Bank of America Corporation is a Delaware corporation, a bank holding company (BHC) and a financial holding company. When used in this report, "the Corporation" may refer to Bank of America Corporation individually, Bank of America Corporation and its subsidiaries, or certain of Bank of America Corporation's subsidiaries or affiliates. As part of our efforts to streamline the Corporation's organizational structure and reduce complexity and costs, the Corporation has reduced and intends to continue to reduce the number of its corporate subsidiaries, including through intercompany mergers.

Bank of America is one of the world's largest financial institutions, serving individual consumers, small- and middle-market businesses, institutional investors, large corporations and governments with a full range of banking, investing, asset management and other financial and risk management products and services. Our principal executive offices are located in the

Bank of America Corporate Center, 100 North Tryon Street, Charlotte, North Carolina 28255.

Bank of America's website is www.bankofamerica.com. Our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (Exchange Act) are available on our website at http://investor.bankofamerica.com under the heading Financial Information SEC Filings as soon as reasonably practicable after we electronically file such reports with, or furnish them to, the U.S. Securities and Exchange Commission (SEC). Also, we make available on http://investor.bankofamerica.com under the heading Corporate Governance: (i) our Code of Conduct (including our insider trading policy); (ii) our Corporate Governance Guidelines (accessible by clicking on the Governance Highlights link); and (iii) the charter of each active committee of our Board of Directors (the Board) (accessible by clicking on the committee

names under the Committee Composition link), and we also intend to disclose any amendments to our Code of Conduct, or waivers of our Code of Conduct on behalf of our Chief Executive Officer, Chief Financial Officer or Chief Accounting Officer, on our website. All of these corporate governance materials are also available free of charge in print to shareholders who request them in writing to: Bank of America Corporation, Attention: Office of the Corporate Secretary, Hearst Tower, 214 North Tryon Street, NC1-027-18-05, Charlotte, North Carolina 28255.

Through our banking and various nonbank subsidiaries throughout the U.S. and in international markets, we provide a diversified range of banking and nonbank financial services and products through four business segments: Consumer Banking , Global Wealth & Investment Management (GWIM), Global Banking and Global Markets, with the remaining operations recorded in All Other . Additional information related to our business segments and the products and services they provide is included in the information set forth on pages 29 through 40 of Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations (MD&A) and Note 24 – Business Segment Information to the Consolidated Financial Statements in Item 8. Financial Statements and Supplementary Data (Consolidated Financial Statements).

We operate in a highly competitive environment. Our competitors include banks, thrifts, credit unions, investment banking firms, investment advisory firms, brokerage firms, investment companies, insurance companies, mortgage banking companies, credit card issuers, mutual fund companies, and e-commerce and other internet-based companies. We compete with some of these competitors globally and with others on a regional or product basis.

Competition is based on a number of factors including, among others, customer service, quality and range of products and services offered, price, reputation, interest rates on loans and deposits, lending limits, and customer convenience. Our ability to continue to compete effectively also depends in large part on our ability to attract new employees and retain and motivate our existing employees, while managing compensation and other costs.

At December 31, 2016 , we had approximately 208,000 full-time equivalent employees. None of our domestic employees are subject to a collective bargaining agreement. Management considers our employee relations to be good.

The following discussion describes, among other things, elements of an extensive regulatory framework applicable to previously defined BHCs, financial holding companies, banks and broker-dealers, including specific information about Bank of America.

We are subject to an extensive regulatory framework applicable to BHCs, financial holding companies and banks and other financial services entities. U.S. federal regulation of banks, BHCs and financial holding companies is intended primarily for the protection of depositors and the Deposit Insurance Fund (DIF) rather than for the protection of shareholders and creditors.

As a registered financial holding company and BHC, the Corporation is subject to the supervision of, and regular inspection

by, the Board of Governors of the Federal Reserve System (Federal Reserve). Our U.S. banking subsidiaries (the Banks) organized as national banking associations are subject to regulation, supervision and examination by the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and the Federal Reserve. U.S. financial holding companies, and the companies under their control, are permitted to engage in activities considered "financial in nature" as defined by the Gramm-Leach-Bliley Act and related Federal Reserve interpretations. Unless otherwise limited by the Federal Reserve, a financial holding company may engage directly or indirectly in activities considered financial in nature provided the financial holding company gives the Federal Reserve after-the-fact notice of the new activities. The Gramm-Leach-Bliley Act also permits national banks to engage in activities considered financial in nature through a financial subsidiary, subject to certain conditions and limitations and with the approval of the OCC.

The 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act (Financial Reform Act) enacted sweeping financial regulatory reform across the financial services industry, including significant changes regarding capital adequacy and capital planning, stress testing, resolution planning, derivatives activities, prohibitions on proprietary trading and restrictions on debit interchange fees. As a result of the Financial Reform Act, we have altered and will continue to alter the way in which we conduct certain businesses.

We are also subject to various other laws and regulations, as well as supervision and examination by other regulatory agencies, all of which directly or indirectly affect our operations and management and our ability to make distributions to shareholders. For instance, our broker-dealer subsidiaries are subject to both U.S. and international regulation, including supervision by the SEC, the New York Stock Exchange and the Financial Industry Regulatory Authority, among others; our commodities businesses in the U.S. are subject to regulation by and supervision of the U.S. Commodity Futures Trading Commission (CFTC); our U.S. derivatives activity is subject to regulation and supervision of the CFTC and National Futures Association or the SEC, and in the case of the Banks, certain banking regulators; our insurance activities are subject to licensing and regulation by state insurance regulatory agencies; and our consumer financial products and services are regulated by the Consumer Financial Protection Bureau (CFPB).

Our non-U.S. businesses are also subject to extensive regulation by various non-U.S. regulators, including governments, securities exchanges, prudential regulators, central banks and other regulatory bodies, in the jurisdictions in which those businesses operate. For example, our financial services operations in the United Kingdom (U.K.) are subject to regulation by and supervision of the Prudential Regulatory Authority for prudential matters, and the Financial Conduct Authority for the conduct of business matters.

Under the Financial Reform Act and Federal Reserve policy, BHCs are expected to act as a source of financial strength to each subsidiary bank and to commit resources to support each such subsidiary. Similarly, under the cross-guarantee provisions of the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA), in the event of a loss suffered or anticipated by the FDIC, either as a result of default of a banking subsidiary or related to FDIC assistance provided to such a subsidiary in danger of default,

the affiliate banks of such a subsidiary may be assessed for the FDIC's loss, subject to certain exceptions.

Pursuant to Section 23A and 23B of the Federal Reserve Act, as implemented by the Federal Reserve's Regulation W, the Banks are subject to restrictions that limit certain types of transactions between the Banks and their nonbank affiliates. In general, U.S. banks are subject to quantitative and qualitative limits on extensions of credit, purchases of assets and certain other transactions involving its nonbank affiliates. Additionally, transactions between U.S. banks and their nonbank affiliates are required to be on arm's length terms and must be consistent with standards of safety and soundness.

Deposits placed at U.S. domiciled banks (U.S. banks) are insured by the FDIC, subject to limits and conditions of applicable law and the FDIC's regulations. Pursuant to the Financial Reform Act, FDIC insurance coverage limits were permanently increased to $250,000 per customer. All insured depository institutions are required to pay assessments to the FDIC in order to fund the DIF.

The FDIC is required to maintain at least a designated minimum ratio of the DIF to insured deposits in the U.S. The Financial Reform Act requires the FDIC to assess insured depository institutions to achieve a DIF ratio of at least 1.35 percent by September 30, 2020. The FDIC has adopted regulations that establish a long-term target DIF ratio of greater than two percent. The DIF ratio is currently below the required targets and the FDIC has adopted a restoration plan that may result in increased deposit insurance assessments. Beginning in the third quarter of 2016, the FDIC implemented a surcharge to accelerate compliance to the 1.35 percentage requirement. Deposit insurance assessment rates are subject to change by the FDIC and will be impacted by the overall economy and the stability of the banking industry as a whole. For more information regarding deposit insurance, see Item 1A. Risk Factors – Regulatory, Compliance and Legal on page 12 .

As a financial holding company, we and our bank subsidiaries are subject to the risk-based capital guidelines issued by the Federal Reserve and other U.S. banking regulators, including the FDIC and the OCC. These rules are complex and are evolving as U.S. and international regulatory authorities propose and enact enhanced capital and liquidity rules. The Corporation seeks to manage its capital position to maintain sufficient capital to meet these regulatory guidelines and to support our business activities. These evolving rules are likely to influence our planning processes for, and may require additional, regulatory capital and liquidity, as well as impose additional operational and compliance costs on the Corporation. In addition, the Federal Reserve and the OCC have adopted guidelines that establish minimum standards for the design, implementation and board oversight of BHC's and national banks' risk governance frameworks. The Federal Reserve has also issued a final rule requiring us to maintain minimum amounts of long-term debt meeting specified eligibility requirements.

For more information on regulatory capital rules, capital composition and pending or proposed regulatory capital changes, see Capital Management – Regulatory Capital in the MD&A on page 45 , and Note 16 – Regulatory Requirements and Restrictions to the Consolidated Financial Statements , which are incorporated by reference in this Item 1.

We are subject to various regulatory policies and requirements relating to capital actions, including payment of dividends and common stock repurchases. For instance, Federal Reserve regulations require major U.S. BHCs to submit a capital plan as part of an annual Comprehensive Capital Analysis and Review (CCAR). The purpose of the CCAR is to assess the capital planning process of the BHC, including any planned capital actions, such as payment of dividends and common stock repurchases.

Our ability to pay dividends is also affected by the various minimum capital requirements and the capital and non-capital standards established under the FDICIA. The right of the Corporation, our shareholders and our creditors to participate in any distribution of the assets or earnings of our subsidiaries is further subject to the prior claims of creditors of the respective subsidiaries.

If the Federal Reserve finds that any of our Banks are not "well-capitalized" or "well-managed," we would be required to enter into an agreement with the Federal Reserve to comply with all applicable capital and management requirements, which may contain additional limitations or conditions relating to our activities. Additionally, the applicable federal regulatory authority is authorized to determine, under certain circumstances relating to the financial condition of a bank or BHC, that the payment of dividends would be an unsafe or unsound practice and to prohibit payment thereof.

For more information regarding the requirements relating to the payment of dividends, including the minimum capital requirements, see Note 13 – Shareholders' Equity and Note 16 – Regulatory Requirements and Restrictions to the Consolidated Financial Statements .

Many of our subsidiaries, including our bank and broker-dealer subsidiaries, are subject to laws that restrict dividend payments, or authorize regulatory bodies to block or reduce the flow of funds from those subsidiaries to the parent company or other subsidiaries.

As a BHC with greater than $50 billion of assets, the Corporation is required by the Federal Reserve and the FDIC to annually submit a plan for a rapid and orderly resolution in the event of material financial distress or failure.

Such resolution plan is intended to be a detailed roadmap for the orderly resolution of a BHC and material entities pursuant to the U.S. Bankruptcy Code and other applicable resolution regimes under one or more hypothetical scenarios assuming no extraordinary government assistance.

If both the Federal Reserve and the FDIC determine that the Corporation's plan is not credible, the Federal Reserve and the FDIC may jointly impose on us more stringent capital, leverage or liquidity requirements or restrictions on our growth, activities or operations. A description of our plan is available on the Federal Reserve and FDIC websites.

The FDIC also requires the submission of a resolution plan for Bank of America, N.A. (BANA), which must describe how the insured depository institution would be resolved under the bank resolution provisions of the Federal Deposit Insurance Act. A description of this plan is also available on the FDIC's website.

We continue to make substantial progress to enhance our resolvability, including simplifying our legal entity structure and business operations, and increasing our preparedness to

implement our resolution plan, both from a financial and operational standpoint.

Similarly, in the U.K., rules have been issued requiring the submission of significant information about certain U.K.-incorporated subsidiaries and other financial institutions, as well as branches of non-U.K. banks located in the U.K. (including information on intra-group dependencies, legal entity separation and barriers to resolution) to allow the Bank of England to develop resolution plans. As a result of the Bank of England's review of the submitted information, we could be required to take certain actions over the next several years which could increase operating costs and potentially result in the restructuring of certain businesses and subsidiaries.

