Royal Bank of Canada

Regulatory Filings • Dec 12, 2025

ROYAL BANK OF CANADA

(a Canadian chartered bank)

2^nd Supplementary Notes Base Prospectus dated December 10, 2025

Pursuant to the Programme for the Issuance of Securities

This 2^nd Supplementary Notes Base Prospectus (the "2^nd Supplementary Prospectus") to the Notes Base Prospectus dated July 9, 2025 (the "Original Base Prospectus"), as supplemented by the 1^st Supplementary Prospectus dated August 28, 2025 (the Original Base Prospectus, together with the 1^st Supplementary Prospectus dated August 28, 2025, the "Base Prospectus"), and Admission Particulars for Royal Bank of Canada ("RBC" or the "Issuer") constitutes a supplementary prospectus in respect of the Base Prospectus for the Issuer for the purposes of Article 23.1 of the U.K. Prospectus Regulation and supplementary admission particulars in respect of the Admission Particulars for the purposes of the ISM Rulebook, and is prepared in connection with the programme for the issuance of securities established by RBC (the "Programme"). When used in this 2^nd Supplementary Prospectus, "U.K. Prospectus Regulation" means Regulation (EU) 2017/1129 as it forms part of U.K. domestic law by virtue of the European Union (Withdrawal) Act 2018, as amended.

Terms defined in the Base Prospectus have the same meaning when used in this 2^nd Supplementary Prospectus. This 2^nd Supplementary Prospectus is supplemental to, and shall be read in conjunction with, the Base Prospectus.

This 2^nd Supplementary Prospectus has been approved as a supplement to a base prospectus by the Financial Conduct Authority as competent authority under Regulation (EU) 2017/1129 of the European Parliament and of the Council of June 14, 2017 on the prospectus to be published when securities are offered to the public or admitted to trading on a regulated market, and repealing Directive 2003/71/EC, as it forms part of UK domestic law by virtue of the European Union (Withdrawal) Act 2018. The Financial Conduct Authority has only approved this 2^nd Supplementary Prospectus as meeting the standards of completeness, comprehensibility and consistency imposed by the UK Prospectus Regulation and such an approval should not be considered as an endorsement of the Issuer nor as an endorsement of the quality of any Notes that are the subject of this 2^nd Supplementary Prospectus. Investors should make their own assessment as to the suitability of investing in such Notes.

RBC accepts responsibility for the information contained in this 2^nd Supplementary Prospectus. To the best of the knowledge of RBC, the information contained in this 2^nd Supplementary Prospectus is in accordance with the facts and this 2^nd Supplementary Prospectus makes no omission likely to affect its import.

The purpose of this 2^nd Supplementary Prospectus is to (a) incorporate by reference in the Base Prospectus the Issuer's latest audited consolidated financial statements and management's discussion and analysis thereof and the 2025 AIF (as defined below); (b) update the section entitled "Caution Regarding Forward-Looking Statements" set out in the Original Base Prospectus; (c) delete and replace the risk factors, which

are incorporated by reference in the Original Base Prospectus via the Registration Document dated July 8, 2025, in light of the publication of the 2025 MD&A (as defined below); (d) update paragraph 3 of the section entitled "GENERAL INFORMATION" in the Base Prospectus regarding governmental, legal or arbitration proceedings which may have, or have had, a significant effect on the financial position or profitability of the Issuer or of the Issuer and its subsidiaries taken as a whole; and (e) include an updated statement in respect of no significant change and no material adverse change in the Base Prospectus.

To the extent that there is any inconsistency between (a) any statement in this 2 nd Supplementary Prospectus or any statement incorporated by reference into the Base Prospectus by this 2 nd Supplementary Prospectus; and (b) any other statement in, or incorporated by reference in, the Base Prospectus, the statements referenced in (a) above will prevail.

Save as disclosed in this 2 nd Supplementary Prospectus or those sections of the 2025 AIF (as defined below) and the 2025 Annual Report (as defined below) incorporated by reference in the Base Prospectus by virtue of this 2 nd Supplementary Prospectus, no significant new factor, material mistake or material inaccuracy relating to the information included in the Base Prospectus which may affect the assessment of Notes issued under the Programme has arisen or been noted, as the case may be, since approval by the Financial Conduct Authority (the "FCA") of the 1st Supplementary Prospectus dated August 28, 2025.

DOCUMENTS INCORPORATED BY REFERENCE

The following documents (or the specified sections thereof) are, by virtue of this 2nd Supplementary Prospectus, incorporated in, and form part of, the Base Prospectus:

• (a) RBC's Annual Information Form dated December 2, 2025 (the "2025 AIF"), including, without limitation, the following sections:
• (i) "Description of the Business General Summary" on page 3;
• (ii) "Description of the Business Competition" on pages 3 and 4; and
• (iii) "Appendix A Principal Subsidiaries" on page 27;
• (b) the following sections of RBC's 2025 Annual Report (the "2025 Annual Report") for the year ended October 31, 2025:
• (i) the Management's Discussion and Analysis on pages 22 through 135 (the "2025 MD&A");
• (ii) the audited annual consolidated financial statements, which comprise the consolidated balance sheets as of October 31, 2025 and 2024, and the related consolidated statements of income, comprehensive income, changes in equity, and cash flows for the years then ended, including the related notes, prepared in accordance with International Financial Reporting Standards as issued by the International Accounting Standards Board on pages 144 through 241, together with the Management's Report on Internal Control over Financial Reporting as of October 31, 2025 on page 138, the Independent Auditor's Report and the Report of Independent Registered Public Accounting Firm, each dated December 2, 2025, on pages 139 through 141 and 142 through 143, respectively (the "2025 Audited Consolidated Financial Statements"); and

(iii) the information about tax examinations and assessments and legal and regulatory matters to which the Issuer and its consolidated subsidiaries are or have been subject in Note 21 on page 227 and Note 24 on pages 230 and 231, respectively.

The remainder of the 2025 Annual Report is either covered elsewhere in the Base Prospectus or is not relevant for investors.

The 2025 AIF and the 2025 Annual Report, which includes the 2025 Audited Consolidated Financial Statements and the 2025 MD&A, are available for viewing at:

2025 AIF

https://www.rbc.com/investor-relations/\_assets-custom/pdf/aif2025.pdf

2025 Annual Report

https://www.rbc.com/investor-relations/\_assets-custom/pdf/ar\_2025\_e.pdf

The 2025 AIF and 2025 Annual Report, which includes the 2025 Audited Consolidated Financial Statements and the 2025 MD&A, have been filed with the National Storage Mechanism and are available for viewing at https://data.fca.org.uk/#/nsm/nationalstoragemechanism and have been announced via the Regulatory News Service operated by the London Stock Exchange.

For the avoidance of doubt, any document incorporated by reference in the 2025 AIF or the 2025 Annual Report, including the 2025 Audited Consolidated Financial Statements and the 2025 MD&A, shall not form part of this 2 nd Supplementary Prospectus for the purposes of the U.K. Prospectus Regulation or the ISM Rulebook, except where such information or other documents are specifically incorporated by reference in or attached to this 2 nd Supplementary Prospectus.

Copies of this 2 nd Supplementary Prospectus, the Base Prospectus and the documents incorporated by reference in either of these can be (i) viewed on the Issuer's website maintained in respect of the Programme at https://www.rbc.com/investor-relations/european-senior-notes-program.html; (ii) obtained on written request and without charge from the Issuer at Investor Relations, Royal Bank of Canada, 200 Bay Street, South Tower, Toronto, Ontario, Canada M5J 2J5 and from the office of the Issuing and Paying Agent, The Bank of New York Mellon, London Branch, 160 Queen Victoria Street, London EC4V 4LA, England, Attention: Manager, EMEA Corporate & Sovereign Department; and (iii) viewed on the website of the Regulatory News Service operated by the London Stock Exchange at http://www.londonstockexchange.com/exchange/news/market-news/market-news-home.html under the name of the Issuer and the headline "Publication of Prospectus". Copies of the Issuer's periodic financial reporting can also be viewed by accessing the Issuer's disclosure documents through the internet on the Canadian System for Electronic Document Analysis and Retrieval at www.sedarplus.com (an internet-based securities regulatory filing system). Any websites referenced in this 2 nd Supplementary Prospectus other than in respect of the information incorporated by reference are for information purposes only and do not form part of this 2 nd Supplementary Prospectus or the Base Prospectus and the FCA has neither scrutinised nor approved the information contained therein.

