Federal Agricultural (AGM) Risk Analysis

In addition to the general risks posed by adverse weather conditions, Farmer Mac's exposure to credit risk and the market value of loan collateral is potentially subject to risks associated with farmers and ranchers facing increasing, as well as increasingly-severe, weather incidents. The U.S. experienced 27 separate billion-dollar weather disasters in 2024, surpassed only by the 28 billion-dollar weather disasters in 2023, both of which significantly exceeded the previous high set in 2020 (which had 22 billion-dollar weather disasters) as the highest level in the more than 40 years tracked by the National Oceanic and Atmospheric Administration ("NOAA"). Many climatologists predict increases in average temperatures, more extreme temperatures, and increases in volatile weather over time. These physical changes may prompt changes in regulations or consumer preferences, which in turn could have negative consequences for the business models of borrowers, such as increasing costs, reducing the value of assets, and increasing operating expenses. At the end of 2024, approximately 70% of the United States is classified as experiencing some level of drought or dryness according to the National Drought Mitigation Center, USDA, and NOAA. The effects of severe weather events could make some agricultural properties less suitable for farming or for other alternative uses. Extended periods of drought and dryness can reduce agricultural productivity, cause lasting damage to permanent crops like fruit and tree nuts, and result in producers leaving some fields fallow due to lack of water. These and other effects of severe weather could have an adverse impact on farming operations and the value of loan collateral, which could have a material adverse effect on Farmer Mac's business, operating results, or financial condition.

Farmer Mac's ability to operate its business, meet its obligations, generate asset volume growth, and fulfill its statutory mission depends on Farmer Mac's continued access to the U.S. financial markets at favorable rates and terms to remain adequately capitalized through the issuance of equity and with adequate access to liquidity through the issuance of debt securities. The issuance of debt securities is Farmer Mac's primary source for repaying or refinancing existing debt and to fund contingent liabilities, as needed. Farmer Mac's ability to access the debt and equity markets to raise capital, fund its assets, repay debt, and earn net interest income depends on market perception of Farmer Mac. If Farmer Mac were unable to access the U.S. financial markets to issue equity or debt securities at favorable rates and terms, Farmer Mac's business, operating results, liquidity, or financial condition could be adversely affected.

Farmer Mac's guarantee and purchase commitment obligations to third parties, including LTSPCs and securities guaranteed by Farmer Mac, are obligations of Farmer Mac only and are not backed by the full faith and credit of the United States, FCA, or any other agency or instrumentality of the United States other than Farmer Mac. As of December 31, 2024, Farmer Mac had $4.5 billion of contingent liabilities related to LTSPCs and securities issued to third parties and guaranteed by Farmer Mac, which represents Farmer Mac's exposure if all loans underlying these LTSPCs and guarantees defaulted and Farmer Mac recovered no value from the related collateral. If this were to occur, the funds available for payment on these guarantees and LTSPCs could be substantially less than the aggregate amount of the corresponding liabilities. As of December 31, 2024, Farmer Mac held cash, cash equivalents, and other investment securities with a fair value of $7.0 billion that could be used as a source of funds for payment on its obligations, including its guarantee and LTSPC obligations. Although Farmer Mac believes that it remains well-collateralized on the assets underlying its guarantee and LTSPC obligations to third parties and that the estimated probable losses for these obligations remain low relative to the amount available for payment of claims on these obligations, Farmer Mac's total contingent liabilities for these obligations could exceed the amount it may have available for payment of Farmer Mac's obligations, including claims on Farmer Mac's contingent obligations. See "Management's Discussion and Analysis-Risk Management-Credit Risk – Loans and Guarantees" for more information on Farmer Mac's management of credit risk.

