Contract

1 UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS UNITED STATES OF AMERICA v. STATE STREET CORPORATION, Defendant ) ) ) ) ) ) ) ) ) Criminal No. Violation: Count One: Conspiracy to Commit Wire Fraud (18 U.S.C. § 1349) DEFERRED PROSECUTION AGREEMENT Defendant State Street Corporation (the “Company”), pursuant to the authority granted by the Company’s Board of Directors, and the United States Attorney’s Office for the District of Massachusetts (the “Office”), enter into this deferred prosecution agreement (the “Agreement”). Criminal Information and Acceptance of Responsibility 1. The Company acknowledges and agrees that the Office will file the attached one- count criminal Information (the “Information”) in the United States District Court for the District of Massachusetts charging the Company with conspiracy to commit wire fraud, in violation of Title 18, United States Code, Section 1349. In so doing, the Company: (a) knowingly waives its right to indictment on this charge, as well as all rights to speedy trial pursuant to the Sixth Amendment to the United States Constitution, Title 18, United States Code, Section 3161, and Federal Rule of Criminal Procedure 48(b); and (b) knowingly waives any objection with respect to venue to any charges by the United States arising out of the conduct described in the Statement of Facts attached hereto as Attachment A (“Statement of Facts”), and consents to the filing of the Information, as provided under the terms of this Agreement, in the United States District Court for the District of Massachusetts. The Office agrees to defer prosecution of the Company and any of Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 2 of 52

2 its subsidiaries and majority-owned, operationally-controlled affiliates pursuant to the terms and conditions described below. 2. The Company admits, accepts, and acknowledges that it is responsible under United States law for the acts of its officers, directors, employees, and agents as charged in the Information, and as set forth in the Statement of Facts, and that the allegations described in the Information and the facts described in the Statement of Facts are true and accurate. Should the Office pursue the prosecution that is deferred by this Agreement, the Company stipulates to the admissibility of the Statement of Facts in any proceeding, including any trial, guilty plea, or sentencing proceeding, and will not contradict anything in the Statement of Facts at any such proceeding. Term of the Agreement 3. This Agreement is effective for a period beginning on the date on which the Information is filed and ending two years from the later of either: (a) the date on which the Information is filed, or (b) the date on which the independent compliance monitor (the “Monitor”) is retained by the Company, as described in Paragraphs 13 to 15 below. The Company agrees, however, that in the event the Office determines, in its sole discretion, that the Company has knowingly violated any provision of this Agreement, an extension or extensions of the Term may be imposed by the Office, in its sole discretion, for up to a total additional time period of one year without prejudice to the Office’s right to proceed as provided in Paragraphs 18 to 23 below. Any extension of the Agreement extends all terms of this Agreement, including the terms of the monitorship in Attachment C, for an equivalent period. Conversely, in the event the Office finds, in its sole discretion, that there exists a change in circumstances sufficient to eliminate the need for the monitorship in Attachment C, and that the other provisions of this Agreement have been Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 3 of 52

3 satisfied, the Term of the Agreement may be terminated early. If the Court rejects the Agreement, all the provisions of the Agreement shall be deemed null and void, the Agreement shall be inadmissible in any proceeding, and the Term shall be deemed to have not begun. Relevant Considerations 4. The Office enters into this Agreement based on the individual facts and circumstances presented by this case, including: a. The Company received credit for cooperating with the Office’s investigation, including by: voluntarily disclosing the misconduct to the Office; collecting, analyzing, and organizing voluminous evidence and information for the Office; and providing all non-privileged facts relating to individual involvement in the misconduct described in the Statement of Facts; b. The Company announced that it would reimburse the victims of the misconduct for the amounts that it determined were overbilled, with interest, and promptly engaged a consulting firm with financial and forensic accounting experience to assist the Company in assessing and identifying the categories of expenses that were overbilled, to identify the clients affected, and to assess the Company’s method of calculating the amount of reimbursements; c. The Company paid disgorgement, prejudgment interest, and a civil monetary penalty in connection with a settlement with the United States Securities and Exchange Commission in the amount of approximately $88 million, and paid civil penalties to state regulators in the amount of $8.575 million; d. The Company engaged in remedial measures, including terminating employees responsible for the misconduct, enhancing governance and oversight related to the accuracy of customer invoicing, enhancing controls to monitor and test costs for expenses to be billed to customers, developing new standard fee schedules to clarify the Company’s invoicing methodologies, and taking additional steps to enhance its compliance program by ensuring consequences to both individuals and business units for misconduct; e. The Company has committed to continue to enhance its compliance program and internal controls and has agreed to retain a Monitor as discussed below and in Attachment C; Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 4 of 52

4 f. The nature and seriousness of the offense; g. The Company’s criminal history, which consists of a prior deferred prosecution agreement with the Office and the United States Department of Justice, Criminal Division, Fraud Section (the, “Fraud Section”), dated January 17, 2017 (the “2017 Agreement”), as well as the Company’s history of civil government settlements; and h. The Company has agreed to continue to cooperate with the Office in any ongoing investigation of the conduct of the Company and its officers, directors, employees, agents, business partners, and consultants relating to possible violations of federal criminal law. Future Cooperation and Disclosure Requirements 5. The Company shall cooperate fully with the Office in any and all matters relating to the conduct described in this Agreement and the Statement of Facts, and any other possibly fraudulent conduct under investigation by the Office or any other component of the Department of Justice at any time during the Term of this Agreement, subject to applicable law and regulations, until the later of the date upon which all investigations and prosecutions arising out of such conduct are concluded, or the end of the Term as specified in Paragraph 3. At the request of the Office, the Company shall also cooperate fully with other domestic or foreign law enforcement and regulatory authorities and agencies in any investigation of the Company, or its subsidiaries and majority- owned, operationally-controlled affiliates, or any of its present or former officers, directors, employees, agents, and consultants, or any other party, in any and all matters relating to the conduct described in this Agreement and the Statement of Facts. The Company agrees that its cooperation pursuant to this paragraph shall include, but not be limited to, the following: a. The Company shall truthfully disclose all factual information not protected by a valid claim of attorney-client privilege or work product doctrine with respect to its activities, those of its subsidiaries and majority-owned, operationally-controlled affiliates, and those of its present and former directors, officers, employees, agents, and consultants, including any evidence or allegations and internal or external investigations of possible fraud-related conduct about which the Company has any knowledge or Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 5 of 52

5 about which the Office may inquire. This obligation of truthful disclosure includes, but is not limited to, the obligation of the Company to provide the Office, upon request, any document, record, or other tangible evidence not protected by a valid claim of attorney-client privilege or work product doctrine about which the Office may inquire of the Company; b. Upon request of the Office, the Company shall designate knowledgeable employees, agents, or attorneys to provide information and materials described in Paragraph 5(a) of this Agreement on behalf of the Company. It is further understood that the Company must at all times provide complete, truthful, and accurate information; c. The Company shall use its best efforts to make available for interviews or testimony, as requested by the Office, present or former officers, directors, employees, agents, and consultants of the Company. This obligation includes, but is not limited to, sworn testimony before a federal grand jury or in federal trials, as well as interviews with domestic or foreign law enforcement and regulatory authorities. Cooperation under this paragraph shall include identification of witnesses who, to the knowledge of the Company, may have material information regarding the matters under investigation; and, d. With respect to any information, testimony, documents, records, or other materials provided to the Office pursuant to this Agreement, the Company consents to any and all disclosures, subject to applicable law and regulations, to other governmental authorities, including domestic or foreign governments, as deemed appropriate in the sole discretion of the Office. 6. In addition to the obligations in Paragraph 5, during the Term of the Agreement, should the Company learn of credible evidence or allegations of a violation of law, the Company shall promptly report such evidence or allegations to the Office. Payment of Monetary Penalty 7. The Company and the Office agree that the application of the United States Sentencing Guidelines (the, “USSG” or “Sentencing Guidelines”) to determine the applicable fine range yields the following analysis: a. The 2018 Sentencing Guidelines are applicable to this matter. b. Offense Level. Based on USSG § 2B1.1, the total offense level is 35, Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 6 of 52

Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 7 of 52

7 circumstances, it will recommend to the Court that any amount paid under this Agreement should be offset against any fine the Court imposes as part of a future judgment. The Company further acknowledges that no tax deduction may be sought in connection with the payment of any part of this $115,000,000 penalty. The Company shall not seek or accept directly or indirectly reimbursement or indemnification from any source outside the Company, its subsidiaries and majority-owned, operationally-controlled affiliates with regard to the penalty amounts that the Company pays pursuant to this Agreement or any other agreement entered into with an enforcement authority or regulator concerning the conduct described in the Statement of Facts. Conditional Release from Liability 9. Subject to Paragraphs 18 to 23 below, the Office agrees, except as provided in this Agreement, that it will not bring any criminal or civil case against the Company or subsidiaries and majority-owned, operationally-controlled affiliates relating to any of the conduct described in the Statement of Facts or the Information. The Office, however, may use any information related to the conduct described in the Statement of Facts or the Information against the Company: (a) in a prosecution for perjury or obstruction of justice; (b) in a prosecution for making a false statement; (c) in a prosecution or other proceeding relating to any crime of violence; or (d) in a prosecution or other proceeding relating to a violation of any provision of Title 26 of the United States Code. 10. This Agreement does not provide any protection against prosecution for any future conduct by the Company or any of its subsidiaries and majority-owned, operationally-controlled affiliates or for any prior conduct not specifically set forth in the attached Statement of Facts or the Information. 11. In addition, this Agreement does not provide any protection against the prosecution of any individuals, regardless of their affiliation with the Company. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 8 of 52