CAUTION REGARDING FORWARD-LOOKING STATEMENTS

The section entitled "CAUTION REGARDING FORWARD-LOOKING STATEMENTS" on pages 12 to 13 of the Original Base Prospectus is deleted and replaced with the following:

"From time to time, the Issuer makes written or oral forward-looking statements within the meaning of certain securities laws, including the "safe harbour" provisions of the United States Private Securities Litigation Reform Act of 1995 and any applicable Canadian securities legislation. The Issuer may make forward-looking statements in this Base Prospectus and in the documents incorporated by reference herein, in filings with Canadian regulators, the United States Securities and Exchange Commission, other securities regulators or, in other reports to shareholders, and in other communications. In addition, representatives of the Issuer may communicate forward-looking statements orally to analysts, investors, the media and others. Forward-looking statements in this Base Prospectus and in the documents incorporated by reference herein include, but are not limited to, statements relating to the Issuer's financial performance objectives, priorities, vision and strategic goals, the economic, market, and regulatory review and outlook for Canadian, U.S., United Kingdom (U.K.), Euro area and global economies, the regulatory environment in which the Issuer operates, the "Strategic priorities" and "Outlook" sections of the Issuer's 2025 MD&A contained in the Issuer's 2025 Annual Report (as defined in the section entitled "Documents Incorporated by Reference") for each of the Issuer's business segments, the risk environment including the Issuer's credit risk, market risk, liquidity and funding risk as well as the effectiveness of the Issuer's risk monitoring, its climate- and sustainability-related beliefs, targets and goals and related legal and regulatory developments, and include statements made by the Issuer's President and Chief Executive Officer and other members of management. The forward-looking statements contained in this Base Prospectus and in the documents incorporated by reference herein represent the views of the Issuer's management and are presented for the purpose of assisting the holders and potential purchasers of Notes issued by the Issuer and financial analysts in understanding the Issuer's financial position and results of operations as at and for the periods ended on the dates presented, as well as the Issuer's financial performance objectives, vision, strategic goals and priorities and anticipated financial performance, and may not be appropriate for other purposes. Forward-looking statements are typically identified by words such as "believe", "expect", "suggest", "seek", "foresee", "forecast", "schedule", "anticipate", "intend", "estimate", "goal", "commit", "target", "objective", "plan", "outlook", "timeline" and "project" and similar expressions of future or conditional verbs such as "will", "may", "might", "should", "could", "can", "would" or negative or grammatical variations thereof.

By their very nature, forward-looking statements require the Issuer to make assumptions and are subject to inherent risks and uncertainties, both general and specific in nature, which give rise to the possibility that the Issuer's predictions, forecasts, projections, expectations or conclusions will not prove to be accurate, that the Issuer's assumptions may not be correct, that the Issuer's financial performance, environmental & social or other objectives, vision and strategic goals will not be achieved, and that the Issuer's actual results may differ materially from such predictions, forecasts, projections, expectations or conclusions.

The Issuer cautions readers not to place undue reliance on the Issuer's forward-looking statements as a number of risk factors could cause the Issuer's actual results to differ materially from the expectations expressed in such forward-looking statements. These factors – many of which are beyond the Issuer's control and the effects of which can be difficult to predict – include, but are not limited to: business and economic conditions in the geographic regions in which the Issuer operates, Canadian housing and household indebtedness, information technology, cyber and third-party risks, geopolitical uncertainty, environmental and social risk, digital disruption and innovation, privacy and data related risks, regulatory changes, culture and conduct risks, credit, market, liquidity and funding, insurance, operational, compliance, reputation and strategic risks, other risks discussed in the risk sections of the Issuer's 2025 Annual Report, including legal and regulatory environment risk, the effects of changes in government fiscal, monetary and other policies, tax risk and transparency, credit, market, liquidity and funding, insurance, operational, compliance, reputation and strategic risks, other risks discussed in the risk sections of the Issuer's 2025 Annual Report, including legal and regulatory environment risk, and the Issuer's ability to anticipate and successfully manage risks arising from all of the foregoing factors. Additional factors that could cause actual results to differ materially from the expectations in such forward-looking statements can be found in the risk sections of the Issuer's 2025 MD&A contained in the Issuer's 2025 Annual Report and incorporated by reference herein, as may be updated by the Issuer's subsequent quarterly reports.

The Issuer cautions that the foregoing list of risk factors is not exhaustive and other factors could also adversely affect the Issuer's results. When relying on the Issuer's forward-looking statements to make decisions with respect to the Issuer, investors and others should carefully consider the foregoing factors and other uncertainties and potential events, as well as the inherent uncertainty of forward-looking statements. Material economic assumptions underlying the forward-looking statements contained in this Base Prospectus and in the documents incorporated by reference herein are set out in the Economic, market and regulatory review and outlook section and for each business segment under the Strategic priorities and Outlook sections of the Issuer's 2025 MD&A contained in the Issuer's 2025 Annual Report which sections are incorporated by reference herein and, as such sections may be updated by the Issuer's subsequent quarterly reports. Any forward-looking statements contained in this Base Prospectus and in the documents incorporated by reference herein represent the views of management only as of the date hereof, and except as required by law, the Issuer, any dealer appointed in relation to any issue of Notes by the Issuer or any other person do not undertake to update any forward-looking statement, whether written or oral, that may be made from time to time by the Issuer or on the Issuer's behalf.

Additional information about these and other factors can be found in the risk sections of the Issuer's 2025 MD&A contained in the Issuer's 2025 Annual Report, as may be updated by the Issuer's subsequent quarterly reports."

RISK FACTORS

The current risk factors under the section entitled "Risks relating to the Issuer" in the Registration Document, which Registration Document is incorporated by reference in the Original Base Prospectus, are deleted and replaced by the risks relating to the Issuer set out below. For the avoidance of doubt, all revisions to the risk factors noted herein are only for the purposes of the Base Prospectus and do not constitute a supplement to the Registration Document itself.

"1. Top and emerging risks

An important component of the Issuer's risk management approach is to seek to ensure that top and emerging risks, as they evolve, are identified, managed, and incorporated into the Issuer's existing risk management assessment, measurement, monitoring and escalation processes and addressed in the Issuer's risk frameworks and policies. These practices are intended to ensure a forward-looking risk assessment is maintained by management in the course of business development and as part of the execution of ongoing risk oversight responsibilities. Top and emerging risks are discussed by the Issuer's senior management and the Board on a regular basis.

The Issuer has developed supplementary internal guidance to support enterprise-wide identification and assessment of all material risks, including those that are not readily apparent. Top and emerging risks encompass those that could materially impact the Issuer's financial results, financial and operational resilience, reputation, business model or strategy, as well as those that may materially impact the Issuer as the risks evolve.

The table below sets out the risk factors that the Issuer currently considers its top and emerging risks, but it should be highlighted that the risks set out in these tables are not exhaustive and investors should consider all the risk factors disclosed in this Risk Factors section.

Top & emerging risks	Description
----------------------	-------------

1.1 Business and economic conditions

The Issuer's financial results are affected to varying degrees by the general business and economic conditions in the geographic regions in which the Issuer operates. These conditions may include factors such as: economic growth or contraction trends, consumer saving and spending habits; consumer and corporate borrowing and repayment patterns; unemployment rates; the differing economic trajectories among nations across the globe; global tensions and geopolitical uncertainty and conflicts; the level of business investment and overall business sentiment; trade policy developments; the emergence of a new pandemic outbreak or other health crisis; the level of government spending, including developments relating to tariffs and trade agreements, as well as fiscal and monetary policy; the level of activity and volatility of the financial markets; disruptions to energy and other commodity markets; competitiveness; supply chain challenges and labour shortages; the evolution of inflationary pressures; and possible stagflation or deflation. Moreover, interest rate changes and actions taken by central banks to manage inflation, deflation or the broader economy have implications for the Issuer. The Issuer's financial results are sensitive to changes in interest rates, as described in the "Government fiscal, monetary and other policies" section below.

