Corebridge Financial, Inc. (CRBG) Risk Factors

Legislators, regulators and self-regulatory organizations have in the past and may in the future periodically consider various proposals that may affect or restrict, among other things, our business practices or eligibility to do business with certain public sector clients, underwriting methods and data utilization, product designs and distribution relationships, how we market, sell or service certain products we offer, our capital, reserving and accounting requirements, price competitiveness of the products we sell and consumer demand for our products or the profitability of certain of our business lines. Further, new laws and regulations may even affect or significantly limit our ability to conduct certain business lines at all, including proposals relating to restrictions on the type of activities in which investment managers and other financial institutions, including insurance companies in particular, are permitted to engage, as well as the types of investments we hold or divest. For example, regulators have shown continued interest in how organizations within the financial services industry, including insurance companies, are managing climate risk within their business operations and investment portfolios. Resulting actions by governments, regulators and international standard setters could lead to additional reporting obligations concerning investment holdings that are exposed to climate change-related risk. They could also lead to substantial additional laws or regulations that limit or restrict investments in certain assets, such as thermal coal or other carbon-based investments, and impose additional compliance costs. As another example, rules on defined benefit pension plan funding may reduce the likelihood of, or delay corporate plan sponsors in, terminating their plans or engaging in transactions to partially or fully transfer pension obligations. This could affect the mix of our PRT business and increase non-guaranteed funding products. There has also been increased regulatory scrutiny of the use of "big data" techniques, machine learning, predictive models and artificial intelligence, including in the insurance industry. Certain state and federal lawmakers, insurance regulators, including in Colorado and New York, and advisory groups are developing, or have developed, regulations or guidance applicable to insurance companies that use artificial intelligence, "big data" techniques, machine learning and predictive models in their operations. We cannot predict what, if any, regulatory actions may be taken in the future with regard to "big data," artificial intelligence, machine learning or predictive models, but any limitations imposed as a result of or in response to any such regulatory actions could have a material impact on our business, processes, results of operations and financial condition. It is difficult to predict the impact laws and regulations adopted in foreign jurisdictions may have on the financial markets generally or our business, results of operations or cash flows. It is possible such laws and regulations may significantly alter our business practices. See "Business-Regulation-U.S. Regulation" and "Business-Regulation-International Regulation."

Certain of our annuity and life insurance products include features that guarantee a certain level of benefits, including GMDB, guaranteed living benefits, including GMIB, and products with guaranteed interest crediting rates, including crediting rate guarantees tied to the performance of various market indices. Many of these features are accounted for at fair value as either MRBs or embedded derivatives under GAAP, and they have significant exposure to capital markets and insurance risks. An increase in valuation of liabilities associated with the guaranteed features results in a decrease in our profitability and depending on the magnitude of any such increase, could materially and adversely affect our financial condition, including our capitalization, as well as our financial strength ratings. We employ a capital markets hedging strategy to partially offset the economic impacts of movements in equity, interest rate and credit markets; however, our hedging strategy may not effectively offset movements in our GAAP equity or our statutory surplus and capital requirements and may otherwise be insufficient in relation to our obligations. Furthermore, we are subject to the risk that changes in policyholder behavior or actual levels of mortality/longevity as compared to assumptions in pricing and reserving, combined with adverse market events, could produce losses not addressed by the risk management techniques employed. These factors, individually or collectively, may have a material adverse effect on our business, results of operations, financial condition and liquidity including our ability to receive dividends from our operating companies. Changes in interest rates result in changes to the fair value liability. All else being equal, higher interest rates generally decrease the fair value of our liabilities, which increases our earnings, while low interest rates generally increase the fair value of our liabilities, which decreases our earnings. A prolonged low interest rate environment or a prolonged period of widening credit spreads may also subject us to increased hedging costs or an increase in the amount of statutory reserves that our insurance company subsidiaries are required to hold for our liabilities, lowering their statutory surplus, which would adversely affect their ability to pay dividends. In addition, it may also increase the perceived value of our benefits to our policyholders, which in turn may lead to a higher than expected benefit utilization and lower than expected surrender rates of those products over time as compared to pricing assumptions. Differences between the change in fair value of the GAAP MRBs and embedded derivatives, as well as associated statutory and tax liabilities, and the value of the related hedging portfolio may occur and can be caused by movements in the level of equity, interest rate and credit markets, market volatility, policyholder behavior, and mortality/longevity rates that differ from our assumptions and our inability to purchase hedging instruments at prices consistent with the desired risk and return trade-off. In addition, we may sometimes choose not to hedge or fully mitigate these risks, based on economic considerations and other factors. The occurrence of one or more of these events has in the past resulted in, and could in the future result in, an increase in the fair value of liabilities associated with the guaranteed benefits without an offsetting increase in the value of our hedges, or a decline in the value of our hedges without an offsetting decline in our liabilities, thus reducing our results of operations and shareholders' equity.