8 Corporate Compliance Program 12. The Company represents that it has implemented or will implement a compliance and ethics program throughout its operations, including those of its majority-owned operationally- controlled affiliates, agents, and joint ventures, and those of its contractors and sub-contractors whose responsibilities include interaction with customers, investors, and business partners, determining pricing or compensation to the Company for services provided to customers, and making representations to customers, investors, or business partners, either directly or indirectly, regarding among other things, the prevention and detection of fraud-related violations of law. The Company’s efforts pursuant to this Agreement shall focus on the prevention and detection of fraud- related conduct by its employees, representatives, and agents, including but not limited to misrepresentations to and concealment of information from the Company’s customers, investors, and business partners. Implementation of this compliance and ethics program shall not be construed in any future proceeding as providing immunity or amnesty for any crimes not disclosed to the Office as of the date of this Agreement for which the Company would otherwise be responsible. Independent Compliance Monitor 13. Promptly after the Office’s selection pursuant to Paragraph 14 below, the Company agrees to retain a Monitor for the term specified in Paragraph 15 below. The Monitor’s duties and authority, and the obligations of the Company with respect to the Monitor and the Office, are set forth in Attachment C, which is incorporated by reference into this Agreement. Upon the execution of this Agreement, and after consultation with the Office, the Company will propose to the Office a pool of three qualified candidates to serve as the Monitor. If the Office determines, in its sole discretion, that any of the candidates are not, in fact, qualified to serve as the Monitor, or if the Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 9 of 52

9 Office, in its sole discretion, is not satisfied with the candidates proposed, the Office reserves the right to seek additional nominations from the Company. The parties will endeavor to complete the Monitor selection process within thirty business days of the execution of this Agreement. The Monitor candidates or their team members shall have, at a minimum, the following qualifications: a. Demonstrated expertise with respect to United States criminal fraud laws and regulations; b. Demonstrated expertise with respect to corporate compliance and ethics within the financial services industry, including counseling financial services companies with custody businesses on these issues; c. Experience designing and/or reviewing corporate compliance policies, procedures, and internal controls; d. The ability to access and deploy resources as necessary to discharge the Monitor’s duties as described in the Agreement; and, e. Sufficient independence from the Company to ensure effective and impartial performance of the Monitor’s duties as described in the Agreement. The Office agrees that, as an alternative to the selection process set forth above, the Company may elect to retain the independent compliance monitor retained under the 2017 Agreement, to serve as the Monitor under this Agreement, and upon any resignation of the Monitor the Company may elect to retain his or her predecessor under the 2017 Agreement. 14. In the event the Company does not elect to retain the independent compliance monitor it retained under the 2017 Agreement to serve as the Monitor under this Agreement, the Office retains the right, in its sole discretion, to choose the Monitor from among the candidates proposed by the Company, though the Company may express its preference(s) among three candidates. In the event the Office rejects all proposed Monitors, the Company shall propose an additional three candidates within twenty business days after receiving notice of the rejection. This process shall continue until a Monitor acceptable to both parties is chosen. The Company and the Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 10 of 52

10 Office will use their best efforts to complete the selection process within sixty calendar days of the execution of this Agreement. If the Monitor resigns or is otherwise unable to fulfill his or her obligations as set in this Agreement and/or in Attachment C, the Company shall within twenty business days recommend a pool of three qualified Monitor candidates from which the Office will choose a replacement, as described in Paragraph 13. 15. The Monitor’s term shall be two years from the date on which the Monitor is retained by the Company, subject to extension or early termination as described in Paragraph 3. The Monitor’s powers, duties, and responsibilities, as well as additional circumstances that may support an extension of the Monitor’s term, are set forth in Attachment C. The Company agrees that it will not employ or be affiliated with the Monitor or the Monitor’s firm for a period of at least two years from the date on which the Monitor’s term expires. Nor will the Company discuss with the Monitor or the Monitor’s firm the possibility of further employment or affiliation during the Monitor’s term or within the two years from the date on which the Monitor’s term expires. Deferred Prosecution 16. In consideration of the undertakings agreed to by the Company herein, the Office agrees that any prosecution of the Company or any of its subsidiaries and majority-owned, operationally-controlled affiliates for the conduct set forth in the attached Statements of Facts or Information be and hereby is deferred for the Term. To the extent there is conduct disclosed by the Company that is not set forth in the Statement of Facts or Information, such conduct will not be exempt from further prosecution and is not within the scope of or relevant to this Agreement. 17. The Office further agrees that if the Company fully complies with all of its obligations under this Agreement, the Office will not continue the criminal prosecution against the Company described in Paragraph 1, and, at the conclusion of the Term, this Agreement shall Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 11 of 52

11 expire. Within six months of the Agreement’s expiration, the Office shall seek dismissal with prejudice of the criminal Information filed against the Company described in Paragraph 1, and agree not to file charges in the future against the Company or any of its subsidiaries and majority- owned, operationally-controlled affiliates based on the conduct described in this Agreement and the Statement of Facts. Breach of the Agreement 18. The Company shall be subject to prosecution if, during the Term, it: a. Commits any felony under United States federal law; b. Provides in connection with this Agreement deliberately false, incomplete, or misleading information, including in connection with its disclosure of information about individual culpability; c. Fails to cooperate as set forth in Paragraphs 5 and 6 of this Agreement; d. Fails to implement the programs as set forth in Paragraphs 12 and 13 of this Agreement and Attachment C; and, e. Otherwise fails specifically to perform or fulfill completely each of the Company’s obligations under the Agreement, regardless of whether the Office becomes aware of such breach after the Term is complete. The parties agree that the Office may pursue the prosecution for any federal criminal violation, including, but not limited to, the charges in the Information, in the United States District Court for the District of Massachusetts or any other appropriate venue. 19. Determination of whether the Company has breached the Agreement and whether to pursue prosecution of the Company shall be in the sole discretion of the Office. Any such prosecution may be premised on information provided by the Company or its personnel. Any such prosecution relating to the conduct described in the Statement of Facts or relating to conduct known to the Office prior to the date on which this Agreement was signed that is not time-barred by the applicable statute of limitations on the date of the signing of this Agreement may be Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 12 of 52

12 commenced against the Company, notwithstanding the expiration of the statute of limitations, between the signing of this Agreement and the expiration of the Term plus one year. Thus, by signing this Agreement, the Company agrees that the statute of limitations with respect to any such prosecution that is not time-barred on the date of the signing of this Agreement shall be tolled for the Term plus one year. In addition, the Company agrees that the statute of limitations as to any criminal fraud-related violation of federal law that occurs during the Term will be tolled from the date upon which the violation occurs until the earlier of the date upon which the Office is made aware of the violation or the duration of the Term plus five years, and that this period shall be excluded from any calculation of time for purposes of the application of the statute of limitations. 20. In the event the Office determines that the Company has breached this Agreement, the Office agrees to provide the Company with written notice prior to instituting any prosecution resulting from such breach. Within thirty business days of receipt of such notice, the Company shall have the opportunity to respond to the Office in writing to explain the nature and circumstances of the breach, as well as the actions the Company has taken to address and remediate the situation, which the Office shall consider in determining whether to pursue prosecution of the Company. 21. In the event that the Office determines that the Company has breached this Agreement: a. All statements made by or on behalf of the Company to the Office or to the Court, including the Statement of Facts, and any testimony given by the Company before a grand jury, a court, or any tribunal, or at any legislative hearings, whether prior or subsequent to this Agreement, and any leads derived from such statements or testimony, shall be admissible in evidence in any and all criminal or civil proceedings brought by the Office against the Company; and, b. The Company shall not assert any claim under the United States Constitution, Rule 11(f) of the Federal Rules of Criminal Procedure, Rule Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 13 of 52

13 410 of the Federal Rules of Evidence, or any other federal rule that any such statements or testimony made by or on behalf of the Company prior or subsequent to this Agreement, or any leads derived therefrom, should be suppressed or otherwise inadmissible. The decision shall be in the sole discretion of the Office as to whether conduct or statements of any current director, officer, employee, or any person acting on behalf or at the direction of the Company, will be imputed to the Company for purpose of determining whether the Company has violated any provision of this Agreement. 22. The Company acknowledges that the Office has made no representations, assurances, or promises concerning what sentence may be imposed by the Court if the Company breaches this Agreement and this matter proceeds to judgment. The Company further acknowledges that any such sentence is solely within the discretion of the Court and that nothing in this Agreement binds or restricts the Court in the exercise of such discretion. 23. Thirty business days after the expiration of the period of deferred prosecution specified in this Agreement, the Company, by the Chief Executive Officer of the Company and the Chief Financial Officer of the Company, on the basis of diligent inquiry, will certify to the Office that the Company has met its disclosure obligations pursuant to Paragraphs 5 and 6 of this Agreement. Each certification will be deemed a material statement and representation by the Company to the executive branch of the United States for purposes of Title 18, United States Code, Section 1001, and it will be deemed to have been made in the District of Massachusetts. Sale, Merger, or Other Change in Corporate Form of the Company 24. Except as may otherwise be agreed by the parties in connection with a particular transaction, the Company agrees that in the event that, during the Term, it undertakes any change in corporate form, including if it sells, merges, or transfers business operations that are material to the Company’s consolidated operations, or to the operations of any subsidiaries or affiliates Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 14 of 52