For example, certain sectors, economies and markets have been adversely impacted by uncertainty generated by geopolitical shocks, such as protectionist trade policy developments, which continue to evolve. In addition, governments may face increasing fiscal challenges due to high debt-loads, ongoing deficits, higher spending pressures, and changing demographic and immigration trends. These fiscal challenges may limit future crisis response tools for governments and lead to higher taxes, spending cuts and adverse economic, market, credit and/or liquidity impacts. Moreover, monetary policy uncertainty, due to central bank challenges through a period of potential trade- or supply-related inflationary pressures, could increase economic, credit and market risks.

A slowdown in economic growth or an economic downturn could adversely impact employment rates and household incomes, consumer spending, housing prices, corporate earnings and business investment, all of which could adversely affect the Issuer's business, including, but not limited to, the demand for its loan and other products, and result in lower earnings and higher credit losses. There are also emerging risks related to technological developments and wealth and income inequality, as well as the broader implications of changing demographics and immigration, which could impact the labour market, productivity, the housing market, inflation, demand and consumer trends, and potentially have widespread societal and government policy implications.

1.2 Canadian housing and household indebtedness

Canadian housing and household indebtedness risks remain heightened given the current uncertain economic environment and affordability challenges. Risks around the ability of Canadian households to meet debt obligations could escalate if interest rates rise materially, if there is a resurgence in inflation or if the job market deteriorates significantly amidst economic and other geopolitical uncertainty, potentially resulting in, among other things, higher credit losses or reduced housing market activity. Moreover, elevated interest rates, slowing economic growth or an economic downturn could further adversely impact housing market activity and housing prices, which could push loan-to-value ratios higher and further increase credit losses in impacted regions.

While interest rates have started to decline, Canadian real estate activity generally remains soft, with some markets showing signs of recovery. Challenging affordability conditions and an increase in condominium supply and construction costs may have an adverse impact on future real estate investment and demand. The combination of multiple challenges, including but not limited to elevated home prices, high debt levels, an increasingly high cost of living, a rising unemployment rate and government policy uncertainty (e.g., immigration policy), may make key Canadian housing markets particularly vulnerable to a potential economic shock or financial instability. As at October 31, 2025, the Issuer's retail credit risk exposure, which includes residential mortgages, home equity lines of credit, credit cards, unsecured lines of credit and overdraft protection products, was C\$867,590 million reflecting exposure at default.

Failure to effectively manage these risks may have a negative impact on the Issuer's financial performance, condition and prospects.

1.3 Information technology, cyber and third-party risks

Information technology risk, cyber risk and third-party risk remain top risks, not only for the financial services sector, but for other industries worldwide. Geopolitical tensions have increased the risk of nation state actors attacking critical infrastructure, including banks and critical third parties.

Information technology risk is the risk associated with the use, ownership, operation and adoption of information systems that can result in business interruptions, client service disruptions and loss of confidential information causing financial loss, reputational damage and regulatory fines and penalties.

Cybersecurity risk is the risk to the Issuer associated with cyberattacks initiated to disrupt or disable its operations or to expose or damage data. The Issuer continues to be subject to heightened inherent risk of cyberattacks, data breaches, cyber extortion and similar compromises, due to: (i) the size, scale and global nature of its operations; (ii) its heavy reliance on the internet to conduct dayto-day business activities; (iii) its intricate technological infrastructure; and (iv) its reliance on third-party service providers.

Third-party risk is a risk that arises if and when there is a failure to effectively manage third parties which may expose the Issuer to service disruptions, regulatory action, financial loss, litigation or reputational damage. The Issuer's exposure to information technology, cyber and third-party risks increases as it continues to partner with third-party service providers and adopt new business models and technologies (e.g., cloud computing, software-as-aservice ("SAAS"), generative artificial intelligence ("GenAI") and machine learning). Threat actors gravitate towards vulnerabilities in an ecosystem, and the weakest link in the supply chain can be a supplier or third-party service provider that may not have sufficiently robust controls. Other key drivers of third-party risk include global economic pressures related to inflation, and concentration of suppliers and fourth parties (i.e., suppliers of the Issuer's third-party providers) within the broader supply chain. Third-party providers critical to the Issuer's operations are actively monitored for impacts on their ability to deliver services to the Issuer, including impacts resulting from fourth parties.

Ransomware threats continue to grow in sophistication and ransomware is being used to launch major supply chain attacks. Resulting implications could include business interruptions, client service disruptions, financial loss, theft of intellectual property and confidential information, litigation, enhanced regulatory attention and penalties, as well as reputational damage. Furthermore, the adoption of emerging technologies, such as cloud computing; AI, including GenAI; and robotics, call for continued focus and investment to manage risks effectively.

Failure to effectively manage these risks may have an adverse impact on the Issuer's financial performance and condition.

1.4 Geopolitical uncertainty Elevated geopolitical risks and tensions, particularly from global fragmentation, U.S. policy uncertainty, and recent and future traderelated developments, could continue to impact economies, markets and the Issuer's financial and non-financial risks.

Tensions remain elevated between China and the U.S. and its allies over issues, including trade, technology, human rights, Taiwan, Hong Kong and Macau. Moreover, these trade tensions produce additional vulnerabilities to the Canadian economy given the country's trading relationships with the U.S. and China, Canada's two largest trading partners. Tensions between China and its neighbours over territorial claims, and the prospect of even closer relations between China, Russia, Iran and North Korea, add further global and economic uncertainty. Additionally, continued weakening in the Chinese economy could negatively impact global economic growth.

The Russia-Ukraine conflict has continued to produce turmoil in the geopolitical landscape, with ongoing impacts to the global economy and markets. Despite recent diplomatic efforts, the duration and path of the conflict remains uncertain and could continue to exacerbate global tensions, energy and other commodity shortages, supply chain disruptions, inflationary pressures, weakening sentiment and growth prospects, market volatility, cyberattacks and the proliferation of sanctions and trade measures. In particular, European countries continue to face uncertainty given their potential exposure to the conflict and to U.S. foreign policy changes, including through the countries' military and trade relationships with impacted regions.

Geopolitical tensions in the Middle East and other regions could also add to economic and market uncertainties. For example, ongoing tensions related to Iran's nuclear program or those between Israel and Iran and its proxies could broaden or escalate. This could destabilize global security, markets and economic growth, along with key commodity markets. In addition, an uncertain geopolitical or economic environment could lead to increases in polarization, social unrest or terrorism, each of which could have direct or indirect impacts to the Issuer.

More broadly, the future of global trade remains uncertain, as countries look to decrease reliance on the global supply chain and nations with differing values. Increased global polarization; protectionist measures, including protectionist trade policies, the imposition of tariffs and the re-negotiation of trade agreements; and economic nationalism could reshape global alliances and financial systems as the supply of critical goods of economic and national importance (e.g., energy, critical minerals, semiconductors) remains one of the top priorities of governments. Furthermore, a volatile geopolitical environment could generate an increase in espionage and foreign interference activities that indirectly or directly impact the financial services sector. The Issuer will continue to monitor these developments and others, and will assess the implications they have on the Issuer.

Failure to effectively manage this risk may adversely impact the Issuer's financial performance, position and prospects.

1.5 Environmental and social (E&S) risk

Environmental and social ("E&S") risk is the risk of negative impacts in the short-, medium-, or long-term on the Issuer's financial results, financial and operational resilience, reputation, business model or strategy resulting from E&S risk factors which can arise from the Issuer, a client or a third-party. Because different stakeholders and communities may have divergent views on E&S issues, any actual or perceived action or inaction by the Issuer in the management of an E&S issue may be perceived negatively by at least some stakeholders and, as a result, may increase the Issuer's E&S risk.

E&S risk factors include, but are not limited to, climate change, site contamination, waste management, land and resource use, biodiversity, water quality and availability, environmental regulation, human rights (including, but not limited to, Indigenous Peoples' rights) and community engagement.