For more information regarding our resolution, see Item 1A. Risk Factors – Regulatory, Compliance and Legal on page 12 .

Under the Federal Deposit Insurance Act, the FDIC may be appointed receiver of an insured depository institution if it is insolvent or in certain other circumstances. In addition, under the Financial Reform Act, when a systemically important financial institution (SIFI) such as the Corporation is in default or danger of default, the FDIC may be appointed receiver in order to conduct an orderly liquidation of such institution. In the event of such appointment, the FDIC could, among other things, invoke the orderly liquidation authority, instead of the U.S. Bankruptcy Code, if the Secretary of the Treasury makes certain financial distress and systemic risk determinations. The orderly liquidation authority is modeled in part on the Federal Deposit Insurance Act, but also adopts certain concepts from the U.S. Bankruptcy Code.

The orderly liquidation authority contains certain differences from the U.S. Bankruptcy Code. For example, in certain circumstances, the FDIC could permit payment of obligations it determines to be systemically significant (e.g., short-term creditors or operating creditors) in lieu of paying other obligations (e.g., long-term creditors) without the need to obtain creditors' consent or prior court review. The insolvency and resolution process could also lead to a large reduction or total elimination of the value of a BHC's outstanding equity, as well as impairment or elimination of certain debt.

In 2013, the FDIC issued a notice describing its preferred "single point of entry" strategy for resolving SIFIs. Under this approach, the FDIC could replace a distressed BHC with a bridge holding company, which could continue operations and result in an orderly resolution of the underlying bank, but whose equity is held solely for the benefit of creditors of the original BHC.

Furthermore, the Federal Reserve Board has finalized regulations regarding the minimum levels of long-term debt required for BHCs to ensure there is adequate loss absorbing capacity in the event of a resolution.

For more information regarding our resolution, see Item 1A. Risk Factors – Regulatory, Compliance and Legal on page 12 .

The Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 permits a BHC to acquire banks located in states other than its home state without regard to state law, subject to certain conditions, including the condition that the BHC, after and as a result of the acquisition, controls no more than 10 percent of the total amount of deposits of insured depository institutions in the U.S. and no more than 30 percent or such lesser or greater amount set by state law of such deposits in that state. At June 30, 2016,

we held greater than 10 percent of the total amount of deposits of insured depository institutions in the U.S.

In addition, the Financial Reform Act restricts acquisitions by a financial institution if, as a result of the acquisition, the total liabilities of the financial institution would exceed 10 percent of the total liabilities of all financial institutions in the U.S. At June 30, 2016, our liabilities did not exceed 10 percent of the total liabilities of all financial institutions in the U.S.

The Volcker Rule prohibits insured depository institutions and companies affiliated with insured depository institutions (collectively, banking entities) from engaging in short-term proprietary trading of certain securities, derivatives, commodity futures and options for their own account. The Volcker Rule also imposes limits on banking entities' investments in, and other relationships with, hedge funds and private equity funds, although the Federal Reserve extended the conformance period for certain existing covered investments and relationships to July 2017 and has issued a process for seeking additional extensions related to certain legacy covered funds. The Volcker Rule provides exemptions for certain activities, including market-making, underwriting, hedging, trading in government obligations, insurance company activities, and organizing and offering hedge funds and private equity funds. The Volcker Rule also clarifies that certain activities are not prohibited, including acting as agent, broker or custodian. A banking entity with significant trading operations, such as the Corporation, is required to maintain a detailed compliance program to comply with the restrictions of the Volcker Rule.

Our derivatives operations are subject to extensive regulation globally. Various regulations have been promulgated since the financial crisis, including those under the Financial Reform Act, the European Union Markets in Financial Instruments Directive II/Regulation and the European Market Infrastructure Regulation, that regulate or will regulate the derivatives market by: requiring clearing and exchange trading of certain derivatives; imposing new capital, margin, reporting, registration and business conduct requirements for certain market participants; imposing position limits on certain over-the-counter (OTC) derivatives; and requiring the registration of U.S.-based derivatives dealers as swap dealers. In addition, in support of efforts to enhance the resolvability of SIFIs in an orderly manner, we and 23 other SIFIs have adhered to a protocol published by International Swaps and Derivatives Association, Inc. (ISDA) amending certain financial contracts to provide for contractual recognition of stays of termination rights under various statutory resolution regimes. In addition, the U.K., Germany, and Japan have adopted resolution stay regulations and other G-20 prudential regulators, including U.S. regulators, are expected to adopt similar resolution stay regulations in the near future.

Our consumer businesses are subject to extensive regulation and oversight by federal and state regulators. Certain federal consumer finance laws to which we are subject, including, but not limited to, the Equal Credit Opportunity Act, the Home Mortgage Disclosure Act, the Electronic Fund Transfer Act, the Fair Credit Reporting Act, the Real Estate Settlement Procedures Act, the Truth in Lending Act and Truth in Savings Act, are enforced by the CFPB. Other

federal consumer finance laws, such as the Servicemembers Civil Relief Act, are enforced by the OCC.

We are subject to many U.S. federal, state and international laws and regulations governing requirements for maintaining policies and procedures to protect the non-public confidential information of our customers and employees. The Gramm-Leach-Bliley Act requires the Banks to periodically disclose Bank of America's privacy policies and practices relating to sharing such information and enables retail customers to opt out of our ability to share information with unaffiliated third parties under certain circumstances. Other laws and regulations, at the international, federal and state level, impact our ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. The Gramm-Leach-Bliley Act also requires the Banks to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures for the protection of personal and confidential information are in effect across all businesses and geographic locations. The European Union (EU) has adopted the General Data Protection Regulation (GDPR) which replaces the Data Protection Directive and related implementing national laws in the Member States. The compliance date for the GDPR is May 25, 2018. It will have impacts across the enterprise and impact assessments are underway. Meanwhile other legislation, regulatory activity (the proposed e-Privacy Regulation, elements of the Fourth Money Laundering Directive) and court proceedings, and any impact of bilateral U.S. and EU political developments on the validity of cross-border data transfer mechanisms from the EU continue to lend uncertainty to privacy compliance in the EU.

In the course of conducting our business operations, we are exposed to a variety of risks, some of which are inherent in the financial services industry and others of which are more specific to our own businesses. The discussion below addresses the most significant factors, of which we are currently aware, that could affect our businesses, results of operations and financial condition. Additional factors that could affect our businesses, results of operations and financial condition are discussed in Forward-looking Statements in the MD&A on page 20 . However, other factors not discussed below or elsewhere in this Annual Report on Form 10-K could also adversely affect our businesses, results of operations and financial condition. Therefore, the risk factors below should not be considered a complete list of potential risks that we may face. For more information on how we manage risks, see Managing Risk in the MD&A on page 41 .

Any risk factor described in this Annual Report on Form 10-K or in any of our other SEC filings could by itself, or together with other factors, materially adversely affect our liquidity, competitive position, business, reputation, results of operations, capital position or financial condition, including by materially increasing our expenses or decreasing our revenues, which could result in material losses.

Our business and results of operations may be adversely affected by the U.S. and international financial markets, U.S. and non-U.S. fiscal and monetary policies and economic conditions generally.

Financial markets and general economic, political and social conditions in the U.S. and abroad, including the level and volatility of interest rates, gross domestic product (GDP) growth, inflation, consumer spending, employment levels, energy prices, home prices, bankruptcies, fluctuations or other significant changes in both debt and equity capital markets and currencies, liquidity of the global financial markets, the growth of global trade and commerce, trade policies, the availability and cost of capital and credit, investor sentiment and confidence, and the sustainability of economic growth all affect our business.

In the U.S. and abroad, uncertainties surrounding monetary and fiscal policies present economic challenges. Actions taken by the Federal Reserve and other central banks are beyond our control and difficult to predict and can affect the value of financial instruments and other assets, such as debt securities and mortgage servicing rights (MSRs), and impact our borrowers, potentially increasing delinquency rates.

Changes to existing U.S. laws and regulatory policies including those related to financial regulation, taxation, international trade, fiscal policy and healthcare may adversely impact us. For example, significant fiscal policy initiatives, including tax changes and new spending programs, may increase uncertainty surrounding the formulation of U.S. monetary policy and direction, and volatility of interest rates. Higher U.S. interest rates relative to other major economies could increase the likelihood of a more volatile and appreciating U.S. dollar. Changes to certain trade policies or measures could upset financial markets, and disrupt world trade and commerce.

Any of these developments could adversely affect our consumer and commercial businesses, our securities and derivatives portfolios, our level of charge-offs and provision for credit losses, the carrying value of our deferred tax assets, our capital levels and liquidity and the costs of running our business and our results of operations.

For more information about economic conditions and challenges discussed above, see Executive Summary – 2016 Economic and Business Environment in the MD&A on page 21 .

Increased market volatility and adverse changes in other financial or capital market conditions may increase our market risk.

Our liquidity, competitive position, business, results of operations and financial condition are affected by market risks such as changes in interest and currency exchange rates, equity and futures prices, the implied volatility of interest rates, credit spreads and other economic and business factors. These market risks may adversely affect, among other things, (i) the value of our on- and off-balance sheet securities, trading assets, other financial instruments, and MSRs, (ii) the cost of debt capital and our access to credit markets, (iii) the value of assets under management (AUM), (iv) fee income relating to AUM, (v) customer allocation of capital among investment alternatives, (vi) the volume of client activity in our trading operations, (vii) investment banking fees, and (viii) the general profitability and risk level of the transactions in which we engage. For example, the value of certain of our assets is sensitive to changes in market interest rates. If the Federal Reserve or a non-U.S. central bank changes or signals a change in monetary policy, market interest rates could be affected, which could adversely impact the value of such assets. In addition, while

we expect our net interest income to benefit from increases in interest rates that occurred in the fourth quarter of 2016, if the ongoing low interest rate environment continues, this could negatively impact our liquidity, financial condition or results of operations, including future revenue and earnings growth.

We use various models and strategies to assess and control our market risk exposures but those are subject to inherent limitations. For more information regarding models and strategies, see Item 1A. Risk Factors – Other on page 15 . In times of market stress or other unforeseen circumstances, such as the market conditions experienced in 2008 and 2009, previously uncorrelated indicators may become correlated and vice versa. These types of market movements have at times limited the effectiveness of our hedging strategies and have caused us to incur significant losses, and they may do so in the future. These changes in correlation can be exacerbated where other market participants are using risk or trading models with assumption or algorithms that are similar to ours. In these and other cases, it may be difficult to reduce our risk positions due to activity of other market participants or widespread market dislocations, including circumstances where asset values are declining significantly or no market exists for certain assets. To the extent that we own securities that do not have an established liquid trading market or are otherwise subject to restrictions on sale or hedging, we may not be able to reduce our positions and therefore reduce our risk associated with such positions. In addition, challenging market conditions may also adversely affect our investment banking fees.

For more information about market risk and our market risk management policies and procedures, see Market Risk Management in the MD&A on page 79 .

We may incur losses if the value of certain assets decline, including due to changes in interest rates and prepayment speeds.

We have a large portfolio of financial instruments, including, among others, certain loans and loan commitments, loans held-for-sale, securities financing agreements, asset-backed secured financings, long-term deposits, long-term debt, trading account assets and liabilities, derivative assets and liabilities, available-for-sale (AFS) debt and marketable equity securities, other debt securities, certain MSRs and certain other assets and liabilities that we measure at fair value. We determine the fair values of these instruments based on applicable accounting guidance which requires an entity to base fair value on exit price and to maximize the use of observable inputs and minimize the use of unobservable inputs in fair value measurements. The fair values of these financial instruments include adjustments for market liquidity, credit quality, funding impact on certain derivatives and other transaction-specific factors, where appropriate.

Gains or losses on these instruments can have a direct impact on our results of operations, including higher or lower mortgage banking income and earnings, unless we have effectively hedged our exposures. For example, decreases in interest rates and increases in mortgage prepayment speeds, which are influenced by interest rates and other factors such as reductions in mortgage insurance premiums and origination costs, could adversely impact the value of our MSR asset, cause a significant acceleration of purchase premium amortization on our mortgage portfolio, because a decline in long-term interest rates shortens the expected lives of the securities, and adversely affect our net interest margin. Conversely, increases in interest rates may result in a decrease in residential mortgage loan originations. In addition, increases in interest rates may adversely impact the fair value of debt securities and, accordingly, for debt securities classified as

AFS, may adversely affect accumulated other comprehensive income and, thus, capital levels.