14 involved in the conduct described in the Statement of Facts, as they exist as of the date of this Agreement, whether such sale is structured as sale, asset sale, merger, transfer, or other change in corporate form, it shall include in any contract for sale, merger, transfer, or other change in corporate form a provision binding the purchaser, or any successor in interest thereto, to obligations described in this Agreement. The Company shall obtain approval from the Office at least thirty business days prior to undertaking any such sale, merger, transfer, or other change in corporate form, including dissolution, in order to give the Office an opportunity to determine if such change in corporate form would impact the terms or obligation of the Agreement. This paragraph shall not apply to: a. Any sale, merger, or transfer which is being executed pursuant to recovery and resolution actions of the Company or in furtherance of pursuit of a credible resolution plan as contemplated by the Xxxx-Xxxxx Xxxx Street Reform and Consumer Protection Act; and b. Sales, merger, or transfers between subsidiaries or majority-owned, operationally-controlled affiliates, including internal reorganizations. Public Statements by the Company 25. Within ten business days of the filing of the Information in the United States District Court, the Company will (a) make this Agreement and the Statement of Facts conspicuously available to the public on its website for the duration of this Agreement; and (b) communicate to all Company employees that the Company has entered into this Agreement and make available this Agreement and Statement of Facts to all such employees. 26. The Company expressly agrees that it shall not, through any person authorized to speak on behalf of the Company, including any present or future attorneys, officers, directors, employees, or agents, make any public statement, in litigation or otherwise, contradicting the acceptance of responsibility by the Company set forth above or the facts described in the Statement of Facts. Any such contradictory statement shall, subject to cure rights of the Company described Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 15 of 52

15 below, constitute a breach of this Agreement, and the Company thereafter shall be subject to prosecution as set forth in Paragraphs 20 through 22 of this Agreement. The decision whether any public statement by any such person contradicting a fact contained in the attached Statements of Facts will be imputed to the Company for the purpose of determining whether it has breached this Agreement shall be at the sole discretion of the Office. If the Office determines that a public statement by any such person contradicts in whole or in part a statement contained in the Statement of Facts, the Office shall so notify the Company in writing, and the Company may avoid a breach of this Agreement by publicly repudiating such statement within five business days after notification. The Company shall be permitted to raise defenses and to assert affirmative claims in other proceedings relating to the matters set forth in the Statement of Facts provided that such defenses and claims do not contradict, in whole or in part, a statement contained in the Statement of Facts. This paragraph does not apply to any statement made by any present or former officer, director, employee, or agent of the Company in the course of any criminal proceeding, unless such individual is speaking on behalf of the Company. 27. The Company agrees that if it or any of its direct or indirect subsidiaries or affiliates issues a press releases or holds any press conference in connection with this Agreement, the Company shall first consult with the Office to determine: (a) whether the text of the release or proposed statements at the press conference are true and accurate with respect to matters between the Company and the Office; and (b) whether the Office has any objection to the release. 28. The Office agrees, if requested to do so, to bring to the attention of law enforcement and regulatory authorities the facts and circumstances relating to the nature of the conduct underlying this Agreement, including the nature and quality of the Company’s cooperation and remediation. By agreeing to provide this information to such authorities, the Office is not agreeing Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 16 of 52

16 to advocate on behalf of the Company, but rather is agreeing to provide facts to be evaluated independently by such authorities. Limitations on Binding Effect of Agreement 29. This Agreement is binding on the Company and the Office but specifically does not bind any other component of the Department of Justice, other federal agencies, or any state, local, or foreign law enforcement or regulatory agencies, or any other authorities, although the Office will bring the cooperation of the Company and its compliance with its other obligations under this Agreement to the attention of such agencies and authorities if requested to do so by the Company. Notice 30. Any notice required under this Agreement shall be given by personal delivery, overnight delivery by a recognized delivery service, or registered or certified mail, to the following address for: a. The Office: Chief – Securities, Financial & Cyber Fraud Unit; United States Attorney’s Office for the District of Massachusetts; Xxxx Xxxxxx Xxxxxxx United States Courthouse; 0 Xxxxxxxxxx Xxx, Xxxxx 0000; Xxxxxx, Xxxxxxxxxxxxx 00000; or, b. The Company: General Counsel, State Street Corporation, State Street Financial Center, Xxx Xxxxxxx Xxxxxx, Xxxxxx, Xxxxxxxxxxxxx 00000. 31. Notice shall be effective upon actual receipt by the Office or the Company. Complete Agreement 32. This Agreement, including its attachments, sets forth all the terms of the settlement between the Company and the Office. No amendments, modifications or additions to this Agreement shall be valid unless they are in writing and signed by the Office, the attorneys for the Company and a duly authorized representative of the Company. AGREED: Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 17 of 52

17 FOR STATE STREET CORPORATION: FOR THE UNITED STATES ATTORNEY’S OFFICE: XXXXXXXXX X. XXXXXXX ACTING UNITED STATES ATTORNEY Date: ____________ By: ________________________ Xxxxxx X. X’Xxxxxxx Assistant United States Attorney May 13, 2021 Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 18 of 52

COMPANY OFFICER’S CERTIFICATE I have read this Agreement and carefully reviewed every part of it with outside counsel for State Street Corporation (the “Company”). I understand the terms of this Agreement and voluntarily agree, on behalf of the Company, to each of its terms. Before signing this Agreement, I consulted outside counsel for the Company, who have fully advised me of the rights of the Company, of possible defenses, of the Sentencing Guidelines, and of the consequence of entering into this Agreement. I have also carefully reviewed the terms of this Agreement with the Board of Directors of the Company. Before signing this Agreement, I have advised and caused outside counsel for the Company to advise the Board of Directors fully of the rights of the Company, of possible defenses, of the Sentencing Guidelines, and of the consequences of entering into this Agreement. No promises or inducements have been made other than those contained in this Agreement. Furthermore, no one has threated or forced me, or to my knowledge any person authorizing this Agreement on behalf of the Company, in any way to entered into this Agreement. I am also satisfied with outside counsel’s representation in the matter. I certify that I am the General Counsel for the Company and that I have been duly authorized by the Company to execute this Agreement on behalf of the Company. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 19 of 52

19 CERTIFICATE OF COUNSEL We are counsel for State Street Corporation (the “Company”) in the matter covered by this Agreement. In connection with such representation, we have examined relevant Company documents and have discussed the terms of this Agreement with the Company Board of Directors. Based our review of the foregoing materials and discussions, we are of the opinion that the General Counsel of the Company has been duly and validly authorized, executed, and delivered on behalf of the Company and is a valid and binding obligation of the Company. Further, we have carefully reviewed the terms of this Agreement with the Board of Directors and the General Counsel of the Company. We have fully advised them of the rights of the Company, of possible defenses, of the Sentencing Guidelines’ provisions and of the consequences of entering into this Agreement. To our knowledge, the decision of the Company to enter into this Agreement, based on the authorization of the Board of Directors, is an informed and voluntary one. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 20 of 52

A-1 ATTACHMENT A STATEMENT OF FACTS The following Statement of Facts is incorporated by reference as part of the Deferred Prosecution Agreement (the “Agreement”) between the United States Attorney’s Office for the District of Massachusetts (the “Office”) and State Street Corporation (“State Street” or the “bank”). State Street hereby agrees and stipulates that the following information is true and accurate. State Street admits, accepts, and acknowledges that it is responsible for the acts of its subsidiaries and majority-owned, operationally-controlled affiliates, officers, directors, employees, and agents as set forth below. Should the Offices pursue the prosecution that is deferred by this Agreement, State Street (including its subsidiaries and majority-owned, operationally- controlled affiliates) agrees that it will neither contest the admissibility of, nor contradict, this Statement of Facts in any such proceeding. The following facts establish beyond a reasonable doubt the charges set forth in the criminal Information attached to this Agreement: Background 1. Together with its subsidiaries and affiliates, State Street was a financial services company headquartered and with its principal place of business in Boston, Massachusetts. State Street owned one of the world’s largest custody banks, State Street Bank and Trust Company. Its clients included corporate and public retirement plans, insurance companies, foundations, endowments and other investment pools, and registered investment companies. State Street’s custody business in the United States fell within the Global Services America (“GSA”) division of the Investor Services division of State Street Bank and Trust Company. 2. As a custody bank, State Street held and safeguarded its clients’ financial assets, including stocks, bonds, and currencies. In addition, State Street offered its custody clients Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 21 of 52

A-2 clearing, payment, settlement and record-keeping services. The financial terms of State Street’s relationships with its custody clients were typically documented in fee schedules. During the relevant period, those schedules provided that State Street would be compensated for its services in various ways, including (a) “asset-based” fees that reflected a percentage of its clients’ assets; (b) transaction charges at specified dollar amounts (such as specified charges to transfer money by wire); and (c) “out-of-pocket” (“OOP”) expenses. State Street’s Investment Manager Guide described OOP expenses as “generally understood in the securities industry to mean costs for items paid by the custodian on behalf of the investor,” which were “reimbursable to the custodian.” 3. At all times relevant, State Street’s fee schedules typically provided that customers would make payment for OOP expenses, and identified the following as yielding OOP expenses: (a) interbank messages sent via the Society of Worldwide Interbank Financial Telecommunication (“SWIFT”); (b) asset pricing and valuation services provided by third-party vendors; (c) certain specialized data feeds to funds’ audit firms for purposes of required auditing assessments; (d) reports provided by auditors engaged by State Street to review its internal controls relating to the processing of client transactions, the preparation of client financial statements, and other services; (e) the preparation of SEC Rule 17f-5 reports for mutual fund clients to address certain requirements for the custody of foreign assets by foreign sub-custodians; (f) archiving of client records; (g) delivery and courier services; (h) printing and copying; (i) telephone services; (j) forms and supplies; (k) issuing checks; (l) computer equipment; and (m) wire transfers. 4. For many categories of OOP expenses, State Street established a billing rate per unit volume that reflected the actual costs State Street incurred for those activities, which it passed on to its clients. Over time, however, as the bank’s costs for services declined, State Street continued to charge its clients the old rates, and to represent them as OOP expenses, even though Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 22 of 52