E&S risks are unique and transverse in nature and may impact the Issuer's principal risks in different ways and to varying degrees, including but not limited to strategic, operational, credit and compliance risks.

Failure to effectively manage these risks could lead to negative financial impacts.

The Issuer defines climate-related risk as the potential negative impacts of climate change on its financial results, financial and operational resilience, reputation, business model or strategy. Climate-related risk is categorized into transition risk and physical risk. Transition risk is defined as the risks related to the process of adjustment towards a low-carbon economy. These risks can emerge from current or future government policies, legislation, and regulation to limit carbon emissions as well as technological advancements, and changes in market and customer sentiment towards a lowcarbon economy. Physical risk is defined to include the risks from the increasing severity and frequency of climate-related extremes and events (i.e., acute physical risks), longer-term gradual shifts of the climate (i.e., chronic physical risks) and indirect effects of climate change, such as public health implications (e.g., morbidity and mortality impacts).The Issuer has made sustainability-related commitments that form part of its broader approach to managing E&S risks and opportunities. The Issuer may be exposed to legal, regulatory or reputational impacts for making or not fully meeting the sustainability-related commitments, goals and targets either as a result of its own actions or due to external factors, which could cause the Issuer's actual results to differ materially from the Issuer's expectations expressed in such objectives. More specifically, the Issuer's ability to achieve its sustainability-related commitments, goals and targets will depend on the collective efforts and actions across a wide range of stakeholders outside of its control, and there can be no assurance that they will be achieved. In addition, the Issuer's sustainability-related commitments, goals and targets are aspirational and may need to be changed, or recalibrated in response to these external factors or as data improves and as climate science, transition pathways and market practices regarding standards, methodologies, metrics and measurements evolve, which may result in the Issuer withdrawing from or modifying the Issuer's membership in certain frameworks, principles and initiatives.

1.6 Digital disruption and innovation

As the demand for digital banking services grows, the need to meet the rapidly evolving needs of clients and compete with traditional and non-traditional competitors has increased the Issuer's strategic and reputation risks. Additional risks continue to emerge as demographic trends, evolving client expectations, the increased power to analyze data and the emergence of disruptors are creating competitive pressures across a number of sectors. Moreover, established technology companies, new competitors, digital assets and other products and regulatory changes continue to foster new business models that could challenge traditional banks and financial products. The regulatory landscape of digital assets, in particular as it relates to stablecoins, has evolved materially in the past year across multiple jurisdictions. The Issuer is closely monitoring and assessing emerging risks associated with wider adoption of stablecoins by the market and the related regulatory requirements. Finally, while the adoption of new technologies, such as AI (including GenAI) and machine learning, presents opportunities for the Issuer, it is resulting or could result in new and complex strategic, operational, regulatory, compliance and related reputational risks that would need to be managed effectively. Not managing these risks may adversely impact the Issuer's financial performance and condition.

1.7 Privacy and data related risks Information management risk is the risk of failing to manage information appropriately through its lifecycle due to inadequate processes, controls and technology, resulting in legal and regulatory consequences, reputational damage and/or financial loss.

Privacy risk is defined as the risk of improper creation or collection, use, disclosure, retention or destruction of personal information ("PI"), including the failure to safeguard PI against unauthorized access. PI is information entrusted to the Issuer that identifies an individual or can be reasonably used to identify an individual. PI can relate to current, former and prospective clients, employees and contractors. The protection and responsible use of PI are critical to maintaining the Issuer's clients' trust. In addition, the management and governance of the Issuer's data also remains a top risk given the

high value attributed to its data for the insights it can generate for clients and communities.

Resulting implications from failing to manage data and privacy risks could include financial loss, theft of intellectual property and/or confidential information, litigation, enhanced regulatory attention and penalties, reputational damage and damaged client and employee trust. With the proliferation of artificial intelligence ("AI"), privacy regulators globally have begun issuing guidance around ensuring appropriate use of AI when processing personal information, in addition to guardrails around transparency and ensuring the rights of the individual are respected in the context of AI systems. Adherence to these guidelines and guardrails and trusted integration into existing privacy programs continues to be a focal area for the Issuer.

1.8 Regulatory changes The ongoing introduction of new or revised regulations requires enhanced focus across the organization on meeting additional or modified regulatory requirements and expectations across the multiple jurisdictions in which the Issuer operates. See business segment results on pages 32 to 59 of the 2025 MD&A incorporated by reference in the Base Prospectus for information on the Issuer's business segments and the jurisdictions in which it operates. Regulatory reforms that have been implemented or are being implemented across multiple jurisdictions, such as in areas of digital and operational resilience, data and technology reforms, including AI, cyber security, capital, anti-money laundering and consumer protection continue to impact the Issuer's operations and strategies. Not managing this risk may negatively impact the Issuer's financial performance, condition and prospects.

1.9 Culture and conduct risks The Issuer's purpose, vision, values and risk management principles define its culture. The Issuer demonstrates its culture through its conduct – the behaviours, decisions and actions or inactions of the organization and its employees. Culture and conduct risks are considered top risks for the financial services industry due to the impact the Issuer's choices, behaviours, and overall risk governance can have on outcomes for its clients, shareholders and other stakeholders. The Issuer embeds client considerations into its decision-making processes and continues to focus on the fair treatment of clients which also aligns with regulatory direction. The Issuer seeks to be responsive to evolving employee needs while expecting employees to always act with integrity.

Regulators continue to focus on conduct risks, and heightened expectations generally from regulators could lead to investigations, remediation requirements, higher compliance costs and enforcement actions and fines, and potential criminal prosecutions or imposition of sanctions, which may involve prohibitions or restrictions on some of the Issuer's activities. While the Issuer takes

steps to continue to strengthen its conduct practices and prevent and detect risk outcomes that are not in keeping with the Issuer's responsibilities to its stakeholders, such outcomes may not always be prevented or detected. Failure to effectively manage these risks may negatively impact the Issuer's financial position and performance as well as its prospects.

2. Principal risks

2.1 Credit risk

Credit risk is the risk of loss associated with an obligor's potential inability or unwillingness to fulfill its contractual obligations on a timely basis and may arise directly from the risk of default of a primary obligor of the Issuer (e.g., issuer, debtor, counterparty, borrower or policyholder), indirectly from a secondary obligor of the Issuer (e.g., guarantor or reinsurer), and/or through off-balance sheet exposures, contingent credit risk, associated credit risk and/or transactional risk exposures. Credit risk includes counterparty credit risk arising from both trading and non-trading activities. Exposure to credit risk occurs any time funds are extended, committed or invested through an actual or implied contractual agreement.

Credit risk is inherent in a wide range of the Issuer's businesses. This includes lending to businesses, sovereigns, public sector entities, banks and other financial institutions, as well as certain high net worth individuals, which comprise the Issuer's wholesale portfolio and residential mortgages, personal loans, credit cards, and small business loans, which comprise the Issuer's retail portfolio.

The Issuer's gross credit exposure includes lending-related and other credit risk and trading-related credit risk. Lending-related and other credit risk includes: loans and acceptances outstanding, undrawn commitments, and other exposures, including contingent liabilities such as letters of credit and guarantees, debt securities carried at fair value through other comprehensive income ("FVOCI") or amortized cost and deposits with financial institutions. Trading-related credit risk includes: repo-style transactions, which include repurchase and reverse repurchase agreements and securities lending and borrowing transactions, and derivative amounts. The Issuer's gross credit risk exposure as at October 31, 2025 was C\$2,272,558 million. See the table "Credit Risk exposure by portfolio, sector and geography" on page 77 of the 2025 MD&A incorporated by reference in the Base Prospectus for further information.

Credit risk also includes (i) counterparty credit risk; and (ii) wrong-way risk. Counterparty credit risk is the risk that a party with whom the Issuer has entered into a financial or non-financial contract will fail to fulfil its contractual agreement and default on its obligation. It incorporates not only the contract's current value, but also considers how that value can move as market conditions change. Counterparty credit risk usually arises from trading-related derivatives and repo-style transactions. Derivative transactions include forwards, futures, swaps and options, and can have underlying references that are either financial (e.g., interest rate, foreign exchange, credit or equity) or non-financial (e.g., commodities). For more information on derivatives instruments and credit risk mitigation, see pages 75 to 76 and Note 9 of the 2025 Audited Consolidated Financial Statements incorporated by reference into the Base Prospectus.