Fair values may be impacted by declining values of the underlying assets or the prices at which observable market transactions occur and the continued availability of these transactions. The financial strength of counterparties, with whom we have economically hedged some of our exposure to these assets, also will affect the fair value of these assets. Sudden declines and volatility in the prices of assets may curtail or eliminate trading activities in these assets, which may make it difficult to sell, hedge or value these assets. The inability to sell or effectively hedge assets reduces our ability to limit losses in such positions and the difficulty in valuing assets may increase our risk-weighted assets, which requires us to maintain additional capital and increases our funding costs. Asset values also directly impact revenues in our wealth management and related advisory businesses. We receive asset-based management fees based on the value of our clients' portfolios or investments in funds managed by us and, in some cases, we also receive performance fees based on increases in the value of such investments. Declines in asset values can reduce the value of our clients' portfolios or fund assets, which in turn can result in lower fees earned for managing such assets.

For more information about fair value measurements, see Note 20 – Fair Value Measurements to the Consolidated Financial Statements . For more information about our asset management businesses, see GWIM in the MD&A on page 33 . For more information about interest rate risk management, see Interest Rate Risk Management for the Banking Book in the MD&A on page 84 .

If we are unable to access the capital markets, continue to maintain deposits, or our borrowing costs increase, our liquidity and competitive position will be negatively affected.

Liquidity is essential to our businesses. We fund our assets primarily with globally sourced deposits in our bank entities, as well as secured and unsecured liabilities transacted in the capital markets. We rely on certain secured funding sources, such as repo markets, which are typically short-term and credit-sensitive in nature. We also engage in asset securitization transactions, including with the government-sponsored enterprises (GSEs), to fund consumer lending activities. Our liquidity could be adversely affected by any inability to access the capital markets; illiquidity or volatility in the capital markets; changes to our relationships with our funding providers based on real or perceived changes in our risk profile; changes in regulations or guidance that impact our funding avenues or ability to access certain funding sources; increased regulatory liquidity, capital and margin requirements for our U.S. or international banks and their nonbank subsidiaries; significant failure by a third party, such as a clearing agent or custodian; reputational issues; or negative perceptions about our short- or long-term business prospects, including downgrades of our credit ratings. Several of these factors may arise due to circumstances beyond our control, such as a general market disruption or shock, negative views about the financial services industry generally or a specific news event, changes in the regulatory environment, actions by credit rating agencies or an operational problem that affects third parties or us. The impact of these events, whether within our control or not, could include an inability to sell assets, redeem investments or unforeseen outflows of cash, including customer deposits, additional funding for

commitments and contingencies, as well as unexpected collateral calls, among other things.

Our cost of obtaining funding is directly related to prevailing market interest rates and to our credit spreads. Credit spreads are the amount in excess of the interest rate of U.S. Treasury securities, or other benchmark securities, of a similar maturity that we need to pay to our funding providers. Increases in interest rates and our credit spreads can increase the cost of our funding. Changes in our credit spreads are market-driven and may be influenced by market perceptions of our creditworthiness. Changes to interest rates and our credit spreads occur continuously and may be unpredictable and highly volatile. Additionally, concentrations within our funding profile, such as maturities, currencies, or counterparties, can reduce our funding efficiency.

For more information about our liquidity position and other liquidity matters, including credit ratings and outlooks and the policies and procedures we use to manage our liquidity risks, see Liquidity Risk in the MD&A on page 51 .

Adverse changes to our credit ratings from the major credit rating agencies could significantly limit our access to funding or the capital markets, increase our borrowing costs, or trigger additional collateral or funding requirements.

Our borrowing costs and ability to raise funds are directly impacted by our credit ratings. In addition, credit ratings may be important to customers or counterparties when we compete in certain markets and when we seek to engage in certain transactions, including OTC derivatives. Credit ratings and outlooks are opinions expressed by rating agencies on our creditworthiness and that of our obligations or securities, including long-term debt, short-term borrowings, preferred stock and asset securitizations. Our credit ratings are subject to ongoing review by rating agencies, which consider a number of factors, including our own financial strength, performance, prospects and operations as well as factors not under our control such as the likelihood of the U.S. government providing meaningful support to us or our subsidiaries in a crisis.

Rating agencies could make adjustments to our credit ratings at any time, and there can be no assurance that downgrades will not occur.

A reduction in certain of our credit ratings could negatively affect our liquidity, access to credit markets, the related cost of funds, our businesses and certain trading revenues, particularly in those businesses where counterparty creditworthiness is critical. If the short-term credit ratings of our parent company, bank or broker-dealer subsidiaries were downgraded by one or more levels, we may suffer the potential loss of access to short-term funding sources such as repo financing, and/or increased cost of funds. Under the terms of certain OTC derivative contracts and other trading agreements, if our or our subsidiaries' credit ratings are downgraded, the counterparties may require additional collateral or terminate these contracts or agreements.

While certain potential impacts are contractual and quantifiable, the full consequences of a credit ratings downgrade to a financial institution are inherently uncertain, as they depend upon numerous dynamic, complex and inter-related factors and assumptions, including whether any downgrade of a firm's long-term credit ratings precipitates downgrades to its short-term credit ratings, and assumptions about the potential behaviors of various customers, investors and counterparties.

For information about the amount of additional collateral required and derivative liabilities that would be subject to unilateral termination at December 31, 2016 if the rating agencies had downgraded their long-term senior debt ratings for the Corporation or certain subsidiaries by each of two incremental notches, see Credit-related Contingent Features and Collateral in Note 2 – Derivatives to the Consolidated Financial Statements .

For more information about our credit ratings and their potential effects to our liquidity, see Liquidity Risk – Credit Ratings in the MD&A on page 54 and Note 2 – Derivatives to the Consolidated Financial Statements .

Bank of America Corporation is a holding company and we depend upon our subsidiaries for liquidity, including our ability to pay dividends to shareholders and to fund payments on our other obligations. Applicable laws and regulations, including capital and liquidity requirements, and actions taken pursuant to our resolution plan could restrict our ability to transfer funds from our subsidiaries to Bank of America Corporation or other subsidiaries.

Bank of America Corporation, as the parent company, is a separate and distinct legal entity from our banking and nonbank subsidiaries. We evaluate and manage liquidity on a legal entity basis. Legal entity liquidity is an important consideration as there are legal, contractual and other limitations on our ability to utilize liquidity from one legal entity to satisfy the liquidity requirements of another, including the parent company. The parent company depends on dividends, distributions, loans, advances and other payments from our banking and nonbank subsidiaries to fund dividend payments on our common stock and preferred stock and to fund all payments on our other obligations, including debt obligations. Many of our subsidiaries, including our bank and broker-dealer subsidiaries, are subject to laws that restrict dividend payments, or authorize regulatory bodies to block or reduce the flow of funds from those subsidiaries to the parent company or other subsidiaries. Our bank and broker-dealer subsidiaries are subject to restrictions on their ability to lend or transact with affiliates and to minimum regulatory capital and liquidity requirements, as well as restrictions on their ability to use funds deposited with them in bank or brokerage accounts to fund their businesses. Intercompany arrangements we entered into in connection with our resolution planning submissions could restrict the amount of funding available to the Corporation from our subsidiaries in certain severely adverse liquidity scenarios. For more information regarding our resolution plan, see Item 1A. Risk Factors – Other on page 15 .

Additional restrictions on related party transactions, increased capital and liquidity requirements and additional limitations on the use of funds on deposit in bank or brokerage accounts, as well as lower earnings, can reduce the amount of funds available to meet the obligations of the parent company and even require the parent company to provide additional funding to such subsidiaries. Also, regulatory action that requires additional liquidity at each of our subsidiaries could impede access to funds we need to pay our obligations or pay dividends. In addition, our right to participate in a distribution of assets upon a subsidiary's liquidation or reorganization is subject to prior claims of the subsidiary's creditors. For more information regarding our ability to pay dividends, see Capital Management in the MD&A on page 45 and Note 13 – Shareholders' Equity to the Consolidated Financial Statements .

In the event of our resolution under our preferred single point of entry resolution strategy, such resolution could materially adversely affect our liquidity and financial condition and our ability to pay dividends to shareholders and to pay our obligations.

Bank of America Corporation, our parent holding company, is required annually to submit a plan to the FDIC and Federal Reserve, describing its resolution strategy under the U.S. Bankruptcy Code in the event of material financial distress or failure. In the current plan, Bank of America Corporation's preferred resolution strategy is a single point of entry strategy. This strategy provides that only the parent holding company files for resolution under the U.S. Bankruptcy Code and contemplates providing certain key operating subsidiaries with sufficient capital and liquidity to operate through severe stress and to enable such subsidiaries to continue operating or be wound down in a solvent manner following a bankruptcy. Bank of America Corporation and key subsidiaries have entered into intercompany arrangements governing the contribution of capital and liquidity. As part of these arrangements, Bank of America Corporation transferred certain of its assets (and has agreed to transfer additional assets) to a wholly-owned holding company subsidiary in exchange for a subordinated note. Certain remaining assets secure ongoing obligations under these intercompany arrangements. The wholly-owned holding company subsidiary has also provided a committed line of credit which, in addition to cash, dividends and interest payments, including interest payments received in respect of the subordinated note, may be used to fund its obligations. These intercompany arrangements include provisions to terminate the line of credit, forgive the subordinated note and require Bank of America Corporation to contribute its remaining financial assets to the wholly-owned holding company subsidiary if its projected liquidity resources deteriorate so severely that resolution becomes imminent, which could materially and adversely affect our liquidity and ability to meet our payment obligations.

Further, if the FDIC and Federal Reserve jointly determine that Bank of America Corporation's resolution plan is not credible, they could impose more stringent capital, leverage or liquidity requirements or restrictions on our growth, activities or operations, and we could be required to take certain actions that could impose operating costs and could potentially result in the divestiture or restructuring of certain businesses and subsidiaries.

In addition, under the Financial Reform Act, when a global systemically important bank (G-SIB) such as Bank of America Corporation is in default or danger of default, the FDIC may be appointed receiver in order to conduct an orderly liquidation of such institution. In the event of such appointment, the FDIC could, among other things, invoke the orderly liquidation authority, instead of the U.S. Bankruptcy Code, if the Secretary of the Treasury makes certain financial distress and systemic risk determinations. In 2013, the FDIC issued a notice describing its preferred "single point of entry" strategy for resolving a G-SIB. Under this approach, the FDIC could replace Bank of America Corporation with a bridge holding company, which could continue operations and result in an orderly resolution of the underlying bank, but whose equity is held solely for the benefit of our creditors. The FDIC's single point of entry strategy may result in our security holders suffering greater losses than would have been the case under a bankruptcy proceeding or a different resolution strategy.

We are subject to the Federal Reserve Board's recently finalized rules requiring U.S. G-SIBs to maintain minimum amounts of external total loss-absorbing capacity (TLAC).

On December 15, 2016, the Federal Reserve issued a final rule establishing external TLAC requirements to improve the resolvability and resiliency of large, interconnected BHCs. The rule will be effective January 1, 2019 and U.S. G-SIBs, including Bank of America, will be required to maintain a minimum external TLAC. We estimate our minimum required external TLAC would be the greater of 22.5 percent of risk-weighted assets or 9.5 percent of SLR leverage exposure. In addition, U.S. G-SIBS must meet a minimum long-term debt requirement. Our minimum required long-term debt is estimated to be the greater of 8.5 percent of risk-weighted assets or 4.5 percent of SLR leverage exposure. Actions required to comply with the minimum external TLAC requirement by January 1, 2019 could impact our cost of funding and liquidity risk management plans.

Economic or market disruptions, insufficient credit loss reserves or concentration of credit risk may result in an increase in the provision for credit losses, which could have an adverse effect on our financial condition and results of operations.

A number of our products expose us to credit risk, including loans, letters of credit, derivatives, debt securities, trading account assets and assets held-for-sale. The financial condition of our consumer and commercial borrowers and counterparties could adversely affect our financial condition and results of operations.