A-3 the bank was actually earning a profit from those charges. Many of State Street’s clients, in turn, were unaware that they were paying markups on OOP expenses because the bank’s invoices typically listed only the total amount owing for OOP expenses, but did not break out amounts charged per unit or transaction. 5. SWIFT messages were secure wire communications in interstate and foreign commerce used to effectuate securities trades and related financial transactions. Internally, State Street calculated SWIFT message charges based on two components: a “unit cost” and a “message fee.” The “unit cost” generally reflected what State Street paid per message to the SWIFT organization to send a SWIFT message. During the relevant time, this cost varied over time and by message type, but typically ranged between $0.02 and $0.15 per message unit. The “message fee” was intended to cover the overhead expenses State Street incurred to send SWIFT messages, such as the cost of maintaining SWIFT-dedicated computers and telephone lines. Prior to the relevant period, State Street typically charged clients a “message fee” of $5.00 per message. State Street continued to charge many clients that same amount during the relevant period, even though, as bank executives were aware, an increase in SWIFT message volume caused State Street’s actual SWIFT-related overhead expenses per message to decline substantially. During the relevant period, State Street’s invoices did not break out unit costs or message fees, but instead simply provided custody clients a total amount due for SWIFT-related OOP expenses. 6. Co-Conspirator-1 (“CC-1”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-1 was employed by State Street in Massachusetts as a senior vice president of U.S. Investor Services (“USIS”), a division of GSA, and a senior department head in the investor services group. CC-1 reported to the executive vice president in charge of USIS. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 23 of 52

A-4 7. Co-Conspirator-2 (“CC-2”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-2 was employed by State Street in various locations including in Massachusetts as a senior vice president of USIS and a department head in the investor services group. CC-2 reported to CC-1. 8. Co-Conspirator-3 (“CC-3”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-3 was employed by State Street in Massachusetts as a Managing Director of USIS and a department head in the investor services group. CC-3 reported to CC-1. 9. Co-Conspirator-4 (“CC-4”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-4 was employed by State Street in Massachusetts as a senior vice president of USIS and a department head in the mutual fund services group. CC-4 indirectly reported to the executive vice president in charge of USIS. 10. Co-Conspirator-5 (“CC-5”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-5 was employed by State Street in Massachusetts as a vice president of USIS and controller of State Street’s mutual fund servicing business. CC-5 indirectly reported to the executive vice president in charge of USIS. 11. Co-Conspirator-6 (“CC-6”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-6 was employed by State Street in Massachusetts as a vice president of USIS and head of a unit in the investor services group. CC-6 reported, variously, to CC-2 and CC-3. 12. Co-Conspirator-7 (“CC-7”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-7 was employed by State Street in Massachusetts as a vice president of USIS and head of a unit in the mutual fund services group. CC-7 reported to CC- Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 24 of 52

A-5 4. 13. Co-Conspirator-8 (“CC-8”) was an individual whose identity is known to the Office and State Street. At all relevant times, CC-8 was employed by State Street in Massachusetts as a vice president of USIS and manager of client relations within the investor services group. CC-8 reported to CC-6. 14. Throughout the relevant period, State Street executives were repeatedly made aware that the fees they were charging clients for SWIFT messages and other purported OOP expenses far exceeded the actual costs of those services to the bank. 15. For example, on or about October 26, 2004, CC-7, who was in the process of negotiating with a client, e-mailed CC-4 about SWIFT fees. CC-7 wrote of having been told that the $5 per message SWIFT fee “is NOT the true cost. This $5 has been around for a long while and at one time was accurate. It includes overhead, systems maintenance, etc.” CC-4 responded: “Are we charging anyone the $5 today. I’m a little concerned that in today’s environment the definition of ‘out-of-pocket’ expense should be exactly what we are paying out of pocket.” CC-7 replied: “The current cost is $1 to $2 per message outbound (inbound is nothing). I am trying to get clients who are paying $5 per messages. Two people in Finance have told me that there is mark up involved.” 16. Similarly, on or about December 13, 2005, in response to a question from a State Street executive concerning whether to charge a client the “standard (gross-up) charge” of $5.00 per message or “the true ‘cost’” of $1.00 per message, CC-4 e-mailed CC-7, “How do we get our arms around what is a realistic number. If it’s costing us $1 and we are charging $5 my concern is that it is no longer an out-of-pocket.” 17. State Street executives also discussed the fact that clients were unaware of the Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 25 of 52

A-6 significant markups they were being charged on OOP expenses. As one example, on or about May 11, 2007, CC-4 e-mailed an assistant vice president in State Street’s accounting operations group, “The issue [is] we are charging $5 for a SWIFT message but the cost is much less. . . . We can’t be in a position on [a client] that they discover that we are taking them to the cleaners on SWIFT charges.” The assistant vice president replied: “Sometime back at the beginning of time there was some form of analysis that arrived at the $5 per message (my guess / understanding is that there was overhead included in this figure at the time that now should be spread over a much larger universe). Today that figure is grossly inaccurate in terms of actual costs or even any legitimately defendable ‘fully loaded cost.’ I would absolutely not charge this rate to any new clients.’” 18. Notwithstanding the fact that they had been told that clients were not aware that they were being charged markups, State Street executives deflected client inquiries about OOP fees, and actively misled clients about what they were being charged, while resisting efforts to reduce the charges to the actual out-of-pocket costs the bank had incurred. During the relevant period, SWIFT messages were the largest category of purported OOP expenses State Street improperly charged to its custody clients. Asset Management Firm-1 19. For example, in or about September 2000, State Street entered into a fee schedule to provide custody services to a global asset management firm (“Asset Management Firm-1”). The fee schedule provided that State Street would bill Asset Management Firm-1 monthly “for the recovery of applicable out-of-pocket expenses.” The fee schedule listed representative examples of OOP expenses, but noted that OOP expenses were “not limited to” the examples on the list. 20. Although the fee schedule did not specifically include SWIFT message charges in the list of representative OOP expenses, State Street subsequently identified SWIFT message charges as OOP expenses in monthly invoices it sent to Asset Management Firm-1. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 26 of 52

A-7 21. In or about 2003, after Asset Management Firm-1 began questioning the accuracy of the SWIFT message charges on State Street’s invoices, bank executives discussed how to avoid disclosing the fact that State Street was earning a significant profit on SWIFT fees, contrary to the client’s understanding. For example, on or about November 17, 2003, CC-6 e-mailed a supervisor, CC-2: “[T]he only way I can prove that the current bills are accurate is to show them the volume, the unit cost and tie that detail to the bills. The problem with this is that once they see the unit cost, they are extremely likely to object to that charge. My feeling is that we risk all of the revenue should we do this.” CC-6 proposed reducing SWIFT message charges to Asset Management Firm- 1, adding: “Obviously by doing so, we automatically loose [sic] 30% of the revenue but we do not risk the other 70%.” 22. CC-2 responded: “[P]lease validate how much we are talking about.” CC-6 replied: “We are billing about $1 million for swift.” 23. On or about December 4, 2003, CC-8 e-mailed CC-6 and CC-2 noting that the bank’s internal management information system did not “allocate SWIFT revenue to the OOP revenue section b/c, as we already know; it is not a legitimate OOP item as we make a nice margin on it.” 24. On or about December 10, 2003, CC-6 e-mailed CC-2 and CC-8 as follows: “My concern is that [Asset Management Firm-1] only knows the total charge for SWIFT. It was never explained to them that the fee was $5 per message.” CC-6 proposed offering Asset Management Firm-1 a fee reduction of $100,000 “in hopes that they will not pursue it any further,” but added, “I think we need to be prepared to go to $300,000.” 25. CC-2 forwarded the e-mail to CC-5, adding: “Given that [Asset Management Firm- 1] is all over us on SWIFT charges, from everything that I can see, it looks like we are better off Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 27 of 52

A-8 giving them $300,000 back as a reduction. More than likely, the $700,000 we would still be charging them is far greater than the expense we are incurring.” 26. CC-5 responded: “I agree we’re probably better with reducing the rate to back into a $300k reduction to protect the rest.” CC-2 replied: “We will begin taking the reduction. We may have to deal with some retroactive hits, but we should try to limit these by telling them the billing was behind by a few months.” CC-2 forwarded the e-mail chain to CC-1. 27. In an internal “fee concession” memorandum, State Street executives acknowledged that Asset Management Firm-1 had “questioned the validity of the OOP bills,” and that the bank could not validate the bills without disclosing “volumes and unit fees.” The memorandum noted that Asset Management Firm-1 “currently does not know the unit fee,” and that the fee concession was intended “to avoid the validation process and thus protect the majority of swift revenue.” 28. On or about December 16, 2003, CC-2 approved the reduction in SWIFT message charges. 29. On or about December 31, 2003, CC-6 e-mailed a representative of Asset Management Firm-1 that “the SWIFT billing has been resolved,” and that “[g]oing forward, you can expect a reduction of approximately 30% in the amount billed SWIFT message charges.” The e-mail did not disclose that the SWIFT message charges, even as reduced, would continue to include an undisclosed mark-up. 30. On or about March 22, 2004, CC-6 e-mailed CC-3 an internal memorandum that said Asset Management Firm-1 had requested that State Street “begin providing the detail for OOP’s.” CC-6 added: “[t]his will likely be a problem for XXXXX[,]” and predicted State Street’s “revenue will be at risk once we start providing this detail.” Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 28 of 52

A-9 31. On or about September 23, 2005, a representative of Asset Management Firm-1 e- mailed CC-8 a news article about the fact that SWIFT fees were declining. CC-8 forwarded the e- mail to CC-6, who forwarded it to CC-3. CC-3, in turn, forwarded the e-mail to CC-1, adding: “You just gotta laugh . . . I think [CC-8] has provided her with some reporting that will keep her at bay for now[.]” 32. During a telephone call in or about November 2005, CC-8 told representatives of Asset Management Firm-1, in substance, that SWIFT fees were comprised of message fees and unit fees. CC-8 said that message fees were comprised of programming expenses, maintenance expenses and staffing expenses required to support the SWIFT system, while unit costs represented “the full charge from SWIFT divided by the universe volume.” CC-6 subsequently advised CC-3 and CC-8 that the client representatives “seemed to accept this,” but nonetheless requested “the actual calculations.” CC-6 noted: “We need to talk about this. I can not [sic] see how we can give this to them. Yet I do not see how we can’t either.” 33. Beginning in or about December 2005, State Street executives shared select information on SWIFT with Asset Management Firm-1. For example, on or about December 1, 2005, CC-8 e-mailed representatives of Asset Management Firm-1 data that showed State Street had been charging between $5.00 and $3.50 per message (depending on the type of SWIFT message) and $0.11 per unit. This data did not disclose State Street’s costs per message. 34. At or about the same time, State Street executives with financial responsibilities conducted internal analyses that estimated the bank’s SWIFT costs were, all-in (including the message and unit fees) between $.25 and $.41 per message. For example, on or about December 15, 2005, CC-5 e-mailed State Street billing executives an analysis that concluded that the bank’s internal and external SWIFT costs were $.41 per message. This analysis noted: (a) “Xxxxx resides Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 29 of 52