Wrong-way risk is the risk that exposure to a counterparty is adversely correlated with the credit quality of that counterparty. There are two types of wrong-way risk: (i) specific wrong-way risk, which exists when the Issuer's exposure to a particular counterparty is positively correlated with the probability of default of the counterparty due to the nature of the Issuer's transactions with them (e.g., loans collateralized by shares or debt issued by the counterparty or a related party); and (ii) general wrong-way risk, which exists when the Issuer's exposure to a particular counterparty is positively correlated with the probability of default of the counterparty due to general macroeconomic or market factors. General wrong-way risk can arise in various circumstances, depending on the transaction, collateral type, and the nature of the counterparty.

Geographically, as at October 31, 2025, Canada represented approximately 60.4% of the Issuer's credit risk exposure while the U.S. represented 27.3%, Europe 6.9% and the other international regions 5.4% Accordingly, deterioration in general business and economic conditions in Canada and the U.S. could adversely affect the credit quality of the Issuer's borrowers and counterparties and could thus affect the value of the Issuer's assets and result in an increase in credit losses.

The Issuer has put in place specific frameworks to manage credit risk. See pages 72 to 82 of the 2025 MD&A incorporated by reference in the Base Prospectus for more information. Notwithstanding such frameworks, the Issuer recorded provisions for credit losses ("PCL") to recognize estimated credit losses on all financial assets, except for financial assets classified or designated as fair value through profit or loss ("FVTPL") and equity securities designated as FVOCI, which are not subject to impairment assessment. For the year ended October 31, 2025, the Issuer's total PCL was C\$4,362 million. See the Credit quality performance section on page 81 of the 2025 MD&A incorporated by reference in the Base Prospectus.

Failure to effectively manage credit risk may have an adverse impact on the Issuer's financial condition and performance.

2.2 Market risk

Market risk is defined to be the impact of market prices upon the Issuer's financial condition. This includes potential gains or losses due to changes in market-determined variables such as interest rates, credit spreads, equity prices, commodity prices, foreign exchange rates and implied volatilities.

The Issuer has adopted specific frameworks to manage market risk as described on pages 83 to 88 of the 2025 MD&A incorporated by reference in the Base Prospectus. Despite these frameworks, the Issuer remains exposed to the risk of loss as a result of market risk which may negatively impact its financial performance and condition.

The measures of financial condition impacted by market risk include the following:

• 1. Positions whose revaluation gains and losses are reported in revenue, which includes:
• a) Changes in the fair value of instruments classified or designated as FVTPL, and
• b) Hedge ineffectiveness.
• 1. Common Equity Tier 1 ("CET1") capital, which includes:
• a) All of the above, plus
• b) Changes in the fair value of FVOCI securities where revaluation gains and losses are reported as other comprehensive income ("OCI"),
• c) Changes in the Canadian dollar value of investments in foreign subsidiaries, net of hedges, due to foreign exchange translation, and

• d) Changes in the fair value of employee benefit plan deficits.

• 1. CET1 ratio, which includes:
• a) All of the above, plus
• b) Changes in Risk-weighted assets ("RWA") resulting from changes in traded market risk factors, and
• c) Changes in the Canadian dollar value of RWA due to foreign exchange translation.
• 1. The economic value of the Issuer, which includes:
• a) Points 1 and 2 above, plus
• b) Changes in the economic value of other non-trading positions, net interest income and fee based income, as a result of changes in market risk factors.

2.2.1 The key measures of market risk are as follows:

(a) FVTPL positions

FVTPL is an accounting concept which indicates that the assets and liabilities are measured at fair value on the balance sheet. The measurement is generally used for financial instruments that are part of the Issuer's trading activities (purchased with intent to sell or repurchase) and are classified as FVTPL, but can be elected for financial assets if it eliminates or significantly reduces a measurement or recognition inconsistency that would otherwise arise from measuring assets or liabilities, or recognizing related gains and losses on a different basis (an accounting mismatch).

The fair value option can be elected for financial liabilities if: (i) the election eliminates an accounting mismatch; (ii) the financial liability is part of a portfolio that is managed on a fair value basis, in accordance with a documented risk management or investment strategy; or (iii) there is an embedded derivative in the financial or non-financial host contract and the derivative is not closely related to the host contract. These instruments cannot be reclassified out of the FVTPL category while they are held or issued. Any loss or gain in the fair value of these instruments between quarterly balance sheet dates due to changes in market prices and rates are accounted for as losses or gains, and so directly impact the Issuer's financial performance and condition. Financial liabilities designated as FVTPL are recorded at fair value and fair value changes attributable to changes in the Issuer's own credit risk are recorded in OCI. See "Fair value of financial instruments" on page 121 and "Securities" on page 151 of the 2025 Annual Report incorporated by reference in the Base Prospectus for more information on how fair value is determined.

As an element of the Enterprise Risk Appetite Framework, the Board approves the Issuer's overall market risk appetite. The Market and Counterparty Credit Risk function within Group Risk Management ("GRM") is responsible for creating and managing the controls and governance procedures that are designed to ensure that risk taken is consistent with risk appetite constraints set by the Board. These controls include limits on probabilistic measures of potential loss such as Value-at-Risk and Trading VaR as defined below:

"Trading VaR" captures potential loss for the Issuer's trading portfolio that excludes the impacts of nontrading FVTPL positions such as loan underwriting commitments. Total VaR captures potential loss for all positions classified as FVTPL.

"VaR" is a statistical measure of potential loss for a financial portfolio computed at a given level of confidence and over a defined holding period. The Issuer measures VaR at the 99th percentile confidence level for price movements over a one-day holding period using historic simulation of the last two years of equally weighted historic market data. These calculations are updated daily with current risk positions, with the exception of certain less material positions that are not actively traded which are updated on at least a monthly basis.

Average market risk VaR and Trading VaR for the year ended October 31, 2025 was C\$36 million (decreased C\$34 million from C\$70 million for the year ended October 31, 2024) and C\$25 million (decreased C\$4 million from C\$29 million for the year ended October 31, 2024), respectively. See the table under "Market risk measures — FVTPL positions, including trading portfolios" on page 84 of the 2025 MD&A which is incorporated by reference in the Base Prospectus for more information on the quantitative impact of market risk on FVTPL positions for the year ended October 31, 2025.

(b) Interest Rate Risk in the Banking Book ("IRRBB") positions

IRRBB arises primarily from traditional customer-originated banking products such as deposits and loans, and includes related hedges and the interest rate risk from securities held for liquidity and cash management purposes. Factors contributing to IRRBB include mismatches between asset and liability repricing dates, relative changes in asset and liability rates in response to market rate scenarios, and other product features affecting the expected timing of cash flows, such as options to pre-pay loans or redeem term deposits prior to contractual maturity. IRRBB sensitivities are regularly measured and reported, and subject to limits and controls with independent oversight from GRM.

To monitor and control IRRBB, the Issuer assesses two primary metrics, Net Interest Income ("NII") risk and Economic Value of Equity ("EVE") risk, under a range of market shocks, scenarios, and time horizons. Market scenarios include currency-specific parallel and non-parallel yield curve changes, interest rate volatility shocks, and interest rate scenarios prescribed by regulators. The table on page 86 of the 2025 MD&A show the potential before-tax impact of an immediate and sustained 100 basis points ("bps") increase or decrease in interest rates on projected EVE and 12-month NII, assuming no subsequent hedging. Interest rate risk measures are based on current on and off-balance sheet positions which can change over time in response to business activity and management actions.

As at October 31, 2025, an immediate and sustained -100 bps shock would have had a negative impact to the Issuer's NII of C\$373 million, down from C\$502 million last year, and an immediate and sustained +100 bps shock would have had a negative impact to the Issuer's EVE of C\$2,648 million, up from C\$2,076 million last year.