Deferred income tax represents the tax effect of the differences between the book and tax basis of assets and liabilities. Deferred tax assets are assessed periodically by management to determine if they are realizable. As of December 31, 2023, we had net deferred tax assets, after valuation allowance, of $8.2 billion related to federal, foreign, and state and local jurisdictions. The performance of the business, the geographic and legal entity source of our income, tax planning strategies, and the ability to generate future taxable income from a variety of sources and planning strategies including capital gains, are factored into management's determination. If, based on available evidence, it is more likely than not that the deferred tax asset will not be realized, then a valuation allowance must be established with a corresponding charge to profitability, which such action we have taken from time to time. Such charges could have a material adverse effect on our consolidated results of operations, liquidity and financial condition. For further discussion regarding deferred tax assets, see "Management's Discussion and Analysis of Financial Condition and Results of Operations-Accounting Policies and Pronouncements-Critical Accounting Estimates-Income Taxes-Recoverability of Net Deferred Tax Asset" and Note 24 to the Consolidated Financial Statements.

Our risk management strategy seeks to mitigate the potential adverse effects of changes in capital markets, specifically changes in equity markets, foreign exchange rates and interest rates on guarantees related to variable annuities, fixed index annuities and index universal life insurance, and liability guarantees associated with our GLBs for certain products such as variable annuities, fixed index annuities and fixed annuities. The strategy primarily relies on hedging strategies using derivatives instruments and, to a lesser extent, reinsurance. Derivative instruments primarily composed of futures, swaps and options on equity indices and interest rates are an essential part of our hedging strategy and are selected to provide a measure of economic protection. We utilize a combination of short-term and longer-term derivative instruments to have a laddered maturity of protection and reduce rollover risk during periods of market disruption or higher volatility. As of December 31, 2023, notional amounts on our derivative instruments totaled $243 billion. We manage the potential credit exposure for derivative instruments through utilization of financial exchanges, ongoing evaluation of the creditworthiness of counterparties, the use of International Swap and Derivative Association, Inc. ("ISDA") and collateral agreements, and other master netting agreements. In connection with our hedging program, we may decide to seek the approval of applicable regulatory authorities to permit us to increase our limits with respect to derivatives transactions used for hedging purposes consistent with those contemplated by the program. No assurance can be given that any of our requested approvals will be obtained and whether, if obtained, any such approvals will not be subject to qualifications, limitations or conditions. If our capital is depleted in the event of persistent market downturns, we may need to replenish it by holding additional capital, which we may have allocated for other uses, or purchase additional hedging protection through the use of derivatives with strike levels at then-current market levels, which may result in additional costs. Under our hedging strategy, period-to-period changes in the valuation of our hedges relative to the guaranteed liabilities may result in significant volatility to certain of our profitability measures, which in certain circumstances could be more significant than has been the case historically. In addition, hedging instruments we enter into may not effectively offset changes in economic values of the guarantees within certain of our annuity products or may otherwise be insufficient in relation to our obligations. For example, in the event that derivatives counterparties or central clearinghouses are unable or unwilling to honor their obligations, we remain liable for the guaranteed liability benefits. See "Risks Relating to Our Investment Portfolio, Liquidity, Capital and Credit-We are exposed to counterparty credit risk." The cost of our hedging program may be greater than anticipated if adverse market conditions were to limit the availability and increase the costs of the derivatives we intend to employ, and such costs may not be recovered in the pricing of the underlying products we offer. Our transactions with financial and other institutions generally specify the circumstances under which either party is required to pledge collateral related to any change in the market value of the derivative instruments. The amount of collateral, or a total of initial and variation margins, we are required to post under these agreements could increase under certain circumstances, which could materially and adversely affect our business, results of operations, financial condition and liquidity. The above factors, individually or in the aggregate, may have a material adverse effect on our financial condition, results of operations and our profitability measures and may impact our capitalization, our distributable earnings, our ability to receive dividends from our operating companies and our liquidity. These impacts could then in turn impact our RBC ratios and our financial strength ratings.