A-10 in OOP language of most client fee schemes” and “there has always been a gross up over the costs;” (b) “The Swift cost was last analyzed approx. 2-3 years ago. . . . At that time the unit cost for Xxxxx was approx. $1.00 although we were billing the majority of clients $5.00. The decision was made . . . to continue to bill clients as long as possible;” (c) State Street had overbilled clients by more than $6.6 million in SWIFT fees in 2005; (d) “The issue is we make money on this product, not charged at true costs, and only 4 clients [including Asset Management Firm-1] make up nearly 50% of our total SWIFT billing;” and (e) “The current per message unit cost is really $.40 vs. a $5.00 billing charge.” In the cover e-mail, CC-5 wrote that he needed help to “justify why we were charging [Asset Management Firm-1] such a high unit cost,” adding: “[CC-1] hopes to be able to argue this down to a fee waiver for 2006 only of swift charges,” and “the more ammo that I can give [CC-1] the better.” 35. On or about December 16, 2005, a State Street executive with financial responsibilities e-mailed CC-3 an analysis with detailed data supporting the $.41 per message cost. CC-3 forwarded this analysis to CC-1, who, less than an hour later, replied attaching a new spreadsheet reflecting costs of $.76 or $.98 per message depending on the type of message. In fact, these higher cost figures had no support. CC-3 then forwarded CC-1’s spreadsheet with the higher costs to a representative of Asset Management Firm-1. 36. On or about January 23, 2006, CC-3 e-mailed a representative of Asset Management Firm-1 an analysis to show the aggregate fees State Street had charged the firm for SWIFT messages over the prior five years, along with the purported aggregate costs to the bank. The analysis indicated that the total overcharge for SWIFT messages during the prior five years was just over $2 million. 37. On or about February 27, 2006, a representative of Asset Management Firm-1 e- Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 30 of 52

A-11 mailed CC-1 an analysis the firm had conducted in which it estimated that it had been overcharged by more than $2.8 million. The analysis indicated that, because the firm had “never received a breakdown of past SWIFT fees,” it was “assuming State Street’s breakdown is correct.” It also indicated that Asset Management Firm-1 was basing its calculation on the assumption that the cost data shared by State Street executives – including the $.76 or $.98 per message cost plus the $.11 cents per unit cost – was correct. In fact, as CC-1, CC-3, and other State Street executives were aware, the bank’s internal analyses showed that its cost was, at most, $.41 per message. Asset Management Firm-1’s calculation would have shown an overcharge of more than $3.5 million had it used the $.41 per message cost reflected in State Street’s internal analysis. 38. In an email exchange two days later, CC-6 proposed to CC-1 and CC-3 that State Street “hold the line” on its figure of just over $2 million, and that it offer Asset Management Firm- 1 a concession of $87,000 per month over two years to achieve that number. 39. Ultimately, however, State Street executives agreed to accept Asset Management Firm-1’s estimate of $2.8 million in overcharges. CC-6 e-mailed a representative of Asset Management Firm-1 a proposal to allow it to “recoup” that sum by eliminating SWIFT fees altogether, and cutting trading fees in half, for a two-year period. State Street further proposed that, following the two-year period, it would waive future message fees and only charge unit fees of between 9 cents and 15 cents per message, depending on the type of SWIFT message. 40. State Street executives subsequently discussed how to avoid making similar concessions to other clients. For example, in or about May 2010 – after a pension fund, which was itself a client of Asset Management Firm-1, requested information about SWIFT message charges – CC-6 e-mailed CC-2 and other State Street executives: “This is going to be a problem. This was a huge issue several years ago and we essentially were forced to eliminate the $5 SWIFT charge Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 31 of 52

A-12 [for Asset Management Firm-1]. They are going to insist we eliminate this charge for [the pension fund]. . . . [P]lease try to determine how much of the existing revenue is derived from the $5 SWIFT charge. If it is significant, we have a bigger problem[.]” Another State Street executive replied that if the bank waived the $5 per message charge, “we will end up slightly below breakeven.” Asset Management Firm-2 41. As another example, in or about 2008, State Street executives received inquiries from another asset management firm (“Asset Management Firm-2”) concerning escalating OOP expenses. At the time, the bank’s fee schedule with the firm noted that “billing for the recovery of the following out-of-pocket expenses will be made as of the end of each month.” The schedule listed SWIFT charges among the OOP expenses that would be invoiced monthly. 42. On or about April 22, 2008, after being told that a representative of Asset Management Firm-2 had inquired about why SWIFT message charges were “so high,” CC-7 asked a fellow State Street executive: “Can we shut this off going forward without them inquiring about previous bills?” 43. In or about early 2009, a representative of Asset Management Firm-2 requested that CC-4 investigate the high OOP expenses. CC-4 assigned the task to CC-7. 44. On or about March 31, 2009, CC-7 e-mailed a senior State Street billing specialist (the “Billing Specialist”): “I think there is an issue for OOP on [Asset Management Firm 2]. I just learned we are charging them $5 per report/transaction. . . . Very Hot!!!” The Billing Specialist confirmed that State Street was charging the firm $5.00 per message and $0.05 to $0.12 per unit. 45. CC-7 replied the following day, “I am likely going to 25 cents . . . (down from $5).” but asked, “What I ultimately need to know is how much this will cost us.” The Billing Specialist Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 32 of 52

A-13 responded that a member of State Street’s accounting operations team was “shocked” by the proposed reduction, because “most people reduce it to $2 if they reduce it.” 46. That same day, CC-4 forwarded CC-7 an e-mail from another State Street executive concerning the “absurd fee per message (about $5)” that State Street was charging another custody client. CC-4 added: “Let’s discuss. I don’t think we want to do anything but we need to think about our exposure . . . and our response if they question it. We can xxxx XXXXX charges as an ‘OOP’ (I’m of the opinion that OOP means without markup).” 47. After another State Street executive confirmed that the bank “tack[s] on a margin” to certain OOPs, CC-7 responded: “I knew it. Why we are marking up SWIFT charges is beyond me. I understand XXX’s as pass through charges.” CC-7 forwarded the e-mail chain to CC-4, adding: “I’m telling you. I learn something every day. Simply not amazed at anything that goes on here any more.” 48. On or about April 2, 2009, CC-7 and another State Street executive received a report indicating that State Street had charged Asset Management Firm-2 nearly $600,000 in marked-up OOP expenses the prior year. The executive e-mailed CC-7: “‘Out of pocket’ with ‘mark up’ = Big Problem. . . . [T]here is some serious monkey business going on here.” CC-7 replied: “I agree. Bunch of crap. . . . This is not good. I think the true charge is a quarter per transaction. No other custodian charges for this at least not as a line item.” 49. Later the same day, CC-7 e-mailed a representative of Asset Management Firm-2 to inquire whether the firm required the use of SWIFT services at all. CC-7 advised that discontinuing the use of SWIFT messaging “would eliminate close to 90% of the OOP charges you see.” 50. On or about April 9, 2009, CC-7 instructed a State Street colleague to find out Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 33 of 52

A-14 whether Asset Management Firm-2 had agreed to discontinue the use of SWIFT messages because the Billing Specialist “needs to know how much to charge.” CC-7 cautioned that the firm “isn’t to know the per quote transaction.” 51. Later that day, CC-7 instructed the Billing Specialist to “go to $1.00 for Xxxxx.” The Billing Specialist forwarded the instruction to CC-4, who approved it. Other State Street Custody Clients 52. Even after agreeing to lower SWIFT message charges for certain clients who questioned them – including Asset Management Firm-1 and Asset Management Firm-2 – State Street executives continued to charge other clients significant undisclosed markups on SWIFT fees and other OOP expenses. The executives also resisted disclosing information about the charges when clients inquired about them, and even explored charging additional clients undisclosed markups on OOP expenses when negotiating new fee agreements. 53. For example, on or about April 12, 2009 – just three days after CC-4 approved reducing the per message SWIFT fees for Asset Management Firm-2 from $5 to $1, CC-4 e-mailed a State Street vice president to request “a quick synopsis of what the standard charge for Swift charge ie we are charging $5 for what, etc.” The vice president, copying CC-7, replied that State Street paid SWIFT 9 or 12 cents per message as a unit fee. The vice president added: “The $5 fee represents coverage of the indirect charges for SWIFT messages. This includes the cost of SWIFT terminals, maintenance of files to SWIFT and all other overhead costs incurred in State Street to ensure proper transmission of the SWIFT messages.” The vice president noted, however, that “the true cost of these indirect charges” was only about 25 cents per message, such that the bank’s $5 fee included a “$4.50 markup per message.” The vice president estimated that the “annual revenue [to State Street] from this markup must be in the tens $ of millions.” Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 34 of 52