(c) Investment securities carried at FVOCI

Investment securities carried at FVOCI are primarily debt securities. The Issuer holds debt securities primarily as investments, as well as to manage liquidity risk and hedge interest rate risk in its banking book balance sheet. While debt securities held by RBC Insurance are managed separately, all other debt securities carried at FVOCI are included in the Issuer's IRRBB measures. For further details on the investment securities carried at FVOCI, refer to Notes 2 and 4 of the 2025 Audited Consolidated Financial Statements incorporated by reference into the Base Prospectus

(d) Non-trading foreign exchange rate risk

Foreign exchange rate risk is the potential adverse impact on earnings and economic value due to changes in foreign currency rates. The Issuer's revenue, expenses and income denominated in currencies other than the Canadian dollar are subject to fluctuations as a result of changes in the value of the average Canadian dollar relative to the average value of those currencies. The Issuer's most significant exposure is to the U.S. dollar, due to the Issuer's operations in the U.S. and other activities conducted in U.S. dollars. The Issuer's other significant exposure is to the British pound due to the Issuer's activities conducted internationally in this currency. A strengthening or weakening of the Canadian dollar compared to the U.S. dollar and British pound could reduce or increase, as applicable, the translated value of the Issuer's foreign currency denominated revenue, expenses and earnings and could have a significant effect on the results of the Issuer's operations. The Issuer is also exposed to foreign exchange rate risk arising from its investments in foreign operations. For unhedged equity investments, when the Canadian dollar appreciates against other currencies, the unrealized translation losses on net foreign investments decreases the Issuer's shareholders' equity through the other components of equity and decreases the translated value of the RWA of the foreign currencydenominated asset. The reverse is true when the Canadian dollar depreciates against other currencies. Consequently, the Issuer considers these impacts in selecting an appropriate level of its investments in foreign operations to be hedged.

2.3 Liquidity and funding risk

Liquidity and funding risk ("liquidity risk") is the risk that the Issuer may be unable to generate sufficient cash or its equivalents in a timely and cost-effective manner to meet its commitments. Liquidity risk arises from mismatches in the timing and value of on-balance sheet and off-balance sheet cash flows.

Core funding, comprising capital, longer-term wholesale liabilities and a diversified pool of personal as well as the stable portion of the Issuer's commercial and institutional deposits, is the foundation of the Issuer's structural liquidity position.

The Issuer's ability to access unsecured funding markets and to engage in certain collateralized business activities on a cost-effective basis are largely dependent on maintaining competitive credit ratings. Credit ratings and outlooks provided by rating agencies reflect their views and methodologies. Ratings are subject to change, based on a number of factors including, but not limited to, the Issuer's financial strength, competitive position, liquidity and other factors not completely within the Issuer's control. A lowering of the Issuer's credit ratings may have potentially adverse consequences for the Issuer's funding capacity or access to the capital markets, may affect the Issuer's ability, and the cost, to enter into normal course derivative or hedging transactions and may require the Issuer to post additional collateral under certain contracts, any of which may have an adverse effect on its results of operations and financial condition.

The Liquidity Coverage Ratio ("LCR") is a Basel III metric that measures the sufficiency of high-quality liquid assets ("HQLA") available to meet liquidity needs over a 30-day period in an acute stress scenario. The Basel Committee on Banking Supervision ("BCBS") and Office of the Superintendent of Financial Institutions ("OSFI") regulatory minimum coverage level for LCR is 100%. The Issuer's average LCR for the quarter ended October 31, 2025 was 127%, which translates into a surplus of approximately C\$97 billion, compared to 129% and a surplus of approximately C\$103 billion in the prior quarter. Net Stable Funding Ratio ("NSFR") is a Basel III metric that measures the sufficiency of available stable funding relative to the amount of required stable funding. The BCBS and OSFI regulatory minimum coverage level for NSFR is 100%. The Issuer's NSFR as at October 31, 2025 was 112%, which translates into a surplus of approximately C\$127 billion, compared to 114% and a surplus of approximately C\$137 billion in the prior quarter. Despite the Issuer's liquidity risk management policy described on pages 88 to 101 of the 2025 MD&A incorporated by reference into the Base Prospectus, any significant deterioration in its liquidity position may lead to an increase in funding costs or constrain the volume of new lending. These factors may adversely impact the Issuer's financial performance and position.

2.4 Insurance risk

Insurance risk refers to the potential financial loss to the Issuer that may arise where the amount, timing and/or frequency of benefit and/or premium payments under insurance and reinsurance contracts are different than expected. Insurance risk is distinct from those risks covered by other parts of the Issuer's risk management framework (e.g., credit, market and operational risk) where those risks are ancillary to, or accompany, the risk transfer. The Issuer's main insurance sub-risks are: morbidity, mortality, longevity, policyholder behaviour (lapse), and travel risk. In addition, the Issuer is subject to expense risk, which is the exposure to the variability in future expenses that are expected to be incurred in servicing insurance contracts. Insurance risk may negatively impact the Issuer's financial performance and condition. See a description of the Issuer's insurance business on pages 50 to 52 of the 2025 MD&A incorporated by reference into the Base Prospectus.

2.5 Operational risk

Operational risk is the risk of loss or harm resulting from people, inadequate or failed internal processes, controls and systems or from external events. Operational risk is inherent in all the Issuer's activities and third-party activities and failure to manage operational risk can result in direct or indirect financial loss, reputational impact or regulatory scrutiny and proceedings in the various jurisdictions where the Issuer operates.

Notwithstanding anything in this risk factor, this risk factor should not be taken as implying that the Issuer will be unable to comply with its obligations as a company with securities admitted to the Official List of the UK Financial Conduct Authority (the "FCA") or as a supervised firm regulated by the FCA or the UK Prudential Regulation Authority (the "PRA").

The Issuer's operations expose it to many different operational risks, which may adversely affect its businesses and financial results. In addition to information technology and cybersecurity risk, information management and privacy risk, and third-party risk, which are also discussed above in "1. Top and emerging risks", the Issuer's results could also be adversely affected by risks associated with financial crimes, business continuity and fraud risk.

Financial crimes risk is the risk that the Issuer's products, services and delivery channels are misused to facilitate the laundering of proceeds of crime, financing of terrorist activity, bribery, corruption and other activities that may violate applicable economic sanctions. The Issuer maintains an enterprise-wide program designed to deter, detect and report suspected money laundering and terrorist financing or suspicious activities across its organization, while seeking to ensure compliance with the laws and regulations of the various jurisdictions in which the Issuer operates. Despite the Issuer's compliance programmes, noncompliance may still occur, leading to enforcement actions (which may involve substantial fines or limitations on the Issuer's business activities), criminal prosecutions and reputational damage which could negatively impact its financial performance and condition.

Business continuity risk is the risk of being unable to maintain, continue or restore essential business operations during and/or after an event that prevents the Issuer from conducting business in the normal course. Exposure to disruptive operational events interrupts the continuity of the Issuer's business operations and could negatively impact the Issuer's financial results, reputation, client outcomes and/or result in harm to the Issuer's employees. These operational events could result from the impact of severe weather, outbreak of a pandemic or other health crisis, failed processes, technology failures or cyber threats.

Fraud risk is the risk of intentional unauthorized activities designed to obtain benefits from the Issuer or assets under the Issuer's care, or from using the Issuer products. Fraud may be perpetrated by external parties (external fraud) or by individuals inside the organization (internal fraud). It typically results in financial loss, reputational damage or other harm to victims and involves intent to deceive for improper or illegal gain. Examples include theft of cash or assets, and unauthorized transactions.

2.6 Compliance risk and legal and regulatory environment risk

2.6.1 Compliance risk

Compliance risk is the risk of potential non-conformance with laws, rules, regulations and prescribed practices in any jurisdiction in which the Issuer operates. Issues regarding compliance with laws and regulations can arise in a number of areas in large complex financial institutions, such as the Issuer, and are often the result of inadequate or failed internal processes, controls, people or systems. The Issuer currently is, and may be at any given time, subject to legal and regulatory proceedings and subject to governmental and regulatory examinations, investigations and other inquiries.