Global and U.S. economic conditions may impact our credit portfolios. Economic or market disruptions would likely increase the risk that borrowers or counterparties would default or become delinquent in their obligations to us. Increases in delinquencies and default rates could adversely affect our consumer credit card, home equity, residential mortgage and purchased credit-impaired portfolios through increased charge-offs and provisions for credit losses. Additionally, increased credit risk could also adversely affect our commercial loan portfolios with weakened customer and collateral positions.

We estimate and establish an allowance for credit losses for losses inherent in our lending activities (including unfunded lending commitments), excluding those measured at fair value, through a charge to earnings. The process for determining the amount of the allowance requires us to make difficult and complex judgments, including loss forecasts on how borrowers will react to changing economic conditions. The ability of our borrowers or counterparties to repay their obligations will likely be impacted by changes in future economic conditions, which in turn could impact the accuracy of our loss forecasts and allowance estimate. There is also the possibility that we will fail to accurately identify the appropriate economic indicators or that we will fail to accurately estimate their impacts.

We may suffer unexpected losses if the models and assumptions we use to establish reserves and make judgments in extending credit to our borrowers or counterparties become less predictive of future events. In addition, external factors, such as natural disasters, can influence recognition of credit losses in our portfolios and impact our allowance for credit losses. Although we believe that our allowance for credit losses was in compliance with applicable accounting standards at December 31, 2016 , there is no guarantee that it will be sufficient to address credit losses, particularly if economic conditions deteriorate. In such an event,

we may increase the size of our allowance which would reduce our earnings.

In the ordinary course of our business, we also may be subject to a concentration of credit risk in a particular industry, geographic location, counterparty, borrower or issuer. A deterioration in the financial condition or prospects of a particular industry or a failure or downgrade of, or default by, any particular entity or group of entities could negatively affect our businesses and the processes by which we set limits and monitor the level of our credit exposure to individual entities, industries and countries may not function as we have anticipated. While our activities expose us to many different industries and counterparties, we routinely execute a high volume of transactions with counterparties in the financial services industry, including broker-dealers, commercial banks, investment banks, insurers, mutual funds and hedge funds, and other institutional clients. This has resulted in significant credit concentration with respect to this industry. Financial services institutions and other counterparties are inter-related because of trading, funding, clearing or other relationships. As a result, defaults by, or even market uncertainty about the financial stability of one or more financial services institutions, or the financial services industry generally, could lead to market-wide liquidity disruptions, losses and defaults. Many of these transactions expose us to credit risk and, in some cases, disputes and litigation in the event of default of a counterparty. In addition, our credit risk may be heightened by market risk when the collateral held by us cannot be realized or is liquidated at prices not sufficient to recover the full amount of the loan or derivatives exposure due to us. Further, disputes with obligors as to the valuation of collateral could increase in times of significant market stress, volatility or illiquidity, and we could suffer losses during such periods if we are unable to realize the fair value of the collateral or manage declines in the value of collateral.

In the ordinary course of business, we also enter into transactions with sovereign nations, U.S. states and U.S. municipalities. Unfavorable economic or political conditions, disruptions to capital markets, currency fluctuations, changes in oil prices, social instability and changes in government policies could impact the operating budgets or credit ratings of these government entities and expose us to credit risk.

We also have a concentration of credit risk with respect to our consumer real estate loans, including home equity lines of credit (HELOCs), auto loans, consumer credit card and commercial real estate portfolios, which represent a large percentage of our overall credit portfolio. In addition, our commercial portfolios include exposures to certain industries, including the energy sector, which may result in higher credit losses for us due to adverse business conditions, market disruptions or greater volatility in those industries as the result of low energy prices or other factors. Economic weakness or deterioration in real estate values or household incomes could result in higher credit losses.

In addition, our home equity portfolio contains a significant percentage of loans in second-lien or more junior-lien positions, and such loans have elevated risk characteristics. Our home equity portfolio is largely comprised of HELOCs that have not yet entered their amortization period. HELOCs that have entered the amortization period have experienced a higher percentage of early stage delinquencies and nonperforming status when compared to the HELOC portfolio as a whole. Loans in our HELOC portfolio generally have an initial draw period of 10 years and 23 percent of these loans will enter the amortization period during 2017. As a result, delinquencies and defaults may increase in future periods.

For additional information, see Consumer Portfolio Credit Risk Management in the MD&A on page 56 .

Liquidity disruptions in the financial markets may result in our inability to sell, syndicate or realize the value of our positions, leading to increased concentrations, which could increase the credit and market risk associated with our positions as well as increasing our risk-weighted assets.

For more information about our credit risk and credit risk management policies and procedures, see Credit Risk Management in the MD&A on page 55 , Note 1 – Summary of Significant Accounting Principles and Note 4 – Outstanding Loans and Leases to the Consolidated Financial Statements .

If the U.S. housing market weakens, or home prices decline, our consumer loan portfolios, credit quality, credit losses, representations and warranties exposures, and earnings may be adversely affected.

Although U.S. home prices continued to improve during 2016, the declines in prior years have negatively impacted the demand for many of our products. Additionally, our mortgage loan production volume is generally influenced by the rate of growth in residential mortgage debt outstanding and the size of the residential mortgage market. Conditions in the U.S. housing market in prior years have also resulted in significant write-downs of asset values in several asset classes, notably mortgage-backed securities, and exposure to monolines. If the U.S. housing market were to weaken, the value of real estate could decline, which could negatively affect our exposure to representations and warranties and could have an adverse effect on our financial condition and results of operations.

Our derivatives businesses may expose us to unexpected risks and potential losses.

We are party to a large number of derivatives transactions, including credit derivatives. Our derivatives businesses may expose us to unexpected market, credit and operational risks that could cause us to suffer unexpected losses. Severe declines in asset values, unanticipated credit events or unforeseen circumstances that may cause previously uncorrelated factors to become correlated (and vice versa) may create losses resulting from risks not appropriately taken into account in the development, structuring or pricing of a derivative instrument. The terms of certain of our OTC derivative contracts and other trading agreements provide that upon the occurrence of certain specified events, such as a change in our credit ratings or that of certain of our subsidiaries, we may be required to provide additional collateral or other remedies, or our counterparties may have the right to terminate or otherwise diminish our rights under these contracts or agreements.

Many derivative instruments are individually negotiated and non-standardized, which can make exiting, transferring or settling some positions difficult. Many derivatives require that we deliver to the counterparty the underlying security, loan or other obligation in order to receive payment. In a number of cases, we do not hold, and may not be able to obtain, the underlying security, loan or other obligation.

In the event of a downgrade of our credit ratings, certain derivative and other counterparties may request we substitute BANA (which has generally had equal or higher credit ratings than the parent company) as counterparty for certain derivative contracts and other trading agreements. The parent company's ability to substitute or make changes to these agreements to meet counterparties' requests may be subject to certain limitations, including counterparty willingness, regulatory limitations on

naming BANA as the new counterparty and the type or amount of collateral required. It is possible that such limitations on our ability to substitute or make changes to these agreements, including naming BANA as the new counterparty, could adversely affect our results of operations.

For more information on our derivatives exposure, see Note 2 – Derivatives to the Consolidated Financial Statements .

We are subject to numerous political, economic, market, reputational, operational, legal, regulatory and other risks in the non-U.S. jurisdictions in which we operate.

We do business throughout the world, including in emerging markets. Our businesses and revenues derived from non-U.S. jurisdictions are subject to risk of loss from currency fluctuations, financial, social or judicial instability, changes in governmental policies or policies of central banks, expropriation, nationalization and/or confiscation of assets, price controls, capital controls, exchange controls and other restrictive actions, unfavorable political and diplomatic developments, oil price fluctuation and changes in legislation. These risks are especially elevated in emerging markets. A number of non-U.S. jurisdictions in which we do business have been negatively impacted by slow growth rates or recessionary conditions, market volatility and/or political unrest. The political and economic environment in Europe remains challenging and the current degree of political and economic uncertainty could increase. In the U.K., the impact of the vote to leave the EU remains uncertain.

Potential risks of default on sovereign debt in some non-U.S. jurisdictions could expose us to substantial losses. Risks in one nation can limit our opportunities for portfolio growth and negatively affect our operations in other nations, including our U.S. operations. Market and economic disruptions may affect consumer confidence levels and spending, corporate investment and job creation, bankruptcy rates, levels of incurrence and default on consumer and corporate debt, economic growth rates and asset values, among other factors. Any such unfavorable conditions or developments could have an adverse impact on our company.

We also invest or trade in the securities of corporations and governments located in non-U.S. jurisdictions, including emerging markets. Revenues from the trading of non-U.S. securities may be subject to negative fluctuations as a result of the above factors. Furthermore, the impact of these fluctuations could be magnified because non-U.S. trading markets, particularly in emerging markets, are generally smaller, less liquid and more volatile than U.S. trading markets.

Our non-U.S. businesses are also subject to extensive regulation by governments, securities exchanges, central banks and other regulatory bodies. In many countries, the laws and regulations applicable to the financial services and securities industries are uncertain and evolving, and it may be difficult for us to determine the exact requirements of local laws in every market or manage our relationships with multiple regulators in various jurisdictions. Our potential inability to remain in compliance with local laws in a particular market and manage our relationships with regulators could have an adverse effect not only on our businesses in that market but also on our reputation in general.

In addition to non-U.S. legislation, our international operations are also subject to U.S. legal requirements. For example, our international operations are subject to U.S. laws on foreign corrupt practices, the Office of Foreign Assets Control, know-your-customer requirements and anti-money laundering regulations. Our ability to

comply with these laws is dependent on our ability to improve detection and reporting capabilities and reduce variation in control processes and oversight accountability.

We are subject to geopolitical risks, including acts or threats of terrorism, and actions taken by the U.S. or other governments in response thereto and/or military conflicts, which could adversely affect business and economic conditions abroad as well as in the U.S.

For more information on our non-U.S. credit and trading portfolios, see Non-U.S. Portfolio in the MD&A on page 74 .

The U.K. Referendum, and the potential exit of the U.K. from the EU, could adversely affect us.

We conduct business in Europe primarily through our U.K. subsidiaries. For the year ended December 31, 2016, our operations in Europe, Middle East and Africa, including the U.K., represented approximately eight percent of our total revenue, net of interest expense. A referendum was held in the U.K. on June 23, 2016, which resulted in a majority vote in favor of exiting the EU. The vote outcome increased global economic and market uncertainty and volatility, and resulted in significant declines in the value of the British Pound. Market volatility has since reduced but the British Pound has continued to show weakness. The U.K. government has announced an intention to formally commence the exit process. Once the exit process begins, negotiations on the terms of the exit are expected to be a multi-year process. During this transition period, the ultimate impact of the U.K.'s exit from the EU may remain unclear and economic and market volatility may continue to occur. If uncertainty resulting from the U.K.'s potential exit from the EU negatively impacts economic conditions, financial markets and consumer confidence, our business, results of operations, financial position and/or operational model could be adversely affected.

In addition, if the terms of the exit limit the ability of our U.K. entities to conduct business in the EU or otherwise result in a significant increase in economic barriers between the U.K. and the EU, it is possible these changes could impose additional costs on us, cause us to be subject to different laws, regulations and/or regulatory authorities, cause adverse tax consequences to us, and could adversely impact our business, financial condition and operational model.

A failure in or breach of our operational or security systems or infrastructure, or those of third parties, could disrupt our businesses, and adversely impact our results of operations, liquidity and financial condition, as well as cause reputational harm.