A-15 54. The next day, CC-4 e-mailed a State Street executive vice president in USIS (the “EVP”) a memorandum discussing, among other issues, “Revenue Protection.” CC-4 wrote: Clients are looking at expenses very closely. One thing that has recently [been] brought to my attention is SWIFT fees which we pass on to clients as OOP expenses. The number is well into the millions for [my own department]. I would think that our clients would think that OOP expenses are pass thru’s with maybe a bit of [a] mark-up to cover our expenses. XXXXX currently charges us either 12 cents or 5 cents [as a unit fee] depending on the message type. We charge our clients $5.00 per message – an exorbitant mark up that will certainly piss off clients when they figure this out. . . . Regarding OOP expenses I recommend the following: We develop justification for SWIFT message charges[.] All departments review OOP expenses for propriety i.e. are we charging what we are entitled to. The EVP replied: “[T]his is very helpful. Can I ask you to review on the 21st with the group? I would delete the section on OOP expenses. I would do more work on your own and maybe raise as a strategy question with a small group verbally only.” CC-4 responded: “I agree with your viewpoint on OOP’s. We’ll do some more homework and you and I can discuss how you want to handle. I raised it mainly because across [USIS] the number is significant.” Neither the EVP nor CC-4 followed up on this issue. 55. As another example, on or about July 20, 2010, a State Street vice president e- mailed CC-4 concerning a client who “knows the $5 fee is outrageously high so they are kicking up a fuss.” The vice president added: “I think we stick with our plan to no longer charge and not say anything”, but “if they ask we can tell them we decided to no longer charge SWIFT fees[.]” The vice president continued: “Sorry to re-hash this but we need to be careful with this as this is not a true OOP as we have portrayed[.]” CC-4 replied: “We are on the same page my brother.” 56. Similarly, on or about December 3, 2010, a client representative e-mailed State Street executives to request “more detail” concerning XXXXX charges, noting that the “custody agreement simply notes SWIFT Charges would be passed through . . . but these are getting quite large . . . which has taken us by surprise.” After repeated follow-up requests over a period of years, Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 35 of 52

A-16 the client representative e-mailed State Street executives again on or about June 3, 2015: “We never received a satisfactory response to any of these inquiries until we had the opportunity to discuss such fees with outside firms . . . and discovered they were indeed excessive. . . . I’m sure you can understand our frustration, especially given that we have been inquiring about the accuracy of these charged since 2010 (5 ½ years).” 57. On or about January 27, 2012, CC-7 e-mailed a fellow State Street executive about the possibility of increasing revenues by charging additional clients for OOP expenses. CC-7 said: “Another area to look at is Swift fees. . . . Typical charge is between 50 cents and $1.50 per transaction and definitely adds up.” The fellow executive replied: “The true cost of XXXXX is less [sic] 25 cents or less right? I don’t want to be part of charging $1.50 or more on a cost labeled as OOP unless I am forced.” 58. On or about July 31, 2014, CC-7 advised CC-4 that lowering the $5 per message SWIFT fee for one client would result in a “360K impact.” CC-7 recommended leaving the fee at $5, because the client “never questioned” it. CC-4 replied: “I agree . . . they are paying it, always have, never questioned it[.]” Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 36 of 52

B-1 ATTACHMENT B CERTIFICATE OF CORPORATE RESOLUTIONS WHEREAS, State Street Corporation (the “Company”) has been engaged in discussions with the United States Attorney’s Office for the District of Massachusetts (the “Office”) regarding issues arising in relation to fraudulent overcharging of, and misrepresentations to, certain customers of the Company’s custody business; and WHEREAS, in order to resolve such discussions, it is proposed that the Company enter into a certain agreement with the Office; and WHEREAS, the Company’s General Counsel, Xxxxx X. Xxxxxx, together with outside counsel for the Company, have advised the Board of Directors of the Company of its rights, possible defenses, the Sentencing Guidelines’ provisions, and the consequences of entering into such agreements with the Offices; Therefore, the Board of Directors has RESOLVED that: 1. The Company (a) acknowledges the filing of the one-count Information charging the Company with conspiracy to commit wire fraud in violation of Title 18, United States Code, Section 1349; (b) waives indictment on such charges and enters into a deferred prosecution agreement with the Office; and (c) agrees to accept a monetary penalty against the Company totaling $115,000,000.00, and to pay such penalty to the United States Treasury with respect to the conduct described in the Information; 2. The Company accepts the terms and conditions of this Agreement, including, but not limited to, (a) a knowing waiver of its rights to a speedy trial pursuant to the Sixth Amendment to the United States Constitution, Title 18, United States Code, Section 3161, and Federal Rule of Criminal Procedure 48(b); (b) a knowing waiver for purposes of this Agreement and any charges Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 37 of 52

B-2 by the Office arising out of the conduct described in the attached Statement of Facts of any objection with respect to venue and consents to the filing of the Information, as provided under the terms of this Agreement, in the United States District Court for the District of Massachusetts; and (c) a knowing waiver of any defenses based on the statute of limitations for any prosecution relating to the conduct described in the attached Statement of Facts or relating to conduct known to the Office prior to the date on which this Agreement was signed that is not time-barred by the applicable statute of limitations on the date of the signing of this Agreement; 3. The General Xxxxxxx, Xxxxx X. Xxxxxx, is hereby authorized, empowered and directed, on behalf of the Company, to execute the Deferred Prosecution Agreement substantially in such form as discussed with the Board of Directors with such changes as the General Counsel, Xxxxx X. Xxxxxx, may approve; 4. The General Counsel, Xxxxx X. Xxxxxx, is hereby authorized, empowered and directed to take any and all actions as may be necessary or appropriate and to approve the forms, terms or provisions of any agreement or other documents as may be necessary or appropriate, to carry out and effectuate the purpose and intent of the foregoing resolutions; and 5. All of the actions of the General Counsel, Xxxxx X. Xxxxxx, which actions would have been authorized by the foregoing resolutions except that such actions were taken prior to the adoption of such resolutions, are hereby severally ratified, confirmed, approved, and adopted as actions on behalf of the Company. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 38 of 52

C-1 ATTACHMENT C INDEPENDENT COMPLIANCE AND BUSINESS ETHICS MONITOR The duties and authority of the Independent Compliance and Business Ethics Monitor (“Monitor”) pursuant to the Deferred Prosecution Agreement (“Agreement”) to which this Attachment C is appended, and the obligations of State Street Corporation (“Company”), on behalf of itself and its subsidiaries and majority-owned, operationally-controlled affiliates (collectively, “Monitored Entities”), with respect to the Monitor and the United States Attorney’s Office for the District of Massachusetts (“Office”) are as described below, to the extent permissible under locally applicable laws and regulations, and the instructions of local regulatory agencies: Term of the Monitorship 1. The Company will, pursuant to the Agreement, retain the Monitor for a period of up to two years (“Term”). Upon recommendation of the Monitor, the Office may, in its sole discretion, terminate the Monitorship prior to the expiration of the Term and/or accelerate the reporting deadlines set forth in this Attachment C, provided that (i) the Monitor provides the certification in Paragraph 22 below, (ii) such early termination shall not occur earlier than one year from the commencement of the Term, and (iii) such early termination shall not otherwise affect the provisions of the Agreement. 2. The Company and the Office acknowledge that the work of the Monitor appointed pursuant to the Company’s deferred prosecution agreement with the Office and the United States Department of Justice, Criminal Division, Fraud Section, dated January 17, 2017 (“2017 DPA”), is continuing and shall be governed by the terms of the 2017 DPA. Neither the Company nor the Office intend for the Agreement or the Monitor’s mandate as set forth herein to diminish the scope of the Monitor’s mandate as set forth in the 2017 DPA. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 39 of 52

C-2 Monitor’s Mandate 3. The Monitor’s primary responsibility is to assess, oversee, and monitor the Monitored Entities’ compliance with their obligations under the terms of the Agreement, so as to specifically address and reduce the risk of any recurrence of the misconduct as described in the Statement of Facts attached to the Agreement as Attachment A. During the Term, while not duplicating efforts taken pursuant to the 2017 DPA, the Monitor shall assess, and, if necessary, make recommendations reasonably designed to detect fraudulent conduct by the Monitored Entities (“Misconduct”) and/or to reduce the risk of Misconduct by any director, officer, employee, or agent of any of the Monitored Entities, as set forth below in this Paragraph 3. In so doing, the Monitor shall: a. Review and monitor the Monitored Entities’ current and ongoing compliance with the Agreement. b. Review, evaluate, and monitor the Monitored Entities’ billing system and organization to ensure they are sufficient to maintain a reasonably effective framework to detect Misconduct related to billing (“Billing Misconduct”) and reduce Billing Misconduct by any director, officer, employee, or agent of any of the Monitored Entities. This may include: (i) assessing reports submitted by the Monitored Entities, as detailed below in Paragraph 6(a); (ii) analyzing tests of the billing system and organization conducted by the Monitored Entities or by third-parties retained by the Monitored Entities; (iii) directing that the Monitored Entities conduct additional testing of the billing system and organization and, if necessary, conducting independent testing to the extent the Office determines that such testing is appropriate pursuant to Paragraph 10 below; (iv) interviewing current and former directors, officers, employees, business partners, agents, and other persons, and/or conducting walk-throughs to evaluate the Monitored Entities’ billing system and ability to detect and reduce Billing Misconduct; and (v) making recommendations designed to ensure that the Monitored Entities’ billing system is designed reasonably to detect and mitigate Billing Misconduct. c. Review, assess, and monitor the Monitored Entities’ and senior management’s commitment to, and effective implementation of, training directors, officers, employees, or agents of the Monitored Entities related to promoting a culture that detects and reduces Misconduct (“Culture Training”). This may include: (i) reviewing and evaluating the action plan submitted by the Monitored Entities, as detailed in Paragraph 6(b) below; Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 40 of 52