There have been a number of cases involving fraud or other misconduct by employees in the financial services industry in recent years and we are also exposed to the risk that fraud or misconduct by our employees or agents of third parties performing services and activities for us could occur. Our human resources and compliance departments work collaboratively to monitor for fraud and conduct extensive training for such employees and agents, however, employee misconduct may still occur. Instances of fraud, illegal acts, errors, failure to document transactions properly or to obtain proper internal authorization, misuse of customer or proprietary information or failure to comply with regulatory requirements or our internal policies may result in losses and/or reputational damage.

Downgrades of the IFS ratings of our insurance company subsidiaries, including related to changes in rating agency methodologies, could prevent these companies from selling, or make it more difficult for them to succeed in selling, products and services, make it more difficult for them to enter into new reinsurance contracts or obtain it on reasonable terms, or result in increased policy cancellations, lapses and surrenders, termination of, or increased collateral posting obligations under, assumed reinsurance contracts, or return of premiums. A downgrade in our credit ratings could result in a downgrade of the IFS ratings of our insurance or reinsurance company subsidiaries. Similarly, a downgrade of the IFS ratings of our insurance and reinsurance company subsidiaries could result in a downgrade in our credit ratings. In addition, a downgrade of our long-term debt ratings by one or more of the major rating agencies, including related to changes in rating agency methodologies, could increase our financing costs and collateral requirements and limit the availability of financing, making it more difficult to refinance maturing debt obligations, and support business and investment strategies. Specifically, a downgrade of our or CRBGLH's long-term debt ratings below specified levels may require us and CRBGLH to collateralize the principal amount outstanding under the CRBGLH notes and our junior subordinated debt at any given time, any related accrued and unpaid interest, and the net present value of future interest payments with respect to such debt. Such collateralization could materially and adversely affect our business, results of operations, financial condition and liquidity. A downgrade could also impede our ability to maintain or improve the IFS ratings of our insurance company subsidiaries. Additionally, a downgrade in our insurance company subsidiaries' IFS ratings or our credit ratings could cause counterparties to limit or reduce their exposure to us and thus reduce our ability to manage our market risk exposures effectively during times of market stress. Such a downgrade could materially and adversely affect our business, results of operations, financial condition and liquidity. For information on our credit ratings, see "Management's Discussion and Analysis of Financial Condition and Results of Operations -Liquidity and Capital Resources-Credit Ratings."