The potential for operational risk exposure exists throughout our organization and, as a result of our interactions with, and reliance on, third parties, is not limited to our own internal operational functions. Our operational and security systems, infrastructure, including our computer systems, data management, and internal processes, as well as those of third parties, are integral to our performance. We rely on our employees and third parties in our day-to-day and ongoing operations, who may, as a result of human error, misconduct, malfeasance or failure, or breach of third-party systems or infrastructure, expose us to risk. We have taken measures to implement backup systems and other safeguards to support our operations, but our ability to conduct business may be adversely affected by any significant disruptions to us or to third parties with whom we interact and rely. For example, large-scale strategic technology project implementation challenges may cause business interruptions. In addition, our

ability to implement backup systems and other safeguards with respect to third-party systems is more limited than with respect to our own systems. Our financial, accounting, data processing, backup or other operating or security systems and infrastructure may fail to operate properly or become disabled or damaged as a result of a number of factors including events that are wholly or partially beyond our control which could adversely affect our ability to process these transactions or provide these services. There could be sudden increases in customer transaction volume; electrical, telecommunications or other major physical infrastructure outages; natural disasters such as earthquakes, tornadoes, hurricanes and floods; disease pandemics; and events arising from local or larger scale political or social matters, including terrorist acts. We continuously update these systems to support our operations and growth and to remain compliant with all applicable laws, rules and regulations globally. This updating entails significant costs and creates risks associated with implementing new systems and integrating them with existing ones, including business interruptions. Operational risk exposures could adversely impact our results of operations, liquidity and financial condition, as well as cause reputational harm.

A cyberattack, information or security breach, or a technology failure of ours or of a third party could adversely affect our ability to conduct our business, manage our exposure to risk or expand our businesses, result in the disclosure or misuse of confidential or proprietary information, increase our costs to maintain and update our operational and security systems and infrastructure, and adversely impact our results of operations, liquidity and financial condition, as well as cause reputational harm.

Our businesses are highly dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third parties with whom we interact. Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including foreign state actors. Our businesses rely on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in our computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access our network, products and services, our customers and other third parties may use personal mobile devices or computing devices that are outside of our network environment. We, our customers, regulators and other third parties have been subject to, and are likely to continue to be the target of, cyberattacks. These cyberattacks include computer viruses, malicious or destructive code, phishing attacks, denial of service or information or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information of ours, our employees, our customers or of third parties, or otherwise materially disrupt our or our customers' or other third parties' network access or business operations.

Although to date we have not experienced any material losses or other material consequences relating to technology failure, cyberattacks or other information or security breaches, whether directed at us or third parties, there can be no assurance that we will not suffer such losses or other consequences in the future. Our risk and exposure to these matters remain heightened because of, among other things, the evolving nature of these

threats, our prominent size and scale, and our role in the financial services industry and the broader economy, our plans to continue to implement our internet banking and mobile banking channel strategies and develop additional remote connectivity solutions to serve our customers when and how they want to be served, our continuous transmission of sensitive information to, and storage of such information by, third parties, including our vendors and regulators, our geographic footprint and international presence, the outsourcing of some of our business operations, the continued uncertain global economic environment, threats of cyber terrorism, external extremist parties, including foreign state actors, in some circumstances as a means to promote political ends, and system and customer account updates and conversions. As a result, cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for us. As cyberthreats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents.

We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including financial counterparties; financial intermediaries such as clearing agents, exchanges and clearing houses; vendors; regulators; providers of critical infrastructure such as internet access and electrical power; and retailers for whom we process transactions. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyberattack or other information or security breach that significantly degrades, deletes or compromises the systems or data of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyberattack or other information or security breach, termination or constraint could, among other things, adversely affect our ability to effect transactions, service our clients, manage our exposure to risk or expand our businesses.

Any of the matters discussed above could result in our loss of customers and business opportunities, significant business disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, or damage to our customers' and/or third parties' computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity and financial condition.

Our mortgage loan repurchase obligations or claims from third parties could result in additional losses.

We and our legacy companies have sold significant amounts of residential mortgage loans. In connection with these sales, we or certain of our subsidiaries or legacy companies made various representations and warranties, breaches of which may result in a requirement that we repurchase the mortgage loans, or otherwise

make whole or provide other remedies to counterparties. At December 31, 2016, we had approximately $18.3 billion of unresolved repurchase claims, net of duplicate claims and excluding claims where the statute of limitations has expired without litigation being commenced. We have also received notifications pertaining to loans for which we have not received a repurchase request from sponsors of third-party securitizations with whom we engaged in whole-loan transactions and for which we may owe indemnity obligations.

We have recorded a liability of $2.3 billion for obligations under representations and warranties exposures. We also have an estimated range of possible loss of up to $2 billion over our recorded liability. The recorded liability and estimated range of possible loss are based on currently available information, significant judgment and a number of assumptions that are subject to change. Future representations and warranties losses may occur in excess of our recorded liability and estimated range of possible loss and such losses could have an adverse effect on our liquidity, financial condition and results of operations.

Additionally, our recorded liability for representations and warranties exposures and the corresponding estimated range of possible loss do not consider certain losses related to servicing, including foreclosure and related costs, fraud, indemnity, or claims (including for residential mortgage-backed securities (RMBS)) related to securities law or monoline insurance litigation. Losses with respect to one or more of these matters could be material to our results of operations or liquidity.

For more information about our representations and warranties exposure, including the estimated range of possible loss, see Off-Balance Sheet Arrangements and Contractual Obligations – Representations and Warranties in the MD&A on page 40 , Consumer Portfolio Credit Risk Management in the MD&A on page 56 and Note 7 – Representations and Warranties Obligations and Corporate Guarantees to the Consolidated Financial Statements .

Failure to satisfy our obligations as servicer for residential mortgage securitizations, along with other losses we could incur in our capacity as servicer, and foreclosure delays and/or investigations into our residential mortgage foreclosure practices could cause losses.

We and our legacy companies have securitized a significant portion of the residential mortgage loans that we originated or acquired. We service a large portion of the loans we have securitized and also service loans on behalf of third-party securitization vehicles and other investors. If we commit a material breach of our obligations as servicer or master servicer, we may be subject to termination if the breach is not cured within a specified period of time following notice, which could cause us to lose servicing income. In addition, for loans principally held in private-label securitization trusts, we may have liability for any failure by us, as a servicer or master servicer, for any act or omission on our part that involves willful misfeasance, bad faith, gross negligence or reckless disregard of our duties. If any such breach were found to have occurred, it may harm our reputation, increase our servicing costs or adversely impact our results of operations. Additionally, with respect to foreclosures, we may incur costs or losses due to irregularities in the underlying documentation, or if the validity of a foreclosure action is challenged by a borrower or overturned by a court because of errors or deficiencies in the foreclosure process. We may also incur costs or losses relating to delays or alleged deficiencies in processing documents necessary to comply with state law governing foreclosure.

Changes in the structure of the GSEs and the relationship among the GSEs, the government and the private markets, or the conversion of the current conservatorship of Fannie Mae or Freddie Mac into receivership, could result in significant changes to our business operations and may adversely impact our business.

During 2016, we sold approximately $15.3 billion of loans to Fannie Mae and Freddie Mac. Each is currently in a conservatorship with its primary regulator, the Federal Housing Finance Agency, acting as conservator. We cannot predict if, when or how the conservatorships will end, any associated changes to their business structure that could result or whether the conservatorships will end in receivership. There are several proposed approaches to reform that, if enacted, could change the structure and the relationship among the GSEs, the government and the private markets, including the trading markets for agency conforming mortgage loans and markets for mortgage-related securities in which we participate. We cannot predict the prospects for the enactment, timing or content of legislative or rulemaking proposals regarding the future status of any GSEs. Accordingly, there continues to be uncertainty regarding their future, including whether they will continue to exist in their current form.

Our risk management framework may not be effective in mitigating risk and reducing the potential for losses.

Our risk management framework is designed to minimize risk and loss to us. We seek to identify, measure, monitor, report and control our exposure to the types of risk to which we are subject, including strategic, credit, market, liquidity, compliance, operational and reputational risks. While we employ a broad and diversified set of risk monitoring and mitigation techniques, including hedging strategies and techniques that seek to balance our ability to profit from trading positions with our exposure to potential losses, those techniques are inherently limited because they cannot anticipate the existence or development of currently unanticipated or unknown risks and rely upon our ability to manage and aggregate data. For instance, we use various models to assess and control risk, which are subject to inherent limitations.

Our risk management framework is also dependent on ensuring that a sound risk culture exists throughout the Corporation, and that we manage risks associated with third parties and vendors. Uncertain economic conditions, heightened legislative and regulatory scrutiny of the financial services industry and the overall complexity of our operations, among other developments, have resulted in a heightened level of risk for us. Accordingly, we could suffer losses as a result of our failure to properly anticipate and manage risks.

For more information about our risk management policies and procedures, see Managing Risk in the MD&A on page 41 .

We are subject to comprehensive government legislation and regulations, both domestically and internationally, which impact our operating costs, and could require us to make changes to our operations and result in an adverse impact on our results of operations. Additionally, these regulations and uncertainty surrounding the scope and requirements of the final rules implementing recently enacted and proposed legislation, as well as certain settlements and consent orders we have entered into, have increased and will continue to increase our compliance and operational risks and costs.

We are subject to comprehensive regulation under federal and state laws in the U.S. and the laws of the various jurisdictions in which we operate. These laws and regulations significantly affect

and have the potential to restrict the scope of our existing businesses, limit our ability to pursue certain business opportunities or make our products and services more expensive for clients and customers.

Significant new legislation and regulations affecting the financial services industry have been enacted or proposed in recent years, both in the U.S. and globally. In response to the financial crisis, the U.S. adopted the Financial Reform Act, which has resulted in significant rulemaking and proposed rulemaking by the U.S. Department of the Treasury, the Federal Reserve, the OCC, the CFPB, Financial Stability Oversight Council, the FDIC, the Department of Labor, the SEC and CFTC. Under the provisions of the Financial Reform Act known as the "Volcker Rule," we are prohibited from proprietary trading and limited in our sponsorship of, and investment in, hedge funds, private equity funds and certain other covered private funds. Non-U.S. regulators, such as the U.K. financial regulators and the European Parliament and Commission, have adopted or proposed laws and regulations regarding financial institutions located in their jurisdictions, which could require us to make significant modifications to our non-U.S. businesses, operations and legal entity structure in order to comply with these requirements.

We continue to make adjustments to our business and operations, legal entity structure and capital and liquidity management policies, procedures and controls to comply with these new and proposed laws and regulations. However, a number of provisions still require final rulemaking, guidance and interpretation by regulatory authorities. Further, we could become subject to regulatory requirements beyond those currently proposed, adopted or contemplated. Accordingly, the cumulative effect of all of the new and proposed legislation and regulations on our business, operations and profitability remains uncertain. This uncertainty necessitates that in our business planning we make certain assumptions with respect to the scope and requirements of the proposed rules. If these assumptions prove incorrect, we could be subject to increased regulatory and compliance risks and costs as well as potential reputational harm. In addition, U.S. and international regulatory initiatives may overlap, and non-U.S. regulations and initiatives may be inconsistent or may conflict with current or proposed U.S. regulations, which could lead to compliance risks and increased costs.

Our regulators' prudential and supervisory authority gives them broad power and discretion to direct our actions, and they have assumed an increasingly active oversight, inspection and investigatory role across the financial services industry. Regulatory focus is not limited to laws and regulations applicable to the financial services industry specifically, but also extends to other significant regulations such as the Foreign Corrupt Practices Act and U.S. and international anti-money laundering regulations. The number of investigations and proceedings brought by regulators against the financial services industry generally has increased. As part of their enforcement authority, our regulators have the authority to, among other things, assess significant civil or criminal monetary penalties, fines or restitution, issue cease and desist or removal orders and initiate injunctive actions. The amounts paid by us and other financial institutions to settle proceedings or investigations have been substantial and may continue to increase. In some cases, governmental authorities have required criminal pleas or other extraordinary terms as part of such settlements, which could have significant consequences for a financial institution, including reputational harm, loss of

customers, restrictions on the ability to access capital markets, and the inability to operate certain businesses or offer certain products for a period of time.

The complexity of the federal and state regulatory and enforcement regimes in the U.S., coupled with the global scope of our operations and the increasing aggressiveness of the regulatory environment worldwide also means that a single event or practice or a series of related events or practices may give rise to a large number of overlapping investigations and regulatory proceedings, either by multiple federal and state agencies in the U.S. or by multiple regulators and other governmental entities in different jurisdictions. Responding to inquiries, investigations, lawsuits and proceedings, regardless of the ultimate outcome of the matter, is time-consuming and expensive and can divert the attention of our senior management from our business. The outcome of such proceedings may be difficult to predict or estimate until late in the proceedings, which may last a number of years.