To conduct and manage its business operations, Farmer Mac relies heavily on technology and information systems, including from third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information in its information systems (and those of third parties). These technology and information systems encompass an integrated set of hardware, software, infrastructure, and personnel organized to facilitate the planning, control, coordination, operations, and decision-making processes within Farmer Mac. Risks to Farmer Mac's information systems and data as a result of cybersecurity attacks has increased as the importance and complexity of Farmer Mac's technology and information systems has increased, and as new technologies are developed that are used by its customers, Farmer Mac, and its service providers to support its business and operations. Like many other financial institutions, Farmer Mac and its third-party service providers, vendors, and suppliers face regular attacks by threat actors attempting to gain unauthorized access to, or disrupt, its information systems and access or acquire its data, including from organized criminal groups, hackers, nation states, activists, insiders, and others. These threats come from a variety of different sources, including cyber-attacks, computer viruses, malware, exploits of system and network vulnerabilities, human error, phishing, ransomware, and distributed denial of service attacks. The threats Farmer Mac and its third-party service providers face and the methods used to gain unauthorized access to or disrupt their information systems and data are evolving. Farmer Mac is not always able to prevent or recognize attacks, its existing cybersecurity defenses may not be sufficient to detect attacks in a timely manner or to fully investigate an attack, and it may be unable to implement effective preventive measures or proactively address these threats until after a cybersecurity incident has been discovered. Farmer Mac also may have limited or no control over its service providers' handling of cybersecurity incidents, including their recognition and prevention practices. Any employees or agents of Farmer Mac's (or its third-party customers or vendors) who have authorized access to confidential, proprietary, or personal information could also intentionally, inadvertently, or erroneously disseminate the information to unauthorized third parties. Farmer Mac's current information security program with cybersecurity procedures, policies, practices, and controls, may not be sufficient to prevent unauthorized access to its information technology assets or data, which could lead to a significant disruption to business operations; unauthorized access to or acquisition, destruction, alteration, release, theft, or loss of confidential, proprietary, or personal data; fraud (on Farmer Mac and/or its customers); extortion; financial and economic loss or costs; errors in its financial statements; impairment of its liquidity; harm to employees, customers, or vendors; liability or service interruptions to its customers; loss of customers or vendors; violation of data protection laws and other litigation and legal risk; increased regulatory or legislative scrutiny; or reputational damage. Even when an attempted cybersecurity attack or other security breach is successfully avoided or thwarted, Farmer Mac may need to expend substantial resources in doing so, may be required to take actions that could adversely affect customer satisfaction or behavior, or may be exposed to reputational damage. Farmer Mac also could be subject to litigation and government enforcement actions as a result of any failure in its procedures, policies, practices, and controls. Any such claim or proceeding could cause us to incur significant unplanned expenses in excess of Farmer Mac's insurance coverage, which could adversely affect Farmer Mac's financial condition and results of operations. The amount and scope of insurance Farmer Mac maintains may not cover all expenses related to those claims. Also, the risk of unauthorized access to confidential, proprietary, or personal information through information system breaches or inadvertent dissemination may be heightened in a remote-working environment, which is currently more prevalent at Farmer Mac.

Farmer Mac is exposed to operational risk due to the complex nature of its business operations and the processes and systems used to undertake its business activities and comply with regulatory requirements. Operational risk includes the risk of loss to Farmer Mac resulting from: - inadequate or failed internal processes, systems, cybersecurity program, or infrastructure;- Farmer Mac's inability to successfully implement enhancements to any of these or migrate to new systems or infrastructure;- any cybersecurity incident or compromise of Farmer Mac's information systems or security measures (including of its third parties), or the unauthorized access and/or acquisition of data;- failed execution of system implementations and upgrades;- human error, malfeasance, or other misconduct;- undetected or unknown errors, defects, or vulnerabilities in third party software or cybersecurity incidents related to third party software;- inadequate or failed internal controls or processes to detect or prevent fraud or other violations of law or regulations; or - external events, including a disruption involving physical site access, catastrophic events, natural disasters, terrorist activities, or disease pandemics. Farmer Mac relies on business processes that largely depend on people, technology, and the use of complex systems and models to manage its business, process a high volume of daily transactions, and generate the records on which Farmer Mac's financial statements are based. Inadequacies or failures in Farmer Mac's internal processes, personnel, systems, cybersecurity program, or infrastructure could lead to a significant disruption to business operations; unauthorized access to, or acquisition, destruction, alteration, release, theft, or loss of, confidential, proprietary, or personal data; fraud on Farmer Mac's business and customers; extortion; financial and economic loss or costs; errors in its financial statements; impairment of its liquidity; harm to its employees, customers, or vendors; liability or service interruptions to its customers; loss of customers or vendors; violation of data protection laws and other litigation and legal risk; increased regulatory or legislative scrutiny; or reputational damage. The potential for operational risk exposure also exists as a result of Farmer Mac's interactions with, and reliance on, third parties. Farmer Mac's business relies on its ability to process, evaluate, and interpret significant amounts of information, much of which third parties provide or process. Yet Farmer Mac's ability to implement safeguards preventing disruption or unauthorized access to third-party systems or infrastructure is more limited than for its own systems or infrastructure. If the financial, accounting, data processing, backup, information technology, or other operating systems and infrastructure of third parties with whom Farmer Mac interacts or upon whom it relies fail to operate properly, are subject to unauthorized access or improper use, or are disrupted, then Farmer Mac may be impacted in the same manner as it would be due to inadequacies or failures in Farmer Mac's own internal processes, personnel, systems, cybersecurity program, or infrastructure.