We use information technology systems, infrastructure and networks and other operational systems to store, retrieve, evaluate and use customer, employee, and company data and information. Our business is highly dependent on our ability to access these systems to perform necessary business functions. In the event of a natural disaster, a computer virus, unauthorized access, a terrorist attack, cyber-attack or other disruption, our systems and networks may be inaccessible to our employees, customers or business partners for an extended period of time, and we may be unable to meet our business obligations for an extended period of time if our data or systems are disabled, manipulated, destroyed or otherwise compromised. Additionally, some of our systems and networks are older, legacy-type systems that are less efficient, more susceptible to cybersecurity risks and require an ongoing commitment of significant resources to maintain or upgrade. Supply chain disruptions or delays could prevent us from maintaining and implementing changes, updates and upgrades to our systems and networks in a timely manner or at all. System and network failures or outages could compromise our ability to perform business functions in a timely manner, which could harm our ability to conduct business, hurt our relationships with our business partners and customers and expose us to legal claims as well as regulatory investigations and sanctions, any of which could have a material adverse effect on our business, results of operations, financial condition and liquidity. Some of these systems and networks also rely upon third-party systems and services, which themselves may rely on the systems and services of other third parties. Problems caused by, or occurring in relation to, our third-party providers' systems and services, including those resulting from breakdowns or other disruptions in information security and technology services provided by our third-party providers and the other third-parties on which they rely, our inability to acquire third-party services on commercially acceptable terms, failure of a third-party provider to perform as anticipated or in compliance with applicable laws or regulations, inability of a third-party provider to provide the required volumes of services or third-party providers experiencing cyber-attacks, security breaches or data breaches continue to potentially, and could in the future materially and adversely affect our business, results of operations, financial condition and liquidity. See "Cybersecurity-Cybersecurity Risk Management-Board Oversight and Governance" below. Like other companies, the systems and networks we maintain and third-party systems and networks we use have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, including physical or electronic break-ins or unauthorized tampering, as well as attempted cyber and other security threats and other attacks such as "denial of service" attacks, phishing, untargeted but sophisticated and automated attacks, ransomware and other disruptive software. Also, like other companies, we face an increasing challenge of attracting and retaining highly qualified security personnel to assist us in combating these security threats. Cybersecurity threats can originate from a broad range of sources including terrorists, nation states, state-sponsored actors, financially motivated actors, internal actors, or third-parties (including third-party providers), and the techniques used in these attacks may change, develop and evolve rapidly, including the use of emerging technologies, such as broader forms of artificial intelligence, and are frequently or are often not recognized until after they have been launched. The frequency and sophistication of such threats continue to increase and often become further heightened in connection with geopolitical tensions. In light of these geopolitical events and dynamics, state-sponsored parties or their supporters have in the past and may in the future, launch cyberattacks, and attempt to cause supply chain disruptions, or carry out other geopolitically motivated actions that may adversely disrupt or degrade our operations and may result in data compromise. There is no assurance that our security measures, including information security and technology policies and standards, administrative, technical and physical controls, and other actions by us or contracted third-parties designed as preventative, will provide fully effective protection from threats to our data, systems and networks, including malware and computer virus attacks, ransomware, unauthorized access, business e-mail compromise, misuse, denial-of-service attacks, ransomware, system failures and disruptions, both independently and through contracts with third parties. There is no assurance that our security measures, including information security and technology policies and standards, administrative, technical and physical controls, and other actions designed as preventative, will provide fully effective protection from such events. We maintain insurance to cover operational risks, such as cyber risk and technology outages, but this insurance may not cover all costs associated with the consequences of information systems or personal, confidential or proprietary information being compromised. We cannot be certain that insurance coverage will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage of a future claim. In the case of a successful ransomware or extortion attack in which our data and information systems are compromised and applicable restore control processes to restore access are not effective, our information could be held hostage until a ransom, which may be significant, is paid. In some cases, such a compromise may not be immediately detected, which may make it difficult to restore critical services, mitigate damage to assets and maintain the integrity and security of data, including our policyholder, employee, agent and other confidential information processed through our systems and networks. Additionally, since we rely heavily on information technology and systems and on the integrity and timeliness of data to run our businesses and service our customers, any such security event and resulting compromise of systems or data may impede or interrupt our business operations and our ability to offer products to and service our customers, and otherwise may materially and adversely