We are currently subject to the terms of settlements and consent orders that we have entered into with government agencies and may become subject to additional settlements or orders in the future. Such settlements and consent orders impose significant operational and compliance costs on us as they typically require us to enhance our procedures and controls, expand our risk and control functions within our lines of business, invest in technology and hire significant numbers of additional risk, control and compliance personnel. Moreover, if we fail to meet the requirements of the regulatory settlements and orders to which we are subject, or more generally, to maintain risk and control procedures and processes that meet the heightened standards established by our regulators and other government agencies, we could be required to enter into further settlements and orders, pay additional fines, penalties or judgments, or accept material regulatory restrictions on our businesses.

While we believe that we have adopted appropriate risk management and compliance programs, compliance risks will continue to exist, particularly as we adapt to new rules and regulations. We also rely upon third parties who may expose us to compliance and legal risk. Future legislative or regulatory actions, and any required changes to our business or operations, or those of third parties upon whom we rely, resulting from such developments and actions, could result in a significant loss of revenue, impose additional compliance and other costs or otherwise reduce our profitability, limit the products and services that we offer or our ability to pursue certain business opportunities, require us to dispose of or curtail certain businesses, affect the value of assets that we hold, require us to increase our prices and therefore reduce demand for our products, or otherwise adversely affect our businesses. In addition, legal and regulatory proceedings and other contingencies will arise from time to time that may result in fines, penalties, equitable relief and changes to our business practices. As a result, we are and will continue to be subject to heightened compliance and operating costs that could adversely affect our results of operations.

U.S. federal banking agencies may require us to hold higher levels of regulatory capital, increase our regulatory capital ratios or increase liquidity requirements, which could result in the need to issue additional securities that qualify as regulatory capital or to take other actions, such as to sell company assets.

We are subject to U.S. regulatory capital and liquidity rules. These rules, among other things, establish minimum requirements to qualify as a "well-capitalized" institution. If any of our subsidiary insured depository institutions fail to maintain its status as "well

capitalized" under the applicable regulatory capital rules, the Federal Reserve will require us to agree to bring the insured depository institution back to "well-capitalized" status. For the duration of such an agreement, the Federal Reserve may impose restrictions on our activities. If we were to fail to enter into or comply with such an agreement, or fail to comply with the terms of such agreement, the Federal Reserve may impose more severe restrictions on our activities, including requiring us to cease and desist activities permitted under the Bank Holding Company Act of 1956.

In the current regulatory environment, capital and liquidity requirements are frequently introduced and amended. It is possible that regulators may increase regulatory capital requirements, change how regulatory capital is calculated or increase liquidity requirements. Our risk-based capital surcharge (G-SIB surcharge) may increase from current estimates, and we are also subject to a countercyclical capital buffer which, while currently set at zero, may be increased by U.S. federal banking agencies. A significant component of regulatory capital ratios is calculating our risk-weighted assets, including operational risk, which may increase. Additionally, in April 2016, the U.S. banking regulators proposed Net Stable Funding Ratio (NSFR) requirements which target longer term liquidity risk and would apply to us and our subsidiary insured depository institutions beginning on January 1, 2018. The Basel Committee on Banking Supervision (BCBS) also has finalized its fundamental review of the trading book, which updates both modeled and standardized approaches for market risk measurement, and a revised standardized model for counterparty credit risk. The U.S. federal banking agencies may update the U.S. capital rules to incorporate the BCBS revisions.

As part of its annual CCAR review, the Federal Reserve conducts economic stress testing on parts of our business using hypothetical economic scenarios prepared by the Federal Reserve. Those scenarios may affect our CCAR stress test results, which may have an effect on our projected regulatory capital amounts in the annual CCAR submission, including the CCAR capital plan.

Changes to and compliance with the regulatory capital and liquidity requirements may impact our operations by requiring us to liquidate assets, increase borrowings, issue additional equity or other securities, cease or alter certain operations, sell company assets, or hold highly liquid assets, which may adversely affect our results of operations. We may be prohibited from taking capital actions such as paying or increasing dividends, or repurchasing securities if the Federal Reserve objects to our CCAR capital plan. The Federal Reserve has indicated that it may consider incorporating a stress capital buffer into our capital plan minimum requirements which could increase our capital requirement. For additional information, see Capital Management – Regulatory Capital in the MD&A on page 45 .

Changes in accounting standards or assumptions in applying accounting policies could adversely affect us.

Our accounting policies and methods are fundamental to how we record and report our financial condition and results of operations. Some of these policies require use of estimates and assumptions that may affect the reported value of our assets or liabilities and results of operations and are critical because they require management to make difficult, subjective and complex judgments about matters that are inherently uncertain. If those assumptions, estimates or judgments were incorrectly made, we could be required to correct and restate prior-period financial statements. Accounting standard-setters and those who interpret the accounting standards (such as the Financial Accounting

Standards Board (FASB), the SEC, banking regulators and our independent registered public accounting firm) may also amend or even reverse their previous interpretations or positions on how various standards should be applied. These changes may be difficult to predict and could impact how we prepare and report our financial statements. In some cases, we could be required to apply a new or revised standard retroactively, resulting in us revising and republishing prior-period financial statements.

In June 2016, the FASB issued new accounting guidance that will require the earlier recognition of credit losses on loans and other financial instruments based on an expected loss model, replacing the incurred loss model that is currently in use. The new guidance is effective on January 1, 2020, with early adoption permitted on January 1, 2019. This new accounting standard is expected, on the date of adoption, to increase the allowance for credit losses with a resulting negative adjustment to retained earnings.

For more information on some of our critical accounting policies and recent accounting changes, see Complex Accounting Estimates in the MD&A on page 87 and Note 1 – Summary of Significant Accounting Principles to the Consolidated Financial Statements .

We may be adversely affected by changes in U.S. and non-U.S. tax laws and regulations.

Policy makers have indicated an interest in reforming the U.S. corporate income tax code in 2017. Possible approaches include lowering the 35 percent corporate tax rate, modifying the U.S. taxation of income earned outside the U.S. and limiting or eliminating various deductions, tax credits and/or other tax preferences. It is not possible at this time to quantify either the one-time impacts from the remeasurement of deferred tax assets and liabilities that might result upon tax reform enactment or the ongoing impacts reform proposals might have on income tax expense.

In addition, we have U.K. net deferred tax assets which consist primarily of net operating losses that are expected to be realized by certain subsidiaries over an extended number of years. Adverse developments with respect to tax laws or to other material factors, such as prolonged worsening of Europe's capital markets or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead our management to reassess and/or change its current conclusion that no valuation allowance is necessary with respect to our U.K. net deferred tax assets.

Damage to our reputation could harm our businesses, including our competitive position and business prospects.

Our ability to attract and retain customers, clients, investors and employees is impacted by our reputation.

Harm to our reputation can arise from various sources, including employee misconduct, security breaches, unethical behavior, litigation or regulatory outcomes, compensation practices, the suitability or reasonableness of recommending particular trading or investment strategies, sales practices, failing to deliver products, standards of service and quality expected by our customers, clients and the community, compliance failures, inadequacy of responsiveness to internal controls, unintended disclosure of confidential information, and the activities of our clients, customers and counterparties, including vendors. Actions by the financial services industry generally or by certain members or individuals in the industry also can adversely affect our reputation. In addition, adverse publicity or negative information

posted on social media websites, whether or not factually correct, may adversely impact our business prospects or financial results.

We are subject to complex and evolving laws and regulations regarding privacy, know-your-customer requirements, data protection, including GDPR, cross-border data movement and other matters. Principles concerning the appropriate scope of consumer and commercial privacy vary considerably in different jurisdictions, and regulatory and public expectations regarding the definition and scope of consumer and commercial privacy may remain fluid. It is possible that these laws may be interpreted and applied by various jurisdictions in a manner inconsistent with our current or future practices, or that is inconsistent with one another. If personal, confidential or proprietary information of customers or clients in our possession is mishandled or misused, we may face regulatory, reputational and operational risks which could have an adverse effect on our financial condition and results of operations.

We could suffer reputational harm if we fail to properly identify and manage potential conflicts of interest. Management of potential conflicts of interests has become increasingly complex as we expand our business activities through more numerous transactions, obligations and interests with and among our clients. The failure to adequately address, or the perceived failure to adequately address, conflicts of interest could affect the willingness of clients to deal with us, or give rise to litigation or enforcement actions, which could adversely affect our businesses.

Our actual or perceived failure to address these and other issues, such as operational risks, gives rise to reputational risk that could harm us and our business prospects. Failure to appropriately address any of these issues could also give rise to additional regulatory restrictions, legal risks and reputational harm, which could, among other consequences, increase the size and number of litigation claims and damages asserted or subject us to enforcement actions, fines and penalties and cause us to incur related costs and expenses.

For additional information, see Capital Management – Regulatory Capital in the MD&A on page 45 .

We are subject to significant financial and reputational risks from potential liability arising from lawsuits, and regulatory and government action.

We face significant legal risks in our business, and the volume of claims and amount of damages, penalties and fines claimed in litigation, and regulatory and government proceedings against us and other financial institutions remains high. Greater than expected litigation and investigation costs, substantial legal liability or significant regulatory or government action against us could have adverse effects on our financial condition and results of operations or cause significant reputational harm to us, which in turn could adversely impact our business results and prospects. We continue to experience a significant volume of litigation and other disputes, including claims for contractual indemnification, with counterparties regarding relative rights and responsibilities. Consumers, clients and other counterparties continue to be litigious. Among other things, financial institutions, including us, increasingly have been the subject of claims alleging anti-competitive conduct with respect to various products and markets, including U.S. antitrust class actions claiming joint and several liability for treble damages. Our experience with certain regulatory authorities suggests continued supervisory focus on enforcement, including in connection with alleged violations of law and customer harm. Recent actions by regulators and government agencies indicate that they may, on an industry basis, increasingly pursue claims under the Financial Institutions Reform, Recovery, and

Enforcement Act of 1989 (FIRREA) and the False Claims Act, as well as claims under the antitrust laws. FIRREA contemplates civil monetary penalties as high as $1.89 million per violation or, if permitted by the court, based on pecuniary gain derived or pecuniary loss suffered as a result of the violation. Treble damages are also potentially available for False Claims Act cases. The ongoing environment of extensive regulation, regulatory compliance burdens, and regulatory and government enforcement, combined with uncertainty related to the evolving regulatory environment, has resulted in operational and compliance costs and risks, which may limit our ability to continue providing certain products and services.

For more information on litigation risks, see Note 12 – Commitments and Contingencies to the Consolidated Financial Statements .

We face significant and increasing competition in the financial services industry.

We operate in a highly competitive environment and will continue to experience intense competition from local and global financial institutions as well as new entrants, in both domestic and foreign markets. Additionally, the changing regulatory environment may create competitive disadvantages for certain financial institutions given geography-driven capital and liquidity requirements. For example, U.S. regulators have in certain instances adopted stricter capital and liquidity requirements than those applicable to non-U.S. institutions. To the extent we expand into new business areas and new geographic regions, we may face competitors with more experience and more established relationships with clients, regulators and industry participants in the relevant market, which could adversely affect our ability to compete. In addition, technological advances and the growth of e-commerce have made it easier for non-depository institutions to offer products and services that traditionally were banking products, and for financial institutions to compete with technology companies in providing electronic and internet-based financial solutions including electronic securities trading, marketplace lending and payment processing. Increased competition may negatively affect our earnings by creating pressure to lower prices or credit standards on our products and services requiring additional investment to improve the quality and delivery of our technology and/or reducing our market share.

Our inability to adapt our products and services to evolving industry standards and consumer preferences could harm our business.

Our business model is based on a diversified mix of business that provides a broad range of financial products and services, delivered through multiple distribution channels. Our success depends on our ability to adapt our products and services to evolving industry standards. There is increasing pressure by competitors to provide products and services at lower prices and this may impact our ability to grow revenue and/or effectively compete, in part, due to legislative and regulatory developments that affect the competitive landscape. Additionally, the competitive landscape may be impacted by the growth of non-depository institutions that offer products that were traditionally banking products as well as new innovative products. This can reduce our net interest margin and revenues from our fee-based products and services. In addition, the widespread adoption of new technologies, including internet services and payment systems, could require substantial expenditures to modify or adapt our

existing products and services as we grow and develop our internet banking and mobile banking channel strategies in addition to remote connectivity solutions. We might not be successful in developing or introducing new products and services, integrating new products or services into our existing offerings, responding or adapting to changes in consumer behavior, preferences, spending, investing and/or saving habits, achieving market acceptance of our products and services, reducing costs in response to pressures to deliver products and services at lower prices or sufficiently developing and maintaining loyal customers.