C-3 (ii) reviewing, evaluating, and monitoring Culture Training programs to determine if they are effective; (iii) submitting questions to be included in surveys of employees related to Culture Training that shall be conducted by the Company; (iv) assessing the results of the surveys of employees related to Culture Training, and, if necessary, interviewing survey recipients as the Monitor deems appropriate; and (v) making recommendations designed to promote a culture that detects and reduces Misconduct. d. Review, evaluate, and monitor resources - including, but not limited to, staffing and financial - given to compliance and business ethics procedures and practices at the Monitored Entities to ensure they are sufficient to maintain a reasonably effective framework to detect and reduce Billing Misconduct by any director, officer, employee, or agent of any of the Monitored Entities (“Compliance Resources”). This may include: (i) reviewing and assessing reports submitted by the Monitored Entities, as detailed in Paragraph 6(c) below; (ii) reviewing and assessing Compliance Resources of the Monitored Entities; and (iii) making recommendations designed to ensure that the Company devotes adequate Compliance Resources to detect and reduce Billing Misconduct. The Company’s Obligations 4. The Company, its subsidiaries and majority-owned, operationally-controlled affiliates shall cooperate fully with the Monitor, including with respect to the Monitor’s Mandate, and the Monitor shall have the authority to take such reasonable steps as, in his or her view, may be necessary to be fully informed about the Monitored Entities’ compliance and ethics programs in accordance with the principles set forth herein and applicable law, including any applicable bank secrecy, confidential supervisory information, data protection and labor laws and regulations. To that end, the Company shall: facilitate the Monitor’s access to the Monitored Entities’ documents and resources; not limit such access, except as provided in Paragraphs 8 and 9 below; and provide guidance on applicable local law, such as relevant bank secrecy, confidential supervisory information, data protection and labor laws. The Company shall provide the Monitor with access to all information, documents, records, systems, facilities, and employees, as reasonably requested by the Monitor, that fall within the scope of the Monitor’s Mandate under Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 41 of 52

C-4 the Agreement. The Company shall use its best efforts to provide the Monitor with access to the Monitored Entities’ former employees and its third-party vendors, agents, and consultants. 5. Any disclosure by the Company to the Monitor concerning fraudulent or criminal conduct shall not relieve the Company of any otherwise applicable obligation to truthfully disclose such matters to the Office pursuant to the Agreement. 6. The Company shall provide the Monitor the following in the format requested by the Monitor: a. Within 45 calendar days of the commencement of the Term, a report setting forth the status, expected milestones, and resourcing devoted to the Company’s efforts to detect and reduce Billing Misconduct, and a plan addressing the scope and approach for testing of those efforts (“Billing Report”). Thereafter, the Company shall provide updated Billing Reports every 90 calendar days, or at such intervals as directed by the Monitor, and such reports shall include the results of the Company’s internal testing. The Billing Reports shall include a certification from the Company’s Chief Financial Officer: (i) reporting any efforts undertaken to detect and/or reduce Billing Misconduct since the previous Billing Report, and (ii) stating whether, in his or her belief, the Company has established and maintains controls reasonably effective to detect and reduce Billing Misconduct. The Monitor may direct that the Billing Reports address specific issues, and request data or information related to issues identified in the Billing Reports. The Company shall provide any requested information and/or data to the Monitor. The Monitor should, when possible, request information and/or data in a format consistent with the way the requested information and/or data is maintained in the Company’s systems. b. Within 45 calendar days of the commencement of the Term, a plan for Culture Training, including training new hires about Misconduct, and an assessment of the effectiveness of current Culture Training programs, including the results of a survey of employees related to Culture Training (“Culture Plan”). Thereafter, the Company shall provide updated Culture Plans every 180 calendar days, or at such intervals as directed by the Monitor, and such plans shall include materials sufficient to evaluate Culture Training programs conducted by the Company since the submission of the previous Culture Plan. The Culture Plans shall include a certification from the Head of Human Resources stating whether the Company’s employees have completed required Culture Training. The Monitor may direct that the Culture Plans address specific issues, and may also require the Company to submit additional periodic survey questions on Culture Training to a subset of directors, officers, or employees. The Company shall Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 42 of 52

C-5 conduct the surveys as requested by the Monitor and provide the consolidated results and the raw data to the Monitor. c. Within 45 calendar days of the commencement of the Term, a report that describes the structure of the Company’s compliance and business ethics procedures, practices and programs intended to detect and reduce Billing Misconduct (“Compliance Report”). The Compliance Report shall describe the Compliance Resources (including, but not limited to, financial and staffing), including the identity of each employee whose principal function is to design, evaluate, or test internal controls intended to detect and reduce Billing Misconduct. Thereafter, the Company shall provide updated Compliance Reports every 180 calendar days, or at such intervals as directed by the Monitor. The Compliance Reports shall include a certification from the Company’s Head of Human Resources that all employees whose principal function is to design, evaluation, or test internal controls to detect and reduce Billing Misconduct have been identified in the Compliance Report. The Compliance Reports shall further include a certification from the Company’s Chief Compliance Officer that, in his or her belief, the Compliance Resources are sufficient to maintain a reasonably effective system to detect and reduce Billing Misconduct. The Monitor may direct that the Compliance Reports address specific issues. The Company shall also provide, in the format and at the intervals requested by the Monitor, information concerning any material organizational change in the compliance function at the Company. The Monitor should, when possible, request information and/or data in a format consistent with the way that the requested information and/or data is maintained in the systems of the Monitored Entities. 7. The Company shall permit the Monitor to meet with the Examining and Audit Committee of the Company’s Board of Directors (“Audit Committee”) at intervals set by the Monitor, to discuss any issues covered by the Agreement. The Monitor shall, when possible, schedule such meetings at regularly scheduled meetings of the Audit Committee. Withholding Access 8. The parties agree that no attorney-client relationship shall be formed between the Company and the Monitor. In the event that the Company seeks to withhold from the Monitor access to information, documents, records, facilities, or current or former employees of the Company that may be subject to a claim of attorney-client privilege or to the attorney work product doctrine, or where the Company reasonably believes production would otherwise be inconsistent Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 43 of 52

C-6 with the applicable law, the Company shall work cooperatively with the Monitor to resolve the matter to the satisfaction of the Monitor. 9. If the matter cannot be resolved, at the request of the Monitor, the Company shall promptly provide written notice to the Monitor and the Office. Such notice shall include a general description of the nature of the information, documents, records, facilities or current or former employees that are being withheld, as well as the legal basis for withholding access. The Office may then consider whether to make a further request for access to such information, documents, records, facilities, or employees. Monitor’s Coordination with the Company and Review Methodology 10. In carrying out the Mandate, to the extent appropriate under the circumstances, the Monitor shall coordinate with Company personnel, including in-house counsel, compliance personnel, and internal auditors, on an ongoing basis. In carrying out the Mandate, the Monitor may: a. Rely on the product of the Company’s processes, such as the results of studies, surveys, plans, reviews, audits, reports, and analyses conducted by or on behalf of the Company, the Company’s internal resources (e.g., legal, compliance, and internal audit), or any other source of information provided by the Company to assist the Monitor in carrying out the Mandate through increased efficiency and Company-specific expertise (“Company product”), provided that the Monitor has confidence in the quality of the Company product. b. Rely on sampling and testing conducted by or on behalf of the Company (“Testing”) provided that Testing can be appropriately performed by the Monitored Entities and/or their consultants under the supervision of the Audit Committee. In the event the Monitor determines that Testing cannot be adequately performed by the Company, the Monitor, after consultation with the Company, may commission Testing to be performed by an independent entity at the Company’s expense. c. Conduct meetings with, and interviews of, relevant current and, where appropriate, former directors, officers, employees, business partners, agents, and other persons at mutually convenient times and places Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 44 of 52

C-7 concerning Billing Misconduct, Cultural Training, and/or Compliance Resources. The Monitor shall use, when feasible, Company product, Company Testing, and Company surveys in lieu of interviews, unless the Monitor concludes that their use is insufficient. Any disputes between the Company and the Monitor with respect to Company product, Testing and/or the Monitor’s request for meetings or interviews shall be decided by the Office in its sole discretion. 11. The Monitor’s reviews should use a risk-based approach in carrying out the Mandate, and thus, the Monitor is not expected to conduct a comprehensive review of all business lines, all business activities, or all markets. In carrying out the Mandate, while taking care not to duplicate reviews conducted pursuant to the 2017 DPA, the Monitor should consider, for instance, risks presented by the Company’s: a. Billing system, including the detection and reduction of Billing Misconduct; b. Organizational culture, including Cultural Training programs or lack thereof; and c. Compliance process, including the Compliance Resources. 12. In undertaking the reviews to carry out the Mandate, the Monitor may formulate conclusions based on among other things: a. Inspection of relevant documents, including reports, plans, surveys submitted by the Monitored Entities to the Monitor; b. Analyses, studies, and/or Testing of the Monitored Entities’ billing system, organizational culture, and compliance process and resources; c. On-site observation of selected management information or systems and procedures of the Monitored Entities at sample sites, including internal accounting controls, record-keeping, and internal audit procedures; and d. Meetings with, and interviews of, relevant current and, where appropriate, former directors, officers, employees, business partners, agents, and other persons at mutually convenient times and places concerning Billing Misconduct, Cultural Training, and/or Compliance Resources. The Monitor Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 45 of 52