Farmer Mac relies on its employees' breadth and depth of knowledge of Farmer Mac and related industries to run its business operations successfully. If Farmer Mac cannot continue to retain and attract motivated and qualified employees or does not have adequate human capital to achieve its business objectives, Farmer Mac's business performance, operations, financial condition, or reputation could be materially adversely affected. A significant disruption in the continuity of Farmer Mac's employees or any significant executive leadership change could also result in a loss of productivity and affect Farmer Mac's ability to successfully execute business strategies by creating uncertainty or instability or requiring Farmer Mac to divert or expend more resources to replace personnel. Loss of key leadership personnel could also damage the public or market perception of Farmer Mac or result in the departure of other executives or key employees. Any of these factors could materially adversely affect Farmer Mac's business performance, operations, financial condition, or reputation. Any of the risks described in this section could materially and adversely affect Farmer Mac's business, operating results, financial condition, reputation, capital levels, and future earnings. For more information about Farmer Mac's risk management, see "Management's Discussion and Analysis of Financial Condition and Results of Operations-Risk Management" in Item 7 of this report.

Farmer Mac relies on third parties, including loan servicers, information systems providers, software-as-a-service (SaaS) providers, cloud computing service providers, law firms, and other service providers, to perform various functions that support Farmer Mac's business and operations. Farmer Mac depends on these third parties to collect, process, transmit, and store a variety of confidential, proprietary, or personal information, including sensitive financial information and customer information. Just as Farmer Mac is subject to numerous cyber-attacks from a variety of actors, so too are these third parties. Farmer Mac requires third parties who collect, process, or store confidential, proprietary, or personal data to adhere to security policies, processes, and controls. However, the control systems, cybersecurity program, infrastructure, and personnel associated with third parties with which Farmer Mac does business or obtains services are beyond its control. Farmer Mac is aware of cybersecurity incidents involving its third party service providers in the past. Although Farmer Mac has not experienced a material loss of data or disruption of its operations due to a breach of third party systems, unauthorized access to a third party service provider's information technology assets or data may significantly impact Farmer Mac's operations in the same manner as incidents on its own systems. Farmer Mac relies upon a variety of third-party applications, services, and tools that are not developed by Farmer Mac, including artificial intelligence systems and cloud-based platforms and related data centers, to host data and support and operate certain aspects of its services and business operations. The effective adoption, integration, and leveraging of existing and emerging technologies, including artificial intelligence and machine learning systems into our operations, presents operational and market risks, including system failures, inaccuracies with artificial intelligence outputs, and the investment of time and resources to develop and implement successful artificial intelligence solutions in a rapidly changing competitive market. The unauthorized access to, acquisition, misuse, mishandling, unavailability, or destruction of Farmer Mac's data or confidential information stored by these third parties or on their applications and systems, including artificial intelligence systems, or unauthorized access to or disruption of these third party applications, services, or tools could result in: unauthorized access to Farmer Mac's own systems; significant disruption to its business operations; fraud (on Farmer Mac and/or its customers); extortion; financial and economic losses or costs; errors in financial statements; impairment of its liquidity; harm to its employees, customers, or vendors; liability or service interruptions to its customers; loss of customers or vendors; violation of data protection laws and other litigation and legal risk; increased regulatory or legislative scrutiny; reputational damage; or litigation and government enforcement actions.