Our ability to attract and retain qualified employees is critical to the success of our business and failure to do so could hurt our business prospects and competitive position.

Our performance is heavily dependent on the talents and efforts of highly skilled individuals. Competition for qualified personnel within the financial services industry and from businesses outside the financial services industry is intense. Our competitors include non-U.S. based institutions and institutions subject to different compensation and hiring regulations than those imposed on U.S. institutions and financial institutions.

In order to attract and retain qualified personnel, we must provide market-level compensation. As a large financial and banking institution, we may be subject to limitations on compensation practices (which may or may not affect our competitors) by the Federal Reserve, the OCC, the FDIC or other regulators around the world. Recent EU and U.K. rules limit and subject to clawback certain forms of variable compensation for senior employees. Current and potential future limitations on executive compensation imposed by legislation or regulation could adversely affect our ability to attract and maintain qualified employees. Furthermore, a substantial portion of our annual incentive compensation paid to our senior employees has in recent years taken the form of long-term equity awards. Therefore, the ultimate value of this compensation depends on the price of our common stock when the awards vest. If we are unable to continue to attract and retain qualified individuals, our business prospects and competitive position could be adversely affected.

We could suffer losses if our models and strategies fail to properly anticipate and manage risk.

We use proprietary models and strategies extensively to measure the capital requirements for credit, country, market, operational and strategic risks and to assess and control our operations. These models require oversight and periodic re-validation and are subject to inherent limitations due to the use of historical trends and assumptions, and uncertainty regarding economic and financial outcomes. Our models may not be sufficiently predictive of future results due to limited historical patterns, extreme or unanticipated market movements and illiquidity, especially during severe market downturns or stress events. The models that we use to assess and control our market risk exposures also reflect assumptions about the degree of correlation among prices of various asset classes or other market indicators. Market conditions in recent years have involved unprecedented dislocations and highlight the limitations inherent in using historical data to manage risk. We could suffer losses if our models and strategies fail to properly anticipate and manage risks.

Failure to properly manage and aggregate data may result in inaccurate financial, regulatory and operational reporting.

We rely on our ability to manage data and our ability to aggregate data in an accurate and timely manner for effective risk reporting and management which may be limited by the effectiveness of our policies, programs, processes and practices that govern how data is acquired, validated, stored, protected and processed. While we continuously update our policies, programs, processes and practices, many of our data management and aggregation processes are manual and subject to human error or system failure. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risk, to produce accurate financial, regulatory and operational reporting as well as to manage changing business needs.

None

We own or lease approximately 81.7 million square feet in 21,194 facility and ATM locations globally, including approximately 76.0 million square feet in the U.S. (all 50 states and the District of Columbia, the U.S. Virgin Islands and Puerto Rico) and approximately 5.7 million square feet in more than 35 countries.

We believe our owned and leased properties are adequate for our business needs and are well maintained. We continue to evaluate our owned and leased real estate and may determine from time to time that certain of our premises and facilities, or ownership structures, are no longer necessary for our operations. In connection therewith, we are evaluating the sale or sale/leaseback of certain properties and we may incur costs in connection with any such transactions.

See Litigation and Regulatory Matters in Note 12 – Commitments and Contingencies to the Consolidated Financial Statements , which is incorporated herein by reference.

None

Bank of America Corporation (the "Corporation") and its management may make certain statements that constitute "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995. These statements can be identified by the fact that they do not relate strictly to historical or current facts. Forward-looking statements often use words such as "anticipates," "targets," "expects," "hopes," "estimates," "intends," "plans," "goals," "believes," "continue," "suggests" and other similar expressions or future or conditional verbs such as "will," "may," "might," "should," "would" and "could." Forward-looking statements represent the Corporation's current expectations, plans or forecasts of its future results, revenues, expenses, efficiency ratio, capital measures, and future business and economic conditions more generally, and other future matters. These statements are not guarantees of future results or performance and involve certain known and unknown risks, uncertainties and assumptions that are difficult to predict and are often beyond the Corporation's control. Actual outcomes and results may differ materially from those expressed in, or implied by, any of these forward-looking statements.

You should not place undue reliance on any forward-looking statement and should consider the following uncertainties and risks, as well as the risks and uncertainties more fully discussed under Item 1A. Risk Factors of this Annual Report on Form 10-K and in any of the Corporation's subsequent Securities and Exchange Commission filings: the Corporation's ability to resolve representations and warranties repurchase and related claims, including claims brought by investors or trustees seeking to distinguish certain aspects of the New York Court of Appeals' ACE Securities Corp. v. DB Structured Products, Inc. (ACE) decision or to assert other claims seeking to avoid the impact of the ACE decision; the possibility that the Corporation could face increased servicing, securities, fraud, indemnity, contribution or other claims from one or more counterparties, including trustees, purchasers of loans, underwriters, issuers, other parties involved in securitizations, monolines or private-label and other investors; the possibility that future representations and warranties losses may occur in excess of the Corporation ' s recorded liability and estimated range of possible loss for its representations and warranties exposures; potential claims, damages, penalties, fines and reputational damage resulting from pending or future litigation and regulatory proceedings, including the possibility that amounts may be in excess of the Corporation's recorded liability and estimated range of possible loss for litigation exposures; the possible outcome of LIBOR, other reference rate, financial instrument and foreign exchange inquiries, investigations and litigation; uncertainties about the financial stability and growth rates of non-U.S. jurisdictions, the risk that those jurisdictions may face difficulties servicing their sovereign debt, and related stresses on financial markets, currencies and trade, and the Corporation ' s exposures to such risks, including direct, indirect and operational; the impact of U.S. and global interest rates (including rising, negative or continued low interest rates), currency exchange rates and economic conditions; the possibility that future credit losses may be higher than currently expected due to changes in economic assumptions, customer behavior and other uncertainties; the impact on the Corporation ' s business, financial condition and results of operations of a potential higher interest rate environment; the impact on the Corporation ' s business, financial condition and results of operations from a protracted period of lower oil prices or ongoing volatility with respect to oil prices; the Corporation's ability to achieve its expense targets or net

interest income or other projections; adverse changes to the Corporation ' s credit ratings from the major credit rating agencies; estimates of the fair value of certain of the Corporation ' s assets and liabilities; uncertainty regarding the content, timing and impact of regulatory capital and liquidity requirements, including the potential impact of total loss-absorbing capacity requirements; potential adverse changes to our global systemically important bank (G-SIB) surcharge; the potential for payment protection insurance exposure to increase as a result of Financial Conduct Authority actions; the impact of Federal Reserve actions on the Corporation's capital plans; the possible impact of the Corporation's failure to remediate shortcomings identified by banking regulators in the Corporation's Resolution Plan; the impact of implementation and compliance with U.S. and international laws, regulations and regulatory interpretations, including, but not limited to, recovery and resolution planning requirements, Federal Deposit Insurance Corporation (FDIC) assessments, the Volcker Rule, fiduciary standards and derivatives regulations; a failure in or breach of the Corporation's operational or security systems or infrastructure, or those of third parties, including as a result of cyberattacks; the impact on the Corporation's business, financial condition and results of operations from the potential exit of the United Kingdom (U.K.) from the European Union (EU); and other similar matters.

Forward-looking statements speak only as of the date they are made, and the Corporation undertakes no obligation to update any forward-looking statement to reflect the impact of circumstances or events that arise after the date the forward-looking statement was made.

Notes to the Consolidated Financial Statements referred to in the Management's Discussion and Analysis of Financial Condition and Results of Operations (MD&A) are incorporated by reference into the MD&A. Certain prior-year amounts have been reclassified to conform to current-year presentation. Throughout the MD&A, the Corporation uses certain acronyms and abbreviations which are defined in the Glossary.

The Corporation is a Delaware corporation, a bank holding company (BHC) and a financial holding company. When used in this report, "the Corporation" may refer to Bank of America Corporation individually, Bank of America Corporation and its subsidiaries, or certain of Bank of America Corporation's subsidiaries or affiliates. Our principal executive offices are located in Charlotte, North Carolina. Through our banking and various nonbank subsidiaries throughout the U.S. and in international markets, we provide a diversified range of banking and nonbank financial services and products through four business segments: Consumer Banking , Global Wealth & Investment Management (GWIM) , Global Banking and Global Markets , with the remaining operations recorded in All Other . We operate our banking activities primarily under the Bank of America, National Association (Bank of America, N.A. or BANA) charter. At December 31, 2016 , the Corporation had approximately $2.2 trillion in assets and approximately 208,000 full-time equivalent employees.

As of December 31, 2016 , we operated in all 50 states, the District of Columbia, the U.S. Virgin Islands, Puerto Rico and more than 35 countries. Our retail banking footprint covers approximately 80 percent of the U.S. population, and we serve

approximately 46 million consumer and small business relationships with approximately 4,600 retail financial centers, approximately 15,900 ATMs, and leading online (www.bankofamerica.com) and mobile banking platforms with approximately 34 million active accounts and more than 22 million mobile active users. We offer industry-leading support to approximately three million small business owners. Our wealth management businesses, with client balances of approximately $2.5 trillion , provide tailored solutions to meet client needs through a full set of investment management, brokerage, banking, trust and retirement products. We are a global leader in corporate and investment banking and trading across a broad range of asset classes serving corporations, governments, institutions and individuals around the world.

The economy in the U.S. grew in 2016 for the seventh consecutive year. Following a soft start to the year partly reflecting severe winter weather, domestic demand grew at a moderate pace over the remainder of the year. Suppressed by a slowdown in housing gains and a decrease in state and local government purchases, domestic spending growth was less than two percent, while weak exports, in part a lagged response to the sharp U.S. dollar appreciation of recent years, and continued inventory reductions by businesses also had a negative impact on GDP growth.

Meanwhile, the labor market continued to tighten, and average hourly earnings increased at the fastest pace since 2008. Payroll gains remained solid, and the unemployment rate trended downward, with the decline limited by stabilizing labor force participation. With employment and wages both rising, consumer spending, the largest component of the U.S. economy, was an economic bright spot. Core inflation (which, unlike headline inflation, excludes certain items subject to frequent volatile price change such as food and energy) also increased during 2016 , but remained below the Federal Reserve System's (Federal Reserve) longer-term target of two percent. Meanwhile, headline inflation recovered, as energy costs began to reverse some of their large declines of recent years.

Following a weak start, equity markets advanced in 2016 . Higher energy costs improved the trajectory of the manufacturing sector and the outlook for business investment. Treasury yields decreased in the first half of the year, but more than reversed their declines during the second half, especially in the fourth quarter. The U.S. dollar followed a similar pattern, depreciating in the first half only to reverse the losses later in the year.

For a second consecutive year, the Federal Open Market Committee raised its target range for the Federal funds rate by 25 basis points (bps) at the year's final meeting. With a stronger economy, rising inflation and continued labor market tightening, Federal Reserve members raised expectations that if economic growth continued, the pace of rate increases will pick up in 2017, although the removal of accommodation would remain gradual. The contrast between U.S. tightening and quantitative easing in Europe and Japan remained a source of dollar strength.

Internationally, the Eurozone grew moderately in 2016 amid increasing political uncertainty and fragmentation which led to political impasse and fragile governments in many countries, including Italy and Spain. In this context, the European Central Bank extended its quantitative easing program, albeit at a slower pace. At the same time, the U.K. surprised financial markets by voting in favor of leaving the EU. Despite this decision, the U.K. economy proved resilient. Activity in Japan continued to expand in 2016 . However, inflation fell back into negative territory for most of the year, forcing the Bank of Japan to adopt a new monetary policy framework aimed at targeting sovereign yields. Aided in part by the increase in oil prices, the Russian and Brazilian economies showed signs of stabilizing following their deep recessions. China's economy decelerated modestly during the year, as its transition towards a growth model less focused on trade, and public investment continued.