C-8 may use surveys in lieu of conducting interviews or meetings when the Monitor deems doing so to be appropriate. Monitor’s Written Work Plans 13. To carry out the Mandate, during the Term, the Monitor shall conduct an initial review and prepare an initial report, as described in Paragraphs 15 to 18 below. The Monitor shall also conduct one follow-up review and prepare an additional report, as described in Paragraphs 19 to 22 below, unless the Monitorship is terminated or accelerated pursuant to Paragraph 1 above. In so doing, the Monitor shall: a. With respect to the initial report, after consultation with the Company, the Monitor shall prepare the first written work plan within 45 calendar days after receipt from the Company of its first Billing Report, Culture Plan, and Compliance Report (collectively, “Company Reports”), provided, however, that the Monitor may extend the time period for issuance of the first written work plan after consultation with the Company and with the prior approval of the Office. The first written work plan should set forth the manner in which the Monitor will review, evaluate, and monitor Misconduct, Culture Training, and Compliance Resources. The Company and the Office shall provide comments within 30 calendar days after receipt of the first written work plan. b. With respect to each follow-up report, after consultation with the Company, and review of the latest version of the Company Reports, the Monitor shall prepare a written work plan at least 30 calendar days prior to commencing any follow-up review, unless otherwise agreed by the Company, the Monitor, and the Office. The Company and the Office shall provide comments within 20 calendar days after receipt of any written work plan for a follow-up review. Any disputes between the Company and the Monitor with respect to any written work plan shall be decided by the Office in its sole discretion. 14. All written work plans shall identify with reasonable specificity the activities the Monitor plans to undertake in execution of the Mandate, including any written request for documents or information from the Company. The Monitor’s work plan for the initial review shall include such steps as are reasonably necessary to conduct an effective initial review in accordance Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 46 of 52

C-9 with the Mandate, including by developing an understanding, to the extent the Monitor deems appropriate, of the facts and circumstances surrounding any violation that may have occurred before the date of the Agreement. In developing such an understanding the Monitor is to rely to the extent possible on available information and documents provided by the Company. It is not intended that the Monitor will conduct his or her own inquiry into the historical events that gave rise to the Agreement. Initial Review 15. The initial review shall commence no later than 150 calendar days from the start of the Term unless otherwise agreed by the Company, the Monitor, and the Office. The Monitor shall issue a written report within 120 calendar days of commencing the initial review, setting forth the Monitor’s assessment of and, if necessary, recommendations related to the matters identified in Paragraph 3 above. The Monitor should consult the Company concerning his or her findings and recommendations on an ongoing basis and should consider the Company’s comments and input to the extent the Monitor deems appropriate. The Monitor may also choose to share a draft of reports with the Company prior to finalizing them. The Monitor’s reports need not recite or describe comprehensively the Company’s history or compliance policies, procedures, and practices, but rather may focus on those areas with respect to which the Monitor wishes to make recommendations, if any, for improvement or which the Monitor otherwise concludes merit particular attention. The Monitor shall provide the report to the Board of Directors of the Company and contemporaneously transmit a copy to the Chief of the Securities, Financial & Cyber Fraud Unit; United States Attorney’s Office for the District of Massachusetts; Xxxx Xxxxxx Xxxxxxx United States Courthouse; 0 Xxxxxxxxxx Xxx, Xxxxx 0000; Xxxxxx, Xxxxxxxxxxxxx 00000. After consultation with the Company, the Monitor may extend the time period for issuance of the initial report for a brief period of time with the prior approval of the Office. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 47 of 52

C-10 16. Within 150 calendar days after receiving the Monitor’s initial report, the Company shall adopt and implement all recommendations in the report, unless, within 60 calendar days of receiving the report, the Company notifies in writing the Monitor and the Office of any recommendation that the Company considers unduly burdensome, inconsistent with applicable law or regulations, impractical, excessively expensive, or otherwise inadvisable. With respect to any such recommendation, the Company need not adopt that recommendation within the 150 calendar days of receiving the report but shall propose in writing to the Monitor and Office an alternative policy, procedure or system (and the necessary timeframe for implementation) designed to achieve the same objective or purpose as the recommendation made by the Monitor. As to any recommendation on which the Company and the Monitor do not agree, the Company and Monitor shall attempt in good faith to reach an agreement within 45 calendar days after the Company serves the written notice. 17. In the event that the Company and the Monitor are unable to agree on an acceptable alternative proposal, the Company shall promptly consult with the Office. The Office may consider the Monitor’s recommendations and the Company’s reasons for not adopting the recommendation in determining whether the Company has fully complied with its obligations under the Agreement. Pending such determination, the Company shall not be required to implement any contested recommendation. 18. With respect to any recommendation that the Monitor determines cannot reasonably be implemented by the Company within 150 calendar days after receiving the initial report, the Monitor may extend the time period for implementation with prior written approval of the Office. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 48 of 52

C-11 Follow-Up Reviews 19. A follow-up review shall commence no later than 180 calendar days after the issuance of the initial report unless otherwise agreed by the Company, the Monitor, and the Office. The Monitor shall issue a written follow-up report within 120 calendar days of commencing the follow-up review, setting forth the Monitor’s assessment and, if necessary, making recommendations in the same fashion as set forth in Paragraph 15 with respect to the initial review. After consultation with the Company, the Monitor may extend the time period for completion of the follow-up review and issuance of the follow-up report for a brief period of time with prior written approval of the Office. 20. Within 120 calendar days after reviewing any follow-up report, the Company shall adopt and implement all recommendations in the report, unless, within 30 calendar days after receiving the report, the Company notifies in writing the Monitor and the Office concerning any recommendations that the Company considers unduly burdensome, inconsistent with applicable law or regulation, impractical, excessively expensive, or otherwise inadvisable. With respect to any such recommendation, the Company need not adopt that recommendation within the 90 calendar days of receiving the report but shall propose in writing to the Monitor and the Office an alternative policy, procedure, or system designed to achieve the same objective or purpose. As to any recommendation on which the Company and the Monitor do not agree, such parties shall attempt in good faith to reach an agreement within 30 calendar days after the Company serves the written notice. 21. In the event the Company and the Monitor are unable to agree on an acceptable alternative proposal, the Company shall promptly consult with the Office. The Office may consider the Monitor’s recommendation and the Company’s reasons for not adopting the recommendation in determining whether the Company has fully complied with its obligations under the Agreement. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 49 of 52

C-12 Pending such determination, the Company shall not be required to implement any contested recommendation(s). With respect to any recommendation that the Monitor determines cannot reasonably be implemented by the Company within 120 calendar days after receiving any follow- up report, the Monitor may extend the time period of implementation with prior written approval of the Office. The Monitor may undertake a second follow-up review no later than 150 calendar days after the issuance of the first follow-up report. The Monitor, if a second follow-up review occurs, shall issue a second follow-up report within 120 days of commencing the second review, and recommendations shall follow the same procedures described in Paragraphs 19 to 21. 22. In his or her final report, the Monitor shall certify whether the Company’s compliance program, including its policies and procedures, is reasonably designed and implemented to prevent and detect violations of anti-fraud laws. The final follow-up review and report shall be completed and delivered to the Offices no later than 30 days before the end of the Term. Monitor’s Discovery of Potential or Actual Misconduct 23. Except as set forth below, should the Monitor discover during the course of his or her engagement that: (i) questionable, improper, or illegal practices relating to anti-fraud laws, including but not limited to, misrepresentations made to customers; or (ii) violations of fraud-related aspects of the Company’s compliance or ethics programs, or anti-fraud laws either (a) may have occurred after the date on which the Agreement was signed, or (b) have not been adequately dealt with by the Company (collectively, “Potential Misconduct”), the Monitor shall immediately report the Potential Misconduct to the Company’s General Counsel, Chief Compliance Officer, and/or the Audit Committee for further action unless the Potential Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 50 of 52

C-13 Misconduct was already so disclosed. The Monitor also may report Potential Misconduct to the Office at any time, and shall report Potential Misconduct to the Office upon request. 24. In some instances, the Monitor should immediately report Potential Misconduct directly to the Office and not to the Company. The presence of any of the following factors militates in favor of reporting Potential Misconduct directly to the Office and not to the Company, namely, where the Potential Misconduct: poses a risk to public health, safety, or the environment; involves senior management of the Company; involves obstruction of justice; and/or otherwise poses a substantial risk of harm. 25. If the Monitor believes that Potential Misconduct actually occurred or may constitute a criminal or regulatory violation (“Actual Misconduct”), the Monitor shall immediately report the Actual Misconduct to the Office. If the Monitor discovers Actual Misconduct, the Monitor shall disclose the Actual Misconduct solely to the Office. The Monitor should disclose important activities in his or her discretion directly to the Office, and not to the Company, and, in such cases, disclosure of the Actual Misconduct to the General Counsel and Chief Compliance Officer, and/or the Audit Committee of the Company should occur as the Office and Monitor deem appropriate under the circumstances. 26. The Monitor shall address in his or her reports the appropriateness of the Company’s response to all disclosed Potential Misconduct or Actual Misconduct, whether previously disclosed to the Office or not. Further, if the Company, or any entity or person working directly or indirectly for or on behalf of the Company, withholds information necessary for the performance of the Monitor’s responsibilities, and the Monitor believes that such withholding is without just cause, the Monitor shall also immediately disclose that fact to the Office and address the Company’s failure to disclose the necessary information in his or her reports. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 51 of 52

C-14 27. Neither the Company, nor anyone acting on its behalf, shall take any action to retaliate against the Monitor for any such disclosures or for any other reason. Meetings During Pendency of Monitorship 28. The Monitor shall meet with the Office within 30 calendar days after providing each report to the Office to discuss the report, to be followed by a meeting between the Office, the Monitor, and the Company. 29. At least annually, and more frequently if appropriate, representatives from the Company and the Office will meet together to discuss the Monitorship and any suggestions, comments, or improvements the Company may wish to discuss with or propose to the Office, including with respect to the scope or costs of the Monitorship. Contemplated Confidentiality of Monitor’s Reports 30. The Monitor’s reports will likely include proprietary, financial, confidential, and competitive business information. Moreover, public disclosure of the reports could discourage cooperation, or impede pending or potential government investigations and thus undermine the objects of the Monitorship. For these reasons, among others, the reports and the contents thereof are intended to remain and shall remain non-public, except as otherwise agreed to by the Office and the Company in writing, or except to the extent the Office determines in its sole discretion that disclosure would be in furtherance of the Office’s discharge of its duties and responsibilities or is otherwise required by law. Case 1:21-cr-10153 Document 1-2 Filed 05/13/21 Page 52 of 52