to develop and implement successful artificial intelligence solutions in a rapidly changing competitive market. The unauthorized access to, acquisition, misuse, mishandling, unavailability, or destruction of our data or confidential information stored by these third parties or on their applications and systems, including artificial intelligence systems, or unauthorized access to or disruption of these third party applications, services, or tools could result in: unauthorized access to our own systems; significant disruption to our business operations; fraud (on us and/or our customers); extortion; financial and economic losses or costs; errors in financial statements; impairment of liquidity; harm to employees, customers, or vendors; liability or service interruptions to customers; loss of customers or vendors; violation of data protection laws and other litigation and legal risk; increased regulatory or legislative scrutiny; reputational damage; or litigation and government enforcement actions.

Our business, operating results, financial condition, and capital levels may be materially and adversely affected by external factors that may affect the price or marketability of our products and services or our ability to offer our products and services, including, but not limited to: - disruptions in the debt or equity capital markets;- competitive pressures in our loan purchase and guarantee activities or in the issuance of our debt securities;- changes in interest rates that may increase our funding costs;- market or customer perception of our reputation;- legislative or regulatory developments adversely affecting our ability to offer new products, the ability or motivation of lenders to participate in our lines of business, or the cost of related corporate activities;- reduced demand for agricultural real estate loans or infrastructure loans due to regional, domestic, or global economic conditions; and - expanded funding alternatives available to agricultural and infrastructure borrowers.

Our business and ability to generate revenues and profits largely depends on our ability to purchase Eligible Loans or place Eligible Loans under guarantees or LTSPCs and to purchase or guarantee AgVantage securities. We conduct a significant portion of our business with a few business counterparties. This concentration of business could potentially result in increased variability in our business as existing assets pay down or mature and the status and needs of our customers evolve. In 2025, ten institutions generated approximately 55% of loan purchase volume in the Agricultural Finance line of business. Between December 31, 2024 and December 31, 2025, the outstanding balance of our AgVantage securities decreased by approximately $0.1 billion. As of December 31, 2025, approximately 90.6% of the $8.4 billion outstanding principal amount of AgVantage securities (of which $1.2 billion and $0.9 billion will be maturing in 2026 and 2027, respectively) were issued by three institutions. As of December 31, 2025, transactions with two institutions represented nearly all of the business volume under our Infrastructure Finance line of business. Our ability to maintain the current relationships with our business counterparties or customers and the business generated by those business counterparties or customers is significant to our business. As a result, the loss of business from any one of our key business counterparties could decrease our revenues and profitability. We may be unable to replace the loss of business of a key business counterparty or customer with alternate sources of business due to limitations on the types of assets eligible for our secondary market, which could adversely affect our business and decrease our revenues and profits.