Recent Events

During 2016, we repurchased approximately $5.1 billion of common stock pursuant to the Board of Directors' (the Board) authorization of our 2016 and 2015 Comprehensive Capital Analysis and Review (CCAR) capital plans and to offset equity-based compensation awards. Also, in addition to the previously announced repurchases associated with the 2016 CCAR capital plan, on January 13, 2017, we announced a plan to repurchase an additional $1.8 billion of common stock during the first half of 2017, to which the Federal Reserve did not object. For additional information, see Capital Management on page 45 .

On December 20, 2016, we entered into an agreement to sell our non-U.S. consumer credit card business to a third party. Subject to regulatory approval, this transaction is expected to close by mid-2017. After closing, we will retain substantially all payment protection insurance (PPI) exposure above existing reserves. We have considered this exposure in our estimate of a small after-tax gain on the sale. This transaction, once completed, will reduce risk-weighted assets and goodwill, benefiting regulatory capital. At December 31, 2016, the assets of this business, which are presented in assets of business held for sale on the Consolidated Balance Sheet, included non-U.S. credit card loans of $9.2 billion. This business is included in All Other for reporting purposes. For more information on the assets and liabilities of this business, see Note 1 – Summary of Significant Accounting Principles to the Consolidated Financial Statements .

Financial Highlights

Net income was $17.9 billion , or $1.50 per diluted share in 2016 compared to $15.8 billion , or $1.31 per diluted share in 2015 . The results for 2016 compared to 2015 were driven by higher net interest income and lower noninterest expense, partially offset by a decline in noninterest income and higher provision for credit losses.

Net interest income increased $2.1 billion to $41.1 billion in 2016 compared to 2015 . The net interest yield increased seven bps to 2.21 percent for 2016 . These increases were primarily driven by growth in commercial loans, the impact of higher short-end interest rates and increased debt securities balances, as well as a charge of $612 million in 2015 related to the redemption of certain trust preferred securities, partially offset by lower loan spreads and market-related hedge ineffectiveness. We expect net interest income to increase approximately $600 million per quarter beginning in the first quarter of 2017, assuming interest rates remain at the year-end 2016 level and modest growth in loans and deposits.

Noninterest income decreased $1.4 billion to $42.6 billion for 2016 compared to 2015 . The following highlights the significant changes.

The provision for credit losses increased $436 million to $3.6 billion for 2016 compared to 2015 due to a slower pace of credit quality improvement in the consumer portfolio and an increase in energy sector reserves for the higher risk energy sub-sectors in the commercial portfolio. For more information on the provision for credit losses, see Provision for Credit Losses on page 75 . For more information on our energy sector exposure, see Commercial Portfolio Credit Risk Management – Industry Concentrations on page 71 .

Noninterest expense decreased $2.8 billion to $55.0 billion for 2016 compared to 2015 . Personnel expense decreased $1.3 billion as we continue to manage headcount and achieve cost savings. Continued expense management, as well as the expiration of advisor retention awards, more than offset the increases in client-facing professionals. Professional fees decreased $293 million primarily due to lower legal fees. Other general operating expense decreased $551 million primarily driven by lower foreclosed properties expense and lower brokerage fees, partially offset by higher FDIC expense.

We have previously announced an annual noninterest expense target of approximately $53 billion for full-year 2018.

The effective tax rate for 2016 was driven by our recurring tax preferences and net tax benefits related to various tax audit matters , partially offset by a charge for the impact of the U.K. tax law changes discussed below. The effective tax rate for 2015 was driven by our recurring tax preferences and by tax benefits related to certain non-U.S. restructurings, partially offset by a charge for the impact of the U.K. tax law change enacted in 2015.

The U.K. Finance Bill 2016 was enacted on September 15, 2016. The changes included reducing the U.K. corporate income tax rate by one percent to 17 percent, effective April 1, 2020. This reduction favorably affects income tax expense on future U.K. earnings, but required a remeasurement of our U.K. net deferred tax assets using the lower tax rate. Accordingly, upon enactment, we recorded an income tax charge of $348 million. In addition, for banking companies, the portion of U.K. taxable income that can be reduced by existing net operating loss carryforwards in any one taxable year has been reduced from 50 percent to 25 percent retroactive to April 1, 2016.

Our U.K. deferred tax assets, which consist primarily of net operating losses, are expected to be realized by certain subsidiaries over a number of years. Significant changes to management's earnings forecasts for those subsidiaries, changes in applicable laws, further changes in tax laws or changes in the ability of our U.K. subsidiaries to conduct business in the EU, could lead management to reassess our ability to realize the U.K. deferred tax assets. For additional information, see Item 1A. Risk Factors.

At December 31, 2016 , total assets were approximately $2.2 trillion , up $43.4 billion from December 31, 2015 . The increase in assets was primarily due to higher debt securities driven by the deployment of deposit inflows, an increase in loans and leases driven by client demand for commercial loans, and higher securities borrowed or purchased under agreements to resell due to increased customer financing activity. These increases were partially offset by a decrease in cash and cash equivalents as excess cash was deployed.

Cash and Cash Equivalents

Cash and cash equivalents decreased $11.6 billion primarily driven by loan growth, net securities purchases and net debt maturities.

Federal Funds Sold and Securities Borrowed or Purchased Under Agreements to Resell

Federal funds transactions involve lending reserve balances on a short-term basis. Securities borrowed or purchased under agreements to resell are collateralized lending transactions utilized to accommodate customer transactions, earn interest rate spreads, and obtain securities for settlement and for collateral. Federal funds sold and securities borrowed or purchased under agreements to resell increased $5.7 billion due to a higher level of customer financing activity.

Trading Account Assets

Trading account assets consist primarily of long positions in equity and fixed-income securities including U.S. government and agency securities, corporate securities and non-U.S. sovereign debt.

Trading account assets increased $3.7 billion primarily driven by client demand within Global Markets .

Debt Securities

Debt securities primarily include U.S. Treasury and agency securities, mortgage-backed securities (MBS), principally agency MBS, non-U.S. bonds, corporate bonds and municipal debt. We use the debt securities portfolio primarily to manage interest rate and liquidity risk and to take advantage of market conditions that create economically attractive returns on these investments. Debt securities increased $23.8 billion primarily driven by the deployment of deposit inflows. For more information on debt securities, see Note 3 – Securities to the Consolidated Financial Statements .

Loans and Leases

Loans and leases increased $9.7 billion compared to December 31, 2015 . The increase consisted of $18.9 billion in net loan growth driven by strong client demand for commercial loans, partially offset by $9.2 billion in non-U.S. credit card loans that were reclassified from loans and leases to assets of business held for sale, which is included in all other assets in the table above. For more information on the loan portfolio, see Credit Risk Management on page 55 .

Allowance for Loan and Lease Losses

The allowance for loan and lease losses decreased $1.0 billion primarily due to the impact of improvements in credit quality from a stronger economy. For additional information, see Allowance for Credit Losses on page 75 .

All Other Assets

All other assets increased $11.1 billion driven by the reclassification of $10.7 billion in assets related to our non-U.S. credit card business primarily from loans and leases and debt securities to assets of business held for sale, which is included in all other assets in Table 6 .

At December 31, 2016 , total liabilities were approximately $1.9 trillion , up $32.8 billion from December 31, 2015 , primarily due to an increase in deposits, partially offset by a decrease in long-term debt.

Deposits

Deposits increased $63.7 billion primarily due to an increase in retail deposits.

Federal Funds Purchased and Securities Loaned or Sold Under Agreements to Repurchase

Federal funds transactions involve borrowing reserve balances on a short-term basis. Securities loaned or sold under agreements to repurchase are collateralized borrowing transactions utilized to accommodate customer transactions, earn interest rate spreads and finance assets on the balance sheet. Federal funds purchased and securities loaned or sold under agreements to repurchase decreased $4.0 billion primarily due to a decrease in repurchase agreements.

Trading Account Liabilities

Trading account liabilities consist primarily of short positions in equity and fixed-income securities including U.S. Treasury and agency securities, corporate securities and non-U.S. sovereign debt. Trading account liabilities decreased $3.9 billion primarily due to lower levels of short U.S. Treasury positions driven by less client demand within Global Markets .

Short-term Borrowings

Short-term borrowings provide an additional funding source and primarily consist of Federal Home Loan Bank (FHLB) short-term

borrowings, notes payable and various other borrowings that generally have maturities of one year or less. Short-term borrowings decreased $4.2 billion primarily due to a decrease in short-term bank notes, partially offset by an increase in short-term FHLB Advances. For more information on short-term borrowings, see Note 10 – Federal Funds Sold or Purchased, Securities Financing Agreements and Short-term Borrowings to the Consolidated Financial Statements .

Long-term Debt

Long-term debt decreased $19.9 billion primarily driven by maturities and redemptions outpacing issuances. For more information on long-term debt, see Note 11 – Long-term Debt to the Consolidated Financial Statements .

All Other Liabilities

All other liabilities increased $1.1 billion due to an increase in derivative liabilities.

Shareholders' equity increased $10.7 billion driven by earnings and preferred stock issuances, partially offset by returns of capital to shareholders of $9.4 billion through common and preferred stock dividends and share repurchases, as well as a decrease in accumulated other comprehensive income (OCI) primarily due to an increase in unrealized losses on available-for-sale (AFS) debt securities as a result of higher interest rates.

The Corporation's operating assets and liabilities support our global markets and lending activities. We believe that cash flows from operations, available cash balances and our ability to generate cash through short- and long-term debt are sufficient to fund our operating liquidity needs. Our investing activities primarily include the debt securities portfolio and loans and leases. Our financing activities reflect cash flows primarily related to customer deposits, securities financing agreements and long-term debt. For additional information on liquidity, see Liquidity Risk on page 51 .

In this Form 10-K, we present certain non-GAAP financial measures. Non-GAAP financial measures exclude certain items or otherwise include components that differ from the most directly comparable measures calculated in accordance with GAAP. Non-GAAP financial measures are provided as additional useful information to assess our financial condition, results of operations (including period-to-period operating performance) or compliance with prospective regulatory requirements. These non-GAAP financial measures are not intended as a substitute for GAAP financial measures and may not be defined or calculated the same way as non-GAAP financial measures used by other companies.

We view net interest income and related ratios and analyses on an fully taxable-equivalent (FTE) basis, which when presented on a consolidated basis, are non-GAAP financial measures. To

derive the FTE basis, net interest income is adjusted to reflect tax-exempt income on an equivalent before-tax basis with a corresponding increase in income tax expense. For purposes of this calculation, we use the federal statutory tax rate of 35 percent and a representative state tax rate. In addition, certain performance measures including the efficiency ratio and net interest yield utilize net interest income (and thus total revenue) on an FTE basis. The efficiency ratio measures the costs expended to generate a dollar of revenue, and net interest yield measures the bps we earn over the cost of funds. We believe that presentation of these items on an FTE basis allows for comparison of amounts from both taxable and tax-exempt sources and is consistent with industry practices.

We may present certain key performance indicators and ratios excluding certain items (e.g., DVA) which result in non-GAAP

financial measures. We believe that the presentation of measures that exclude these items are useful because they provide additional information to assess the underlying operational performance and trends of our businesses and to allow better comparison of period-to-period operating performance.

We also evaluate our business based on certain ratios that utilize tangible equity, a non-GAAP financial measure. Tangible equity represents an adjusted shareholders' equity or common shareholders' equity amount which has been reduced by goodwill and certain acquired intangible assets (excluding MSRs), net of related deferred tax liabilities. These measures are used to evaluate our use of equity. In addition, profitability, relationship and investment models use both return on average tangible common shareholders' equity and return on average tangible shareholders' equity as key measures to support our overall growth goals. These ratios are as follows:

We believe that the use of ratios that utilize tangible equity provides additional useful information because they present measures of those assets that can generate income. Tangible book value per share provides additional useful information about the level of tangible assets in relation to outstanding shares of common stock.

The aforementioned supplemental data and performance measures are presented in Table 7 and Statistical Table XII.

Statistical Tables XV and XVI on pages 108 and 109 provide reconciliations of these non-GAAP financial measures to GAAP financial measures.