Laws and regulations are in place to protect the financial and other interests of the Issuer's clients, shareholders and the public. As a large-scale global financial institution, the Issuer is subject to numerous laws and extensive and evolving regulation by governmental agencies, supervisory authorities and selfregulatory organizations in Canada, the U.S., the U.K., Europe and other jurisdictions in which it operates. Such regulation continues to become increasingly extensive and complex. In addition, regulatory scrutiny and expectations in Canada, the U.S., the U.K., Europe and other jurisdictions for large financial institutions with respect to, among other things, governance, risk management practices and controls, and conduct, as well as the enforcement of regulatory compliance matters, has intensified. Failure to comply with these regulatory requirements and expectations or to resolve any identified deficiencies could result in increased regulatory oversight and restrictions. Resolution of such matters can also result in the payment of substantial penalties, agreements with respect to future operation of their business, actions with respect to relevant personnel, admission of wrongdoing, and guilty pleas with respect to criminal charges, which in turn may result in the Issuer being prohibited from conducting certain types of business absent regulatory relief, receipt of which cannot be assured.

Regulatory compliance risk includes the regulatory risks associated with financial crimes (which include, but are not limited to, money laundering, terrorist financing, bribery, corruption and violations of economic sanctions), privacy, market conduct, consumer protection and business conduct, as well as prudential and other generally applicable non-financial requirements. Specific compliance policies, procedures and supporting frameworks have been developed to seek to manage regulatory compliance risk.

The Issuer's Regulatory Compliance Management Framework outlines how it manages and mitigates the regulatory compliance risks associated with failing to comply with, or adapt to, current and changing laws, regulations and expectations in the jurisdictions in which it operates.

Operating in a complex regulatory environment and intense regulatory enforcement environment, the Issuer is and has been subject to a variety of legal proceedings, including civil claims and lawsuits, criminal charges, regulatory scrutiny, examinations and proceedings, investigations, audits and requests for information by various governmental regulatory agencies and law enforcement authorities in various jurisdictions (see Notes 21 and 24 of the 2025 Audited Consolidated Financial Statements which is incorporated by reference in the Base Prospectus, for information on current tax examinations and assessments as well as legal and regulatory matters), and the Issuer anticipates that its ongoing business activities will give rise to such matters in the future. The global scope of the Issuer's operations also means that a single issue may give rise to overlapping regulatory investigations, regulatory proceedings, or civil litigation claims and/or criminal prosecutions in different jurisdictions. The Issuer can be subject to such proceedings due to alleged violations of law or, if determined by regulators, allegedly inadequate policies, procedures, controls or remediation of deficiencies. Changes to laws, including tax laws, regulations or regulatory policies, as well as the changes in how they are interpreted, implemented or enforced, could adversely affect the Issuer, for example, by lowering barriers to entry in the businesses in which it operates, increasing its costs of compliance, or limiting its activities and ability to execute its strategic plans. In addition, the severity of the remedies sought in legal and regulatory proceedings to which the Issuer is subject have increased. Further, there is no assurance that the Issuer always will be, or be deemed to be, in compliance with laws, regulations or regulatory policies or expectations. Accordingly, it is possible that the Issuer could receive a judicial or regulatory enforcement judgment or decision that results in significant fines, damages, penalties, and other costs or injunctions, criminal convictions, or loss of licenses or registrations that would damage its reputation and negatively impact its earnings and ability to conduct some of its businesses. The Issuer may also be subject to litigation arising in the ordinary course of its business and the adverse resolution of any litigation could have a significant adverse effect on its results or could give rise to significant related reputational damage, which in turn could impact its future business prospects.

2.6.2 Legal and regulatory environment risk

Legal and regulatory environment risk is the risk that new or modified laws and regulations, and the interpretation or application of laws and regulations, will negatively impact the way in which the Issuer operates, both in Canada and in the other jurisdictions in which it conducts business. The full impact of some of these changes on the Issuer's business will not be known until final rules are implemented and market practices have developed in response. The Issuer continues to respond to these and other developments and is working to minimize any potential adverse business or economic impact. The following provides a high-level summary of some of the key regulatory changes that have the potential to increase or decrease the Issuer's costs, impact its profitability and increase the complexity of its operations.

(i) Global uncertainty

In October 2025, the International Monetary Fund ("IMF") projected global growth of 3.2% for 2025, up 0.2% from its July forecast, reflecting an improvement due to easing of trade tensions, which were tempered as a result of trade deals and resets. The IMF projected global growth for calendar 2026 to be 3.1%. The overall global economic outlook remains fragile and tilted to the downside, driven by: failure to reach trade agreements and reliance on ad-hoc bilateral deals, which could lead to a shift away from global economic integration, negatively impact productivity and further hurt growth prospects, especially for emerging markets and developing economies; substantive projected fiscal deficits across major economies, which could lead to upward pressure on long-term interest rates, financial market instability and/or deceleration in growth, along with their associated impact on consumer and business confidence; diverging monetary policies in response to inflationary pressures, which could drive asset repricing, impact foreign exchange rates and capital flows and heighten financial market volatility; shifting global policy priorities, including ongoing uncertainty around U.S. trade, foreign relations, defense and immigration policies, which could disrupt global alliances and heighten economic, market and other risks, and intensifying political pressures on policy institutions and policymaking, which could weaken policy credibility, reduce investor confidence and heighten macroeconomic vulnerabilities; elevated asset valuations, including in technology and AI-linked sectors which could drive abrupt market corrections, dampen investment, tighten financial conditions and weaken business and consumer confidence; an aging demographic in advanced economies, as well as changing immigration policies, which could have an associated long-term impact on labour supply, economic productivity and government fiscal capacity; ongoing conflicts including those between Russia and Ukraine, in the Middle East and Asia, and rising tensions between China and Taiwan, together with increased polarization and social unrest; and extreme weather-related events. While the Issuer's diversified business model, as well as the Issuer's product and geographic diversification, continue to help mitigate the risks posed by global uncertainty, it may still have an adverse impact on the Issuer's financial performance and condition.

(ii) Sustainability-related legal and regulatory activity

Applicable sustainability-related laws, regulations, policies, frameworks, methodologies and guidance continue to evolve in inconsistent ways across the regions in which the Issuer operates. As such, new or heightened requirements could result in increased regulatory, compliance or other costs or higher capital requirements, and may subject the Issuer to different and potentially conflicting policies and requirements in the various jurisdictions in which the Issuer operates. The Issuer continues to monitor the development of applicable laws, regulations, policies, frameworks, methodologies and guidance in this area, including but not limited to the evolution of sustainability disclosure requirements and climate risk management requirements for financial institutions.

In Canada, OSFI's Guideline B-15 Climate Risk Management, issued in March 2023, sets expectations for managing and disclosing climate-related risks. Subsequent updates in 2024 and 2025 aligned disclosure expectations with IFRS S2 Climate-related Disclosures issued by the International Sustainability Standards Board (ISSB) and extended certain implementation timelines to fiscal 2028 and 2029. The Issuer expects to meet upcoming disclosure phases and continue to monitor further developments.

In the U.S., scrutiny of financial institutions relating to environmental and/or social matters, including climate, continues to be heightened at both the federal and state levels, including through statutes, regulations and litigation. As environmental and social issues remain heavily politicized, statutes or regulations in certain states may be interpreted to prohibit governmental entities, such as public pension funds and issuers of municipal bonds, from doing business with certain financial institutions, and political pressure may be placed upon governmental entities to not do business with certain financial institutions, based on the financial institutions' perceived positions on certain environmental and/or social matters. The Issuer continues to monitor developments in this area and assess their impacts on the Issuer's businesses.

In Europe, the European Union's Corporate Sustainability Reporting Directive (the "CSRD") requires reporting under the European Sustainability Reporting Standards (the "ESRS"). The ESRS, which were adopted by the European Commission in July 2023, set out the requirements for companies to report on sustainability-related impacts, opportunities and risks. The Issuer anticipates that it will be subject to reporting obligations under the CSRD from fiscal 2029 at the consolidated level, and is currently assessing the impact of these requirements.