affect our business, results of operations, financial condition and liquidity. There can be no assurance that any actions taken by us to evaluate and enhance our information security and technology systems (which increasingly will include the use of artificial intelligence technology) and processes, including third-party systems and services on which we rely, as well as changes designed to update and enhance our protective measures to address new threats, will decrease the risk of a system or process failure, and there could be a gap in the associated security measures during the change period. Any such system or process failure or security measures gap could materially and adversely affect our business, results of operations, financial condition and liquidity. We routinely transmit, receive and store personal, confidential and proprietary information by email and other electronic means. Although we attempt to keep such information confidential and secure, we may be unable to do so in all events, especially with clients, vendors, service providers, counterparties and other third parties who may not have or use appropriate controls to protect personal, confidential or proprietary information. Failure by us or any of our third party vendors to secure or appropriately handle personal, confidential or proprietary information could cause a loss of data or compromised data integrity, give rise to remediation or other expenses, expose us to liability under U.S. and international laws and regulations, and subject us to litigation, investigations, sanctions, and regulatory and law enforcement action, and result in reputational harm and loss of business, which could have a material adverse effect on our business, results of operations, financial condition and liquidity. Furthermore, certain of our business lines are subject to laws and regulations enacted by U.S. federal and state governments, foreign governments, data protection authorities or other jurisdictions or enacted by various self-regulatory organizations or exchanges relating to the privacy and security of personal data of clients, employees or others and the security of information systems and non-public information ("Privacy and Information Security Laws"). The variety of applicable Privacy and Information Security Laws exposes us to heightened regulatory scrutiny and requires us to incur significant technical, legal and other expenses in an effort to ensure and maintain compliance and will continue to impact our business in the future by increasing legal, operational and compliance costs. While we have taken steps to comply with current Privacy and Information Security Laws, we cannot guarantee that our efforts will meet the evolving standards imposed by enforcement agencies and by courts in private rights of action and that in the future we will be able to timely comply with rapidly changing Privacy and Information Security Laws worldwide that may require significant technical, operational and administrative changes. If we are found not to be in compliance with current or future Privacy and Information Security Laws, we may be subject to potential private consumer, business partner or securities litigation, regulatory inquiries and governmental investigations and proceedings, including class-actions, and we may incur damage to our reputation. Any such developments may subject us to remediation expenses, governmental fines and other monetary penalties and damages, divert management's time and attention and lead to enhanced regulatory oversight, any of which could have a material adverse effect on our business, results of operations, financial condition and liquidity. Additionally, we expect that increased political and social focus on privacy and cybersecurity risks globally will increase the financial and reputational implications should we or any of our third-party suppliers experience a significant security incident or data breach. New and currently unforeseen laws and regulatory issues could also arise from the increased use of emerging technologies, data analytics and digital services. If we are found not to be in compliance with these laws and regulations concerning emerging technology, data analytics and digital services, we could be subjected to significant civil and criminal liability and exposed to financial and reputational harm. For additional information on data protection and cybersecurity regulations, see "Business-Regulation-U.S. Regulation-Privacy, Data Protection and Cybersecurity."

Plan sponsors, our customers in our Retirement Services segment, have in the past, and may in the future, elect to renegotiate the terms of existing relationships on terms that are not attractive or acceptable to us, limit the products or services they offer to their plan participants, including the types of products and advisory services offered by us, or otherwise reduce or terminate their relationships with us. This could arise as a result of the consolidation of plan sponsors (particularly in the healthcare industry), changes in law and regulations with respect to the investments that may be offered under certain plans, such as collective investment trusts, the redirection of assets to other providers who may provide more favorable terms or products, the provision of operational support by other providers which may be viewed as more optimal for the plan or changes in our business model. The renegotiation or termination of plans that contribute significantly to our profitability could have a meaningful impact on our overall profitability. In the case of employer-sponsored plans, the impact of renegotiations can also vary depending on whether existing plan accounts remain with us, are transferred at the direction of the plan sponsor or are transferred at the direction of individual plan participants. Additionally, both public and private plan sponsors, have in the past, and may in the future, experience financial difficulty and some may reduce costs, including through headcount reductions or the rebalancing of their workforce in favor of part-time employees who are ineligible for retirement benefits. The financial stress on such plan sponsors is often exacerbated by reductions in governmental funding sources. Given these challenges, our premiums and deposits may decline or stagnate, which could adversely affect our business, results of operations, financial condition and liquidity.