The Issuer continues to monitor the development of applicable anti-greenwashing laws and regulations as well as climate-related litigation and regulatory enforcement actions related to greenwashing, including amendments to the Competition Act (Canada) which came into force on June 20, 2024, and which introduced new anti-greenwashing provisions. These provisions are in addition to the pre-existing provisions of the Competition Act (Canada) that prohibit the making of claims that are materially false or misleading. "Greenwashing" generally refers to the practice of conveying false or misleading information about an organization's products or services or operations to suggest that the organization is doing more to protect the environment than it is.

2.7 Strategic risk

Strategic risk is the risk to earnings, capital or liquidity arising from adverse business decisions, improper implementation of strategic initiatives or inadequate responses to changes in the external operating environment by the Issuer or a particular business unit. To safeguard against unacceptable losses or unintended outcomes, the Issuer integrates risk management practices into the Issuer's strategic, financial and capital planning processes. This integration facilitates informed dialogue during strategic decision making and serves as a foundational element of the Issuer's planning cycle. For more information on the Issuer's strategic goals in each of its business segments, see pages 36 to 37, 41, 44, 51 and 54 to 55 of the 2025 MD&A incorporated by reference into the Base Prospectus.

The Issuer's ability to execute on its objectives and strategic goals will influence its financial performance. If the Issuer is unable to successfully implement selected strategies or related plans and decisions, if the Issuer makes inappropriate strategic choices or if the Issuer makes a change to its strategic goals, its financial performance and condition could be adversely affected.

2.8 Reputation risk

Reputation risk is the risk of an adverse impact on stakeholders' perception of the Issuer due to (i) perceived or actual misalignment between stakeholder perceptions of the Issuer and the actions or inactions of the Issuer, its employees or individuals or groups affiliated with the Issuer, (ii) negative or shifting public sentiment on existing, evolving, or emerging industry or global issuers, or (iii) negative outcomes relating to any risk inherent to the financial services industry, including ineffective management of these risks, or situations beyond the Issuer's control such as external events or systemic risks. A strong and trustworthy reputation will generally strengthen the Issuer's market position, reduce the Issuer's cost of capital, increase shareholder value, attract and retain top talent and help the Issuer weather a crisis. Conversely, damage to the Issuer's reputation can result in reduced share price and market capitalization, loss of strategic flexibility, inability to enter or expand into markets, loss of client loyalty and business, or regulatory fines and penalties. The sources of reputation risk are widespread. Reputation risk is a transverse risk which can manifest as an outcome of other risk types including but not limited to credit, regulatory, legal, operational, and E&S risks. The Issuer can also experience reputation risk from a failure to maintain an effective control environment, exhibit good conduct and maintain appropriate cultural practices.

3. Overview of other risks

In addition to the risks described above, there are other risk factors described below, which may affect the Issuer's businesses and financial results. The following discussion is not exhaustive as other factors could also adversely affect the Issuer's results.

3.1 Government fiscal, monetary and other policies

The Issuer's financial results are also sensitive to changes in interest rates. The Federal Reserve is expected to cut interest rates further in calendar 2026 after reducing interest rates less than other global central banks since 2024, while additional interest rate cuts from the Bank of Canada are not expected. Lower interest rates generally lead to spread compression across many of the Issuer's businesses, resulting in an unfavourable impact on the Issuer's net interest margin ("NIM"), but can also promote economic stimulation and drive higher volumes for the Issuer's business than otherwise would have occurred. Higher interest rates may be a potential benefit to the Issuer's NIM but may adversely impact household balance sheets by causing credit deterioration, hence negatively impacting the Issuer's financial results. If elevated interest rates are coupled with persistent inflation, this could increase market volatility, reduce asset values and adversely impact household and corporate balance sheets. This could lead to credit deterioration and impact the Issuer's financial results, particularly in its Personal Banking, Commercial Banking, Wealth Management and Capital Markets businesses.

The Issuer's businesses and earnings are affected by monetary policies that are adopted by the BoC, the Fed in the U.S., the ECB in the European Union (EU), the BoE in the U.K. and monetary authorities in other jurisdictions in which the Issuer operates. In addition, the Issuer's businesses and earnings may be affected by the fiscal, trade-related and other policies of the governments of Canada, the U.S., the U.K., Europe and such other jurisdictions. Those policies may include protectionist trade policies and the imposition of tariffs, as well as increased deficit spending intended to support economic growth. Such policies can have positive or adverse affects on the Issuer's clients and counterparties in Canada, the U.S. and internationally, which may decrease or increase the risk of default by such clients and counterparties.

3.2 Tax risk and transparency

Tax risk refers to the risk of loss related to unexpected tax liabilities. The tax laws and systems that are applicable to the Issuer are complex and wide-ranging. As a result, the Issuer seeks to ensure that any decisions or actions related to tax always reflect its assessment of the long-term costs and risks involved, including their impact on the Issuer's reputation and its relationship with clients, shareholders and regulators.

The Issuer's tax strategy is designed to provide transparency and support its business strategy, and is aligned with the Issuer's corporate vision and values. The Issuer seeks to maximize shareholder value by structuring its businesses in a tax-efficient manner while considering reputation risk by being in compliance with all laws and regulations. The Issuer's policy requires that it:

• Acts with integrity and in a straightforward, open and honest manner in all tax matters;
• Ensures tax strategy is aligned with the Issuer's business strategy supporting only bona fide transactions with a business purpose and economic substance;
• Ensures all intercompany transactions are conducted in accordance with applicable transfer pricing requirements;
• Ensures the Issuer's full compliance and full disclosure to tax authorities of its statutory obligations; and
• Endeavour to work with the tax authorities to build positive long-term relationships and where disputes occur, address them constructively.

With respect to assessing the needs of its clients, the Issuer considers a number of factors including the purpose of the transactions. The Issuer seeks to ensure that it only supports bona fide client transactions with a business purpose and economic substance. Should the Issuer become aware of client transactions that are aimed at evading their tax obligations, the Issuer will not proceed with the transactions.

Given that the Issuer operates globally, complex tax legislation and accounting principles have resulted in differing legal interpretations by the respective tax authorities the Issuer deals with and itself, and the Issuer is at risk of tax authorities disagreeing with prior positions the Issuer has taken for tax purposes. When this occurs, the Issuer is committed to an open and transparent dialogue with the tax authorities to facilitate a quick assessment and prompt resolution of the issues where possible.

Failure to adequately manage tax risk and resolve issues with tax authorities in a satisfactory manner could adversely impact the Issuer's results, potentially to a material extent in a particular period, and/or significantly impact the Issuer's reputation."

AMENDMENT TO STATEMENT REGARDING GOVERNMENTAL, LEGAL OR ARBITRATION PROCEEDINGS

Paragraph 3 of the section entitled "GENERAL INFORMATION" on page 220 of the Base Prospectus is hereby deleted in its entirety and replaced with the following:

"Other than (i) the matters disclosed under the subsection entitled "Tax examinations and assessments" in Note 21 of the 2025 Audited Consolidated Financial Statements set out on page 227 of the Issuer's 2025 Annual Report, and (ii) the legal and regulatory matters disclosed (with the exception of the subsection entitled "Other matters") in Note 24 of the 2025 Audited Consolidated Financial Statements set out on pages 230 and 231 of the Issuer's 2025 Annual Report and in each case incorporated by reference herein, there are no, nor have there been, any governmental, legal or arbitration proceedings (including any such proceedings which are pending or threatened of which the Issuer is aware) during the twelve months prior to the date of this document which may have, or have had in the recent past, individually or in the aggregate, a significant effect on the financial position or profitability of the Issuer or of the Issuer and its subsidiaries taken as a whole."

STATEMENT OF NO SIGNIFICANT CHANGE AND NO MATERIAL ADVERSE CHANGE

Paragraph 4 under the heading "GENERAL INFORMATION" on page 220 of the Base Prospectus is hereby deleted in its entirety and replaced with the following:

"Since October 31, 2025, the last day of the financial period in respect of which the most recent audited consolidated financial statements of the Issuer have been published, there has been no significant change in the financial position or financial performance of the Issuer and its subsidiaries taken as a whole. Since October 31, 2025, the date of its last published audited annual consolidated financial statements, there has been no material adverse change in the prospects of the Issuer and its subsidiaries taken as a whole."